Cutting News

In  February, the Pentagon revealed that it has begun an aggressive cyber campaign against the Islamic State.
The Associated Press reported that U.S. offensive cyber attacks are targeting the group’s ability to use social media and the internet to recruit fighters and inspire followers, including preventing the group from distributing propaganda, videos, or other types of recruiting and messaging on social media sites like Twitter.
Three days later, Secretary of Defense Ash Carter told reporters that cyber operations are underway to interrupt the Islamic State’s “command and control, to cause them to lose confidence in their networks, to overload their networks so that they can’t function,” particularly in Syria.
The Obama administration should be commended for any measure that disrupts IS’ ability to recruit foreign fighters, inspire “lone wolves,” conduct operations in Syria, or coordinate attacks abroad. Yet while there are numerous unanswered questions regarding this new cyber offensive — Secretary Carter, understandably, declined to provide specifics — the first one may be: “What took them so long”?
In his September 2014 address to the American people justifying military operations against IS, President Obama declared: “I have made it clear that we will hunt down terrorists who threaten our country, wherever they are. That means I will not hesitate to take action against [the Islamic State] in Syria, as well as Iraq.” Yet the history of the anti-IS campaign, dubbed Operation Inherent Resolve, is rife with examples of the Obama administration’s hesitance to take actions later deemed necessary to disrupt and degrade the terrorist network:
Despite declaring “Stopping [IS’] financing and funding,” one of the five mutually reinforcing lines of effort to degrade and defeat the group in September 2014, the administration chose not to target the massive convoys of fuel trucks smuggling its oil — generating up to $2 million in revenue per day for the terrorist proto-state — until last November, a full 15 months into the anti-IS air campaign;
The CIA and Joint Special Operations Command reportedly only began a drone campaign to hunt IS leaders in Syria last summer;
It was not until last October — 14 months into Operation Inherent Resolve — that President Obama ordered less than 50 special operations troops into Syria to advise local forces fighting IS.
This hesitance is especially puzzling in the case of cyber operations. The idea of conducting cyber operations against terror networks or in Syria is not exactly new. In 2013, U.S. intelligence operatives covertly sabotaged al Qaeda in the Arabian Peninsula’s propaganda efforts by hacking its online magazine Inspire. When airstrikes against the Assad regime in response to its use of chemical weapons against civilians appeared imminent in 2013,speculation was rampant that offensive cyber attacks would be a component of any military operation. Moreover, the administration clearly recognizes the threat posed by the Islamic State’s activity in cyberspace. Countering its propaganda and recruitment efforts was one of the original five lines of operation. Given that in November 2014 there were estimated to be roughly 46,000 IS-linked Twitter accounts, this line of operation would inevitably require a significant cyber component. Last August, after IS hackers posted the names, addresses, and photos of U.S. troops on Twitter, U.S. forces conducted a targeted drone strike in Raqaa, Syria, killing Junaid Hussain, a British citizen in his early 20s believed to be a leader of the Islamic State’s hacking division. Thus, the option of offensive cyber operations in Syria had been available for almost three years — and IS propaganda and cyber activity had been deemed a threat for 16 months — before the administration authorized their deployment.
There are three possible explanations for this delay:
The administration wanted to avoid establishing a precedent:
P.W. Singer of the New America Foundation noted that Carter’s admission “is the first public acknowledgment” the U.S. military is carrying out offensive cyber operations, and argued that this is “a big line to cross.” Given the conventional wisdom in some quarters that the alleged U.S.-Israeli cyber attack on Iran’s Natanz nuclear reprocessing facility triggered a cyber arms race, it is possible the administration wanted to avoid creating a new norm regarding offensive cyber operations. Yet there are several precedents of states conducting cyber attacks in coordination with military operations. Israel used a cyber attack to disable Syrian air defenses in 2007’s Operation Orchard, destroying the nuclear reactor under construction at Kibar. In 2008, Russian “patriotic hackers” crippled key portions of Georgia’s communications systems to facilitate their invasion of the country. In fact, this is not even the American use of offensive cyber operations as a force multiplier in a broader military campaign, as in 2007 U.S. forces hacked into al Qaeda in Iraq’s cellphone network to send fake texts directing insurgents to locations where they were subsequently targeted. Thus, although acknowledging such cyber operations may be unprecedented, there was certainly no precedent sufficient to deter the administration from actually deploying this capability against IS.
