General Cybersecurity Information

General Information About Cybersecurity

If your experience is at all like mine, you will find that you need to both educate and convince people — from the "on-the-front-lines" users to management. Here's some help. Tell them about telecommunications outages, big-money losses, cyberwar, COMSEC, and more. In the following list:
AWST = Aviation Week and Space Technology
WSJ = Wall Street Journal
DOD = U.S. Department of Defense

DNS (Domain Name System) Security Issues

Update your DNS server. Make sure your server is running up-to-date DNS server software!

Enable DNSSEC. It's a one-button click with Google and other major DNS services. Here's what it looks like for my server:

$ dig @8.8.8.8 cromwell-intl.com ANY

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> @8.8.8.8 cromwell-intl.com ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23210
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 18, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;cromwell-intl.com.		IN	ANY

;; ANSWER SECTION:
cromwell-intl.com.	3599	IN	A	35.203.182.32
cromwell-intl.com.	3599	IN	RRSIG	A 8 2 3600 20191023184932 20191001184932 1336 cromwell-intl.com. kZvoWcuVgaqVQifdA6BWGNgGjeFceDzuXRkJUtJBau10iGvDUPDQlrdK RuM6CMrfpR34YNBFo+SLS7JeJNWcekpoFp/pcdLWsMe8DYPQ68k9Ub1q xVg82QEkIf5gX8wgy1PTqKMfUyZdcj98MSbZfQdO/+9tfVNo5Q8VjqJy VTw=
cromwell-intl.com.	21599	IN	NS	ns-cloud-c1.googledomains.com.
cromwell-intl.com.	21599	IN	NS	ns-cloud-c2.googledomains.com.
cromwell-intl.com.	21599	IN	NS	ns-cloud-c3.googledomains.com.
cromwell-intl.com.	21599	IN	NS	ns-cloud-c4.googledomains.com.
cromwell-intl.com.	21599	IN	RRSIG	NS 8 2 21600 20191023184932 20191001184932 1336 cromwell-intl.com. SN9nldXgN84Kzi/BWUMiG5PWoG3fYdXgN433KOmLelQUzB1FF0XHPFng b0/zCJc8PMxw8VPSaN0EI/6X9p55q5Sz7/takGtqAKLxGSfKoGRd4xFs 0qazkiWKkgP49ueGdQUSUPxTPAHhFMpcfvSAHhlJur/xGbMwQ741wnsG q30=
cromwell-intl.com.	21599	IN	SOA	ns-cloud-c1.googledomains.com. cloud-dns-hostmaster.google.com. 9 21600 3600 259200 300
cromwell-intl.com.	21599	IN	RRSIG	SOA 8 2 21600 20191023184932 20191001184932 1336 cromwell-intl.com. Xczvq1biZTr9yaBijlCuwvrRzg4u6fSEMh2twfH50+PdswzhMxh01uJK Uur7VaH/WeSE1DQpaM4n13yTZI6YNnBra4xSlYC4vatE5UmEAZ/5oqxb QP4IglU7u/vLaizO8deJKsla0LP4VkdOq1fDpOEpPwVwhur3cCgpAQz6 klI=
cromwell-intl.com.	299	IN	DNSKEY	256 3 8 AwEAAZhaibf1ewwx+uvJF/LIU0rNbhmtZIVcWnRECDRYzh7CAKn4fMT8 6lEW5QI02wqoHUCdrLjgG60N4A3jm+vLF/+2uhWfOR/zuTEXSPmQd5Aj xYHf/0FSZiBHhI2coXPhgGQ9Mu/a/zRTraE2qDrmTlM3/nzGJ0tQVQFp 41OKs8Tn
