Business And The Cyber Wars

John M Green is an author, former merchant banker and non-executive director at Worley Parsons and QBE Insurance. His most recent novel, The Trusted, an eco-cyber-thriller, tackles the underworld surrounding the internet, government and business. As ever with a John Green novel the subject is both topical and farsighted. John Green’s earlier novels are Nowhere Man, a financial thriller, and Born to Run, a US political thriller. John Green addressed The Sydney Institute on Wednesday 1 May 2013.

BUSINESS AND THE CYBER WARS

JOHN M. GREEN

It’s a great pleasure and privilege to be invited here to talk tonight. Thank you to The Sydney Institute and also you, ladies & gentlemen, for coming. Let me kick off by posing some scenarios for you …

What if the phone in your pocket or the computers on all your company’s desks blew up? What if planes fell out of the sky? What if stock markets collapsed? What if our city’s power network shut down?

 Yes … welcome to a thriller writer’s fertile imagination. Or is it?

Now, it’s true catastrophes like these are woven into my latest novel, The Trusted.

But what I hope you’ll take away from my talk tonight – apart from at least one of my novels – is that threats like these are no longer fanciful possibilities, and also that business is doing far too little to prevent them or prepare for them.

You’re probably thinking I’m trying to boost my book sales. Sure, I am, but I’m not being alarmist. If you don’t believe me, listen to David Irvine, the Director-General of ASIO.

Wait… David, is that you I spy up the back…? There … the chap in the trench coat and the fake nose… Oh… !  That’s your real nose, sir?  I’m so sorry.

When ASIO’s Irvine gave an exclusive interview to The Australian Financial Review in January, he made it very clear that while my premise in The Trusted may be fiction … it is certainly not fantasy. Here’s what he told The AFR:

A single malicious algorithm could switch off our lights, stop all planes flying, disrupt whole countries’ financial networks, or shutdown their electricity grids.

He sounds remarkably like me, don’t you think? The head of ASIO is saying very deliberately that the outrageous attacks my bad guys conspire to do in The Trusted can be done. Today. But I will go one step further…

That unless we’re all more alert, and prepared, especially in business, horrific things like these WILL happen… Perhaps tomorrow.

US Secretary of Defense Leon Panetta said this, too: “A cyber attack perpetrated by violent extremists could be as destructive as September 11, 2001 … a cyber Pearl Harbor.” Likewise the FBI’s Director, Robert Mueller, who said, “In the not too-distant future … the cyber threat will pose the greatest threat to our country.”

Poor Mr Mueller. I’m guessing he feels especially vulnerable because, recently, his own personal credit records and social security number – and those of other famous people including Michelle Obama – were dumped on the web for all to see after three of the US’s top credit-reporting agencies were hacked.

Even China – the country that many people swear on a stack of Confucius sayings is the world’s most prolific cyber attacker – is worried about cyber war. Two weeks ago, the chief of staff of China’s People’s Liberation Army, General Fang – Yes, Fang… what a great name for a general! – General Fang Fenghui said that cyber wars’ consequences may be “as serious as a nuclear bomb”.

A few years ago, when the premise for The Trusted first popped into my head, cyber-war was not the hot topic it is today. Like many of you, the businessman in me saw the twin forces of globalisation and technology optimistically, as lifting millions out of poverty and driving productivity and wealth creation.

But, the novelist in me asked, “But what if you were a bad guy?” What if you despised the West or Hollywood or apple pie, or Gerard Henderson – who is as apple pie as apple pie – how could you use these forces to advance your ideological or evil ends?

And it hit me. We were fast reaching a crossroad where malefactors would no longer need networks or money to achieve their dastardly goals. They could simply free-ride on what technology and globalisation were making available for free. Well, not strictly for free, but if you’re smart and bad, you can make any technology free simply by stealing it.

Back then, I imagined a time when a single person sitting anywhere, even on a beach or in a car park, could wreak havoc on a global scale, so long as they had the right tools – or codes – at their fingertips, plus phone signal. And think about this horror … the only thing protecting the free world would be that lousy signal from Vodafone.

