Recently In
-
The Ultimate Guide to Barbecue
The best grills, smokers, and tools for your backyard blowouts. Plus, grilling tips from Food Network Canada’s Ted Reader!
-
Five Perfect Double-Breasted Suits And How to Wear Them
How to pull one off, the details to look for, plus why you should never dress like Tubbs from Miami Vice.
Related Stories
No related posts.

![Will the wars of the future be fought over the internet? As reports of increasingly intricate online attacks accumulate, so does concern over the threat of a full-scale cyber war. We investigate. By <a href="http://sharpformen.com/author/shawn-mcmurray-and-rick-leswick/">Shawn McMurray and Rick Leswick</a><p>Near the end of a hall in the basement of University of Toronto’s Munk School of Global Affairs, in Room 63, is The Citizen Lab. The room is quiet, save for the staccato click of keyboards. By all appearances, the dozen or so people here, sitting on Ikea office chairs at their computers, are an everyday group of U of T researchers. But it was in this room that the Citizen Lab and its affiliates, part of the Information Warfare Monitor, uncovered an international cyber spy ring that was unprecedented in its scope. The world would never view online security in the same way again.</p>
<p>In 2008, then Citizen Lab researcher Greg Walton traveled to the Dalai Lama’s safe-haven in Dharamsala, India, after catching wind of suspicious online activity taking place against the Tibetan community. Once there, it didn’t take long for him to determine that computers at the Tibetan leader’s offices had been infiltrated with malicious software (better known as malware), and that sensitive files were being surreptitiously uploaded to a server somewhere in China. Walton could see the names of the files that were being accessed and, ominously, was told that one of them was a document concerning the Dalai Lama’s negotiating position with China.</p>
<p>Back in Canada, senior Citizen Lab researcher Nart Villeneuve and other principal investigators at the Information Warfare Monitor conducted a detailed analysis of Walton’s field review. Villeneuve, a tall, affable man with short brown hair, was already a veteran in the realm of online censorship and surveillance. By this time, he had just completed a report titled “Breaching Trust,” after confirming that TOM-Skype (the Chinese version of the popular chat application) was not only censoring certain messages, it was saving them in an archive and logging the IP addresses of its users. His method for exposing the surveillance was genius in its simplicity: he typed expletives into TOM-Skype’s instant messenger and noticed an extra connection, which he followed in Firefox. “There are people who are technically amazing,” he admits. “I’m not one of them.” His report highlighted the dangerous potential for citizens to be monitored while online, but it was small potatoes compared to what the Information Warfare Monitor was about to unearth.</p>
<p>The analysis of Walton’s field report found that the cyber infiltration of the Dalai Lama’s office was far more widespread than it had initially appeared. Many of the computers had been made to form a “botnet”: that’s techie lingo for a collection of computers that have effectively been zombified by malware. In this case, that malware included a powerful Trojan horse known as “gh0st RAT” that gave the attackers complete, real-time control of the infected computers and all the data on them. Every email, document and file on the botnet was accessible by the botnet’s controller.</p>
<p>Like common computer viruses, these attacks can be difficult to detect because their true source can be easily masked. Malware threats could appear in the guise of an innocuous attachment, like a Word document or a PDF, and they could appear to come from an affiliate. “What if they look like they’re from your boss?” Villeneuve asks, describing the various ways hackers get a foot in the door. “What if the message says, ‘The executive director needs you to read this message?’” When the attachment is opened, it silently installs malware that connects to the attacker’s control server. At that point, depending on the complexity of the malware, they can essentially do whatever they want. “Once you open up that PDF, you’re finished,” he continues. After gaining a foothold, attackers could view email, move files back and forth or even operate a webcam.</p>
<p>This time, though, the attackers had made a major mistake by not properly securing access to their command-and-control servers. The ever-persistent Villeneuve had managed to find a website—completely unprotected by a password—that provided access to the source of the attacks. He had performed a simple Google search of a string of characters embedded within the files of gh0st RAT. “When they screw up, you’ve got to catch it,” Villeneuve says.</p>
