Script Kiddies

Script kiddies are often the least skilled, but most common, of the non-state attackers. The term script kiddie, often used in a derogatory sense, is used to describe someone of no particular skill at attacking systems. Script kiddies generally use scripts and tools that have been written by others in order to conduct their attacks, but have no great skill or ability beyond the use of such tools. Even so, such attackers are often successful owing largely to the poor state of security in the systems being attacked and the very large number of Internet-facing systems that are available to be attacked. The large number of easy to use system penetration tools that are available also contributes to the sheer number of attacks that come from this set of attackers.

Malware Authors

Malware authors can be, but are not always, a very specialized type of attacker and may be independent or work for an organization. For those that actually write original items of malware, some certain amount of skill at programming and knowledge of the target operating systems is required. Such talented developers of malware are capable of developing the malware that botnets utilize, complex tools such as rootkits, and other similarly crafted tools.

The other source of malware, and the source of much of the malware that is loose in the wild, is in variations that are created from already existing sources. When we examine any item of common malware, we will likely find variants of it ranging into the dozens, if not far more. Often, the reason for so many variations of a particular item of malware existing is the use of malware creation kits. Such software packages allow malware to be created by choosing from a set of options allowing the user to vary delivery methods, payload, means of propagation, and other similar factors; the one from column A, one from column B, one from column C approach. Those that create malware using such tools are often grouped into the same category as script kiddies, as creating malware by such means requires no particular skill at programming. Again, as with the tools used by script kiddies, this renders them no less effective.

Scammers

Scammers are often considered to be the lowest of the low when it comes to attackers. They use many of the same techniques con artists have used for decades. The scammers that are caught and discussed publically often do not have the technical skill with attack tools of even the worst of script kiddies, as they prefer other methods of gaining their target information. Such scammers instead use tools that are of a social engineering nature, such as phishing or pharming attacks, in order to trick their victims into willingly parting with the information that they wish to obtain.

The goal of scammers is to separate their unwitting victims, often those that are not technically savvy, from their PII, including names, addresses, social security numbers, financial data, and other such information. Given this information scammers will seek to drain the victim’s bank accounts and run their credit cards up to the limit, often moving such funds out of the country where they cannot be recovered easily.

The motivations of scammers are almost universally financial in nature. Scammers exist to, in one fashion or another, separate their victims from whatever items of value that they might have. This might mean actual currency, information, physical objects, or any number of other means of storing value.

Blackhats

Blackhat hackers, often known simply by the term blackhats (think cowboy movies), are the bad guys of the hacker world. Such hackers often have no particular care for the rule of law, the systems that they disrupt, or what ill effects that they cause. Blackhats are distinguished from whitehats, the good guys, who are often found working to foil the efforts of the blackhats, and grayhats, who ride the line between the two, often crossing from one side to the other.

Identifying an attacker as a blackhat often implies that they possess a certain level of skill at attacking and exploiting systems and networks, at least in excess of the average script kiddie. Blackhats may attack a system or network with a variety of motivations in mind. They may be doing so just for the thrill of exploiting a system, may be after specific information on the system, may be using the system as a “pivot” to attack other systems on the same network, or any of a number of other reasons.

Hacktivists

Hacktivists are, in essence, hackers that use their skills to support a particular point of view. One relatively well-known work on the subject, Hacktivism and the Future of Political Participation, defines hactivism as “the nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends” [1]. The tools of the hacktivist can include website defacement, mass emailing, Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks, Domain Name Service (DNS) hijacking, or any of a number of other methods.

In February of 2010, a group known as Anonymous, well known for similar attacks, launched a DDoS attack against the website of an Australian senator, as well as the Australian Parliament House. Anonymous claimed to have launched the attack due to the attempts of the Australian government to introduce a mandatory Internet filtering service for the entire country [2].

The motivation of the hacktivist is almost entirely politically or religiously oriented in some fashion, and focused on influencing opinions on the particular issue in question. Causes that are supported by hacktivists can be nearly endless, but may include such topics as free speech, civil rights, religious rights, and so on. Nearly any issue that we can find supported or attacked by activist groups, protesters, and the like will have some element of hacktivist support, even if it is not an overt one.

Patriotic Hackers

Patriotic hackers may actually be reasonably argued to be a subset of hacktivists but are generally tied to national conflicts and can even join into cyber wars as independent players. They use many of the same tools and methods: Web site defacement, DDoS, attacks, and so on but generally act in support of a particular country, or an effort on the part of a country, although not in any officially sponsored sense.