cromwell-intl.com.	299	IN	DNSKEY	257 3 8 AwEAAaJd0s3/TaTnNKSKq4V/DKT00k7oE4s7txW1EicoAsvimyLeWLmX 2Prl44lTu4Mqk3MzGJO7SnWW/ALE/hxKvgXPzTsh+0zpiOEnf5BCl+M/ pdhRIKnGcoyQ1/dyMkEHoX6pa7kgdN13pdqGYRdwZS3UkZjpZB8KC6Ev +++twCkNhb9hIXVdRfOT1xGvonQ5TcP0o3y5t52tX6FudmZ7RhKoGE6Y 6VTbYfVBWiUjic3TTgQADnYiOV3Sgl/K4cOzMfmlmWdxuU2tO3UpF0o9 apKJTwCvc6ESeaE/egUMxyB3ciduqoMKjuD22350mfjfLNWUp1sqYYji awYVPx79sCE=
cromwell-intl.com.	299	IN	RRSIG	DNSKEY 8 2 300 20191023184932 20191001184932 18860 cromwell-intl.com. m9JDLOACSephnNEvMPJYHeIhAFMbmq5o1MV0TwqQ++5OweN0ZAc4zfCo ltXBXdNVf+A4DYtqEJMwWr1S2shJERY15neGKJyeizZlLgLyFbwE5mY+ A3Sb3FCY3c8SmHQhA0sNa+w7C/KZpMJ4ZIugzWOupqDaES+7qBdI+kwp J0k1yF3PmnbbbFgtnhHT+lF7+bIc2EDtbCPSUxJCKyYmlM1Ik0TwxXGZ eGsmCVr71WlcFONdNYYzkp3r3cp6NkAJkkgiTKXpN+27XISgOuGdNTZi HF8a1U4NBwLTcMpyKedbC9GKGXJaPoQXJdPi+csFFvRPVbBJ1RuKeU+Y rvsEhg==
cromwell-intl.com.	0	IN	NSEC3PARAM 1 0 1 E3770CCDAA2128C5
cromwell-intl.com.	0	IN	RRSIG	NSEC3PARAM 8 2 0 20191023184932 20191001184932 1336 cromwell-intl.com. lbi/Qs4R8PgjSxrbN9m8NNBiNGCVYnj1tEBtZNoMH6oi507KzAxFAmD2 uwgD3xEeKqElyAYHPOlEjap1RjOG/l6017qjqdw5jBHuV7/f+IXmJC4n kq1y79/crPvhSX0R69uW/PA+J9XFrTr7O0sfmygOWPLYMhH4ECBNqL66 hbQ=
cromwell-intl.com.	299	IN	CDS	18860 8 2 92F4893D8FC1852873EF1C1E2368DFF63A63D8EB9C28AFE3226B5F12 1A9AC80D
cromwell-intl.com.	299	IN	RRSIG	CDS 8 2 300 20191023184932 20191001184932 18860 cromwell-intl.com. nvH3OwVzuPWk6M6EpL1vC2c7DfBxu1fOhsiEwzH9pcddT9jIzjjliXzU qFc9RHq9HIptlhFTNvAmLCZZSAcsVw/q+WO/B4i+y2n2wV4I2R0+1vid vH7b1lkn0rx/KWbTqBrkJq1HpJLjkvKWdTJaGsanfO7Ne5oTfHvBUTGE wfst4EdCMYUYtJbCEkwGgsBsmtzv64oQvO+JKG4MvzUSN+jvw16Prl5y AF6ziAMkgGLI+02u0IJzIRMnoaJz6vApORXlZ0rMC8+1B0hpCBilNTao Ylg9QkYrqB8fKs8QKJ1xtQ0NadhFwjGPivvMiIM8lspXkQTmkGt0bUBe 5KxGbg==
cromwell-intl.com.	3599	IN	CAA	128 issue "letsencrypt.org"
cromwell-intl.com.	3599	IN	RRSIG	CAA 8 2 3600 20191023184932 20191001184932 1336 cromwell-intl.com. lNvXUGJ7f/GNHpxahT2/Q7heM9cD/H555ruz1dbhP7MbCZs03hacqu0H p2SZmIOrq9Hb5IhXIB+TstQFIsemFpZGP2vwuRf6+VeVGlniN8DsRbMy k8BI0c8/r0xcxFoS2JIQvZ+G2/b927bvYEoSgkGSUMIMoa13mBLYrsTZ rSc=
cromwell-intl.com.      3593    IN      TXT     "v=spf1 -all"
cromwell-intl.com.      3593    IN      RRSIG   TXT 8 2 3600 20201210125948 20201118125948 5796 cromwell-intl.com. qI2mc1oxmUcggiQ9y+tPBe8QbtC4TDnQeI9UX+bky1mAIo/SrptNlbVv U62gu6edGxiHyuWU7/3wEN5HRsIUv7WqC/xXWw1c1B6u07HGngzoMSar lMCXqj6oYDxjnlRxgURFgnFMCSNztUpe62DCWCqhepvFz87Q/b9OTSGU 4OE=
cromwell-intl.com.      3593    IN      MX      0 .
cromwell-intl.com.      3593    IN      RRSIG   MX 8 2 3600 20201210125948 20201118125948 5796 cromwell-intl.com. RnjXh2rSESCveU15X8AOYPcFxmResrJv1qdo52VnrnjzegebxX2VDvCr OwBXBG3ebTAFEOIdL09Skm8N27NgMjB9H0Z2HZ9BXdYMMUlTUesDJs6P IAVgCIhqFGccu3kfVzogsMBxEm+LWXap3wpgp/J0Qez2umfThwqxt6rZ mag=

