US Cyber Command Wants Greater Attack Mentality 257
superglaze writes "Lieutenant General Robert J Elder, Jr, a senior figure in US Air Force Cyber Command (AFCYBER), has told ZDNet UK that communication issues are hampering the division's co-ordination. 'IT people set up traditional IT networks with the idea of making them secure to operate and defend,' said Elder. 'The traditional security approach is to put up barriers, like firewalls — it's a defense thing — but everyone in an operations network is also part of the [attack] force. We're trying to move away from clandestine operations. We're looking for real physics — a bigger bang resulting in collateral damage.'"
Fantastic (Score:5, Insightful)
Re:Fantastic (Score:5, Funny)
Re:Fantastic (Score:4, Funny)
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Re:Fantastic (Score:5, Insightful)
Re: (Score:2)
This would imply that these botnets aren't a subtle yet powerful control mechanism to keep the internet "in check". Although, publicly downing a non-sanctioned/friendly botnet would indeed prove your point. All I'm saying is... what's to say Storm is not "our bad guy"?
Re: (Score:3, Interesting)
Truth in Naming (Score:5, Insightful)
The organization is call Cyber Defense Command for a reason, because they know that they should be "defending". If they were honest in their naming then perhaps it would be call Cyber Attack Command. Hmmm, I wonder what other countries would think of that.... It's probably the same reason that our Department of Defense isn't call the Department of Preemptive Strikes. It was called The Department of War until 1947. I know some here will say "the best defense is a good offense", but when you have organizations with "an attack mentality" they will always find someone and some reason to attack. War without End.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
If you launch a successful attack upon another county, chances are that attack can be readily mimicked and launched against your own public infrastructure. If you attempt to establish a defence against that attack you are back to square one.
Most attacks on the internet, have targeted e
Re: (Score:3, Interesting)
Re: (Score:2)
Don't you mean Forever War [wikipedia.org]?
Re: (Score:3, Informative)
Re: (Score:2, Interesting)
"And from the user standpoint: do you really want anything that propagates as a worm doing whatever it wants on your box?"
As a user who knows how to protect themselves. No .
Re: (Score:2)
Though I'm guessing that botnet worm writers will just find ways to circumvent it, just like virus writers and spyware authors have been being malicious towards AV and spyware detectors/scrubbers for years.
Cyber?? (Score:4, Funny)
I'm sorry, what? All I can picture is a pimply teenager sitting in front a flickering screen, typing "Wanna cyber????" into his chat field. I have no idea how to exploit cybering to achieve military objectives. Maybe they want to paralyze the target's networks by getting all lonely teenagers to respond to mass cyber requests?
Re:Cyber?? (Score:4, Insightful)
You can only picture a teenager because for you, the implicit noun modified by cyber- is sex - arguably the default focus of a teen's attention. For the military, the implicit noun is war - that is the default focus of their attention. It is clear that cyber- is an adjective prefix that indicates computation. What it means when the noun is implied is in the mind of the beholder.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I think that's tenuous. When an adjective is part of a name, that doesn't make it a noun. In the name "the White House," White is part of the name, but it's still an adjective, not a noun.
In the article, and in the name of the organization, cyber a shorthand for cyber-warfare. When they say "Cyber Command," it's not the command that's cyber, it's the warfare. And even if they are using cyber as a noun, they are intending "cy
Just what we need (Score:5, Insightful)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Yes, and I pray we'll never get there. At the end of WWII Japan was getting ready to fight to the last Japanese. Not the last Japanese soldier, the last Japanese. The US was also getting ready to fight to the last Japanese. If it hadn't been for Hiroshima, Nagasaki, and the Japanese surrender, the Japanese culture would have ended up as the Cherokee or Sioux cultures.
All the retired military people I've read on this subject agree that
Re:Just what we need (Score:5, Informative)
Off the top of my head, I can think of 4:
1998: US launches cruise missiles at Sudan and Afghanistan
1999: US launches airstrikes against Yugoslavia to get it out of Kosovo
2001: US provides air support to forces in Afghanistan to overthrow the Taliban
2003: US invades Iraq
Re:Just what we need (Score:5, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
"In the past 10 years the US has initiated 2 military actions against foreign powers."
Off the top of my head, I can think of 4:
1998: US launches cruise missiles at Sudan and Afghanistan
1999: US launches airstrikes against Yugoslavia to get it out of Kosovo
2001: US provides air support to forces in Afghanistan to overthrow the Taliban
2003: US invades Iraq
NATO is not the US.
Was it another member of NATO that initiated those attacks?
Re: (Score:2)
No, but we control NATO and tell it what to do.
Has NATO ever used military force at the initiative of another country? If so, when?
Has NATO ever refused to engage in force when the US wanted it to? If so, when?
