Tag: cyberwar
Europe: Prepare for (Cyber) War…
Si Vis Pacem… A recent article published in the Frankfurter Allgemeine Zeitung (FAZ – soft paywall) about Germany’s “Operationsplan Deutschland” (English version of the informational brochure here), or OPLAN DEU, has drawn media attention to escalating tensions between the EU and aligned countries, and Russia, …
Subsea Cables Part II – Mind the Sharks
State of (Cyber)War Episode 7.2
Welcome to the second of our two-part edition on underwater communications cables. Hugo Tarrida and John Salomon discuss the current threat environment facing global underwater data links, motivations of actors, legal frameworks protecting these cables, and more.
Notes and Links:
Part I of this two-part discussion is located here (video) and here (notes).
As with all our talks, this is purely based on our own (limited) knowledge and expertise, and a lot of open source intelligence and publicly available material. Feel free to direct any corrections, insults, and additional information to the various comment sections.
01:58 The Hague Convention (III) relative to the Opening of Hostilities specifies how to do this. We could not find an instructional video on YouTube. https://ihl-databases.icrc.org/pt/ihl-treaties/hague-conv-iii-1907
04:14 For example, in 2005, Chad declared war on Sudan, or rather, “a state of belligerence”. That said, Chad is a Francophone country so maybe there’s a translation question. Today we learned. Some details: https://en.wikipedia.org/wiki/Chad%E2%80%93Sudan_relations
05:05 Foreign Policy in June: https://foreignpolicy.com/2024/06/13/russia-sabotage-attacks-europe-espionage-hybrid-arson/
05:13 https://www.politico.eu/article/russia-berlin-fire-diehl-behind-arson-attack-on-factory/
05:17 https://www.ft.com/content/f8207823-f5e1-4caf-934d-67c648f807bf – plus disruption of several lines in France during the 2024 Summer Olympics: https://edition.cnn.com/2024/07/27/europe/france-train-attacks-explainer-2024-paris-olympics-intl/index.html
05:24 https://www.bbc.com/news/articles/cne900k4wvjo
05:30 https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko followed by https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_Skripal
05:45 Hoo boy. See https://www.politico.eu/article/germany-poland-sabotage-investigation-nord-stream-pipeline-explosions-ukrainian-suspect-volodymyr-z/ and https://www.reuters.com/world/europe/kremlin-says-germany-is-right-fully-investigate-nord-stream-pipeline-blasts-2024-09-09/
07:20 Interestingly in our anecdotal experience, the people most cautious about starting a shooty war tend to be the actual military. We wonder why.
08:25 Some analysis: https://www.pbs.org/wgbh/frontline/article/the-president-blinked-why-obama-changed-course-on-the-red-line-in-syria/
09:10 Our logic: Russian and Chinese strategic communications are likely to be primarily overland, possibly via satellite. While especially China has significant overseas involvement and would be hurt to a large degree by a cut in communications to its allies, foreign markets, and suppliers, this overseas interconnectivity is nowhere near as strategically vital as, say, that of the US and other FVEY countries, Japan, or Europe. The same holds at much smaller scale for Iran, North Korea, and other states that are adversarial towards “the West”.
10:45 Arguably there is the little bitty topic of Russian influence operations, especially through German far right parties…
12:10 Well, here’s another thing that changed quite a bit in between recording and editing this video…
13:25 There have been multiple cuts over the past years, several in 2024 alone, e.g. https://blog.cloudflare.com/east-african-internet-connectivity-again-impacted-by-submarine-cable-cuts/
14:45 The OG of relevant international accords is that 1884 International Convention for the Protection of Submarine Telegraph Cables (Paris Convention): https://cil.nus.edu.sg/wp-content/uploads/2019/02/1884-Convention-for-the-Protection-of-Submarine-Telegraph-Cables-1.pdf (PDF) -currently there are various conventions including UNCLOS that incorporates multiple convention treating subsea cable damage or sabotage.
