America's 'CyberWar' With Foreign Governments Could Get More Aggressive (wral.com) 116
America's Department of Defense "has quietly empowered the United States Cyber Command to take a far more aggressive approach to defending the nation against cyberattacks, a shift in strategy that could increase the risk of conflict with the foreign states that sponsor malicious hacking groups," reports the New York Times. Long-time Slashdot reader TheSauce shares their report:
In the spring, as the Pentagon elevated the command's status, it opened the door to nearly daily raids on foreign networks, seeking to disable cyberweapons before they can be unleashed, according to strategy documents and military and intelligence officials... The new strategy envisions constant, disruptive "short of war" activities in foreign computer networks... "Continuous engagement imposes tactical friction and strategic costs on our adversaries, compelling them to shift resources to defense and reduce attacks"...
The risks of escalation -- of U.S. action in foreign networks leading to retaliatory strikes against U.S. banks, dams, financial markets or communications networks -- are considerable, according to current and former officials... The chief risk is that the internet becomes a battleground of all-against-all, as nations not only place "implants" in the networks of their adversaries -- something the United States, China, Russia, Iran and North Korea have done with varying levels of sophistication -- but also begin to engage in daily attack and counterattack.
An article shared by schwit1 notes that officials in the Obama administration "were also worried that a vigorous cyber response...could escalate into a full scale cyber war."
Yet the Times reports that this new policy reflects "a widespread view that the United States has mounted an inadequate defense against the rising number of attacks aimed at America."
The risks of escalation -- of U.S. action in foreign networks leading to retaliatory strikes against U.S. banks, dams, financial markets or communications networks -- are considerable, according to current and former officials... The chief risk is that the internet becomes a battleground of all-against-all, as nations not only place "implants" in the networks of their adversaries -- something the United States, China, Russia, Iran and North Korea have done with varying levels of sophistication -- but also begin to engage in daily attack and counterattack.
An article shared by schwit1 notes that officials in the Obama administration "were also worried that a vigorous cyber response...could escalate into a full scale cyber war."
Yet the Times reports that this new policy reflects "a widespread view that the United States has mounted an inadequate defense against the rising number of attacks aimed at America."
Is water wet? (Score:1)
You don't say.
It's been obvious for a while that the NSA is too busy hacking other people's computers to properly defend important computers in the USA. I think this comes from the fact that the NSA is run by military leaders, who were all taught that the best defence is a good offence. Yet, no one in government appears to ques
Re: (Score:2)
Re: (Score:2)
Re: Is water wet? (Score:2)
Re: Is water wet? (Score:2)
Re:Is water wet? (Score:4, Insightful)
Re: (Score:2)
There should be 1 government organization responsible for computer security, and they should not also be in charge of spying as that deters foreign governments and corporations from fully cooperating with them. Giving them legal authority to force companies to patch security holes would also help.
Not only authority to legally order large software companies to patch security holes, but prosecute them for some form of criminal negligence when they do things like marketing routers with hard-coded default admin/vendor-access passwords (and especially for not mentioning that little detail very plainly to potential buyers). That sort of nonsense is not just ignoring security or even doing it badly, it's giving the entire concept of security the "Bronx cheer" and causes great financial and societal harm th
Re: (Score:2)
Not only authority to legally order large software companies to patch security holes, but prosecute them for some form of criminal negligence when they do things like marketing routers with hard-coded default admin/vendor-access passwords (and especially for not mentioning that little detail very plainly to potential buyers).
Who do they prosecute when another government agency either pays or orders exploits to be designed in?
Re: (Score:3)
Well, since we're "wish-listing" here as it's unlikely in the extreme that any of this unconstitutional behavior will see any serious repercussions anytime soon, I'd like to see every s
Re: (Score:2)
There should be 1 government organization responsible for computer security, and they should not also be in charge of spying as that deters foreign governments and corporations from fully cooperating with them. Giving them legal authority to force companies to patch security holes would also help.
The NSA has poisoned that well for the entire US government with the aid of the FBI and Congress. They even managed to smear NIST. Nobody should be cooperating with them.
