Everyone understands software's prevalence - from managing complex supply chains to using cell phones to manage the intricacies of a teenager's social life. But how widely is it understood that there's a large, growing group of people solely dedicated to breaking into software? Hacking is no longer a hobbyist's sport. Breaking software has expanded beyond its amateur roots for two reasons:
1) Hacking is state sponsored - For example, there are regular reports on the ongoing cyber war between China and Taiwan. Taiwan regularly accuses China of hacking into defense ministry databases. In 2001, the US government set up a cyber unit "intended to make maximum use of 'cyber-weapons.'"
2) Monetization is the goal - in the past some hackers were simply happy to embarrass Microsoft. Today, the ability to steal credit cards is far more enticing.
Fundamentally, hacking is driven by simple economics. As the US Defense Security Service puts it, "The potential gain from even one successful computer intrusion makes [hacking] an attractive, relatively low-risk option--and the risk to sensitive information on US computer systems will increase." [Source]
For now, let's look at driver #1: State sponsored hacking.
It's an ironic twist that as the world shrinks and countries increase economic interdependence, governments are actively participating in cyber hostility.
I've always been struck by how similar the business style and atmosphere are between China and the US. Yet, according to press reports, these are the two most aggressive countries engaged in cyber warfare.
But it shouldn't surprise anyone. On one side, governments have an obligation to defend their countries. Few would argue that tracking terrorist internet correspondence is immoral. And, of course, there's the old adage: the best defense is a strong offense.
But there are more sinister drivers. Specifically, countries hope to:
1) Access technology-many
countries perceive that GDP and military strength are strongly correlated to
advances in technology. This is what affects private industry the most, especially
companies in defense or technology.
2) Damage or manipulate someone else's national infrastructure Examples
include hacking into media or websites outlets to foster misinformation, paralyzing
banks, etc... Private industries affected include logistics, transportation,
shipping, banking, and much more.
In the latest (March 2007) edition of AIR
FORCE Magazine writer
James Kitfield describes how spying has evolved dramatically from a battle
of the superpowers of the Cold War years to a battle of stealing technology.
Mr. Kitfield, naturally, adopts a very American-centric view. Some interesting
facts from the article:
- According a US National Counterintelligence Executive,
108 nations were involved in trying to steal sensitive US technology in 2005
(the last year these statistics were published)."
The question is: How many hackers, on average, per country? This is tough
to answer. Presumably, larger countries could have thousands whereas smaller
countries could have just a dozen or so. Let's extrapolate, assume a potential
range of 100 to 1000 hackers you get a professional, full time hacker army
ranging from 10,000 to more than 100,000 people.
- "The leading state sponsors
are an open secret and include India, Pakistan, Iran, Japan, France and Israel.
"But US intelligence officers and investigators spend much of their counterintelligence
energies looking particularly into the activities of China and Russia."
What Mr. Kitfield doesn't focus on too much is how the US government has been involved in cyber warfare. According to a 2004 government report, the US believes that "the intensive exploitation of intelligence, the use of new technologies such as offensive computer warfare, and clever but closely controlled technological demonstrations of force might deflect aggression aimed at the U.S. and its allies."
This same article cites several unconfirmed examples of the US government's
cyber attacks:
- "Lebanon's Hezbollah movement said Oct. 21 -- less than a month after the
intifada began Sept. 29 -- that its website server crashed after being targeted
by millions of hits and hostile e-mails from Israel and the United States.
- Cyber warfare
was first used by U.S. forces during the 1991 Persian Gulf War. That effort
was primitive, comparably speaking, as it was limited only to the reading of
e-mail sent between Iraqi commanders.
- When U.S. and allies launched an air
campaign against Yugoslavia, the Pentagon was able to infiltrate Belgrade's
advanced computer-integrated air defense system and inject false messages and
targeting data.
Next week: hacking for money.
