Should we be worried about state-sponsored cyber-attacks against hospitals?

We ABSOLUTELY should!

For the past decade and a half, the criminal underworld, Russian Mafia and other organized crime syndicates in the former Soviet Union have provided a constant reminder of both the fallibility of modern IT systems and the tenacious expertise of Russian hackers and their cyber-criminal community. In what now seems like background white noise, these highly organized perpetrators have executed a near constant campaign of cyber-theft, cyber-extortion, and denial of service attacks. 

Attacks have included a long list of crippling ransomware campaigns that have disabled almost the entirety of national health systems like the Irish HSE and Irish Health System, to the near bankrupting of several large private US health systems, to causing small medical and dental practices to have to close up shop, all in the past year.  This has denied critical medical services to thousands of patients and contributed to increases in patient morbidity and mortality. Yes, Russian cyber criminals have killed innocent people, perhaps not directly or intentionally, but nevertheless their greed and lack of ethical restraint has caused great pain and suffering to thousands. But, the capabilities of these gangs pales into insignificance when compared to the resources and capabilities of nation states.

WannaCry which in 2017 crippled much of UK NHS as well as other providers of health services around the word was a (flawed) cyber weapon created by the DPRK to raise hard currency following international sanctions on Kim Jong Un’s autocratic hermit kingdom. The DPRK’s subsequent cyber weapons have been much less flawed, and have drained many cryptocurrency exchanges and large sums from the Bank of Bangladesh among a long list of other victims. With the exception of its attack against Sony Pictures, Lazarus Group and other DPRK cyber forces operate very similarly to any other criminal enterprise raising cash for the Kim family’s lavish living and to purchase rocket fuel for his pet ICBM and nuclear weapons programs.

Not Petya, a highly destructive wiperware which initially masqueraded itself as a fake ransomware attack, hit the world right on the heels of WannaCry and was quickly attributed to the Russian government, specifically the SandWorm hacking group within the GRU Russian military intelligence organization. Initially designed to target the Ukrainian MeDoc tax accounting application in a software supply chain attack, it quickly spread worldwide to any company and country doing business in Ukraine and took down many of the world’s largest companies including shipping company Maersk, FedEx, pharmaceutical giant Merck, and French firm Saint-Gobain. Each of these organizations spent hundreds of millions of dollars to restore data and systems that NotPetya had encrypted beyond repair. Not Petya destroyed tens of thousands of computer systems and resulted in losses in excess of $10bn USD globally. Already a pariah, the Russian state after this devastating attribution, became synonymous with cybercrime and cyberwarfare across the international community. In a major home goal, NotPetya ended up also wiping a large number of computer systems in Russia for organizations that also conduct business with Ukraine

 

Step forward a few years to 2022 and Russia is up to its old tricks again. A few hours before Russian tanks began rolling into Ukraine, Microsoft raised the alarm warning of a never-before-seen piece of “wiper” malware that appeared aimed at the country’s government ministries and financial institutions. ESET Research Labs, a Slovakia-based cybersecurity company, said it too had discovered a new ‘wiper’ while security experts at Symantec’s threat intelligence team said the malware had affected Ukrainian government contractors in Latvia and Lithuania and a financial institution in Ukraine. ESET has called the malware which renders computers inoperable by disabling rebooting, HermeticWiper, while Microsoft has named it'd discovery FoxBlade.

The trouble with any kind of cyber weapons, no matter how targeted they are, is that these weapons do not recognize national boundaries (just as Putin didn’t recognize Ukraine’s) and so are bound to get out into the global community of interconnected IT systems. Fortunately, and so far at least, the HermeticWiper malware does not appear to be self-propagating, whereas NotPetya was deliberately designed to spread laterally and stealthily. There are no doubt many other offensive cyber weapons being deployed against Ukraine and its allies this week as Putin escalates his attack.

But the real danger is not just in the powerful nation state weapons, but with the semi-professional hackers and organized crime syndicates. Russia has the world’s largest non-state criminal cyber infrastructure employing tens of thousands who are engaged full time in cybercrime, cyber-theft, and cyber-extortion. Putin for various reasons has turned a blind eye to their criminal activities for decades allowing these groups to grow and prosper. These criminals are already using the smokescreen of conflict in Ukraine to launch fresh ransomware attacks against the west, and evidence suggests that Putin has recently instructed them to go all-out to help Mother Russia. Putin has organized a personal crusade of military kinetic and cyber offensive capabilities and paired this with an extensive criminal underground in an attempt to overwhelm the west.