I bet there's one country that's off limits (Score:1)
They're not really a "foreign" government now, more like a good buddy
Re: (Score:2)
Do it (Score:4, Interesting)
It is high time to do the right things and first off strengthen our telecommunications network. We should be running vlan on equipment that is made ONLY in the west. Utilities should be on 1 vlan, and with absolutely NO CROSS-OVER. Likewise, MIlitary/Intelligence should be on one, Roads on another, banks on another (used only for transfers between banks), etc, etc. Regardless, the internet/gen comm absolutely should be on a different vlan from the rest of this.
And above all, we need to stop offshoring of access to those vlans, as well as making sure that telcos techs have security checks. The idea that ATT is outsourcing access to their internal network to India and CHina is nothing less than amazing.
Re: (Score:3, Funny)
Yes, but Russia only attacks us because they love freedom and want the USA to be strong and a shining example of democracy in the West, and not for any nefarious reasons. If you suggest otherwise, you should watch your ass.
Re: (Score:2)
America is not and never has been a "Christian nation" [wikipedia.org].
Re: Do it (Score:2, Offtopic)
The United States had never had a theocratic government, for sure. However for a conception of "nation" that is broader than "government" - yes America was long a Christian nation.
One could argue that even today, excluding a few coastal bourgeoisie, we are still a Christian people.
Re: (Score:3)
America is not and never has been a "Christian nation".
The constitution is the starting point to define the body of laws. It doesn't define the culture of the country. In practice, America (which explicily disallows the government from favuring a religion) is far more of a Christian nation than the UK (which has a state religion and that religion has some voting power in the Lords).
There's the legal aspect and then there's how people act. In the US, a lot of politicians fall over themselves to display their
Re: (Score:2)
Are you sure about that?
https://en.wikipedia.org/wiki/... [wikipedia.org]
"One nation under god"
https://en.wikipedia.org/wiki/... [wikipedia.org]
"In God We Trust" is the official motto of the United States of America and of the U.S. state of Florida. It was adopted as the nation's motto in 1956 as a replacement or alternative to the unofficial motto of E pluribus unum, which was adopted when the Great Seal of the United States was created and adopted in 1782.[1][2]
Re: (Score:2)
I'm aware of religious activists pushing to have that nonsense pasted on our currency and seal, although we got along just fine without it for 180 years, yes.
Re: (Score:2)
Re: (Score:3)
VLAN. I do not think that word means what you think it means.
Re:Do it (Score:4, Funny)
Seriously, the west has been under attack from Russia, CHina, North Korea, Iran, Syria, and a few others, for the last 20 years. We have been in a defensive posture, and losing badly.
So let's start by attacking Canada and western Europe.
Re: (Score:2)
Re:Do it (Score:5, Informative)
It is high time to do the right things and first off strengthen our telecommunications network. We should be running vlan on equipment that is made ONLY in the west. Utilities should be on 1 vlan, and with absolutely NO CROSS-OVER. Likewise, MIlitary/Intelligence should be on one, Roads on another, banks on another (used only for transfers between banks), etc, etc.
You do understand that VLAN only offers security if you have complete control over the physical network? I suspect you may not because you mention using VLAN to isolate services that would typically be at significantly different physical locations and be administered by different people.
Using US made equipment would be a start, but the issue with VLAN is that if anyone has access to the configuration of anything touching a physical connection that is "protected" by VLAN, they can just change the configuration and you don't have isolation any more. All VLAN does is add a couple of bytes to the header of the packets and you *hope* that everyone listening honors those packets. It can really only be used within a physically trusted segment of your network *and* you have to trust everyone who can configure the related network gear. This means that if an attacker gets configuration access to any of your devices touching the VLAN trunk, they can alter the configuration and escalate their access. If you are using VLANs to isolate workstation access at the workstation NIC, well just don't.
In your example of using VLAN to isolate military, utilities, and banking, I would have to assume that you mean isolating them when they run across a common set of network links. This is an unlikely scenario because VLAN is a physical layer 2 (data link / Ethernet segment) thing and you typically would use a network layer 3 (routing / IP subnet) thing to deal with connecting disparate networks over distance. If you are actually talking about tying these entities together at the physical layer of the network, you would have to trust that the parties at both ends and everyone in the middle absolutely kept physical administrative control and that there were no bad actors in the mix. This is unlikely.