;; Query time: 247 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Oct 04 12:20:50 EDT 2019
;; MSG SIZE  rcvd: 2270

The A record says that the IPv4 address is 35.203.182.32.

The RRSIG A record is a Signature Resource Record, with a digital signature for that A record. Then the RRSIG NS record validates the NS records, and so on.

The Measurement Factory has DNS tools and white papers.

DNSInspect is a web-based tool for testing DNS servers.

Protect domains that don't send or receive email. Add records saying you do not have any sending or receiving servers, any mail apparently from your domain should be rejected, plus an empty DKIM key record. Something like this:

@             TXT  v=spf1 -all
*._domainkey  TXT  v=DKIM1; p=
@             MX   0 .
_dmarc	      TXT  v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;fo=1;rua=mailto:you@example.com

The UK government has useful guidance here. The M3AAWG or Messaging Malware Mobile Anti-Abuse Working Group has more details.

The 2012 NTP Outage

On November 19, 2012, the two stratum 1 NTP servers tick.usno.navy.mil and tock.usno.navy.mil went back in time by about 12 years. This caused outages in a wide range of PBXs, routers, and Active Directory servers. See NTP Issues Today at the NANOG mailing list, and Did Your Active Directory Domain Time Just Jump To The Year 2000? and Has your Windows Server 2003 Domain Controller time gone back to year 2000 (like Y2K)? at Microsoft's Technet.

Electromagnetic Pulse Myths: EMP and HERF Guns

There are constant dire warnings about electromagnetic pulse (or EMP) weapons. Here is an excellent collection of rebuttals and disproofs:
EMP Weapons: Keeping us fearful

This has been over-hyped with fictional stories at least since the mid 1990s. Back then there was a persistent claim that a London banking organization paid millions of pounds to stop a two-year series of attacks mixing logic bombs with electromagnetic pulse weapons. This was supposedly reported in the London Sunday Times, 2 June 1996, pg 1, and 9 June 1996, pg 1, but good luck finding the report. This story is now widely thought to be overly hyped and possibly a complete fabrication, especially the part about the electromagnetic pulse weapons. But self-proclaimed "infowar specialists" still carry on endlessly about "HERF guns" (or high-energy radio frequency weapons) and EMP devices.

GPS Spoofing

Cyberwar

Reports of GPS spoofing by Russia became common in 2017. Also see the academic paper "Hostile Control of Ships via False GPS Signals: Demonstration and Detection", Jahshan Bhatti and Todd E. Humphreys, Navigation, doi://10.1002/navi.183.

Mass GPS Spoofing Attack in Black Sea?
The Maritime Executive, 11 July 2017

Ships fooled in GPS spoofing attack suggest Russian cyberweapon
New Scientist, 10 Aug 2017

Bizarre GPS Activity Means Drivers Near the Kremlin Are Always at the Airport
The Truth About Cars, 30 Jan 2017

Cyber threats prompt return of radio for ship navigation
Reuters, 7 Aug 2017

2017-005A – GPS Interference – Black Sea
US DOT Maritime Administration

2017-006 – GPS Disruption – Global
US DOT Maritime Administration

Above Us Only Stars — Exposing GPS Spoofing in Russia and Syria
C4ADS, 2019

A new type of GPS spoofing around the port of Shanghai was reported in late 2019.