Re: (Score:2)
Re: (Score:3, Interesting)
-ellie
Re: (Score:2, Funny)
Re: (Score:2)
As silly as it sounds, (Score:2)
Re: (Score:2)
hacking contests to replace bang-boom wars
"In order to disrupt the Soviet gas supply, its hard currency earnings from the West, and the internal Russian economy, the pipeline software that was to run the pumps, turbines, and valves was programmed to go haywire, after a decent interval, to reset pump speeds and valve settings to produce pressures far beyond those acceptable to pipeline joints and welds," Reed writes.
"The result was the most monumental non-nuclear explosion and fire ever seen from space [msn.com]," he recalls, adding that U.S. satellites pick
Translation (Score:2, Funny)
Re:Translation (Score:4, Insightful)
Re: (Score:2)
Use Satellite video feed to see when all the cars registered to said person are parked in the driveway.
The big trick is I don't see that much cooperation in the Government.
Hello Citizen (Score:5, Funny)
Your ISP has identified you as subscribing to a connection with >1Mbs upload speed. A recent top-secret national security bill requires all citizens with such bandwidth to become part of the national defense infrastructure. Attached to this email you will find an application. Install it. It will self register with homeland defense and be available for defense of the homeland should the need arise.
Thank you for your cooperation.
ZZ
PS: you have 1 week to register or you will be added to the terrorism watch list and will be subject to extreme rendition if needed.
PPS: we can't show you the bill, this is top-secret national defense stuff.
PPPS: if you are thinking of decompiling or interfering with the operation of this software, see PS:
PPPPS: yes this is MS windows Vista only software. Don't have Vista, see PS:
Re: (Score:2)
Then again...if they're putting it all on windows vista to begin with they've set up the honeypot for me.
Re: (Score:2)
Offensive forces and actions should never be labeled with defense.
For one example, nuclear weapons isn't a defensive weapon, it's purely an offensive one.
A force that mainly operate in military (non-peacekeeping) operations outside their own nations borders is an offensive force, not a defensive force.
Money that goes into those operations should be labeled "offense budged", not "defense budget", so that the public
Re: (Score:2)
Re: (Score:2)
"No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law."
Great... (Score:4, Insightful)
shouldn't
be
connected
to
the
INTERNET!!!
perfect security is impossible, somehow "bringing the fight to the enemy" isn't a solution. Changing the way you think about the internet is.
I can't wait until it's "you're on our side of the internet or you're on their side!!"
Every time a government, or especially its military, does something stupid in regards to the internet, I feel the strong need to drink.
Re: (Score:2)
Re:Great... (Score:5, Funny)
Java has so many bugs in it that it can't be hacked?
Re:Great... (Score:5, Funny)
That's why you just got the uncontrollable urge to eat brains.
Re: (Score:2)
Say I develop a SCADA system for a large data center for a major financial institution. It has an IP backbone, and I connect security cameras to that; the backbone is sized about 1,000x what it needs for my bandwidth requirements, so it isn't a problem. The cameras actually provide a support function (call it visual feedback) to the SCADA network, so it is all in the family, right?
All ethernet ports
IT Attack mentality? (Score:3, Interesting)
OTOH, there's no technical reason not use snort + script kiddie tools to automatically detect intruders and try to whack them. You can identify botnet members pretty easily from the pattern of accesses (the probes tend to come in waves, as various parts of the swarm poke your boxes).
The US could just hide in that swarm of accesses, poking servers and doing slow scans to figure out what's where. It's pretty easy these days to do signature profiling on systems, and to just stash this info in a database somewhere. Update each entry every few weeks, and be able to update ranges on demand.
The only really hard part is getting your own botnet up and running. The US Government could, theoretically, tap into the search engines to do this for them, which would be pretty amusing. Nobody pays attention to web spiders, and well, if the spider does a slow port scan 'accidentally' who cares?
AFCYBER - division patch (Score:2)
US Air Force Cyber Command (AFCYBER)
http://en.wikipedia.org/wiki/Shoulder_patch [wikipedia.org]
http://www.tioh.hqda.pentagon.mil/DUI_SSI_COA_page.htm [pentagon.mil]
Where's hypno-toad... (Score:2, Insightful)
...when you really need him?
random quote from forgotten source:
Re: (Score:2)
Yup, that's how WWI could've been prevented. Oh, wait....
They are right (Score:2)
If all you do is defense, then eventually the enemy is likely to figure out, how to break you.
Attack is the best defense. You have to be able to retaliate. In "cyber" world this would mean some of the "hacking back", identifying him, putting him to jail, confiscating his computer, fining him.
