US and UK prepare fightback against eastern hackers
Hackers are being targeted for attack by US and UK security authorities eager to launch a cyber counteroffensive to kick them off the net
Hackers who attack defence or commercial computers in the US and UK in future may be in for a surprise: a counterattack, authorised and carried out by the police and defence agencies that aims to disrupt and even knock them off the net.
The secret plans, prompted by the explosion in the number of computer-crime incidents from east Asia targeting commercially or politically sensitive information, are known as "strikeback", and are intended to target hackers' computers and disrupt them, in some cases involving denial of service attacks.
According to well-placed sources, work on "strikeback" has already begun in the UK, with the Serious Organised Crime Agency (Soca) and the Metropolitan police's e-crime unit working to deploy teams. The measures are being adopted because of the unprecedented level of attacks being suffered from hacking groups in China, Russia and North Korea, which are suspected of being state sponsored. Among intelligence circles in Washington, DC, the idea of hitting back at foreign hacking groups is being described as the hottest topic in cyberspace.
"This is considered to be a key activity," said a former CIA officer actively involved in the debate. "We are being penetrated and it is not in our tradition to sit back and do nothing.
"This is a huge, huge deal in Washington and it is a high-priority discussion. What it means is that if we can identify who is doing this to us, then we can return fire with a payload that takes them out. That's a very big priority." Amid rhetoric reminiscent of the cold war, it is clear the US has run out of patience, following blatant cyberattacks such as Titan Rain - an attempt to breach western defence systems with the aim of stealing defence and commercial secrets.
Pledge on cybersecurity
While on the campaign trail last July, Barack Obama identified cybersecurity as one of the biggest challenges facing the United States. "As president, I'll make cybersecurity the top priority that it should be in the 21st century," he said. He has also equated cyberthreats with nuclear and biological weapons.
Last week saw the results of President Obama's cybersecurity concerns, with the publication by the White House of the "Cyberspace Policy Review" written by Melissa Hathaway, a senior director at the National Security Council who is widely tipped to become Obama's cybersecurity chief.
In the document - a review of the US's computer security problems, carried out over the past 60 days - Hathaway broadly recommends more cooperation and education, and maintaining the US's technological lead. The document also states: "The Communications Act of 1934 authorized the President, if he deems it necessary in the national security or defense and the requisite threshold condition exists, to use, control, or close communications services, systems, and networks under the jurisdiction of the Federal Communications Commission in conditions ranging from 'state of public peril' to 'war'."
Many involved in the "strikeback" discussions in the US think it must be deployed immediately to develop a "defensive offensive capability". "At a high level this has to do with a cyberwar threat discussion. If we can confirm who has attacked us, we have to have an offensive strikeback," said the former intelligence officer. Less bellicose but equally specific definitions are now in force in Britain. "The UK, like many other nations, has an offensive capability, which is for defence only," said a UK intelligence source. "There is a growing willingness to strike back against some of the more obvious threats."
One of the stated aims of the Met's e-crime unit is to "disseminate target-specific intervention and prevention advice, and conduct intelligence-led disruption activity". It all sounds very hawkish but it is a policy that is exciting controversy - how do you hit someone back without causing damage to someone else on the way, or taking out the servers of an ISP that the attack was routed through?
The cost of collateral
"People were talking about this six years ago," said Rik Ferguson, a senior security adviser for the computer-security company Trend Micro. "This is a very bad idea, due to the issues surrounding collateral damage." But the hawks say concern is outmoded, as conventional computer-security procedures and the methods used by security companies are proving ineffective at stemming the tide of attacks. And, according to some in the industry, targeting is possible.
"We know of a couple of hundred individuals in China and Brazil, a hundred in Russia and similar numbers in North Korea," said Brian Grayek, vice president of product development for CA, a company specialising in tools to identify the origin of attacks. "We can put tracking tools on the attackers' computers so we know who they are, where they are coming from, where they are going and when they are doing it. "We can pinpoint to street and location, there are a number of times we can identify individuals and I would be fairly sure the US government has the same capability." Which leaves the problem of who carries out the counterattacks.
"We were approached by Soca and asked if we were prepared to carry out denial of service attacks and trace routes back to known IP addresses," said a security specialist working in the City of London.
According to Len Hynds, former head of the National High-Tech Crime Unit, targeting and disruption of hacking groups such as the Russian Business Network has long been a topic of discussion at Soca. "Soca was looking at it as a target, but the stumbling block for them was legal issues." Which for many means that outsourcing the response is the name of the game. Just as groups such as the RBN and the students operating from Guangdong in China are suspected of working with the collusion of their governments, so many think the hunter-killers of cyberspace will operate on an outsourced basis as paid vigilantes.
In through the backdoor
"Anything that the UK would do would be deniable," says Pat Tyrrell, a former high-ranking official at the Ministry of Defence who drafted the UK's first assessment of the potential for cyberwarfare. "Doing things this way would not surprise me I always though the only way to deal with this was, quote, 'illegally'.
"You can either do nothing, which leaves you open to attack, or you can do something and accept there might be a risk downstream. One of the risks is that you do something and get caught but the people attacking us are already doing that," says Tyrrell, adding that drastic steps were now necessary to deal with the scale of the problem. "There are Chinese manufacturers of telecoms equipment who are known to have put backdoors into them, which is why their technology is banned from use in the US, even though it is significantly cheaper. This isn't just about hacking."
Asked to comment for this article, a spokeswoman for Soca says: "I've spoken with our e-crime team. All we can really say on this is that Soca uses a range of techniques within the available legal frameworks, appropriate to each investigation. We don't comment on the detailed use of individual tactical options."