But the truth is we have already reached that crossroad. Fact – this week, Spanish police arrested a Dutch citizen alleged to have launched the biggest cyber-attack in history, and from where? His campervan. Fact – last month, the global CEO of energy giant BP, Bob Dudley, revealed that BP receives 50,000 cyber-attacks a day. Yes, 50,000. That’s a big number.

Here are some more numbers. I’ve taken them from reports on cyber-security issued by Symantec the software security firm, Verizon a US equivalent of Telstra, and Ponemon a US research institute, and the numbers are 2012 numbers.

• Let’s start with email. We all get bombarded but a stunning 69 per cent of email traffic never makes it to you because it’s rejected as spam beforehand. But of the 31 per cent we do get, not all of it is clean, because of clever techniques the bad guys use, such as phishing – which I’ll explain soon.
• It’s not just big companies like BP that get attacked: 31 per cent of attacks are aimed at businesses with less than 250 employees
• It takes a long time and a lot of money to deal with a cyber attack – on average 24 days at an average cost of US$600,000
• And with companies seeing an average of 1.8 successful attacks per week, firms are spending up big, in one case shelling out $46m in one year to respond to cyber crime
• Attacks using the web increased 30 per cent on 2011, many of them from “waterhole” or “drive-by” attacks, i.e. where you innocently visit an infected website and infect your computer with a malicious payload. Symantec says that in 2012, they blocked 74,000 malicious websites.
• Every day, critical vulnerabilities in the key software we use are discovered, in 2012, around 100 were discovered every week, or 5,291. How many were not found? Who knows?
• The most costly cyber crimes are caused by denial of service, web-based attacks and malicious insiders.

Now Prime Minister Julia Gillard clearly has lots of experience with denial of service, web-based attacks and malicious insiders. And she confirmed recently that, in 2012, the Australian government suffered 438 cyber incidents so serious they required a significant response by the Cyber Security Operations Centre. She also reported that 5.4 million Australians were victims of cyber crime in 2012 with an estimated cost to the economy of $1.65 billion.

Maybe that’s where the government’s fabled Surplus went?

But here’s the thing. We, the good guys, aren’t exactly helping ourselves. Studies in 2012 (Ponemon) show some shocking figures:

• Only 49 per cent of companies have installed cyber detection technology.
• If that doesn’t worry you, this should: only 51 per cent of companies insist that the laptops, tablets and other mobile devices their employees use are configured with security settings and controls.
• A massive 40 per cent don’t require security settings at all and 9 per centsimply didn’t have a clue either way.
• On top of that, a whopping 60 per cent of firms shrug their shoulders, saying their employees circumvent or disengage whatever security features they put in anyway.

One study (Ponemon in 2008) found that 12,000 laptops were lost weekly in US airports, and if that isn’t bad enough, more than half held confidential company information, and more than two thirds of the people losing them had done nothing to protect it.

So, some of us in business land seem pretty dumb, but this is an asymmetric war, and the crooks are getting smarter.

Phishing

 Let me introduce you to one of their favourite tools. Twenty-nine per cent of all targeted attacks and a whopping 95 per cent of state-affiliated – i.e. espionage – attacks use what’s called socially engineered phishing. What the hell is that?

It’s where the bad guys identify their target, search corporate websites, Facebook and Twitter, and news reports to find useful information, then they make up a spoof email to you from a trusted insider – i.e. it says it comes from someone you know – and they send it to you.

A common phishing email just a couple of weeks ago was “Hey, John, watch this video of the Boston bombings”. The bad guys are smart and they’re quick. You may have clicked on one yourself and infected your computer.

Two years ago, cyber-phishermen hooked a monster catch, irony of ironies, a sophisticated cyber-security firm called RSA, and its client, the US’s biggest defence contractor, Lockheed Martin. RSA makes those tiny SecurID two-factor authentication tokens that generate random passwords.

A spoofed email from a recruiting firm popped up in RSA’s HR department with the header, “2011 Recruitment plan” and the message, “I forward this file to you for review. Please open and view it.” The attached Excel file was embedded with a malicious Flash object that when opened would create a back door into their system behind their firewalls.

Fact – a few weeks later, RSA recalled 40 million of its security tokens because, well, they weren’t secure anymore. Not long after, RSA’s client Lockheed Martin announced it had been hacked, though it claims it stopped the attack in its tracks.