Ghost ships, crop circles, and soft gold: A GPS mystery in Shanghai
MIT Technology Review, 15 November 2019

New Type Of GPS Spoofing Attack In China Creates "Crop Circles" Of False Location Data
The Drive, 18 November 2019

Watermarking

Digital watermarking, related to steganography (hiding messages in data), has been around a long time:

It was used by Demaratus, a Greek, to send a message to the Spartans in the war between the Greeks and the Persians in 480 B.C. [see "The Histories" by Herodotus, "The Code Book" by Simon Singh, and "The Codebreakers" by David Kahn]
Much later than that (in 1500!), it was described by the Benedictine monk Johannes Trithemius in Steganographia. He described a method of hiding text in a prayer book.
Playboy used it to watermark imagery sold in electronic form starting around 1997. See the Digimarc press release or Secure Computing, Aug 1997, pg 15.
It's been discussed in non-specialist publications since the mid-1990s:
- Nature, 12 Dec 1996, pg 514
- AWST, 20 Oct 1997, pg 13, and 3 Nov 1997, pg 17
- Business Week, 1 Sep 97, pg 35
- New York Times, 17 Feb 1999.

Wasted Time

For huge losses most people willingly ignore, see Scientific American, July 1997, pp 82-89, for a great article, "Taking Computers to Task" by W. W. Gibbs. For example, Sun Microsystems prohibited fancy presentations, as they found that people can quickly assemble quality technical information but they will waste lots of time trying to make slides look pretty.

"Security through obscurity"

"Security through obscurity" has known to be ineffectual for well over a century. Auguste Kerckhoffs (1835-1903) stated that the security of a cryptosystem must not depend on keeping its algorithm secret. See his article "La cryptographie militaire", in Journal des sciences militaries, vol IX, pp 5-38, Jan 1883.
Overview The original paper (PDF)

U.S. Government fear-mongering about electrical power grid hacking

The U.S. Department of Homeland Security released a very contrived video in September 2007 showing catastrophic failure of an electrical power generator. This got notoriety as the "Aurora Generator Test", conducted in March 2007. But it was largely interpreted as little more than an intentional scare story by DHS.

Then "CIA senior analyst Tom Donahue" seems to have gone on a one-man fright crusade:

"A CIA analyst told attendees at a SANS Institute conference that hackers infiltrated an overseas power grid to knock out power. Senior analyst Tom Donahue did not say which cities were affected, or for how long power was cut. The warning came in the wake of a U.S. Department of Homeland Security video demonstrating a hacker taking over a power grid." SC Magazine, March 2008, pg 14
"We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands," Donohue said at the SCADA 2008 Control System Security Summit in New Orleans [16 Jan 2008]. "We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge," he said. "We have information that cyberattacks have been used to disrupt power equipment in several regions outside the United States. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the Internet." See a description in Government Executive, 18 Jan 2008.

June 2008 — "Last month the National Journal cited two computer security professionals, who in turn cited unnamed U.S. intelligence officials, in reporting that China's People's Liberation Army may have cracked the computers controlling the U.S. power grid to trigger the cascading blackout that cut off electricity to 50 million people in eight states and a Canadian province [in August, 2003]" But cyber security consultant Paul Kurtz, who worked at the White House at the time of the blackout, said they're no truth to the claim and many others have backed him up.

April 2009 — This same story appeared, again, in the Wall Street Journal this time (4 April 2009, article by Siobhan Gorman). The article is based on anonymous sources and "former national-security officials". It goes on to re-hash "CIA senior analyst Tom Donahue", making this just yet another cycle of the same old scare story.

April 15, 2009 — Time magazine observes that there have been no instances of cyberattacks taking down national power grids.

It has been observed in a Wired article that these scary stories are suspiciously correlated with US Government announcements of the need for increased surveillance.

A more prominent threat is physical attacks. Some have taken place, see stories at the Los Angeles Times, Reuters, and the Wall Street Journal for reports on an April 2013 attack on the PG&E Metcalf substation near San Jose, California, when rifle shots damaged 17 transformers.