There have also been occasions where such patriot hackers have been rumored to have actually been in the employ of a state and have been paid to carry out their activities. One such occasion in December of 2009 involved the theft and public posting of thousands of emails from the University of East Anglia Climatic research unit. It is believed that the patriot hackers involved in the incident were acting on behalf of Russia in order to discredit the need for reduction in carbon emissions to help fight global warming [3].

Patriot hackers will likely have many of the same motivations as hacktivists, although with a much more nationalistic focus. The activities of patriot hackers may additionally be of a somewhat more sharp and directed nature than those of a hacktivist.

Motivation for Corporations to Act in Cyber Warfare

The activities of corporations acting in cyber conflicts can be broken down into two primary areas: legal actions and illegal actions. Corporations carrying out acts in support of cyber war in a legal fashion will typically be doing so in the employ of a nation-state. In the United States, we can see many examples of corporations performing such roles on behalf of the U.S. government. Large defense contractors such as Northrop Grumman, General Dynamics, Lockheed Martin, TASC, and Raytheon provide expertise and resources to the government, enabling it to carry out the required cyber activities [5]. Another set of companies that support these efforts are think tanks and Federally Funded Research and Development Centers (FFRDCs). In such situations, the cyber warfare activities of these corporations are allowed and legally blessed, and the corporations are well paid for their efforts.

On the other side of corporate activities, we could potentially find similar actions taking place without the legal authorization of the powers that be. In such cases, we might see any number of activities taking place to benefit the corporation. Depending on the country in which the corporation is operating, it may have great flexibility in the cyber operations that it is legally allowed to carry out. As we will discuss in Chapter 13 when we talk about legal issues, the laws regarding cyber warfare, hacking, espionage, and similar activities can vary greatly from one country to another. By strategically placing equipment, resources, and subsidiaries of the corporation in various countries, it may be possible for the corporation to take certain activities with relative impunity, as long as it is careful in matters of scale during such activities. Certain outright attacks might be sufficient to draw international attention and cause difficulty for the host country, which would likely not be desirable for the corporation.

Reasons for Cyber Terrorist Attacks

The motivation of cyber terrorists, as with any other branch of terrorism, is ultimately to influence the victim or victims of the attack into a particular line of activity or thinking. Cyber terrorists are also much more likely to resort to attacks that cause large-scale damage or destruction than hacktivists or patriot hackers.

Supervisory Control and Data Acquisition (SCADA) systems are often considered to be a prime target for cyber terrorist attacks. As we discussed in Chapter 7, such systems are responsible for control and monitoring of many processes that make life in an industrialized world possible, such as the distribution of power, flow of oil, communications, and many others.

Due to the nature of such systems, it would be possible to cause great physical disruption or damage by manipulating the devices such SCADA systems control in order to cause them to fail or behave erratically. Given that the nature of terror attacks is to evoke feelings of unrest, anxiety, and others of a similar nature in the target populace, highly visible and highly effective targets such as these present a great source of opportunity to terrorists.

What will Happen When we see a Cyber Terrorist Attack?

As we have not seen, at the time of this writing, what would be considered a terrorist attack of a cyber nature, it is difficult to say exactly what will happen when one does occur, but we can speculate. If we look at the activities surrounding the 9/11 attack in the United States, we can see a quick series of activities that took place. We saw great changes in the intelligence apparatus of the government, some good, some bad, but all designed to collect and share information in manner that would obviate the stovepiping of intelligence that allowed the attack to go unmitigated. New laws and new powers were enacted to allow more and greater amounts of information to be collected to feed the intelligence agencies as well. In general, a great deal more monitoring was put in place in an attempt to halt future attacks of a similar nature.

We also saw a great deal of military build-up, some directly within the branches of the U.S. military, but a great deal within defense contractors as well. Much of this was in support of the conventional war that was swiftly taken to the area of the world that was deemed responsible for the attacks. Whether this was reasonable or effective is a matter of much debate and largely inconsequential to this discussion.

Within the borders of the United States, we saw greatly tightened security for a period of time, with armed soldiers standing in airports and places of public interest. Directly after the event, such controls were very tight for a period of time, but relaxed considerably as more time passed without another large attack getting through. Generally, we saw a huge spike in security for a period of a year or two, then things relaxed but we can definitely still see some of the changes resulting from the attacks that were made permanent.

