Clipping method

The work presented in this chapter is the result of daily efforts performed throughout the first half of 2013. On a daily basis, we searched for relevant cybersecurity discussions in the following places: the blogs of major vendors like Symantec, Kaspersky, and F-Secure; news feeds from various sites, online magazines and journals; security documents of research laboratories; scientific articles; blogs and tweets of security experts; vulnerabilities databases; and search engines. This resulted in a set of articles, news clips, reports, and other documents from which we extracted the more interesting ones, analyzed their credibility, veracity, and theoretical groundings to include them in the chapter. Every day, chosen items were rendered in a list organized after the structure of this chapter in order to classify each source. The study presented in this chapter distinguishes itself for its methodical analysis and discussion of the state-of-the-art on cybersecurity. Due to space constraints, we do not include every reference compiled, citing only the most important ones.

Network perimeter

Since the 1990s, the openness of networks has gradually increased, opening doors for applications like email and websites, while the perimeter trust has gradually narrowed down, creating an attack spectrum spanning several vectors [5]. To reduce the exposure gap, networks are enclosed within various layers of security controls, whose purpose is preventing, detecting, and mitigating intrusions and other activities of similar nature. Such perimeters are traditionally composed of firewalls, intrusion prevention/detection systems, sensors and traffic analyzers, proxies and reverse proxies, load balancers, and anti-* solutions.¹

Security controls are set up to log events according to the syslog standard for a centralized point that is part of the Security Information and Event Management (SIEM) process. Security logs can be extremely huge data sets, with on the order of millions or even billions of rows. When processed by SIEM devices, the resulting information gives a picture of the network’s health status—a holistic view of the egress and ingress traffic points and systems. Front-end platforms analyze those events, correlate them, track patterns, and trigger pre-set alarms for a monitoring team typically placed within a Security Operations Center (SOC)—a Computer Emergency Response Team (CERT).

The advent of “big data” has caused quite a commotion, and the industry has started to work out solutions. Thus, the SIEM process could surely benefit from such technology that would optimize log processing and event correlation at a large scale.

Responding to cybersecurity incidents

Responding to cybersecurity incidents involves internal procedures defined by the company’s policy. The de facto framework for incident response involves five steps: preparation, identification, mitigation, eradication, and recuperation. The preparation phase consists of knowing the network, systems, applications, and the SOC infrastructure beforehand. The remaining four steps define the response flow for real-time incident response. The incident is first detected and identified. Then it is mitigated, that is, contained, to at least diminish its impact. Eradication involves eliminating possible compromised artifacts, like patching vulnerabilities or purging malware, which supports the idea that a capacity for deep technical forensic investigation is required in the cybersecurity field. Finally, targeted systems are recovered and restored to their normal operation. In the majority of the simplest cases, the last two steps might not even be executed. Afterward, the lessons learned should be used to optimize the infrastructure and improve incident response in the future.

Sometimes Internet protocol (IP) addresses get included in known international blocking lists (e.g., the Spam and Open Relay Blocking System [SORBS]) for participating in spam or phishing campaigns. To delist IP addresses, CERTs have to cooperate with those cyber-authorities and provide evidence of eradication. CERTs also collaborate with other security teams around the world, thereby creating a white hat network of cyber-warriors that fight malefactors.

The most straightforward way to mitigate an incident is to block the source IP address or addresses. Blackhole Access Control Lists (ACLs) or drop rules are among the common techniques used. But these approaches can be problematic under Distributed Denial of Service (DDoS) conditions. It can be time-consuming to block lots of IP addresses, and both ACLs and rules put processing constraints on routers and firewalls. Moreover, many security controls are still stateful nowadays and rely on deep packet inspection and signature databases. However, both enterprise networks and the Internet are now lively, dynamic places, where many kinds of traffic originate from countless discrete devices, decreasing the effectiveness of such approaches. For example, the probability of anti-viruses correctly matching signatures with malware is roughly 30 to 50 percent [6].