This "active defense", however, is full of legal (and ethical) pitfalls and thus it is now wonder, the private companies are mostly sticking to passive defense. Private sector is also the main source of professional
Re: (Score:3, Insightful)
Attack is the best defense.
Spoken like someone who has no understanding of the art of war.
The first rule of war is: don't go to war.
The second rule of war is if you have to go to war make yourself invulnerable before you attack.
"Attack is the best defense" did not work for Germany in the 2nd world war. It didn't work in Vietnam
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Re: (Score:2)
Oh, look, real war-artist teaching Slashdot wannabes... And failing.
Sorry, dear. Blasting the US and a not-so-hidden comparison with Nazi Germany of the 2nd World War may get you the "Insightful" moderations, but it is, in fact, off-topic and I will not bite.
There is no question, whether or not to go to war with cyber-criminals — they have already gone to war with us. Every time a spam tries (successfully or not) to creep into your mailbox, every time your
Re: (Score:2)
Silly me. Here I thought it was "All warfare is based on deception."
As in, "When able to attack, we must seem unable; when using our forces, we must seem inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near. Hold out baits to entice the enemy. Feign disorder, and crush him. If he is secure at all points, be prepared for him. If he is in superior strength, evade him. If your opponent is
Re: (Score:2)
You are Sooooo wrong, it hurts when I pee. (Score:2)
"Attack is the best defense" did not work for Germany in the 2nd world war. One might observer that it didn't work for them in the long run, because they WERE NOT TRYING TO DEFEND when they started the war. Their goal was conquest, not defense. They perfected the tactic of the 'blitzkreig', which involves an aggressive drive to cripple you opponent's communication, organization, and logistics, which gave them ov
Re: (Score:2)
True, didn't work so well for the U.S. recently. But I'd say the whole conquering of North and South America (Spain, England, France and later as the US pushed to the Pacific) went VERY well for the offensive crowd. Not to be rude, but look at the Plains War for "success" with offense first (In no way am I saying that was GOOD for the US to do,
Re: (Score:3, Insightful)
As for changes at home - talk at the highest levels about how torturing people is OK, suspension of the rule of law in some cases for something a bit more Feudal and widespread hysteria awoken by things like advertising signs looks like a bit of a cha
Re: (Score:2)
It worked for Russia though. Russian generals preferred to go on the offensive and take the battle to the Germany army. As for the US, I recall the speed of the collapse of the Iraqi military and government during the initial ground invasion proves you wrong. Same for Afghanistan. What's not working right now is sitting around waiting for o
Re: (Score:2)
The second world war offers famous examples of this. The most obvious is submarine warfare. Neither the navy nor the merchant marine officers liked convoy; the navy preferred to aggressively chase after submarines
Collateral Damage? (Score:2, Funny)
Re: (Score:2)
S P L A T T ! ! !
Comment removed (Score:3, Insightful)
Re: (Score:3, Informative)
That may be the case, but more likely the Chinese government just puts them to work. The same thing happens here in the US. There were a couple of guys who went to the LA 2600 meetings in the early 1990s who got visits from the governm
Good luck with that. (Score:4, Insightful)
Someone posted about a class of theirs on Security issues that got shut down by one big corporation, who threatened not to hire any of their departments' students if they insisted on teaching that class.
So, the bottom line is that our Education system isn't turning out the skilled people that the Military is looking to hire.
This is compounded by the fact that the ones who DO get this knowledge, and have the right attitude, are snapped up by the Bad Guys. Crime is increasingly playing a big part on the internet, and those folks WILL pay good money for the right talent which can deliver results.
I suppose the Military could consider subcontracting out to the Mafia. That's really their only option if they are serious. Otherwise, the best they can get will just be second-rate talent, and more likely third-rate talent.
Good luck attacking, or defending, with that. As a US citizen, I find this frightening, but I've been saying it for years. I'm glad someone is finally waking up to the matter. But I doubt anything serious will ever be done until it's too late.
Re:Good luck with that. (Score:5, Insightful)
Attack! (Score:2, Funny)
Greater attack mentality? (Score:2)
Didn't know the Airforce was into this stuff (Score:5, Funny)
Re: (Score:2)
War is physics... (Score:2)
Re: (Score:2)
Factorials aside, there are plenty of potential "bangs" in things controlled by computers. If someone is stupid enough (and plenty of people are) to allow any of these to be connected to the 'net, well then...
Consider, for example, power stations, refineries and similar chemical plants, air traffic control systems, (or even regular traffic control systems -- turn all the traffic lights in a city green in all directions, I guarantee you'll get
Re: (Score:2)
Re: (Score:3, Funny)
Let's play Global Thermonuclear War ..... (Score:2)
the good news I guess is that just like the spammers they'll all be going after the windows platforms because that's the biggest bang for the buck - the rest of us can watch the death of the internet from our linux bunkers
somewhat mutually exclusive? (Score:2)
On a related note, I wonder if the military would build their own botnet from scratch.