What’s especially fascinating about socially engineered phishing is that the biggest dumbies inside companies – the people who click most readily on these phony emails – are higher-level executives and managers. People who love spreadsheets and PowerPoint. People who have greater access privileges. Richer, juicier targets.

Verizon claims a cyber campaign of merely 3 spoof emails has a 60 per cent chance of success. At 20 emails, Verizon gives them 100 per cent probability. The RSA email was sent to one person and CC’d to three others. What odds would Tommy Waterhouse give them?

More joyously, a hacker who advised me on The Trusted says he targets his phishing so well his success rate is three clicks out of four emails. Not only are the bad guys going phishing, there is now a thriving black market in crimeware – “weaponised exploits”, or code that bad guys sell each other to exploit vulnerabilities in software or websites.

They’re sold on what’s called the Underweb or the Deepnet, a kind of eBay for terrorists. One package apparently rents for $10,000 per month, though I wonder who the bad guys use to do their credit checks, or for money clearing.

Facing all this, the statistics – plus anecdotal evidence from questions I’ve asked numerous people in corporate Australia – suggest that in many Australian businesses we are operating with our eyes closed, one arm tied behind our backs, and the other crossing its fingers.

Part of it is a rosy view that it’s not real life, it’s the stuff of movies and novels like mine. Part is a belief that what we have on our systems isn’t that important or, even if it is, that we are all so frantic paddling to stay above water that we don’t have time or money for the upscaling in costs and effort.

To all of that, I say: It’s not if, it’s when. And if you think what you have isn’t important, why do you bother locking your doors when you go home at night? Plus, the evidence is that most of us have no idea what might be going on under our very noses right now.

Too few of us think like the bad guys. 

 While most data exfiltration or theft takes only a few hours, if not minutes or seconds, in an astonishing 66 per cent of cases, the victims take months or years to discover it. (Verizon) Partly that’s because they’re not even looking.

A big problem is that too few of us think like the bad guys.

This dawned on me during my research for The Trusted. When I started conceiving my terrorists’ gambits, I decided I needed experts to help me, to check if these attacks could really be done.

See, I learned from my first two novels – Nowhere Man, a financial thriller, and Born to Run, a US political thriller – that readers love to tell you if you’ve made even a tiny technical or factual error. In the first edition of Nowhere Man I mentioned a Davis Cup grand final, and then a reader phoned me – from the south of France I might add – to tell me there isn’t a grand final, only a final.

Again, in what I thought was the final draft of Born to Run, there’s a gruesome scene when the first woman likely to win the White House – yes, it’s fiction – is attacked by wolves in the wild. I’d also mentioned grizzly bears. But luckily, in this case, I’d sent the draft to P J O’Rourke, the US political writer and satirist and, while he loved the book and gave me a great cover quote for it, he warned me that the only grizzlies in that part of the country were politicians. So I changed it.

For The Trusted, because it relies on so much technical stuff, I went hunting for experts. I found them in the US, Australia, Asia, Europe, Scandinavia and the UK. They’re from many fields: hackers and IT specialists, nuclear engineers, naval architects, banking and finance experts, a steel production expert, algorithmic traders or algos, geneticists, smart grid gurus, even an Antarctic expert.

But with most of the experts, I found a certain rhythm repeating. I’d start out with, “My bad guys want to do X. How can they do that?” And, at first, the experts almost always answered, “They can’t.”

On probing why not, it was mostly because my initial idea was so obvious the good guys had already nipped it in the bud. So I’d go away and think some more – like a bad guy – then return and ask, “Well, what if they did Y, would that work?”

This process of “What if…?”, “No, because…” often went back and forth several times, for days, sometimes months. But in almost every case, there was that Aha! moment when my expert would say, “Heck” or perhaps a stronger word, “yes, the bad guys could do that.” And then they’d explain how.

And, if it wasn’t for me as a proxy for a bad guy, pressing and pushing them, the specific tricks might never have occurred to them because, like most of us, they think like good people. Before you panic about what I reveal in the book, let me say that while almost all my bad guys’ stratagems are possible, the book, for ethical reasons, is very hazy on the mechanics.