Dynamic environments

Both the Internet and corporate networks are changing and becoming more dynamic environments, and security controls have to keep up with the changes. Cloud computing and Bring Your Own Device (BYOD) are gaining ground, but they also raise several security questions. How can company policy be enforced on outsourced infrastructures or on employee devices? They can move from one Wi-Fi hotspot to another and to telecommunications networks (e.g., 4 G) seamlessly, and can carry malware while accessing the enterprise’s applications. Security controls lack the monitoring capability to address this situation, and end-point protection still needs development on this regard as well. Cisco [7] believes that people-to-machine, people-to-people, and machine-to-machine connections will dictate and play a key role in the future. Clearly, to maintain the traditional holistic perspective while overseeing evolving network components in long term, it is necessary to recognize these key issues and adapt cybersecurity accordingly.

Threat profiles

In the context of cybersecurity, three threat profiles are considered: the hacktivist, the cyber-criminal, and the nation-state. Each of these profiles is enough to categorize cyber-threats in terms of personality, habits, motives, methods, and dedication. The hacktivist is the sort of a threat that can be dangerous within a very short time-frame. It is also normally easy to guess when and where attacks are going to hit, because they are often publicized ahead of time to show off and gather supporters. The cyber-criminal, in contrast, is more keen, looking over his or her shoulder, as it were, constantly. This profile is characterized by a meticulous and methodical approach that aims to make profit at any cost on the underground. The nation-state profile is intrinsically linked to Advanced Persistent Threats (APTs) and state-sponsored threats. Hacktivists tend to engage in crisis, whereas nation-states mean to disable target abilities for cyber-warfare. Cyber-espionage lies somewhere in the gray area between these three, as it can be conducted by an entity with any profile, individual or group.

Malware trends

The continual search for profit is the reason for new surges of trojans mainly targeting the finance sector. Beta Bot evolved from an HTTP bot to a banking malware [8]. Shipped with an embedded rootkit, it offers a kill switch for other malware and is capable of stealing home banking credentials by capturing HTTP requests. VSkimmer steals credit card information from card readers plugged into machines running Windows [9]. With thousands of infected machines, the Kangoo botnet targets home banking theft [10]. In Brazil, a homemade browser tricks a home banking website into not needing a security plugin by disguising itself as a mobile browser [11] while, in fact, it is stealing user credentials.

It is more convenient to control a victim computer than to provoke damage. However, McAfee [12] believes that destructive malware and ransomware on mobile devices will make a comeback. Indeed, in August of 2012, the Saudi Arabian oil company Aramco had thousands of machines down for a week [13]—caused by the Shamoon malware. These types of attacks can be troubling because they impact the real world. In this case, oil prices could increase. More recently, a time-bomb wiped out several computer hard drives of Korean financial institutions and TV broadcasters [14]. Other cases of Master Boot Record (MBR) wiping [15] have been reported, but with ransomware functionality too. Ransomware locks victim computers and encrypts data, asking for payment in order to undo the lock. Fees are demanded in the name of policing authorities, like the Federal Bureau of Investigation (FBI) [16]. Moreover, Reveton, a well-known ransomware strain, has been updated with a password purloining function [17].

Malware writers are focusing their efforts on new platforms. Smartphones, and consequently the BYOD paradigm, along with social networks and Mac machines, are making strides in the technology scene, but they also give rise to new arenas for malware development. On top of that, consumers are less aware of security risks on these environments, making them especially phishable. In 2012, a 2577 percent Android malware growth was recorded [7], with hundreds of new malicious samples per day and thousands already estimated for 2013 [18,19]. Most are profit-motivated and do not connect to Command-and-Control (CnC) servers, but the noteworthy ones do so, making mobile botnets little different than traditional ones.