Other technologies, such as VPN would be more appropriate. This as well as regulations that require either air-gapping of sensitive systems or proven control of the encryption keys used to create VPN sessions running through shared networks.
Is this performance art.... (Score:2)
FTFY. For christsake you spend more than
Re: (Score:2)
BUT, CHina, Russia, North Korea, Iran, etc have been working to destroy the west since the 90s. We were not even dealing with the issues.
And had you paid attention to Snowden, you would have known that BND had given NSA access to their networks. IOW, they KNEW we were there (though I suspect that they did not know that we were listening in on Merkel).
So, no, the smart thing is for us to start dealing with Russia/China/etc on their own terms.
Re: (Score:2)
More projection. The U.S. literally bragged [dailywire.com] about interfering in the 1996 Russian election, has been staging practice invasions off North Korea's coast every year since the 90's, committed an act of war on Iran with Stuxnet and spent years illegally threatening them with a military invasion over a nuclear weapons program the U.S. knew Iran didn't actually have.
US 'giving' ideas to NK, LoL (Score:3)
Re: (Score:3)
Re: (Score:2)
Bureau 121 is a North Korean cyberwarfare agency, which is part of the Reconnaissance General Bureau of North Korea's military.... its primary intelligence targets are South Korea, Japan, and the United States[4]. Bureau 121 was created in 1998 [wikipedia.org]
China:
A 2008 article in the Culture Mandala: The Bulletin of the Centre for East-West Cultural and Economic Studies by Jason Fritz alleges that the Chinese government from 1995 to 2008 was involved in a number of high-profile cases of espionage, prima [wikipedia.org]
As opposed to... (Score:1)
Researching and designing a specific payload to decimate a targeted resource? Or doesn't an aggressive offense count? Smells like FUD to me.
https://en.wikipedia.org/wiki/... [wikipedia.org]
""a widespread view that the United States has mounted an inadequate defense against the rising number of attacks aimed at America.""
Extreme Stupidity (Score:2)
Perpetrated by cave-men that think the only valid response to anything is to apply violence. The actual facts are that attribution is basically impossible and that you have an extremely high chance to hit the wrong target and that will obviously make matters worse, not better. There is even an attack-technique were you let some aggressive but brain-dead actor do your dirty work by faking an attack from the intended victim. So far this did usually not work because nobody was actually stupid enough to try an
Re: (Score:2)
Re: (Score:1)
Fascinating. You obviously have not even taken a very brief look at the relevant literature and research. Probably you should apply there, as you seem to have the right combination of "can do" attitude and absolutely no clue whatever.
Re: (Score:2)
Probably not. Historically, a people this disconnected from reality just becomes irrelevant. This is typically accelerated by all the smart ones leaving when it becomes obvious that things will not improve.
What allies? (Score:3, Insightful)
Once upon a time the US was an ally many nations wanted to have (discounting the relationships fostered by the CIA). Today, the image of the US is one of isolationism and paranoia, very much in the frame of the leader.
Granted, it is hard to tell what is due to the commander in chief and what is simply politics as usual? It is also hard tell who is creating more spin?
Whatever happens the next leader needs to heal the wounds and divisions created by Trump (he already started during Obamaâ(TM)s terms), but that wonâ(TM)t be easy while Trump is still respected by his base. It also wonâ(TM)t be easy while the Democrats donâ(TM)t listen to the nation.
Re: (Score:2)
Re: (Score:2)
Perhaps you need to re-evaluate what you consider "incoherent", then.
Re: (Score:2)
Re: (Score:2)
A bit grotesque to hold Trump accountable for the demise of US as world police agent and favourite cheerleader.
Re: (Score:2)
He didn't say Obama caused divisions, he said Trump started doing so while Obama was still in office.
To avoid future embarrassment, try reading the entire sentence rather than just looking for random words within it to snarl at.
Re: (Score:2)
Involuntary pen testing needed. (Score:5, Insightful)
If there is going to be any real defense of our critical systems then what we actually need is to have our own government bringing down vulnerable systems. Allowing these systems to continue to function when they could fail at any moment is like building on a fractured foundation: it's a disaster waiting to happen.
This effort will cause annoying outages but it will also force companies to invest in real security while allowing those who already have will thrive. Most companies have been complacent for far too long and it's made us very vulnerable.