Now, let’s look how close real life is already to the picture I’m painting in the book. As I run through this, I’m inviting you to observe that if we’ve got this far, worse is not far away.

In The Trusted, I point out a huge vulnerability in our financial markets that’s ripe for the bad guys to exploit. It’s algorithmic or High Frequency Trading. This is where super-powerful computers run by programs, not people, scan multiple markets and news reports simultaneously, trawling for the briefest, tiniest trading opportunities, aiming to be first to execute orders into the market, often in milliseconds.

If you put HFT and cyber crime together, the potential for instant – and I mean instant – economic catastrophe is mind-blowing. You don’t have to read The Trusted to learn this – though I hope you do.

So guess what, last week the bad guys had their first relatively successful attempt at exploiting this.

Fact – on 24 April, the “Syrian Electronic Army” triggered a trading frenzy that in three minutes drove the Dow down by 149 points, wiping US$140 billion, around 1 percent off the market’s value. How? By hacking into the Twitter account of a trusted news agency Associated Press, and falsely tweeting two explosions in the White House had injured President Obama.

True, the plunge didn’t last long, because AP immediately corrected the story and the market bounced back. But without HFT and algorithmic trading, the panic wouldn’t have been as bad or as quick.

How did they get the password for that account? Phishing probably, but maybe a trusted insider gave it to them. Far fetched? Well, no. Fact – only last month, Reuters fired Matthew Keys, its deputy social media editor, whom police charged the next day with giving the infamous hacking group Anonymous the computer network log-ins for his prior employer, The Tribune Company, the owner of the Los Angeles Times, Chicago Tribune, and The Baltimore Sun.  As one of my bad guys says in The Trusted, “Why bother Occupying Wall Street when you can destroy it … from the inside?”

Say next time it’s not a tweet. Say instead that one of the sophisticated algos working on the HFT code is a bad guy. My experts say it would be easy to implant code to generate a trading pattern that tricked other market players into thinking a downturn was coming and thus trigger a market meltdown. Yet, stock exchanges naively sell access to their trading infrastructure to these people, without a clue what their secret algorithms do, or are capable of. They take it largely on trust.

These exchanges are like railroads hauling a company’s products, but uncaring that what could be inside the unlabelled drums is radioactive. Because they don’t think like bad people.

US President Ronald Reagan once famously said, “Trust, but verify.” So which exchanges are verifying? And even if some are, frankly, are they smart enough to know what to look for?

Now, some other vulnerabilities I work into my novel. What about Cloud computing, the trend du jour? IT giant Cisco predicts that by 2015, a third of global data traffic will have shifted from premises-based to Cloud-based. Outsourcing your data and systems onto someone else’s network is economically hugely attractive. Many of us are doing it almost unthinkingly. How many of us are on Gmail, for example? But Clouds carry some big risks.

First, they make you a target even if you weren’t before. If you’re sharing a Cloud with government departments and giant multinationals, that Cloud is suddenly a very, very juicy target for the bad guys. Worse, the Cloud is effectively a single point of failure for the hundreds or thousands of firms using it.

Denial of service – or volumetric attacks that overwhelm a network’s infrastructure with bandwidth – consuming traffic or resource-sapping requests – is likely as a major form of attack. Deny service to a Cloud and you deny service to everyone in it. Last year, the firewalls of several Cloud providers failed during denial of service attacks.

But crack a Cloud open and, voila, you have bad guy heaven, what is already called “hyperjacking”. And may I say, that these days, if it has a name, it will happen.

More vulnerabilities

 How many of you today, or yesterday saw a software update pop up on your computer screen from Apple, Microsoft, Adobe and you simply clicked ACCEPT? How did you know it was real? Even if it was legitimate, how can Apple, Microsoft and Adobe be positive that nowhere in their sprawling organisations is there a single individual intent on planting some malicious code or bug or vulnerability in their updates?

With these weaponised exploits now being sold on the black market for big dollars, suddenly the financial incentives exist where they didn’t before.

As I said at the beginning, what if your computer blew itself up? Well, the bad guys have got close. Here’s two examples.