See the following section about attacks on infrastructure for things that really did happen.

Russian Business Network (RBN) cyber-crime organization

A 13 Oct 2007 Washington Post article "Shadowy Russian Firm Seen as Conduit for Cybercrime" reported, "An Internet business based in Saint Petersburg has become a world hub for Web sites devoted to child pornography, spamming and identity theft, according to computer security experts. They say Russian authorities have provided little help in efforts to shut down the company. The Russian Business Network sells Web site hosting to people engaged in criminal activity, the security experts say. Groups operating through the company's computers are thought to be responsible for about half of last year's incidents of "phishing" VeriSign said that the Rock Group phishers used RBN to steal about US$ 150 million over the preceding year. Symantec said that RBN was "responsible for hosting Web sites that carry out a major portion of the world's cybercrime and profiteering." RBN does not have its own web site, you must contact its operators via instant-messaging or obscure Russian-language online forums. You must also prove that you are not a law enforcement investigator by demonstrating active involvement in theft of consumers' financial and personal data.

Russky Newsweek described "the world of Russian hackers" in December 2009. It mentions the apparently connections between international conflict on the Internet between Russia and Estonia and Georgia, attacks against Citigroup, and massive identity theft and spamming. But it's still uncertain if RBN was really one criminal vast organization or if it was a host to multiple Internet based gangs. Interesting anecdotes in that article include:

"Aleksandr Gostev, director of Kaspersky Labs, a global research and threat analysis center, believes that RBN's servers are located in Panama."
"According to one study, the network comprised 406 addresses and 2090 domain names by the end of 2007."
"The original RBN was behind the cyberattack on Estonia, Paget says, and, according to a study by the U.S. Cyber Consequences Unit (US-CCU), one of its successors was behind the virtual assault on Georgia."
"One of RBN's most prosperous businesses is Internet pharmacies, with the international organization Spamhaus naming Canadian Pharmacy as the main propagator of criminal cyberschemes." The bootleg medications are produced in India, and several dozen virtual pharmacies makes sales mostly to the U.S.
"According to Dmitry Golubov, who describes himself as the leader of the Internet Party of Ukraine, a group of 20 to 25 people account for 70 percent of the world's spam. 'A database of active e-mails costs money,' says Golubov. 'For example, a million addresses of purchasers of access to porn resources costs $25,000 to $30,000.'"

U.S. military use of commercial telecommunication links

Early 1990s — "About 20% of satcom support for Operation Desert Storm came from commercial [satellite] fleets." AWST 19 Nov 2007 pp 52-53.

1995-1996 — 95% of military communication at least touches the public switched networks. DOD is primarily reactive with no uniform policy for assessing risks, protecting systems, responding to incidents, or assessing damage. Military and Aerospace Electronics, January 1997, pg 17; AWST, 13 Jul 1998, pp 67-70 (quoting Maj. Gen. John Casciano, USAF director of intelligence); Lt Gen Kenneth A Minihan, "Intelligence and Information System Security", Defense Intelligence Journal, vol 5 n 1 (Spring 1996), pg 20.

2007 — "Now about 80% of all satellite communications in Iraq and Afghanistan come from commercial spacecraft, which may in some cases simultaneously provide services to friendly forces, as well as adverseries. AWST 19 Nov 2007 pp 52-53.

2008 — "Roughly 85% of [U.S.] military satellite communications are processed by commercial entities, but those services are purchased in an ad hoc fashion." AWST Oct 13, 2008, pg 34.

A 19 Nov 2007 AWST article (pp 52-53) described the USAF 16th Space Control Squadron (SPCS), dedicated to "defensive counterspace" and detecting and locating jamming to satellite links. It says that the 16th SPCS, based at Peterson AFB in Colorado, operates the new Rapid Attack Identification Reporting System (Raidrs), alerting its operators of interference to satellite communications links at UHF and the microwave C, K_u and X bands. It's designed and manufactured by Integral Systems of Lanham, Maryland. Each Raidrs site includes up to six 2.4-meter dish antennas to monitor signals, and a 3.7-meter antenna connected to a Blackbird system, said to operate like a spectrum analyzer. Two more 4.5-meter antennas are said to locate the distant ground-based jamming or interference source. The article made it sound as if the location is done by precise measurement of uplink signals reflected from the satellite bodies of the intended relay satellite and another satellite in a nearby orbit — an impressive achievement if correct.