Mobile malware focuses on toll fraud (premium-rate Short Message Service [SMS] messages), ad jacking, and bank fraud by capturing mobile Transaction Authentication Numbers (TANs) [19,20]. They disseminate via drive-by downloads or malvertising, or even disguising themselves as legitimate applications on official stores like Google Play Store and Apple App Store. A noteworthy malware with multiple advanced functionalities has been uncovered [21]. Obad, as it was dubbed, is able to send premium-rated SMS messages, download and install other malware onto the device or send it further via Bluetooth, and remotely issue console commands on Android devices. Of more concern is the fact that the user cannot delete it without root access once it acquires administrative privileges by exploiting a flaw in the operating system.

Regarding social networks, the Dorkbot malware spreads through Facebook internal chat, hopping from one friend to another. It circulates in many countries and is capable of stealing personal information and spying on user activities [22]. Another malware [23] posts malicious links on Facebook, while a surge [24] tweets malicious links onto Twitter. Furthermore, signs of malware are beginning to show up on Macs. The best example is the popular Flashback trojan, which exploited a vulnerability in Java. Recently found, the spyware Kumar dumps and uploads screenshots to CnC servers [25]. The most interesting aspect of this evildoer is that it was signed with a valid Apple Developer ID.

In general, cyber-criminals develop mainstream functionalities to reinforce malware but also to avoid detection and slip past anti-viruses. Recent anti-virtual machine, anti-debugging, and anti-sandbox techniques have been used by malware to evade detection because those isolated environments are used to analyze malware [26]. For example, a malware can ascertain if infected machines have mouse movements or not, the latter being evidence of dormant systems devoid of user interaction. These techniques are also particularly of concern for cloud computing. Truly, it is a game of cat and mouse between the white hat and dark hat communities. Malware, the infectious digital disease, will not fade away in the near future. When new technologies come along, malware can be expected to follow them into unexpected places [27]. This is the case of the Internet of Everything (IoE) [7], where IP-enabled devices connected to the Internet, like TVs and cars, can run existing operating systems similar to Android.

Botnets

Botnets are a network of computer bots infected with malware controlled by a CnC infrastructure, or mothership. Botmasters issue commands from CnC servers to bots. Malware can be written for virtually anything. In some cases, Remote Administration Tools (RATs) (e.g., the Travnet botnet [28]) allow complete control over the machines, being suitable for APTs. Botnets are mostly known and perceived (negatively) in this way.

Phishing and spam

Email spam is undoubtedly one of the greatest cyber-weapons. Good mass mail, such as newsletters, is characterized as non-spam (also known as ham). Mass mail carrying malicious attachments or images with Uniform Resource Locators (URLs) or text URLs pointing to malware or phishing servers is characterized as spam. Tricky social engineering methods fool email readers into opening such attachments or clicking on those URLs. Some 91 percent of targeted attacks involve spear-phishing emails, 94 percent of which have malicious email attachments [41]. Spam numbers have been decreasing for the past few years, but an increase was witnessed in early 2013: 97.4 billion spam emails and 973 million malware emails were sent worldwide each day, almost double the number tallied at the end of the previous year [42].

Email is a main tool for businesses but also a doorway for infiltrating corporate networks. Because software can remain unpatched for some time, some vulnerabilities can still be exploited by malware spammed years later. Malicious binaries are usually encapsulated within files of vulnerable programs or zip archives. They are not directly attached to messages because email gateways and spam filters usually block such attempts. For example, Gmail does not allow attachment of any executable file, compressed or not.

Year-round spam is about spoofed brands, mostly pharmaceuticals [7]. The Kelihos botnet was used for that purpose, sending enormous spam waves without regard for spam filters [43]. This is an old technique to maximize email throughput: if 99.99 percent gets blocked, the 0.01 percent that is not blocked still accounts for many emails. Spammers also take advantage of real-life events for improving their effectiveness, such as the tax season or a gadget launch, or unexpected events like the pope’s election. The recent Boston Marathon bombing [44] is a perfect example. Moreover, malware and phishing websites are usually set up on generic Top-Level Domains (TLDs) or on domains belonging to countries where cybersecurity laws are not stringent [45].

