Cyber Terror ICT Conference

Iftach Ian Amit | November 2010

www.security-art.com

Cyber[Crime|Terror]Links between crime and terror on the cyber front: analysis and mitigation strategies

Iftach Ian AmitVP Business Development, Security ArtBoard Member - CSA IsraelIL-CERT Dreamer

So, I heard that crime has something to do

with state?You heard right...

Hungry yet?That was just the appetizer...

CyberWar

“Cyberwarfare, is the use of computers and the Internet in conducting warfare in cyberspace.”

Wikipedia

It did not happen yetBeing an exceptionEstoniaGeorgiaTitan RainIndiaGoogleAdobe

Many faces of how CyberWar is perceived...

From McAfee’s “Virtual Criminology Report 2009”Image caption:

“countries developing advanced offensive cyber capabilities”

CyberWar - AttackHighly selective targeting of military (and critical) resourcesIn conjunction with

a kinetic attackOR

Massive DDOS in order to “black-out” a region,

disrupt services, and/or push political

agenda (propaganda)

CyberWar - Defense

•Never just military

• Targets will be civilian

• Physical and logical protections = last survival act

•Availability and Integrity of services

•Can manifest in the cost of making services unavailable for most civilians

CyberCrime

You want money, you gotta play like the big boys do...

CyberCrime - Ammunition

=≈ APT

CyberCrime - Defense•Anti [ Virus | Malware | Spyware | Rootkit |

Trojan ]

•Seriously?

•Firewalls / IDS / IPS

•Seriously?

•Brought to you by the numbers 80, 443, 53...

•SSL...

How do these connect?

Claim: CyberCrime is being used to conduct

CyberWar/Terror

Proof: Let’s start with some history...

History - Revisited...

Israel

September 6th, 2007Source:

http://en.wikipedia.org/wiki/Operation_Orchard

Source: Der Spiegel

Operation Orchard

All attacks on targets

are Attributed to

Hacktivists

Israeli

Arabic

Cast-Led, 2nd Lebanon war

Mid-east crime-war links

ARHack

Hacker/Political forum by day

Cybercrime operations by night

Political post

Buying/Selling cards for 1/2 their balanceSelling

1600 visa cards

History - Revisited...

2009 Twitter DNS hack attributed to Iranian activity.Political connections are too obvious to ignore (elections)

UN Council Decisions

Protests by leadership

opposition in Tehran

Timing was right on:

Iran-Twitter connecting dots•Twitter taken down December 18th

•Attack attributed eventually to a group named “Iranian Cyber Army”

•Until December 2009 there was no group known as “Iranian Cyber Army”...

•BUT - “Ashiyane” (Shiite group) is from the same place as the “Iranian Cyber Army”

Iran-Twitter - Ashiyane

•Ashiyane was using the same pro-Hezbolla messages that were used on the Twitter attack with their own attacks for some time...

•AND the “Iranian Cyber Army” is an active group on the Ashiyane forums www.ashiyane.com/forum

Let’s take a look at how Ashiyane operates...

On [Crime|Terror] trainingAshiyane forums

WarGames

Wargames targets includes:

Back to [Crime|Terror] Links:

What else happened on the 18th?

Additional targets - Baidu taken down

with the same MO (credentials)

Mapping Iran’s [Crime|Terror]

More recently:Iranian Cyber Army expanding

into the “Crime” business

Along with the cybercrime“honeypot” tactics…

Ashiyane

Iranian Cyber Army

Botnet Herding

Site Defaceme

ntCredit Card Theft

Strategic Attacks

Mapping Iran’s [Crime|Terror]Iran Iraq

The Future (Ilustrated)

CLOUDS

Deterrence

Think: Article 5 for the Cyber Commons!

An attack agains one or more states, shall be considered an attack against all member states, who agree, to exercise their right to assist the attacked party, including the right to use armed forces.

NATO Article 5 - abridged

Attribution?•Technical - not feasible

•Political - should be obvious

•Defending state?

•Should have the responsibility to “clean up” its portion of the Cyber Commons in order to enable a sustainable economic and civil environment.

SummaryGood Bad

Formal training on cybersecurity by nations

Commercial development of

malware still reignsUglyGood meet Bad: money changes

hands, less tracks to cover, criminal ops already creating the weapons

and are linked to terrorist organizations...

SummaryThe Future

Lack of legislation and cooperation on multi-national level is creating de-facto “safe haven” for cybercrime. <- FIx this! (see article 5 suggestions)

Treaties and anti-crime activities may prove to be beneficial. <- nukes? (i.e. treaties...)

Thanks!

www.security-art.com

iamit@security-art.com

twitter.com/iiamit

blog.security-art.com

Cyber Terror ICT Conference

Technology

ICT in Education of Korea - scpd.gov.kw. ICT in Education... · Cyber security center Enhanced teacher training II. ICT in Education: Overview ... Open edX-based, localized for Korean

SOMERSET ICT INSET DAY CYBER SECURITY EDUCATION

State of Qatar ICT Development Strategy · 68 ICT Investment Opportunities 1 Cyber-Security 2 Integrated Data Mgmt. and Monetization 3 Cyber Physical Systems 4 ISP 5 ICT Training

Cyber Security in ICT Networks - Organization of American ... · Inter-American Telecommunication Commission (CITEL) Cyber Security in ICT Networks: CITEL Perspectives Wayne Zeuch

Cyber Security Mngt in Kenya -ICT Board- Victor Kyalo

Politics, cyber-security, trade and the future of ICT supply chains - … · 2015-06-26 · Politics, cyber-security, trade and the future of ICT supply chains government and core

ICT Cyber Desk Review #6 Report 6.pdf · International Institute for Counter Terrorism (ICT) Additional resources are available on the ICT Website: Cyber-Terrorism Activities

Technology Document ICT Program Brief Cyber Security

ICT, Cyber Security and Digital Government Strategy

Big Data in Indonesia Cyber Security - idicti.com idicti.pdf · Indonesia ICT Institute Cyber Security Cyber attack in te last three year tend to increase. In every month, there are

ICT Network and Cyber Security Statement of Direction

The New Wave of Cyber Terror in the Korea Financial Sector · 2016-10-23 · CYBER TERROR TIMELINE 2009.7.7 DDoS against Government (CheongWaDae(Bluehouse), etc) 2011.3.4 DDoS against

Current issues on cyber terror presentation

ICT Cyber Desk Review #8 · 2016-02-07 · International Institute for Counter Terrorism (ICT) Additional resources are available on the ICT Website: Cyber-Terrorism Activities Report

Innovating business and organizations through ICT Cyber Risk …channels.theinnovationgroup.it/cybersecurity/wp-content/uploads/... · Modelli di governance dei rischi cyber e raccomandazioni

MSc in Applied Cyber Security - ICT Skillnet Ireland · cyber security there is a growing focus on training the next generation of cybersecurity experts. This part-time Cyber Security

Politics, Cyber-security, Trade and the Future of ICT Supply Chains

Cyber-Desk Review: Report #2 - ICT Report 2.pdfCyber-Desk Review: Report #2 The second cyber-desk report addresses two main subjects: cyber-terrorism (offensive, defensive, and the

Cyber Security: Differences between Industrial Control Systems and ICT Approach

Peo Insider Article Cyber Terror