On the other side, the call has gone out for Ukrainian cyber gangs to launch an all-out offensive against the institutions of the Russian Federation, and they have been joined by Anonymous and many other international hacktivists. If we are to believe the reports coming out of Russia, then many of the Kremlin’s public systems have been taken down by cyber-attacks. This tit-for-tat action risks serious escalation, and Russia which is widely acclaimed to have invented the concept of cyber-warfare during its two brutal wars against Chechen separatists, is sure to have some very powerful, very devastating cyber weapons in its war chest. Of course so too does the USA, UK, and many other countries. These weapons if ever launched would wreak devastation akin to a nuclear war and wipe out just about anything electronic. Given our reliance upon IT systems today, especially in hospitals this would not end well for patients, resulting in a significant rise in patient morbidity and mortality. The trouble for the west is, that these cyber weapons would cause far greater damage to advanced western institutions than to former Soviet ones in Russia, Belarus, Kazakhstan, and Chechnya supporting Putin where computerization is less prevalent.

We should be taking every precaution to patch all systems, ensuring the legitimacy of patches by examining hash values before deploying, by enforcing multi-factor authentication for all users, and by disconnecting and isolating systems which cannot be properly secured. Staff should be briefed on the need for heightened awareness and told to take extra precautions in their day-to-day activities. 

 

But first however, we need to fully understand what is connected to our networks and who is accessing our systems. In this day and age of heightened threats, we need to understand what is 'normal' so that abnormal or 'anomalous behavior' can be flagged and quickly isolated. The inconvenience of kicking a user off of a system and inconveniencing them, should be far less of a concern than the safety of a patient on life support being kept alive by a collection of connected medical devices.

Read More

When Cyber Attacks Go Too Far

News today that Israel has responded to a cyber-attack with a kinetic reply is perhaps a first but, in many ways, to be expected, given a rising tide of global cyber-attacks by those who cause increasing levels of damage, yet hide from attribution by use of proxies or through assumed anonymity.

According to Forbes:

The escalating global threat of cyber-attacks against nation-states took a turn yesterday when Israel's military announced that it had "thwarted an attempted Hamas cyber offensive against Israeli targets. Following our successful cyber defensive operation, we targeted a building where the Hamas cyber operatives work….HamasCyberHQ.exe has been removed," the tweet concluded.

Now that the precedent has been set, it should serve as a very real warning to cyber criminals everywhere that just because they reside in a state that turns a blind eye to international lawlessness, they are not immune from being brought to justice.

This may not be the first kinetic response to an act of cyber warfare but its certainly the first one mass-publicized. The US has reserved the right to retaliate against cyber-attacks with military force since 2011, and in 2015 it launched a hellfire missile attack from a drone to assassinate British born Islamic state hacker Junaid Hussain as he walked down a street in Raffa, Syria.

Many people have been expecting a kinetic response to a cyber attack for some time and talking about the advent of hybrid warfare, but can either of these bombings be seen as the turning point?

The fact is that Hamas had recently launched over 600 missiles at Israel and Israel had conducted over 250 air strikes of Hamas targets in retaliation. In the case of Junaid Hussain, he was known to be actively planning terrorist attacks in the west. Both were thus legitimate targets in existing kinetic conflicts, and both appear to satisfy the UN Charter for 'National Collective Self Defense'. But will this latest attack be used to justify a kinetic response to a future cyber attack or the perceived threat of one by a credible adversary? Maybe!

The Israeli Defense Forces (IDF) certainly considered the threat real enough by Hamas hackers planning an attack on Israel to warrant dropping a very large bomb on top of their building, reportedly with them in it!

Iran should certainly watch its back, where we are told, there has been a steady escalation in threats against the United States over recent months. The recently announced positioning of the USS Abraham Lincoln Strike Group to the Persian Gulf together with a Bomber Strike Group may be seen as a strong warning to Tehran. It may also be considered as positioning for future retaliatory kinetic attacks for recent wave of cyber and other attacks against the United States. This may mark the return of more aggressive US policies against terrorists and others who attack the west with assumed impunity. Just as Reagan’s bombing of Libya in 1986 signified a line drawn in the sand for Qaddafi’s support of terrorism against United States citizens, with hawks like John Bolton and Mike Pompeo advising Trump things could escalate very quickly.

But Iran is not alone on the 'Bad Boy' list of cyber-attacks going too far. According to the Center for Strategic and International Studies most of the world’s cyber-crime is originated in four countries – the Peoples Republic of China, the Russian Federation, the Islamic Republic of Iran and the Democratic People's Republic of (north) Korea, as the chart below shows:

Russia has been using cyberwarfare arguably against its own people since the first Chechen war, but in 2008 the Russia military is attributed to blowing up the Turkish Baku-Tbilisi-Ceyhan (BTC) oil pipeline at Refahiye in eastern Turkey after hacking CCTV cameras to gain access to pipeline valves that were then used to super-pressurize the line until it blew up. The BTC pipeline, which links Baku in Azerbaijan to Ceyhan on the Mediterranean coast of Turkey, gives additional energy independence to oil-rich states on Russia's southern border at a time when Russia is seeking to reassert its control over former Soviet states.

In 2014 a massive cyber attack was launched against Sony Pictures Entertainment that involved the theft and release or destruction of a huge amount of data. It was the first destructive cyber attack conducted against the United States and the first time the US attributed a cyber attack to a foreign government. The attack was claimed by 'Guardians of Peace' and was eventually attributed to North Korea to a group of hackers known as 'Shadow Brokers'.