Beyond common email spam, SMS spam has become more frequent due to the increase in mobile devices. SMS messages are combined with phishing scams, such as promotional lures or advanced fee frauds. A particular spam campaign in Europe [46] has been active for several months with profit intents. Social networks, namely, Facebook, are also targeted for credentials theft [47] or credit card information [48]. Twitter widely uses short URLs because of space constraints. Fake Twitter profiles spam tweets or direct messages with long URLs hidden behind shorter services [49]. PayPal phishing scams were also on the rise during the initial months of 2013 [42].

Another spam profit-oriented technique consists of increasing the value of pre-bought penny stocks that are typically traded at low prices. Pump-and-dump spam advertises cheap targeted shares with a twist: also spamming that the company is on the verge of success. Unsuspecting individuals buy a portion of shares, and stock values rise momentarily. Then the spammers sell their stocks at higher prices. This technique has not been used for a while, but it is now making a massive comeback [42,50].

In general, phishing targets popular user platforms, and massive spam volumes are returning. Because spam mail with attachments tend to stand out among legitimate mail, spam filters are more likely to block it. While spam with attachments accounts for only 3 percent of all spam [7], spam with URLs is on the rise [51].

Vulnerabilities management

In the security field, vulnerabilities are formally and officially described through a Common Vulnerabilities and Exposures (CVE) identifier [53], which has been a baseline index for evaluating tools and resources online since 1999. The National Vulnerability Database (NVD) contains a total of over 50,000 records of vulnerabilities. The NVD is the responsibility of the National Institute of Standards and Technology (NIST), while MITRE is its main CVE Numbering Authority (CNA). CVE management is nevertheless a collaboration among several vendors, third-party coordinators, and researchers. Other initiatives, like the Open Source Vulnerability Database (OSVDB), which was created in 2002 for the security community, already contains over 90,000 entries. This initiative clearly shows that some want vulnerability management to be in the hands of the community rather than a few people selected by the government.

Zero-day vulnerabilities

In the realm of vulnerabilities, zero-days are particularly important and can be alarming when exploited in the wild. A zero-day vulnerability is one unknown to the vendor and is most likely spotted when being exploited in the wild by malware. A watering hole campaign targeting older versions of Microsoft Internet Explorer [54] exploited the use-after-free zero-day identified as CVE-2012-4792. If fake objects could be allocated in the heap via heap spraying, the browser would call a function of a previously freed object, which would point to an attacker-controlled shellcode. Since then, many other exploits of the same vulnerabilities in Internet Explorer were discovered; these were eventually patched in the cumulative update MS13-037 on a patch Tuesday [55]. On the same day, Adobe also corrected many flaws for Flash. In total, 11 zero-days have been identified when these programs, along with Adobe Reader and Oracle Java [56], were exploited. This is quite a high number.

Noteworthy vulnerable software

When discussing vulnerabilities, various exploits and subsequent attacks come to mind. Typically, the intent of a front-end hole exploit is to gain access to back-end system servers, notably, databases. Popular attack vectors include Structured Query Language Injection (SQLi) and Cross-Site Scripting (XSS), and others with broken authentication and session management schemes [57]. Popular software is often the most scrutinized, and it is not surprising that flaws were found in them. The Web has become a streamlined attack vector, and thus holes in Web applications, browsers, plugins, and other sorts of software are critical for malware and hackers. Adobe Flash and Reader are among the top three most vulnerable, along with Java [52]. For the latter, a patch [58] addressing 50 vulnerabilities successively found in early 2013 was issued. Amaong browsers, Apple Safari, Google Chrome, and Mozilla Firefox rank as the top three most vulnerable.