More aggressive ... (Score:2)
... than what?
We hear about Russia, China, Ukraine ...
What has the US ever done?
Re: (Score:2)
Thats the way networks are created. In the 1980's and now in 2018.
Beyond that modem is a home computer with a ssd in 2018. All the US cyber experts have to do is follow the network back to a bad home computer in a bad nation.
Push some new and unexpected gov malware down to that home computer and its a happy cyber ending.
Re: (Score:2)
What has the US ever done? ...
That's missing the point abut as badly as it's possible to miss.
Sure so America has done some pretty bad stuff, but surely that doesn't mean you want people to do it back to you in turn. Even if you argue turnabout is fair play, it's also entirely fair and wise to protect against it.
Re: (Score:2)
That's leaks , not cyber attack.
Pay attention.
Your example highlights incompetency.
Additionally, hackers extant to the US have grabbed the good shit crom CIA and NSA, right?
Re: (Score:2)
You and I are in agreement on that.
My goal is to separate that from aggressive, proactive cyber attacks on the part of the US.
They can't do that.
And my point is: While the US sucks the big one on hacking, they are also lousy gatekeepers.
It's incompetence all the way down.
These are the same people who ... (Score:2)
... can't get rid of Kaspersky. [slashdot.org]
US Government Can't Get Controversial Kaspersky Lab Software Off Its Networks
Re: (Score:2)
After sorting for the optics of demographics and considering equality of outcome a new US command was created.
Fill in a questionnaire, pass the biographical screening and become a cyber expert.
This "war" was lost in the 1970s (Score:4, Insightful)
Ambient Authority is a design decision which only appears once you have multiple users sharing a computer. As a result, everyone just kept using it without much thought... until we find ourselves in a world of persistent networks, mobile code, no system administrators, and multiple layers of firmware and OS from various hardware and software vendors.
In such a system, any code runs with the full authority of the user who started the task, and the users have no effective means of limiting the side effects of running a given program. This in turn means we have to try to guess the intent of code (which is equivalent to solving the halting problem, and is thus impossible). The band-aid is to then try to enumerate all the bad code in the world (virus scanners), and to enumerate all the code bugs in all our programs (security updates), and to eliminate the trust of users (DRM, forced updates, "safety" filters in our browsers). None of these band-aids will work against a determined individual, let alone a nation-state.
Running tasks with the least possible privilege, the "Principle of Least Authority" (POLA) allows a user in such a system to decide ahead of time exactly what files the program is allowed to read, write, etc. Because we're all used to dialog boxes, and drag to drop GUI elements, this doesn't even require any special training of users to accomplish.
Of course, rebuilding our infrastructure to fix a design flaw of the size and scope of using 2 digit years (the Y2K problem we once faced), isn't going to be easy... especially when there's no deadline to make the need for action obvious. It's just going to remain an insidious vulnerability instead for decades to come.
If you think EAL certifications address this, they don't. 8(
obligatory (Score:2)
Oceania was at war with Eastasia: Oceania had always been at war with Eastasia.
Yes, countries MUST have secure and local ICT (Score:2)
The idea is that it is foolish to have a single producer of CPU, OS, components.
Think about it: Where is all the Win 10 telemetry going ?
How many "conveniente bugs" do a modern CPU have ?
How many ways are there (that we do not know) to "shutdown" a network infrastructure ?
By having country level perople and experts you also enhance the employment...
What can you wish more ?
America's cyberwar with foreign governments (Score:2)
All the Pentagon has to do is stop running their infrastructure on Microsoft Windows.
We know how to improve security. This ain't it. (Score:2)
The Pentagon is trying to CyberAttack our way to a more secure future. But Security comes from Defense, not attack.
Thousands of years of human experience have shown that destruction is easier than creation. One man can quickly destroy something that takes a community months to create. It may be that "To every thing there is a season; and a time for every purpose under heaven." But, if you don't spend more time on creation than destruction, you end up a lonely, starving scavenger. Any stable, prosperous soci
To really avoid escalation, let's just surrender. (Score:2)
If we're going to hit back out of the fear that the people attacking us will be mad about it (as if we aren't), why bother defending ourselves at all?