<p>In order to further monitor the attacks, the Information Warfare Monitor team performed an old-fashioned sting, essentially, except for the fact that it took place entirely online. The plan, in computer parlance, is called “a honeypot,” and involved a bait computer that was set up to entice the attackers. It didn’t take long for the trap to work. Soon, attackers had taken control of the computer and the team in Room 63 was able to watch everything they did.</p>
<p>After more than 10 months of observation, technical scouting and lab analysis, the Information Warfare Monitor uncovered a massive cyber spy network, which it dubbed GhostNet, that had reached far beyond the Tibetan community. The attacks had affected computers across the globe, and had likely compromised a number of diplomatic missions. Infiltrated systems were found in the ministries of foreign affairs in Iran, Bangladesh, Latvia, Indonesia, Philippines, Brunei, Barbados and Bhutan, and the embassies of South Korea, Indonesia, Romania, Cyprus, Malta and Thailand. Eventually, over 1,295 infiltrated computers were revealed in 103 countries, including computers in the NATO headquarters in Brussels and the embassy of India in the US. Researchers were also able to track the IP addresses of the attackers, many of which led to China’s Hainan Island.</p>
<p>The Information Warfare Monitor’s report on the newly discovered spy ring was cautious to accuse the Chinese government of any wrongdoing, stating, “Alternative explanations are certainly possible.” Hainan Island, though, isn’t just an idyllic vacation spot in the South China Sea. It also happens to be the site of the Lingshui intelligence facility that, according to globalsecurity.org, houses more than 1,000 intelligence analysts of the Third Technical Department of the People’s Liberation Army. Villeneuve, for his part, thinks that the location of the offending IP addresses is purely coincidental. The Chinese government, of course, denied any involvement in hacking, but a separate 2009 report from the University of Cambridge concluded that Chinese agents had, in the past, infiltrated the computer system at the office of the Dalai Lama. In light of the uncertainty of following digital footprints, however, speculation is futile. “People ask, ‘When are you going to find the smoking gun?’” Villeneuve says. “It’s not going to happen; it’s impossible.”</p>
<p>This investigation into GhostNet was conducted by civilian researchers at a university, not a government or military organization. Still, as threats like the one posed by GhostNet continue to grow, Canada has yet to establish a formal domestic or foreign cyberspace strategy. The Canadian Cyber Incident Response Centre is geared towards cyber protection on a national level, but at the moment it merely handles incident reports, Villeneuve says. Meanwhile, any NGO or individual here who falls victim to the scourge of cyber attacks is, essentially, on their own to deal with it.</p>
<p>This kind of activity, as disturbing as it currently is, will only get worse, according to Villeneuve. He admits that a well-executed cyber attack on certain targets could be devastating (“Why would you go and blow up a bridge,” he wonders, “if you could hack the radio frequency that controls opening and closing it?”), but he’s no doomsayer, and is careful to avoid exaggerating the ability of computer hackers to wage all-out cyber war by affecting the services we depend on. “Within the community, there are those who think it is likely,” he says, “but I’d say opinion is divided.”</p>
<p>Not so with Richard Clarke, a trusted authority on the subject, who believes that the threat of international cyber war is very real. Clarke served as the chief counterterrorism advisor to presidents Clinton and George W. Bush, and in 2001, months before the September 11 attacks, tried in vain to convince the Bush administration of the likelihood of an impending strike by al-Qaeda. In a recent interview on National Public Radio’s Fresh Air, he painted a bleak scenario in which computer hackers are able to wreak widespread havoc at the touch of a keyboard.</p>
<p>“What could cyber-war do? It could derail trains all over the country,” he told NPR. “It could blow up pipelines. It could cause blackouts and damage electrical power grids so that the blackouts would go on for a long time. It could wipe out or confuse financial records so that we would not know who owned what, and the financial system would be badly damaged.”</p>
<p>Clarke goes so far as to suggest a cyber arms race is already under way between nations like the US and China. Citing The Wall Street Journal and other reputable news organizations, Clarke points out the possibility that China has already planted “logic bombs” within the American power grid, so that in a period of tension Chinese cyber-spies could systematically and anonymously shut down targeted power systems. If that’s the case, Clarke continues, then the US has likely reciprocated any such virtual warfare.</p>