Given that response to a cyber terrorist attack is likely to be led by the same military thinking and leadership that responded to the last attack, it is fair to assume that the response will be of a similar nature. The 9/11 attack was a new attack, in both the sense of scale and technique, that the United States had not faced before and did not have hard experience in dealing with. Some mistakes were surely made in the process, but the end result was an overall heightened security posture in order to prevent a repeat of this type of attack and retaliatory action against those that we thought supported it.

In the cyber world, at present, our defenses are in a poor state to withstand such an attack. The virtual world has no borders to speak of, and, even if it did, the attack could very well come from within them, and we have no good way to prevent such a thing from happening. In the physical world, we can attempt to detect and prevent the entry of materials that might be used to cause mass casualties, but we have a considerably more difficult task in preventing the entry of or use of weapons of cyber terrorism. At present, our systems and defenses for dealing with such an attack are reactive only.

In the event of a large cyber terrorist attack, we would likely begin to see the development of borders and security in a virtual sense. This would be a difficult task indeed, due to the myriad of communications methods that can be used to move data in and out of a given country, and we would likely never be able to police them all, but it is something that could eventually be made to work, although with a great deal of pain being involved in the process. To say that the technical challenges involved in such an undertaking would be great and would be a massive understatement, but we would likely see an attempt made in such a direction.

A possible alternative would be to create a secure network for the specific use of critical infrastructure systems. Such a network could be considerably more restrictive than anything that needed to carry public traffic, as it would serve a more specialized set of needs. Although such a network, in and of itself, would not be technically challenging to create, standardizing the environments that might connect to it certainly would be. In addition, as with 9/11, we would likely see military action of a conventional warfare nature taken to the attacker if we could apply some sort of attribution to the source of the attack. While such attribution is very difficult to prove from a technical standpoint, when faced with a cyber terrorist attack that caused a great deal of physical damage, we would likely be able to track it back, to a certain extent, through the intelligence channels, presuming that it did come from a terrorist organization. Due to the nature of such organizations, such an attack is unlikely to be carried out without an increase in chatter, a term often used to describe the volume of communications among suspected or known terrorist organizations [8].

Motivations for Criminal Organizations

The motivations of those in organized crime are twofold: money and power. Given the tools, cyber and otherwise, that are at their disposal, and the resources that they can bring to bear against an enemy, such organizations are truly to be reckoned with. Of all of the non-state actors that we have discussed in this chapter, organized criminals have the most potential to be on an even footing with a nation-state in the areas of resources and effectiveness.

Cyber criminals, in the course of their activities, often develop real world skills in penetrating the defenses of their targets. Some of these attackers, whose activities have later been uncovered, have been found to have been operating inside the networks and systems of their targets for extended periods of time without discovery. Evidence has also been shown regarding cooperation between cyber criminal organizations and coordination in selecting targets so as not to interfere with the activities of other such groups [9].

Exploratory Systems

As we discussed in Chapter 9, the first step in the attack process is to gather intelligence on the systems against which we intend to pursue further action. We need to map out border devices and networks, fingerprint systems, and gather as much information on our targets as we can. At present, there are tools that serve such exploratory functions, such as the famous tool Nmap, although they generally do so with very heavy interaction with the user of the tool, and are not very adaptive to the information that is gathered as they move along through the mapping process.

A good example of a tool designed with an exploratory purpose in mind, implemented as an item of malware, is the infamous Morris worm. The Morris worm, one of the first worms ever created, was written in 1988 by a Cornell University student named Robert Morris. Morris created the worm as a tool to gauge the size of the Internet. He took steps to disguise its point of origin, and used flaws in sendmail, finger, and rsh, as well as a process to break weak passwords, in order to propagate it from one machine to another [10]. Ultimately, due to a flaw in the worm’s design, the result of its propagation was actually a DoS attack against the infected machines. The Morris worm ended up infecting an estimated 6000 systems, about 10% of the systems on the Internet at that time [11].

The potential for autonomous exploration systems is great, from the standpoint of automating a somewhat laborious task, particularly for large networks, and freeing up resources for activities that require more direct human interaction. Of course, depending on how such tools were implemented, they also have the potential to go disastrously wrong, as did the Morris worm. Particularly during the intelligence gathering phase of a cyber warfare attack, accidentally launching a DoS attack on our target would certainly ruin an element of stealth or surprise that we hoped to gain by quietly mapping out the systems and networks of our opponents.

Attack Systems

At present there are a wide variety of attack tools that are available to those wishing to conduct cyber attacks, ranging widely in toolsets and utility. Some such tools, such as the Metasploit Framework, provide an excellent library of attacks, but only a certain level of automation, and surely not autonomy. Other tools (such as those that we discussed in Chapter 6) combine multiple different applications into tool chains in order to add some level of automation to the process. Although such tools are not usually autonomous we can presently see autonomous or semiautonomous examples of attacks tools that are already functioning.