Fact – last April, 41,600 Apple Mac users in Australia, and 600,000 of them worldwide, woke up to learn their Macs were infected. The trigger? Yes, a simple click ACCEPTing a fake Adobe Update.

Fact – last August, the bad guys got even smarter. Their aim was to cripple both the Saudi Arabian economy and global energy production and they managed to implant their Shamoon worm into national energy giant, Saudi Aramco’s computers. While Shamoon didn’t succeed in shutting off supplies, it did wipe 30,000 computers clean – yes clean – and caused the company to close down its internal networks for ten days.

Each time the bad guys try something, they share the information, they sell it to each other and they get smarter. Yet half of us good guys aren’t even using detection technology.

Here are some more real life examples from my opening:

How do you shut down a city’s power plants? Well, increasingly, they are operated by sophisticated SCADA systems – or Supervisory Control and Data Acquisition systems. In lay terms, SCADA are internet-facing, remotely accessible, computer control systems used to monitor and control pipelines, energy and water utilities, traffic systems, airports, etc.

But we think we’re safe, that the companies running these systems are competent as are the bureaucrats regulating them.

I hope so in Australia, but that’s not what Finland found when, in January, Aalto University researchers went looking and discovered 2,915 unsecured, completely exposed internet-facing SCADA systems. Those systems were running critical industrial automation, power management, transport and water supply systems, and remote access systems, including building automation for a bank, for a hospital, and if that’s not bad enough, the building automation for a jail. So now all a well-heeled mafia boss serving life needs to do for his “get out of jail” card, is to hire a hacker.

But back to energy supplies and the US. Fact – in January 2013, the Department of Homeland Security reported that in the first six months of 2012, cyber-criminals stole data that could disrupt or damage 23 gas pipeline networks.

Fact – in September 2012, Chinese hackers hit a Canadian group, Telvent, that specialises in SCADA systems and stole project files for a control system used in North America’s electrical grid, its oil and gas pipeline systems, and some water system networks.

But it’s not just the Chinese (assuming it is them in the first place). Many of you will know of the Stuxnet worm that, supposedly, the US and Israel collaborated on and infected Iran’s nuclear facilities with in 2010. Well Stuxnet is still alive, and attacked an Iranian electricity plant in December. None of this is fiction, though it sounds like it.

So, if you can imagine it, they can probably do it. In other words, as I’ve been saying, we need to start thinking like bad guys so we can stay ahead of them. Or, to make myself sound more scholarly, I’ll use the words of the great Chinese military strategist, Sun Tzu, “To know your enemy, you must become your enemy.”

But to do that successfully we need to: “know our enemy”. So find out who they are, most people look through one lens, one that focuses on the bad guys’ motivations. Through this lens, there are 3 main types of bad guys, and none will surprise you:

• Criminals – chasing money. They are 75 per cent of all attacks today
• Spies – usually state actors chasing data or trade secrets.
• Hactivists – who want to advance an ideology, or have fun

But that lens is only half the pair of glasses. Unless we look through a second lens, we might find we are not just fighting the last war, but possibly a medieval war. Certainly not a cyber war. Recall that in medieval Europe, the kings built great fortresses, with massive walls, towering battlements and wide moats. All to keep the invading hoards at bay. But where was the king’s most powerful, most insidious enemy? Often, sitting right beside him inside the castle, eating the same food, drinking the same wine. His wife perhaps, his brother, his cousin. In other words, someone trusted, and deep inside.

So the second lens forces us to look at not only the bad guys’ motives but where the bad guys are compared to us.

There are three places to look:

• Our partners – people with some level of trust or privilege
• Insiders – trusted people with privileged access
• Outsiders – no trust implicit at all

Attacks from our business partners, according to Verizon, are low, at 1%, whereas outsider attacks are at 92 per cent. I’ll come to insiders shortly.

Outsiders

 It’s unsurprising that 92 per cent of attacks are from the outside simply because there are lots of them out there and, more and more, they are using scalable technologies. So unfortunately, we do have to keep building our modern-day medieval fortresses to keep them out, even though the evidence is that most of us aren’t even doing the basics.