<p>This all may reek of sensationalism, but critical infrastructure has been the target of hackers in the past. In 2000, Vitek Boden, a recently fired employee from an Australian sewage treatment plant, used his laptop and some radio equipment to gain control of some 140 sewage pumping stations. From a safe distance away from the plant, he was able to cause millions of gallons of noxious sludge to spill into nearby rivers and parks before eventually getting arrested. Boden had taken advantage of vulnerabilities in a software system known as Supervisory Control and Data Acquisition (SCADA). Many industrial and infrastructure processes, like power generation, water treatment, oil pipelines, and railways are dependent on this type of software. The fact that these systems do not always connect to the Internet does not make them safe, partly because they often rely on radio signals to control devices. In this case, Boden was able to wirelessly usurp control of the plant he formerly worked at. As an ex-employee, he was intimately familiar with that SCADA system in a way that no foreign cyber attacker would be, but it still illustrates the potential for critical infrastructure to be hacked.</p>
<p>Blackouts, in particular, have had a penchant for stirring up speculations of cyber terrorism. In a speech last year, US President Barack Obama said, “In other countries cyber attacks have plunged entire cities into darkness.” Obama didn’t get any more specific than that, but a massive 2007 blackout in Brazil was attributed by CBS’s 60 Minutes to a cyber attack. The news program used several anonymous sources to support its case, but the Brazilian government would later deny the claims, according to Wired magazine, citing sooty insulators as the cause. A Brazilian official said that he investigated the claims and found no evidence of a hacker attack, adding that Brazil’s electric operating systems are not directly connected to the Internet. The true trigger of that blackout may never be known, but the power grid remains a concern for hacker vulnerability.</p>
<p>Recall 2003, when eight US states and parts of Canada—over 50 million inhabitants—lost power in the biggest blackout in North American history. While no cyber terrorists have been implicated in that mishap, there was likely a cyber element to it. The official story is that some power lines in Ohio had brushed against a few overgrown trees, causing a fault that should have been easy to contain. A series of failures prevented technicians from stopping the problem until it got out of hand, and one of those failures, as Wired would later report, may have been a software glitch that stopped an alarm from alerting power system operators. Other news organizations have reported that the Blaster worm—which was making its rounds on the Internet at the time—may have increased the severity of the blackout. No hackers, perhaps, but the point remains that where critical infrastructure is concerned, compromised software often equates to compromised services.</p>
<p>Professor Paul T. Mitchell, from the Canadian Forces College in Toronto—where future generals go to learn the art of advanced warfare—is presently conducting research on the impact of networks on military operations and is due to publish additional findings in early 2011.</p>
<p>Canada has been slow to adapt to cyber threats, but Mitchell downplays the severity of the issue. “My opinion on the subject is that while cyber security is undoubtedly an important national and even personal security issue, it is much like crime,” he says. “Unchecked, it can pose real problems for stability, but it is something that can be effectively kept in a box by governments. The effects of a successful major cyber assault can be compared more to the effects of a significant weather event, like a major snowstorm. While normal services are affected, the threat to life and limb are secondary to the attack and limited in numbers.” He does not share Clarke’s bleak outlook. “Electronic Pearl Harbours make for good copy, but the reality of pulling off such a stunt is highly complex and difficult to do.”<br />
It may let paranoid Canadians sleep a bit better knowing that they are unlikely to wake up to a world where everything from their toaster to traffic signals can crash as the result of a cyber strike. And Dr. Mitchell makes his case by saying, “The concept [of cyber war] has been around for nearly 20 years and yet no one single instance of such an attack has yet occurred. If this is such a strategic mace to be used, why hasn’t it?”</p>
The Next Battlefield](http://sharpformen.com/wp-content/gallery/the-next-battlefield/helmete.jpg)