Schneier on Security

erik • August 24, 2007 6:19 AM

I have been silently laughing into my beard while reading about these “CYBERWAR” incidents. The reactions really are way off the scale, and not in proportion to what happened. Perhaps because these people are lacking the big picture entirely? I wonder what they would really do in a real cyberwar situation?

In an event of a really coordinated and serious real attack the outcome would be really different. What I would for instance myself use would be a worm exploiting a previously unknown vulnerability in the most common operating systems. These appear plenty even nowadays. What mitigates that is that most of them get bought and/or reported by whitehats. There is constantly a lot of stuff that is usable, providing you can get ahold of someone who is good in digging them out. Or, you can simply purchase that component from the markets. A good one could cost you several hundred thousands.

It should also contain ways for penetrating the most common firewall technology (in the field of finding vulnerabilities the attacker has got the advantage of being able to prepare for events like this even for years – there ARE those available providing you have the resources to search) and being able to coordinate from behind NATted networks. Also, it would have heavily optimized propagation algorithms suitable for the targets and payload guaranteeing maximal performance. You can optimize the time slot for activation of payload etc quite reliably by simulations.

The payload would exploit certain bios/acpi/etc APIs to break down the hardware. Yes, it is possible.

In the past you could have used the vga registers to ask impossible things from the CRT monitors, actually damaging them physically and even destroying them. Then they became more intelligent and non-vulnerable. Now, some later TFT panels are suffering from the same again, as they have simplified the devices to control costs. I have seen this actually working myself, this is not speculation.

In the past you have been able to damage HDDs by forcing the heads to lock to transport position and after that issuing commands for still moving them – damaging them physically. Possible again in the past, then not, then perhaps again nowadays possible. Especially the new shock/fall sensors seem quite interesting to me.

What about the other options then? You can control on many hardware voltages by software. You can control clock frequerencies (for instance memory chips can be damaged really fast) of certain components.

One thing that you can do easily for targeted masses is to reflash the BIOSes. Voila. Braindead computers. (Some motherboard chipset bioses can recover that, but there are more things such as hdd and display adapter that can be separately destroyed.)

My point is: Given a few godly vulnerability hunters, resources enough to work for a year or two, associated hardware/software etc required, ANYONE can build a worm that can take down 90% of Internet connected and active computers within 12 hours. There will not be recovering from that for months because all possible supply chains will simply cough in the demands. Now, kids, what happened in Estonia was not really Cyberwar but some silly teen causing telecommunications interference (like driving around with a moped that causes interference lines on your TV set).