Re: (Score:2)
Of course, just think about all of the contracting money to be made there!!! Why use off the shelf, already proven code when you can recreate the wheel and employ lots of PHB's to oversee the operation?
Bad idea (Score:2)
Expecting the typical admin of a commercial network or system to actively participate in an attack is like giving every middle-aged white collar civilian a machine gun and expecting them to attack enemy artillery emplacements.
The most we should expect of the civilian infrastructure is to secure their systems and go hide in the backyard bomb shelter. If I (a middle aged white collar civilian) start getting involved in DoS attacks against an enemy, I'm inviting reprisals by that enemy targeting my, or my e
First strike & offense capablity. (Score:5, Interesting)
First they need older hackers, not script kiddies.
Black hats, or at least former black hats.
Lot's of Jolt Cola, Cold Pizza and some dark dungeon supplied with what ever mind altering substances needed and a steady supply of nerdy Asian girls to look after them.
Also the boxed set of all Stargate, Star Wars, Star Trek, Battlestar Galactica and.. Na on second thought, we'll just grab them off Bit Torrent. Same for the HDTV, UPS delivery off some stolen credit card, old habits die hard.
Maybe more useful would be legal immunity/amnesty, from all of the collateral damage from relaxing hobbies like taking down the RIAA or Microsoft in the process, (oops).
But seriously, a License to hack anything domestic and foreign with total immunity as long at it's primarily against the enemy would be totally cool, I think a lot of us who had to give up the black hat because we have kids and just can't afford to go to prison, would be all over this.
Why domestic, I almost don't want to say this publicly but the best way to get in is start in.
http://www.c-program.com/kt/reflections-on-trusting.html [c-program.com]
Anyhow you can't play by the rules, if they think you can launch and offensive attack without some pre-preparation your wrong.
Making an offensive toolkit is fantasy. By definition this is script kiddie and lame.
> where vulnerabilities are introduced into chipsets during manufacturing that an adversary can then exploit, and electronics vulnerabilities.
I have been told years ago that this is already being done at Taiwanese fabs to us.
Chips were designed to be resonant at some Ghz ranges and would be equivalent to an EMP when hit.
This is done at the fab without changes to the chip design but layer thicknesses that is something the fab has total control over.
These attacks should be in any OS, Router, or any other electronic devices that get sold and without the knowledge if it manufactures either. This would hackers the greatest flexibility to exploit them when needed. They key is to make sure it's not detectable or exploitable by other hackers.
An example would be to hack into Microsoft and muck with their distro before it goes out.
Of course with Microsoft and Apple, this would already seem to be unnecessary.
Re: (Score:3, Insightful)
I completely agree. A lot of people stopped walking along the path that they were walking after age 18 because what they thought was, "Pretty damn cool." the government and law enforcement agencies thought was, "A federal fe
Re: (Score:2)
Kudos, couldn't have said it better myself.
"With great bandwidth comes great responsibility"
Re: (Score:2)
Someday in the Future... (Score:4, Insightful)
And he'll go "Oh my god! We were totally taken by surprise! Who could have ever imagined or prepared for something as astounding as this!", for about the 4,000th time in the history of this administration.
A more interesting question... (Score:2)
Collateral damage (Score:3, Insightful)
collateral damage (Score:5, Insightful)
I thought there was an obligation to try to minimize collateral damage?
Re: (Score:3, Informative)
I thought there was an obligation to try to minimize collateral damage?
Arent computers made in China? (Score:2)
Who's to say they don't build some tricks into them before we get them? They could be monitoring everything we do and be able to shut us down at will for all we know.
Re:IPS? (Score:5, Funny)
Re: (Score:2)
There are all manner of systems that handle hazardous materials that a
Re: (Score:2)
http://tinyurl.com/3ymeov [tinyurl.com]
Re: (Score:2)
That's like getting around anti-hate crime legislation by saying that you killed all those people because y
Re: (Score:2)
The only problem I have with NPR classifying some of the horrible things the US has been doing lately as war crimes is that we're not officially at war, because the president wanted to avoid having to 1) get permission from congress and 2) obey the Geneva conventions. It's a pretty silly excuse, though, saying that the Geneva conventions don't apply because we're fighting terrorists, not a waging war.
That's like getting around anti-hate crime legislation by saying that you killed all those people because you liked them, not because you hated them. Stupid, stupid, rhetorical nonsense.
Well considering there have been exactly zero declared wars since the end of WW2 it sort of puts a point on the futility of the whole thing, doesn't it?
Re: (Score:2)
* * * - No route to host.