USB storage devices and issues for the military

"Colombia's struggling guerrila movement appears to have suffered yet another defeat because of technology. The names of more than 9,000 rebels have fallen into government hands. Two government officials said this week [26 Sep 2008] that soldiers raiding a rebel camp in February [2008] found a memory stick that held the names, aliases and identity numbers of 9,387 rebels — and even included the photos of some of them." The group was FARC, the Revolutionary Armed Forces of Columbia. New York Times 26 Sep 2008, pg A8.

USB storage devices have been stolen from U.S. military bases in Afghanistan by local cleaning staff and sold in the local bazaars through the 2000s. Stories were carried by the BBC and the Los Angeles Times.

Attacks against infrastructure, many mentioned in the article found here. Meanwhile, do not be frightened by apparently weak claims of hacker attacks on the U.S. power network, debunked in elsewhere on this page.

Amazon
ASIN: 0891418377

And pipelines and sewers and ...

The classic story, which isn't true, is Agent Farewell and the Siberian Pipeline Explosion, in which an explosion around the end of October 1982 in the middle of Siberia supposedly "vaporized a large segment of the newly-build trans-Siberian pipeline". Thomas Reed's At the Abyss: An Insider's History of the Cold War describes the U.S. CIA working with a Canadian supplier to compromise the system's SCADA software with a logic bomb. The resulting explosion is enthusiastically described as "visible from space" and "1/7 the magnitudes of the nuclear weapons dropped on Japan during WWII". (combined? each?) See the National Security Archive report for a fairly calm description, and also see the CIA's Center for the Study of Intelligence report. Despite the American enthusiasm for stories about the supposed cataclysm, there were no known physical casualities and seems to have gone unknown to the Soviet public.

Completely ruining the story of supposed American heroism: at that time the Soviet Union did not use any digital controls on pipelines.

Now for events that actually did happen:

1999 — Malicious hackers took control of a Gazprom gas pipeline in Russia for around 24 hours.

2000 — A disgruntled ex-employee accessed the industrial control systems of a sewage treatment plant in Maroochy Shire, Queensland, Australia, and released at least a million liters of raw sewage into a river and onto the grounds of a hotel. From a detailed article:
"Located in a tourist area on the east coast, the sewage system has 142 pumping stations connected by radio to monitoring computers.
The troubles began when the installation company, Hunter Watertech, finished installing the control system in December 1999 and the site supervisor for HWT, Vitek Boden, resigned 'under circumstances that are not exactly explained'. He applied to MSC for a position, but was rejected.
The following month, January 2000, strange things started to happen. Pumps were not running when needed, alarms were not being reported to the control centre, and there was a loss of communications between the control centre and the pumping stations.
[....]
The evidence began to point to outside agents interfering with the system. With data logging this became more apparent when engineers noticed a spoofed pump station ID. The system was receiving signals from a pumping station ID that wasn't where it should have been — and it wasn't sending the right sort of signals. After inspecting one particular pump station site and re-coding its ID, it became clear that they were receiving signals coming in from a station that didn't exist. Radio monitoring was also starting to detect these transmissions. After nearly two months of baffling problems, on 16 March they began to get some hard evidence of what was going on. They spotted radio transmissions controlling various pump stations from the fake ID.
[....]
By this time, in the middle of March, a lot of faults were occurring and it was obvious that the hacker wasn't just playing around with the control system. There were sewage leaks, caused by overflowing tanks when pumps were turned off. The golf course next to the Hyatt Hotel was flooded with a million litres of sewage. A major overflow into a residential area and tidal canal polluted an estuary; in the surrounding area on Australia's Sunshine Coast, creeks turned black and cost the government Au$100,000 to set up an environmental monitoring programme."

Also see "Malicious Control System Cyber Security Attack Case Study — Maroochy Water Services, Australia".