Parallels Plesk Panel was recently found to be vulnerable to remote code execution. An exploit for spawning a shell was quickly disclosed. Not surprisingly, an Internet Relay Chat (IRC) botnet exploiting this vulnerability was found [59]. Although it was shut down, other botnets may appear. Also worrisome are long-standing vulnerabilities that are not patched. For example, Schneider Electric took 18 months to patch some product holes [60].

Cyber-attacks

Cyber-attacks in the realm of data breach come from external entities, and such breaches occurred in the first half of 2013. Evernote issued a service-wide password reset for 50 million users after experiencing a network breach that potentially leaked usernames, emails, and encrypted passwords [61]. Twitter [62] did the same when 250,000 users’ data got compromised. Drupal also experienced this [63]. In particular, and quite different from other attacks, a hacker was able to penetrate a military database containing sensitive information [64]. A cyber-attack originating from China and targeting The New York Times lasted four months [65]. The network was breached, and so was data used to access employees’ computers. This attack might be related to the Chinese APT recently uncovered by Mandiant [66]. The case of Mat Honan [67] is also worth mentioning. Some culprit was able to telephonically extract little pieces of sensitive data from Amazon and Apple support, and then wipe out all of Honan’s Apple devices, revealing a data breach at a smaller but no less dangerous scale.

Unintentional data leakage

Human error and system glitches drive nearly two-thirds of data breaches, according to a recent survey [68]. In 2013, privacy breaches of the Health Insurance Portability and Accountability Act (HIPAA) were common. A hospital employee accidentally uploaded over 1,000 patients’ personal information onto the hospital public website [69]. The leak was only detected some two months later. An incident at a health center affected almost 1,700 patients after a workstation infected with malware copied health records off premises. Finally, unattended or lost hardware can also lead to data leakage. This was the case with over 14,000 students’ social security numbers lost on a portable hard drive that sat on a college computer for two days.

Whistleblowers

The possibility of an insider turning rogue is always present. Malicious insiders, inside persons, informants, and whistleblowers are all capable of leaking data to the outside. These types of data breach often involve more sensitive types of data that are under a national security umbrella. In fact, the government industry ranks first in data breach [70]. The most polemic case in late years is the one of Julian Assange, founder of WikiLeaks. WikiLeaks exposes large sets of secret information provided by anonymous sources. More recently, a former National Security Agency (NSA) employee, Edward Snowden, leaked the so-called NSA PRISM project [71], which has been causing quite a sensation. Snowden now finds himself in the same boat as Assange, searching refuge and political asylum. Schneier [72], a field expert, supports the need for whistleblowers in order to protect people from the abuse of power.

Trends

According to Verizon, in 2012, 98 percent of data breaches were originated by external agents, mainly through some form of hacking—a number that has been continuously growing [73]. Another relevant figure is the 61 percent of breaches caused by a combination of hacking and malware, both mainly going after credentials and cards data. But theft or loss accounted for 36 percent of all data breaches in 2013, surpassing hacking, according to Symantec [74]. Breaches in the healthcare sector rose in 2012 [70,73] , and so far the trend continues [74]. A good omen for cybersecurity in terms of data breaches is their cost, which has been on a downward trajectory for two years [68]. It has been steadily falling because organizations have acknowledged breaches and improved incident response and systems protection.

The underground cyber-crime industry

Cyber-crime was once an activity of isolated individuals, but the underground is now crowded with organized criminal gangs. It is as if the classical gangsters and crime lords, who once counterfeited and smuggled drugs, now make malware, sell it, and perform strategic cyber-attacks in exchange for money. A new crime class has emerged, and nation-states must fight back this threat as well.

In the underground, cyber-crime is democratized. Malware, spam, and phishing campaigns aim at pocketing millions for their masterminds, and each gang member has a specific expertise: one writes the malware, another the spear-phishing email, another prepares the spam botnet, and so on. Like any other economy, the underground markets competitive solutions. Crime packs or exploit packs agglomerate onto a single software numerous functionalities for commanding a botnet or exploiting zero-days. Whoever is the quickest to implement exploits might as well win the day. Famous crime packs include BlackHole, ProPack and Sakura [79]. For example, the death of Margaret Thatcher was hastily used as a spam technique on BlackHole [80].