14:55 https://www.un.org/depts/los/convention_agreements/texts/unclos/unclos_e.pdf (PDF)
15:00 https://www.theguardian.com/world/2016/jul/12/philippines-wins-south-china-sea-case-against-china
15:30 We are not lawyers, but from reading some of these treaties, it sounds like as long as you’re not “damaging” cables, it’s…”legal”?
22:27 We haven’t even begun talking about potential threats to such a critical piece of communications infrastructure from the company and its management itself, acting in bad faith…
22:52 There are a number of parts to this, for example GOVSATCOM at https://www.european-space-law.com/GOVSATCOM.html and the proposed plan for space-based secure communications: https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/space-eu-initiatives-satellite-based-connectivity-system-and-eu-approach-management-space-traffic_en – At least some of this activity falls under the EU Space Strategy for Security and Defence: https://defence-industry-space.ec.europa.eu/eu-space/eu-space-strategy-security-and-defence_en
23:08 Not strictly about satellite communications security, but highly relevant: https://cybersecurityadvisors.network/2023/11/23/the-growing-threat-of-quantum-supremacy-in-the-era-of-digital-civilization/
24:00 More broadly, here’s a paper discussing the space and satellite aspect of the Ukraine war: https://www.airuniversity.af.edu/Portals/10/AEtherJournal/Journals/Volume-3_Number-1/Dickey_Gleason.pdf (PDF)
24:30 Apparently Starlink relies on a fairly distributed array of ground stations. Here is an overview: https://starlinkspot.com/starlink-ground-station-locations/
25:15 https://en.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test
25:32 https://en.wikipedia.org/wiki/Kessler_syndrome
26:30 For the anime nerds, the series “Planetes” is actually a really good hard sci-fi treatment of the topic of space debris. Worth a watch.
27:40 There are various different figures, but most seem to agree on 95% or more of the world’s data traffic passing via subsea cables at some point, for example: https://www.enisa.europa.eu/news/dive-into-the-deep-sea-a-view-of-the-subsea-cable-ecosystem
28:40 Loon LLC, which appears to have failed: https://en.wikipedia.org/wiki/Loon_LLC
You can find CyAN’s Secure-in-Mind YouTube channel at https://youtube.com/@cybersecadvisors – and of course, our videos about cyber conflict on the State of (Cyber)War playlist here. All of our episodes are also available in audio format on Apple iTunes, Amazon Audible, Podcast Republic, Spotify, and Libsyn – links on our Media page.
Cyber Conflict in the Middle East – Round One
State of (Cyber)War Episode 5
In the latest of our series of discussions on CyAN’s YouTube channel “State of (Cyber)War” playlist about cyber conflict and -capabilities, Hugo Tarrida and John Salomon talk about the background and current state of cyber conflict in the Middle East.
We give an overview of some of the major state actors involved, and zero in on the structures, groups, and motivations of the two main regional adversaries – Iran and Israel.
Due to the volume of notes and supporting material, we’ve had to list it here instead. Check out the video at https://youtu.be/X3wkTszRlck or watch it here:
Notes and links:
Hugo Tarrida on LinkedIn
John Salomon on LinkedIn
02:50 A History of the Israeli-Palestinian Conflict – Mark Tessler, Indiana University Press https://iupress.org/9780253220707/a-history-of-the-israeli-palestinian-conflict-second-edition/
06:05 Stuxnet https://en.wikipedia.org/wiki/Stuxnet – IEEE Spectrum (https://spectrum.ieee.org/the-real-story-of-stuxnet) and Wired (https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/) have two among several good and detailed writeups of the attack
08:45 State of (Cyber)War #4 – “China’s Increasingly Muscular Cyberwarfare Capability”, https://www.youtube.com/watch?v=HLVPDojARh0
10:43 E.g. “The Foundations of Geopolitics” by Aleksandr Dugin, https://en.wikipedia.org/wiki/Foundations_of_Geopolitics – we know we bring this up a lot….