Much of the malware that exists in the wild can be considered autonomous to a certain degree. Such tools are constructed with a certain goal in mind, whether this is simple replication, information retrieval, or any of a number of other goals, and let loose into the world. We have seen numerous examples of malware over the years that have been, at least briefly, successful enough to infect millions of machines in the process of carrying out their programming.

In addition to simple items of malware, we can also look at greater structures that are built using malware, called botnets. Botnets are networks of systems running malware that have been recruited without the authorization of the system owners and connected to command and control networks that allow the systems to then be remotely operated en masse. Such botnets can consist of millions of machines, and can be used to conduct DDoS attacks, crack encryption, or almost any task that can benefit from the application of distributed computing. Botnets are generally under the direct control of their operators, but they are also certainly capable of carrying out their tasks without such interaction, presuming that they have been assigned some task to carry out. The malware that recruits new nodes into botnets will generally continue to spread and grow the network in size, even if no commands are being given to the machines.

In 2008 and 2009, the Conficker worm was a regular news item in security and malware circles. The worm, in a variety of revisions, ultimately infected machines in the millions, with estimates generally ranging between 5 and 10 million devices. Regardless of the variety of interesting attack, propagation, and defense measures that were used by the worm, one item of interest for many researchers was that the worm was also recruiting devices into a botnet. As we mentioned earlier, such botnets are generally in the control of an operator or set of operators, who use them for various tasks. In the case of the Conficker botnet, no such operator appeared to be guiding its actions. The botnet continued, through the propagation of the worm, to recruit new devices until it grew to be one of the largest botnets that had ever been recorded at the time. One of the later and more prevalent variants of the Conficker network, Conficker E, quietly self-destructed in May of 2009, taking the control connections to a large number of botnet nodes with it. While a number of theories abound as to the reason behind the apparent inactivity of this botnet and its later self-destruction, one possibility is that it was created as a proof of concept for a cyber weapon, and had simply served its purpose and was then deactivated. Other variants of Conficker still continue working as of this writing.

Autonomous attack systems have great potential to change the face of cyber warfare, as long as we are not terribly picky about the results. Such tools would, in theory, be an offshoot of malware, and would exist with the express purpose of attacking a particular target or targets. Although we can go to great lengths to ensure that we control and limit the attacks of such tools, this is an area in which there are many examples of bugs in existing malware. In addition, the botnets that are active in the world today do not demonstrate aggressive behaviors, instead waiting for the command of the botnet operators. If such tools were created for the express purpose of attack, there is no reason that they could not be made to be sneakier, carry out their own attacks, and generally operate without human guidance. We could potentially, after the release of such an autonomous tool, find ourselves on the receiving end of its attacks, unable to call it off.

Defensive Systems

As we mentioned earlier in this section, we are already at a place where we have defensive systems that verge on autonomy. When we look at the standard Intrusion Detection System (IDS) and IPS in combination, what we essentially have is a system that will, based on its configuration settings, take automatic action to protect the application, system, or network that it is charged with monitoring. Such measures can be at a gross level, for instance dropping all traffic from a target or network that appears to be launching an attack; they can be very granular, in the case of dropping only specific packets that are part of a carefully crafted attack, or at any level of specificity in between. Systems such as these that can react without the express permission of an administrator are necessary in order to be able to handle cyber-related issues in a sufficiently short period of time.

As a variation on the traditional IDS/IPS usage, we could also consider a slight variation on the idea and include some facility for counterattack. We might call such a system, to slightly overload a term, an Intrusion Response System (IRS). An IRS (yes, we could aim the IRS on someone) might go slightly further than the traditionally defensive measures taken by an IPS, and actually launch an attack in return, perhaps using a somewhat “safe” attack such as a DDoS from a botnet built for the purpose. Such a solution is absolutely rife with problems, to include collateral damage and attribution, but might very well be implemented by a non-state actor that felt less restricted legally. We can certainly envision a scenario where multiple IRSs attacking each other created a chain reaction, resulting in a DDoS of truly monumental proportions.

Issues such as these could potentially create the need for new and, as of yet unimagined, defensive scenarios in order to maintain functionality in such a chaotic environment. As cyber warfare and its associated logical weapons begin to reach maturity, we may see the landscape of the Internet change dramatically in order to cope with such situations.