Pete Warren
The Guardian, Thursday 4 June 2009
guardian.co.uk © Guardian News and Media Limited 2009
Hackers are being targeted for attack by US and UK security authorities eager to launch a cyber counteroffensive to kick them off the net
Hackers who attack defence or commercial computers in the US and UK in future may be in for a surprise: a counterattack, authorised and carried out by the police and defence agencies that aims to disrupt and even knock them off the net.
The secret plans, prompted by the explosion in the number of computer-crime incidents from east Asia targeting commercially or politically sensitive information, are known as "strikeback", and are intended to target hackers' computers and disrupt them, in some cases involving denial of service attacks.
According to well-placed sources, work on "strikeback" has already begun in the UK, with the Serious Organised Crime Agency (Soca) and the Metropolitan police's e-crime unit working to deploy teams. The measures are being adopted because of the unprecedented level of attacks being suffered from hacking groups in China, Russia and North Korea, which are suspected of being state sponsored. Among intelligence circles in Washington, DC, the idea of hitting back at foreign hacking groups is being described as the hottest topic in cyberspace.
"This is considered to be a key activity," said a former CIA officer actively involved in the debate. "We are being penetrated and it is not in our tradition to sit back and do nothing.
"This is a huge, huge deal in Washington and it is a high-priority discussion. What it means is that if we can identify who is doing this to us, then we can return fire with a payload that takes them out. That's a very big priority." Amid rhetoric reminiscent of the cold war, it is clear the US has run out of patience, following blatant cyberattacks such as Titan Rain - an attempt to breach western defence systems with the aim of stealing defence and commercial secrets.
Pledge on cybersecurity
While on the campaign trail last July, Barack Obama identified cybersecurity as one of the biggest challenges facing the United States. "As president, I'll make cybersecurity the top priority that it should be in the 21st century," he said. He has also equated cyberthreats with nuclear and biological weapons.
Last week saw the results of President Obama's cybersecurity concerns, with the publication by the White House of the "Cyberspace Policy Review" written by Melissa Hathaway, a senior director at the National Security Council who is widely tipped to become Obama's cybersecurity chief.
In the document - a review of the US's computer security problems, carried out over the past 60 days - Hathaway broadly recommends more cooperation and education, and maintaining the US's technological lead. The document also states: "The Communications Act of 1934 authorized the President, if he deems it necessary in the national security or defense and the requisite threshold condition exists, to use, control, or close communications services, systems, and networks under the jurisdiction of the Federal Communications Commission in conditions ranging from 'state of public peril' to 'war'."
Many involved in the "strikeback" discussions in the US think it must be deployed immediately to develop a "defensive offensive capability". "At a high level this has to do with a cyberwar threat discussion. If we can confirm who has attacked us, we have to have an offensive strikeback," said the former intelligence officer. Less bellicose but equally specific definitions are now in force in Britain. "The UK, like many other nations, has an offensive capability, which is for defence only," said a UK intelligence source. "There is a growing willingness to strike back against some of the more obvious threats."
One of the stated aims of the Met's e-crime unit is to "disseminate target-specific intervention and prevention advice, and conduct intelligence-led disruption activity". It all sounds very hawkish but it is a policy that is exciting controversy - how do you hit someone back without causing damage to someone else on the way, or taking out the servers of an ISP that the attack was routed through?
The cost of collateral
"People were talking about this six years ago," said Rik Ferguson, a senior security adviser for the computer-security company Trend Micro. "This is a very bad idea, due to the issues surrounding collateral damage." But the hawks say concern is outmoded, as conventional computer-security procedures and the methods used by security companies are proving ineffective at stemming the tide of attacks. And, according to some in the industry, targeting is possible.
"We know of a couple of hundred individuals in China and Brazil, a hundred in Russia and similar numbers in North Korea," said Brian Grayek, vice president of product development for CA, a company specialising in tools to identify the origin of attacks. "We can put tracking tools on the attackers' computers so we know who they are, where they are coming from, where they are going and when they are doing it. "We can pinpoint to street and location, there are a number of times we can identify individuals and I would be fairly sure the US government has the same capability." Which leaves the problem of who carries out the counterattacks.
"We were approached by Soca and asked if we were prepared to carry out denial of service attacks and trace routes back to known IP addresses," said a security specialist working in the City of London.
According to Len Hynds, former head of the National High-Tech Crime Unit, targeting and disruption of hacking groups such as the Russian Business Network has long been a topic of discussion at Soca. "Soca was looking at it as a target, but the stumbling block for them was legal issues." Which for many means that outsourcing the response is the name of the game. Just as groups such as the RBN and the students operating from Guangdong in China are suspected of working with the collusion of their governments, so many think the hunter-killers of cyberspace will operate on an outsourced basis as paid vigilantes.
In through the backdoor
"Anything that the UK would do would be deniable," says Pat Tyrrell, a former high-ranking official at the Ministry of Defence who drafted the UK's first assessment of the potential for cyberwarfare. "Doing things this way would not surprise me I always though the only way to deal with this was, quote, 'illegally'.
"You can either do nothing, which leaves you open to attack, or you can do something and accept there might be a risk downstream. One of the risks is that you do something and get caught but the people attacking us are already doing that," says Tyrrell, adding that drastic steps were now necessary to deal with the scale of the problem. "There are Chinese manufacturers of telecoms equipment who are known to have put backdoors into them, which is why their technology is banned from use in the US, even though it is significantly cheaper. This isn't just about hacking."
Asked to comment for this article, a spokeswoman for Soca says: "I've spoken with our e-crime team. All we can really say on this is that Soca uses a range of techniques within the available legal frameworks, appropriate to each investigation. We don't comment on the detailed use of individual tactical options."
Pete Warren
The Guardian, Thursday 4 June 2009
guardian.co.uk © Guardian News and Media Limited 2009