12:45 Anyone who works in cybersecurity, particularly having to do with startups, will be familiar with the plethora of companies at least claiming some sort of origin in IDF Unit 8200 – https://www.idf.il/en/mini-sites/directorates/military-intelligence-directorate/military-intelligence-directorate/
14:00 In all honesty, we did a lot of wikipedia reading before this, e.g. https://en.wikipedia.org/wiki/Cyberwarfare_by_Iran
14:34 Not only have national cybersecurity agencies, such as the Saudi National Cybersecurity Authority (NCA) been taking this topic much more seriously in the form of activities such as preparedness exercises; various entities such as the GCC central banks have increased at least their willingness to discuss cooperation and cybersecurity information sharing across borders in the past 5 years.
15:25 Turkey and Israel have a history of economic and defence cooperation; despite significant tensions over the past few years, these have never fully gone away, not least due to many shared regional interests. For example: https://www.aljazeera.com/news/2022/10/27/israels-gantz-relaunches-defence-ties-with-turkey
15:40 https://old.reddit.com/r/syriancivilwar/ is a wonderful and never-ending source of confusion, with all the greatest hits.
17:32 Saudi Aramco cyberattacks: https://www.cfr.org/cyber-operations/compromise-saudi-aramco-and-rasgas (2012), and https://www.aljazeera.com/economy/2021/7/21/saudi-aramco-confirms-data-leak-after-reports-of-cyber-ransom (2021)
17:45 Such as the OilRig/APT34 group that has also been tied to major attacks on Saudi and Israeli targets: https://www.darkreading.com/cyberattacks-data-breaches/iran-apt34-uae-supply-chain-attack
18:00 For example the UAE Central Bank’s active involvement in cyber-preparedness exercises for their own particular financial sector: https://www.centralbank.ae/en/our-operations/risk-management/cyber-security-centre-of-excellence-1/cyber-wargames/
18:05 UAE involvement in Sudan civil war: https://adf-magazine.com/2024/01/uae-role-in-sudans-civil-war-draws-criticism/
18:07 ..for involvement in the Yemeni civil war, we’ll leave it as an exercise to the listener to find good sources. All the ones we could dig up on a quick search were either horribly out of date, biased, or very limited in scope.
20:26 Duqu (2011): https://www.trendmicro.com/vinfo/br/threat-encyclopedia/web-attack/90/duqu-uses-stuxnetlike-techniques-to-conduct-information-theft
20:29 DuquII (2019): https://www.infosecinstitute.com/resources/malware-analysis/duqu-2-0-the-most-sophisticated-malware-ever-seen/
21:10 Specifically, programmable logic controllers (PLC) running Siemens Step7, used in the Iranian Natanz nuclear research facility.
21:45 Operation Opera/Operation Babylon (1981): https://www.wilsoncenter.org/blog-post/israeli-raid-against-iraqi-reactor-40-years-later-new-insights-archives
22:54 The aforementioned OilRig group may be an example of this. Similarly, see the Iranian Cyber Army: https://en.wikipedia.org/wiki/Iranian_Cyber_Army
23:35 Numerous organizations, in fact – e.g. the Iralnian Revolutionary Guard Corps’ Cyber-Electronic Command (IRGC-CEC). The following website has some interesting information, although we cannot guarantee its impartiality or accuracy: https://www.unitedagainstnucleariran.com/iranian-cyber-threat-structure
23:50 Specifically, the Israel National Cyber Directorate (INCD), under whose aegis falls the national CERT and its various subdivisions: https://www.gov.il/en/departments/israel_national_cyber_directorate/govil-landing-page
25:44 Again, OilRig / Helix Kitten / APT34 is only one of many groups involved in attacks directed specifically at Israel. The recent war in Gaza has also caused a dramatic rise in attacks from Hezbollah and related actors – again, at the very least, affiliated with Iran, but due to the nature of tensions in the region, these are very far from the only groups involved.