2003 — The "Slammer" worm disabled a safety monitoring system at Davis-Basse nuclear power plant in Ohio, USA. Of course, this was not the original intent of the attack.

2007 — A former employee for a federally-owned canal system in California was charged with installing software that damaged a computer used to divert water out of a local river, as described in The Register. The Tehama Colusa Canal Authority operates two canals that move water out of the Sacramento River for use in irrigation and agriculture in Northern California. The perpetrator worked for the TCCA for more than 17 years before being fired on August 15, the date he is alleged to have installed the unauthorized software.

2007 — Lonnie Charles Denison was a SAIC contractor working as a UNIX systems administrator at the California Independent System Operator's data center controlling California's power grid. He had a dispute with his boss at SAIC and learned on 15 April that he had lost computer access privileges. Minutes later he broke a glass cover and hit the emergency power "off" button, shutting down the facility. This cut California off from the wholesale electricity market (although it did not cut off power to the state!). Allegedly he e-mailed a bomb threat the next day to a California ISO employee. In December he pled guilty, and faced up to five years in prison and $250,000 in fines.
The Register, 20 Apr 2007; Computerworld, 1 Jan 2008, pg 6; PC World and several other sources]

2010 — The Stuxnet worm was detected in June, 2010. This eventually led to many more discoveries of malicious software, eventually attributed to the U.S., see the cyberwar page for the details.

2021 — Hackers remotely accessed the water treatment plant of a small city in Florida in early February, and briefly increased the level of sodium hydroxide or NaOH by a factor of over 100, from 100 parts per million to 11,100 parts per million. The plant used a 32-bit version of Windows 7, which was no longer supported, with no firewall and a password shared among employees.
New York Times story Washington Post story Brian Krebs story Associated Press story Ars Technica story

May 2021 — The criminal hacking group DarkSide attacked the Colonial Pipeline with ransomware. That's the largest pipeline carrying gasoline in the U.S., running from Houston through several states to the New York City area. The pipeline was shut down for almost six days. However, the cyber attack hit Colonial's billing system and not anything involved in pipeline control. Colonial shut down the pipeline because they suddenly couldn't keep track of who to bill by how much. Meanwhile Americans went into panic-buying mode, with some people filling plastic bags and clothing storage tubs with gasoline and loading those into their cars.

Read this good article about "The Great Firewall of China", the national firewall in People's Republic of China from The Atlantic Monthly.

In May 1998 an internal review of DOE facilities found serious security problems (classified info on open systems, anonymous ftp write permission, readable password files, etc) on 1,400 of 64,000 systems. Los Alamos had detected 15 security breaches in the preceding 6 months. Brock Meeks, MSNBC, 29 May 1998, Stark Abstracting.

Hardware cryptographic attacks — The Electronic Frontier Foundation developed and built a dedicated platform in 1998 for under US$ 250,000 that breaks DES-encrypted messages in 72 hours, an order of magnitude faster than the best distributed network attack at the time. Much of the cost was design and development — the next one with the same performance would cost $50,000 or less. Speed to break DES on this architecture drops linearly with dollars spent on hardware, so forget all the U.S. government claims about hardware solutions being impossible. Also remember that this is cost for today's hardware, and cost per performance falls fast over time. Click here for the EFF article.

Further References

Threats are under-reported, and that's no recent development:

DISA estimates only 0.2% of attacks are reported. AWST, 27 Apr 1998, pg 27.
Only one of 150 attacks against DOD computer systems is detected. AWST, 20 January 1997, pp 60-61.

ARPA/NSA/DISA/DSS Memorandum of Agreement for coordinating Infosec research programs

For current research and development, see Purdue's CERIAS group.

The classic Unix security paper is UNIX Operating System Security, in AT&T Bell Labs Technical Journal, October 1984.

See the Trusted Product Evaluation Program frequently-asked-question list on computer security.

Disaster recovery is a whole field in itself. Check out the Disaster Recovery Journal. For a light introduction, see IEEE Spectrum, December 1996, pg 49.

A very scholarly treatment of Internet congestion models is in Science,, vol 277, 25 July 1997, pp 477, 535-537.

Keep looking — here are some more web sites to check out.

Back to the Security Page