Cyber-criminals sell their solutions and services. Trend Micro provided [81] valuable insight into the Russian crimeware marketplace, which is one of the most dangerous in Eastern Europe. A pay-as-you-go business model is used, meaning that customers pay only for what it is used. Additionally, DDoS-as-a-Service (DDoSaaS) has been gaining popularity [82]. On top of that, products and services are sold cheap, while creating a multi-billion-dollar Cybercrime-as-a-Service (CaaS) economy [52]. When the ZeuS source code leaked in 2011, an open-source criminal project of one of the most prolific malwares ever was released. After that, variants started to show up on mobile devices [83] and on social networks as well [84].

Notably, an underground forum devoted to smuggling stolen credit card data was recently disabled in Vietnam [85]. It had already facilitated over $200 million worth of card fraud relating to over one million credit cards. Various worldwide agencies, including the FBI, jointly accomplished this deed—a good sign for international cooperation against cyber-crime. Nevertheless, it is predicted [27] that it is going to take time to fully address global cyber-crime effectively.

Advanced persistent threats

During the 1980s, PC revolution hackers were mostly teenagers, playing around with code, computers, and networks. They thought trespassing in neighbors’ computers was something quite different from trespassing on neighbors’ properties. But system administrators did not take such actions lightly, and saw them as vandals and criminals [86,87]. A pioneer incident of cyber-espionage relatedby Stoll [88] in the late 1980s confirms precisely this. He was able to trace the source of an attacker through the maze of telephone circuitry to an overseas country after 10 months, but only after struggling with three-letter agencies in the United States. None of them were willing to cooperate fully, either domestically or abroad. In the end, a German hacker who had been persistently active in cyber-espionage for almost two years, was discovered and sentenced for his crimes, including selling stolen data to the KGB.

Today, the goal of cyber-espionage is no different, except that its significance, technology, and methods have changed. A targeted attack consists of three phases [89]: intelligence gathering, threat modeling, and the attack itself. In the first half of 2013, four APT campaigns of note were uncovered by major security players.

Mandiant indicted a Chinese military unit that had been engaged in extensive cyber-espionage since 2004 [66]. This APT developed its own assault tools and malware, used hundreds of CnC servers and domains, and perpetrated several spear-phishing campaigns for stealing hundreds of terabytes from 141 countries, spanning 20 major industries. The news was acknowledged by the information security community, which started to search for signs of this APT. Tensions between China and other countries have followed, and since then, China has been under several attacks.

Operation Red October, as it was dubbed by Kaspersky [90], has been active for at least since 2007, targeting government and military sites in several countries. Interestingly, this botnet infrastructure uses a second layer of proxy servers before contacting the real CnC servers. Another APT campaign, dating back to 2005, has also been uncovered by Kaspersky [91]. A surveillance malware named NetTraveler is related to the Travnet botnet. Although its source has not been disclosed, perhaps due to insufficient evidence, the modus operandi of the group resembles that of the Chinese group. Various industries are targeted by both, and the attack vectors are similar. Greater NetTraveler activity has been observed in the past few years on high-profile victims.

Norman unveiled the Hangover group [92], an APT emanating from India. This APT attacked various countries and industries for some years, during which over 700 malware samples and hundreds of FQDNs were collected and analyzed. It was also discovered that the Hangover group was selling services on the underground, but preferred to install previously unknown backdoors on customer computers [93]. This APT has been linked with the Mac backdoor malware mentioned earlier.

