Zombie Cell Phones & Botnets

Cell phones. Everyone seems to have them (except my Dad). They're always coming up with something smaller, newer, better in cell phones. They compute, play music, take pictures, send messages, and (oh yeah) make phone calls. Well it seems they might also be vulnerable to becoming the next potential weapon in cyberwarfare. A new report from Georgia Tech finds that cell phones are extremely vulnerable to hacking, especially as phones become more powerful and the phone's internet connection becomes more reliable. The report finds that hackers can exploit a cell phone's typical lack of security in order to take over the phone and create a "zombie computer" that, when connected with other hacked phones or computers, will create botnets. Remember, a botnet is a network of computers (or phones) that can be used to attack other networks through denial of service attacks or SPAM attacks (the computing kind of spam, not the canned ham kind). Scary, isn't it.

Cyberwar!

Cyberwar is real. It’s official, we now have another battlespace besides the sea, the ground, the air and space. The internet is now a battlefield. According to a NY Times report, someone was attacking Georgia’s internet infrastructure with denial of service attacks. (A denial of service attack occurs when a website is overwhelmed with coordinated barrages of requests. The website cannot process all the requests, so it overloads and shuts down. Service denied.) No one knows exactly who was behind the attacks, which happened in late July and lasted only about 24 hours, although there is some speculation that the July attacks were a “dry run” for the more extensive cyberattacks that happened as the violence in Georgia escalated earlier this week.

One internet security expert told the NY Times that his group had been tracking “botnets” (a malicious program that blasts streams of useless data) were staged in preparation for attack over the weekend; probably by a “shadowy” criminal gang out of St. Petersburg known as the Russian Business Network. The botnets were activated shortly before the Russian airstrikes on Georgia began on Sunday. Although everyone cautions against jumping to conclusions, the attackers used the same tools and commands as those known to come from the Russian Business Network and were launched from computers the organization controls.

Since Georgia doesn’t rely heavily on its relatively small internet infrastructure, the cyberattacks didn’t have a huge effect. The attacks did, however, shut down a number of government websites which limited the Georgian government’s ability to communicate with its citizens. The attacks also focused on media, communications, and transportation sites. The National Bank of Georgia had their website defaced. Attacks like those on Georgian sites would have had more severe consequences, if they had been directed at an internet-dependent country (like the US) where transportation, electricity, water, banking, and media outlets are all tied to the internet.

This is the information age. Computers and the internet are here to stay. They make our lives easier; but they also create another “center of gravity” that is subject to attack. Recognize it and deal with it. Cyberwar is here to stay.

Unfortunately, according to a report from the Associated Press, the Pentagon has put the Air Force's planned Cyber Command on hold and may end up doing away with it altogether. The Cyber Command was planned as the entity that would coordinate computer network defense, and possibly computer network attacks, much the same way as the Air Force's Air Combat Command coordinates air defense and attacks from the air for theater commanders. I agree with former-Air Force Secretary Wynne who said that, given the use of cyberattack during the action in Georgia, "this is a very poor time to send a signal that the United States is not interested in focusing on warfighting in the cyber domain."

Information as Propaganda

Kat (who writes at Castle Argghhh, a prominent milblog) has written a wonderful post discussing propaganda. Her main point, that “all information is propaganda. Official information is official propaganda. Thus, it always deserves to be challenged. Paraphrasing Socrates, question everything” is extremely well taken. She also points out that:

In the end, we decide what we make of information, but leaving information unchallenged means that we leave perceptions unchallenged. Milblogs, political blogs and others came to prominence because people were looking for missing information. Because we did not believe we were getting a complete picture or story. Because we believed that without some sort of expertise or background information, the real story was missed for sound bites or two sentences that basically said: bomb today, three soldiers killed. Left to itself and to ourselves, we would have been led to believe, purposefully or not, that the only thing happening in Iraq or Afghanistan was bombs and death.

What is a military blog or milblog? It is a place to get direct information or stories from men and women in the military or retired from the military or with connections to the military. Mostly without any filters. When those blogs proved accurate and the people legitimate, their voices were trusted more than any other media source to be the gage by which to evaluate progress. We linked to those stories to persuade ourselves and others of the facts or views being different than those presented.

We were and are, in fact, conducting a very small part of the information war whether that is our original intent, current purpose or accepted outcome. Information dissemination is information warfare.

All information is meant to inform and persuade. Thus, all information becomes propaganda. All official information is official propaganda. Regardless of who it comes from or how trusted the source. Looking at information to evaluate its persuasive purposes and capability is not paranoid any more than evaluating the purpose of a commercial for its ability to sell a product is paranoia. It does not entail the same potential risk to national or international actions, but it is the same concept.

Right on Kat!