A ‘Cyber Pearl Harbor’?

DoD Buzz alleges it may already have happened.

The Russians are picking our pockets, the Chinese are stealing our most vital secrets, and there’s nothing we can do about it – and it’s all going to get worse.

That was the basic conclusion after Friday’s Air Force Association cyber-conference, where speaker after speaker drove home the utter futility and helplessness of today’s cyber climate, all the while warning that the problem will only grow.

Richard Bejtlich, chief security officer for the info-security firm Mandiant, said 100 percent of the high-profile intrusions his company tracks were done with “valid credentials” – meaning the cyber bad-guys had been able to steal a real user’s login and password, obviating the need for more complex attacks.

The typical time between an intrusion and its discovery is 416 days, he said – down from two or three years – and the way most companies find out about them is when they get a visit from the FBI.

The publicly available malware in the so-called “cyber underground” is now so good that you can do a lot of damage without a dedicated team of code-writers coming up with their own stuff, speakers said.

. . .

[Bejtlich] described how a company had approached Mandiant befuddled that someone would want to steal a certain proprietary device, because it only worked in combination with a specific chemical formula owned by another company. Naturally, it wasn’t long before the second company discovered it was compromised, and also befuddled because its chemical formula would only be useful to someone who had information about the device manufactured by the first.

Online miscreants are also becoming more sophisticated at a strategic level, Bejtlich said: He described how they might target small companies that were merging with larger ones, to avoid trying to attack the bigger firm’s online security. Instead, by compromising a small company’s computer networks, the bad guys can then get into the new common network after a merger.

This can have profound financial as well as security implications, Bejtlich said – if you’re an aerospace giant and you want to acquire a small firm because its widget is worth $10 million, but then you discover it’s been cyber-stolen and no longer proprietary, the technology might only be worth $10,000, and that could put your shareholders and Wall Street in a bad mood.

. . .

An audience member’s question Friday crystallized all the speakers’ points at the cyber-conference: The much-feared “Cyber Pearl Harbor” has already happened, he said. Global cyber crime is more profitable than the drug trade. America’s onetime technological advantage is gone; much of its intellectual property secrets have been stolen.

“People just haven’t realized it yet,” the questioner said.

There’s more at the link.

I highly recommend reading the entire report at DoD Buzz. If what it alleges is true, one has to ask whether the new projects seen emerging from defense industries in Russia (e.g. the Sukhoi PAK FA) and China (e.g. the Chengdu J-20) are, in fact, mainly the fruit of stolen designs and technology. Are commercial advances in those economies, such as new microchips or electronic products, merely stolen copies of First World designs? Are we, in effect, giving away our commercial and industrial ‘crown jewels’ wholesale, because we either won’t or can’t prevent such cyber-espionage?

Peter