Hacktivism

Hacktivism is an act of political, religious, or patriotic protest conceived by non-state groups driven by the desire to correct what they see as wrongful laws and corrupt governments. Notorious groups include LulzSec and Anonymous. Key members of the former have been arrested, and the group is now believed to be extinct, while the latter is globally spread. Hacktivists take actions against targeted computer infrastructures usually using popular, free tools, some considered “script kiddie” tools, to launch Denial of Service (DoS) attacks (e.g., the Low Orbit Ion Cannon [LOIC]), hack websites and put up defacement pages [94,95] or URL redirection, or even leak sensitive data [95]. Some tools are capable of automated cyber-attacks. Marketing stunts are used to gather a cyber-militia empowered by a common vision. Normally, hacktivism targets oppressed nations like Syria and Israel, in the name of stepping up for the oppressed people. In this case, ethical hacking seeks quality of life and world improvement.

Although hacktivists attacks are publicized beforehand, their outcome may or not be successful. For example, the operations dubbed #OpIsrael and #OpUSA (hashtags for “operation Israel,” set, up to protest the Israeli policy toward the Palestinians, and for “operation USA,” mounted to protest American foreign policy) had an overall low attack impact [96,97]. Sometimes sensitive attack information leaked onto paste sites (e.g., Pastebin) can be used by CERTs to prevent an attack. Still, the DDoS attacks experienced by US banks in late 2012 and early 2013 were strong, lowering their available bandwidth [98]. This corroborates the DDoS trend discussed earlier. Operations named #OpInnocence and #OpPedoHunt aim at stopping child abuse [99], while #OpGTMO opposes the Guantanamo Bay detention camp [100]. Interestingly enough, hackers gained access to the Twitter account of the Associated Press to post false information of explosions at the White House [101]. This momentarily sent the United States stock market into freefall.

Governments

The Stuxnet worm was a big government stone dropped into a lake. Specifically infecting uranium production equipment in nuclear-empowered nations is a clear sign of government peeking, but it was likely an illegal act of force [102]. It is unclear whether Iran, which was attacked with Stuxnet, has the right to strike back under the Geneva Convention—after all, cyber-war is a form of war if certain conditions are met [103]. This is, unfortunately, the tip of the iceberg. Stuxnet is an instance of a large malware saga that includes Duqu, Flame, and Gauss [104]. These mainly target Middle Eastern countries, pack numerous functionalities, and only run under specific conditions, but little is yet known about their true goals. The mysteriousness surrounding this saga raises suspicions pointing toward nation-state threats. Other high-profile attacks have been quite common. For example, compromised websites belonging to governments have been found to host malware [105,106].

Given the current state of cybersecurity, nations and enterprises are building response infrastructures and teaming up to meet the challenge. For example, in the United States and in Australia, General Electric is building cybersecurity centers [107] although the Australian state will be in charge of its new center [108]. Both are expected to open in late 2013. The Pentagon is assembling 13 teams capable of offensive cyber-operations and governed by a response framework giving them clear hacking authority [109]. In fact, the Commission on the Theft of American Intellectual Property [110] says that US companies should hack back at cyber-thieves. While the Tallinn Manual on the International Law Applicable to Cyber Warfare attempts to resolve the legal disputes of cyber-warfare, it controversially advises the approval of physical retaliation if data is destroyed or death is proved [111]. It also suggests that engagements be one-on-one in order to reduce collateral damage. A new bill currently being worked out on the United States aims to curb foreign threats [112]. In Spain, a bill draft authorizes the police to install malware on computers without the owners’ knowledge [113]. Perhaps more concerning is the controversial NSA PRISM spy program [71]. Probably the first of its kind, it supposedly mines data from lawful backdoors on major Internet players like Google, Skype, and Facebook.

The industry is investing in cybersecurity to monitor domestic and foreign threats. One way to do this is by installing backdoors on targets. FinFisher is an industrial spy software capable of that. Indeed, a commercial surveillance software marketed through law enforcement channels for spying on dissidents is gaining recognition among governments, particularly under repressive regimes. Some of its samples have been extensively analyzed [114]. The HackingTeam provides a remote control solution for governments or agencies only. Essentially, it creates a spy botnet that can monitor targets on a variety of platforms, including mobile operating systems.