26:11 https://il-cert.org.il/ – a member of https://first.org. Unfortunately their website isn’t great, but the INCD’s website has more detailed info, including a walkthrough video with obligatory pew-pew maps: https://www.gov.il/en/departments/news/119en
26:26 Diginotar: https://slate.com/technology/2016/12/how-the-2011-hack-of-diginotar-changed-the-internets-infrastructure.html Notably, a friend of ours at the Dutch National Cybersecurity Center (NCSC-NL) had a shirt that read, “I took down Diginotar and all I got was this lousy t-shirt”…)
27:37 https://www.cyberlands.io/topsecuritybreachessaudiarabia for starters. Also interesting to see an islamic charity targeted: https://www.infosecurity-magazine.com/news/cyberattack-hits-islamic-charity/
27:57 https://www.bugcrowd.com/glossary/syrian-electronic-army/ – note “directly aligned with President Bashar al-Assad’s regime in Syria”. And being fully conscious of our own philosophical position on murderous autocrats, for a well researched (but obviously biased) piece on why that’s a bad thing, we strongly encourage you to jump down the rabbit hole of Robert Evans’ Behind the Bastards podcast, for example via his two-part overview of Bashar al-Assad: https://podcasts.apple.com/no/podcast/part-one-bashar-al-assad-the-eye-doctor-who-murdered-a-nation/id1373812661?i=1000439928999
28:25 Among others, the Charlie Hebdo attack in 2015 – https://en.wikipedia.org/wiki/Charlie_Hebdo_shooting as well as the much deadlier November 2015 attacks throughout Paris: https://en.wikipedia.org/wiki/November_2015_Paris_attacks not to mention other attacks in Barcelona, Brussels, and elsewhere across Europe and further afield
28:40 Check out “Encounter Battle: Engaging ISIL in Cyberspace” by Dr. Chris Bronk and Gregory S. Anderson: https://www.jstor.org/stable/26267403?seq=6
31:10 Quds Force is the IRGC’s unconventional warfare and military intelligence branch. CFR has an overview of the IRGC’s structure: https://www.cfr.org/backgrounder/irans-revolutionary-guards
31:18 Interestingly, Russia has helped Iran develop its cyber capabilities. WSJ article on the topic:
https://www.wsj.com/articles/russia-supplies-iran-with-cyber-weapons-as-military-cooperation-grows-b14b94cd
33:36 There are multiple instances related to Russian (not only) cyberattacks on power infrastructure. The specific example in question actually involved an attack on a local Russian power station: https://therecord.media/russian-alleged-hack-power-grid – Russian attacks on the US power grid have been more focused around scouting and preparing for potential cyberattacks, for example via the Pipedream malware: https://www.wired.com/story/pipedream-ics-malware/ This is part of a wider set of Russian activities and capabilities targeting adversaries’ power systems, including the BlackEnergy malware used in Ukraine in 2015: https://www.cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01
33:03 E.g. https://mwi.westpoint.edu/russias-vast-cyber-web-enables-deniability-and-obscurity-but-not-without-risks/ – we weren’t able to find specific articles relevant to Iran, which is probably more the result of our not having the slightest idea of Farsi, combined with the lower level of attention paid to Iranian-related cyber news compared to Russia.
34:00 Interestingly, the American Enterprise Institute (center-right US think tank, YMMV) claims a letter (which a very brief Google search failed to turn up) signed by numerous Shia clerics calling for punishment of “cybercriminals”. What is included in their definition of cybercriminality is left as an exercise to the viewer: https://www.aei.org/articles/iran-prosecute-cybercriminals/
35:59 Remember that “cyber warfare” strictly speaking also includes C4I and other support and intelligence capabilities, not just 1377 h4x0rz
37:25 NPDO: https://www.iranwatch.org/iranian-entities/passive-defense-organization
Disinformation and AI – a Growing Challenge
I recently had the pleasure of joining Dr. Egor Zakharov of the AIT Lab at the Swiss Federal Polytechnic University, Zurich (ETHZ) for a fireside chat at the ITBN conference in Budapest, Hungary. Egor is an accomplished researcher and author on the topic of AI-generated …