Nation-state driven cyber attacks often take on a distinct national or regional flavour that can uncloak their origins, according to new research by net security firm FireEye.
Computer viruses, worms, and denial of service attacks often appear from behind a veil of anonymity. But a skilful blending of forensic “reverse-hacking” techniques combined with deep knowledge of others’ cultures and strategic aims can uncover the perpetrators of attacks.
Kenneth Geers, senior global threat analyst at threat protection biz FireEye, explained: “Cyber shots are fired in peacetime for immediate geopolitical ends, as well as to prepare for possible future kinetic attacks. Since attacks are localised and idiosyncratic—understanding the geopolitics of each region can aid in cyber defence.”
Estonia was able to point the finger of blame towards the infamous (and ultimately politically unsuccessful) cyberattacks against its systems in 2007. FireEye argues that understanding the context of cyberattacks can be used to unpick their origins or to better prepare for them.
“A cyber attack, viewed outside of its geopolitical context, allows very little legal manoeuvring room for the defending state,” said Professor Thomas Wingfield of the Marshall Centre, a joint US-German defence studies institute.
“False flag operations and the very nature of the internet make tactical attribution a losing game. However, strategic attribution – fusing all sources of intelligence on a potential threat – allows a much higher level of confidence and more options for the decision maker,” Professor Wingfield continued. “And strategic attribution begins and ends with geopolitical analysis."
Cyber attacks can be a low-cost, high payoff way to defend national sovereignty and to project national power. According to FireEye, the key characteristics for some of the main regions of the world include:
- Asia-Pacific: home to large, bureaucratic hacker groups, such as the “Comment Crew” who pursues targets in high-frequency, brute-force attacks.
- Russia/Eastern Europe: More technically advanced cyberattacks that are often highly effective at evading detection.
- Middle East: Cybercriminals in the region often using creativity, deception, and social engineering to trick users into compromising their own computers.
- United States: origin of the most complex, targeted, and rigorously engineered cyber attack campaigns to date, such as the Stuxnet worm. Attackers favour a drone-like approach to malware delivery.
FireEye's report goes on to speculate about factors that could change the world’s cyber security landscape in the near to medium term, including a cyber arms treaty that could stem the use of online attacks and about whether privacy concerns from the ongoing Snowden revelations about PRISM might serve to restrain government-sponsored cyber attacks in the US and globally.
The net security firm also looks at new actors on the cyberwar stage – most notably Brazil, Poland, and Taiwan. Finally, it considers the possibility that such attacks mights result in outages of critical national infrastructure systems, a long-feared threat over the last 15 years that has thankfully failed to materialise.
Squirrels have caused frequent power outages by doing things like chewing through high-tension power cables (or even touching them, to fatal effect for the furry little rodents) but El Reg's security desk hasn't come up with even one verified example where hacking has triggered a blackout – except in the imaginations of Hollywood execs, of course.
FireEye's report, titled World War C: Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks, can be found here (PDF). ®