Currently, we can split up the 92 per cent of outsider attacks into those three first lens types as follows (Verizon):

• 55 per cent are Criminals – most from US or Eastern Europe.
• 21 per cent are Spies, 96 per cent of whom Verizon claims are from China (which China vehemently denies.)
• Surprisingly only 2 per cent are Hacktivists
• And the balance is unknown 

Insiders – The Trusted

 Now let’s explore the data on the insiders, The Trusted, the people I named my novel after.

Insiders, of course, are highly privileged. They know where our crown jewels are. They also know where our weak spots are – indeed they may even have put them there. Attacks from malicious insiders are already substantial, and they are on the rise. And not just in Canberra.

In 2012, insider cyber attacks accounted for 1 in 7 (14 per cent) of all cyber attacks, up from 1 in 25 attacks a year earlier. (If you’re wondering why the numbers don’t add up to 100 per cent – i.e. outsiders at 92 per cent, insiders at 14 per cent and partners at one per cent. That’s because some attacks involve insiders and outsiders collaborating, as you might expect.)

According to Verizon, most of these insider breaches are deliberate and malicious, and arise from financial motives. Often, employees who have been or are about to be fired.A lot are through negligence or clumsiness. Using an infected USB stick. Sending a confidential email to the wrong recipient.

But a Ponemon study says a remarkable 38 per cent of firms by number experience attacks from malicious insiders. In other words you have a more than a one in three chance that someone in your organisation, someone you trust, will turn bad on you. In small companies, they’re likely to be cashiers and front line staff, skimming accounts and credit cards. But in big companies, they’re likely to be executives, managers and even systems administrators. People with privileges and access – high levels of trust. People with bigger desires.

They can also be people low in the pecking order but because of where they are they have high access, like help desk employees.

Fact – just last week, in Sydney, federal police arrested Matthew Flannery, a support technician at a cyber-security firm, Content Security, for allegedly defacing a government client’s website. Flannery also apparently claimed to be the leader of global hacker movement LulzSec, though one of my hacker buddies disputes that.

Earlier, I told you the average time to resolve a cyber attack is 24 days but attacks from malicious insiders take more than twice that to resolve, at 57 days. Why? Precisely because insiders know how and where to hide.

Now while I knew from the start that my bad guys would be insiders and what they’d do – cyber-catastrophe – I didn’t know what motivated them.

In the golden olden days of thriller-writing, the John Le Carrés naturally drifted to people fighting the big battle of the twentieth century, free markets versus socialism. But that is yesterday’s war, though I wish someone would tell Wayne Swan, our Federal Treasurer.

I pondered Islamists intent on destroying the West – but felt that was too predictable, already a little clichéd, at least in fiction. Then it hit me – the environment – the greatest moral challenge of our time, as a former, perhaps a future Prime Minister has said. With so many of us worried about the planet, about clean air and water, it had to be inevitable that a few – and my story only needed a handful – would be extremists people so disgusted by global inaction they sacrifice everything.

Yes, their jobs, their reputations, even their lives, but that’s what zealots do, even smart ones. My bad guys’ mission wouldn’t be a political ideology in the classic sense, nor status or money … their sole driver would be to save the planet. How? By turning today’s brilliant technology against itself… and against us. By cyber-war.

Ridiculous, you’re thinking? Well, do you remember the Unabomber? Fact. As big a zealot as any, Ted Kaczynski was a Harvard graduate, got his PhD at 21, and became a maths professor at Berkeley. Still thinking ridiculous?

Fact – when I first started exploring this notion, I found the FBI’s top 10 most wanted list of domestic terrorists at the time included several radical environmentalists. But they were the wrong kind – neo-luddites who slap on balaclavas and run around at night torching factories, whose most likely cyber-activity was Mario Kart on a Playstation.

I wanted smart people … people who look like us. People like the infamous Cambridge Five, Kim Philby et al, who in the Cold War did just that and infiltrated the highest echelons of the British Secret Service. People whom Descartes, the seventeenth century philosopher, called “evil geniuses” – as he said, “people as clever and deceitful as they are powerful, and who direct their entire effort to mislead us”. And I found those people. In some very influential positions in some very big organisations. Sure, I made mine up. But fiction or fact? Sometimes they merge.

My message tonight is that if business doesn’t even start looking or putting checks  in place, we won’t know till it’s far too late.