The 2017 'WannaCry' ransomware attack that brought down hundreds of organizations worldwide including the effective closure of a large number of British hospitals and other critical facilities, has also been attributed to the Shadow Brokers, an outfit that works in the PRC and PDK for the Kim regime of North Korea. According to an Op-Ed in the Wall Street Journal, Tom Bossert, then Homeland Security Advisor to President Donald Trump, firmly attributed the attacks to Kim Jong-Un who gave the order to launch the malware attack, he claimed. "We do not make this allegation lightly. It is based on evidence." Bossert stated. Canada, New Zealand, Japan, and the UK all independently agreed with the US attribution.

Right on the heals of WannaCry, the 'Not Petya' attacks of June 2017 were an act of cyber warfare instigated by the Russian GRU (ГРУ), according to a CIA analysis of the attack reported by the Washington Post. Not Petya or Nyetya as it is also known as, was disguised as a new variant of ransomware, but with no way to recover information or the hard drives storing the data, it destroyed millions of dollars of computer equipment and cost businesses the world-over, somewhere between $4bn and $8bn according to Wired at the time, but now widely regarded to be closer to $12bn. Not Petya thus became known as a broadcast 'wiperware" and as a cyber weapon by many.

According to the CIA, Russia's GRU created NotPetya, as an escalation of its existing kinetic and cyber war against Ukraine ongoing since popular revolution there ousted the pro-Russain former Ukrainian President and CCCP Communist Party Member Viktor Yanukovych. The attack which initially targeted Ukrainian accounting tax software company M.E.Doc, brought down virtually all of Ukraine’s government along with Ukrainian hospitals, power companies, airports, and banks. Since then there has been a steady stream of cyber attacks directed by Moscow against Ukrainian critical infrastructure and power utilities knocking them off-line, constant attacks against Ukrainian businesses, and various kinetic attacks including the military occupation and annexation of Crimea, the instigation of Russian nationalism, ethnic unrest and military support of separatists in Eastern Ukraine. This direct support culminated in the July 2014 destruction of an airliner and deaths of all 285 passengers and 15 crew aboard as MH17 as it flew between Amsterdam and Kuala Lumpur when it was hit by a Russian surface to air missile.

The impact of Not Petya spread far beyond the borders of Ukraine and caused massive damage across the world. First investigated by the Ukrainian security agency, known as the SBU, it was quickly attributed to Russian security services, a fact reflected in other countries subsequent investigations into the cyber attack including all of the Five Eyes nations of the United States, UK, Canada, Australia and New Zealand. This was reflected by a White House statement issued February 15, 2018:

"In June 2017, the Russian military launched the most destructive and costly cyberattack in history, NotPetya "quickly spread worldwide, causing billions of dollars in damage across Europe, Asia, and the Americas. It was part of the Kremlin’s ongoing effort to destabilize Ukraine, and demonstrates ever more clearly Russia’s involvement in the ongoing conflict. This was also a reckless and indiscriminate cyber-attack that will be met with international consequences."

Putin's Russia has continued to push the boundaries of acceptability with each new attack from the hacking of the US Democratic Party and former US Secretary of State and presidential candidate Hillary Clinton, to influencing of the US and German presidential elections and the Brexit referendum via its social media bots, to literally hundreds of attacks against think tanks and NGOs according to Microsoft, most of which have been attributed to a group called 'Strontium' - otherwise known as 'Fancy Bear' or 'APT28'.

Meanwhile in the east, The Peoples' Republic of China has kept up a relentless attack against businesses the world over, in its quest to steal the intellectual property and commercial business secrets of the leading global companies. Despite agreements between US and Chinese presidents in 2015, to stop the wholesale cyber-theft of intellectual property, the attacks continue as China tries to surpass the rest of the world with its home-grown companies, using stolen patents and trade secrets invented by others.

The big question is, "how far is too far"? At what point does it become necessary to send a loud and clear message that cyber-attacks will be met with real consequences? Israel certainly deemed it necessary to deal with a group in Hamas that was responsible for cyber attacks against its country and citizens.

Countries may not readily invade one another today as they once did in the nineteenth and twentieth centuries leading to major global conflicts and massive loss of life. That is, perhaps with the recent exception of China's building of military islands off the coast of the Philippines and Vietnam in international waters - an apparent land grab of most of the South China Sea. But we know from history, that if you don't stand up to a bully at least once, then the bullying will continue. Hitler's military occupation of the Rhineland in 1936 is perhaps a good example of what happens when you ignore a problem for too long.

Sometimes we forget that cyber warfare is after all just another form of warfare!

Now that the precedent has been set, those involved in cyber espionage, wholesale theft of IP, extortion, and cyber attacks against businesses and critical infrastructure of countries might want to consider a new profession, or be on the lookout for things falling from the sky!

Read More