The potential costs of cyber operations against IS outweighed the potential gains.
Even as IS has perfected the use of social media for propaganda and recruitment purposes, the U.S. intelligence community has used extremists’ Twitter feeds to monitor their messaging for strategies, tactics, and policies.As one former National Security Agency official noted: “Twitter is an incredible source to learn what these groups are doing. The FBI, CIA, and NSA not only get a lot of intelligence from Twitter, but there is also a lot of manipulation going on.” Thus, the administration may have foregone attacking IS in cyberspace over concerns that blocking its internet access could hurt intelligence gathering. Alternatively, cyber attacks frequently have unintended consequences. In 2008, for example, the U.S. military’s dismantling of a Saudi website that U.S. officials suspected of facilitating suicide bombers in Iraq also inadvertently disrupted more than 300 serversin Saudi Arabia, Germany, and Texas. Fear of similar negative second-order effects may have inhibited the administration.
While such concerns are legitimate, they are also manageable. Secretary Carter reportedly ordered that cyber operations be conducted without diminishing the indications or warning U.S. intelligence officers can glean about IS activities, suggesting this risk can be assessed and mitigated. In fact, Carter went a step further and suggested the hacking campaign could force IS to communicate via more easily interceptable methods. Moreover, although the risk of blowback is endemic to cyber warfare, it may be outweighed by the operational value of the targeted network. In discrete operations such as the jamming of IS online communications networks during the four-day battle for Shaddada in mid-February, which helped U.S.-backed Syrian rebels retake the town and nearby oil fields, the operational objective attained was worth the risk of spillover to untargeted networks.
Either way, the Pentagon clearly believes these risks can be evaluated on a case-by-case basis, and should not have precluded the use of all cyber operations against IS.
The administration is not actually trying to defeat IS.
According to the Los Angeles Times, the cyber offensive against IS was not launched until last December after the IS-inspired attack in San Bernardino, California, that killed 14 Americans. Consequently, in a White House meeting, administration officials directed senior Pentagon officials to prepare options for more aggressive cyber operations. If true, this merely represented the latest in a series of entirely reactive escalations by the Obama administration in Syria and Iraq. President Obama initially dismissed IS as the jayvee team of terrorism, and only signed off on military operations against the group in response to its conquest of Mosul in June 2014 and the subsequent threat of genocide against Iraq’s Yazidi population. The announcement of a drone campaign against IS leadership followed the fall of Ramadi last summer. The deployment of U.S. special operations advisers to aid Syrian rebels only came after Russia began combat operations in Syria last October. Similarly, the decision to accept a greater risk of civilian casualties while bombing IS fuel convoys was only taken after November’s IS-sponsored attack in Paris that killed 130 people.
None of these assets were committed to the anti-IS campaign as part of a comprehensive strategy for defeating the group, but rather as defensive measures in response to successful Islamic State operations or expansion. In a sense, the administration’s incremental deployments are reminiscent of Leslie Gelb and Richard Betts’ famous conclusion in The Irony of Vietnam regarding the Kennedy and Johnson administration’s decision-making: “Each time they turned the ratchet of escalation up another notch they did not believe that the increase would provide victory [in Vietnam].” Similarly, the Obama administration’s incrementalism projects the appearance of fighting not to lose in Syria and Iraq.
Why does the administration appear to have eschewed victory against IS as a strategic objective? Some analysts speculate that President Obama does not want to risk empowering anti-IS groups that also oppose Bashar al-Assad — or even provide Syrian civilians with a modicum of protection from his forces — in order to avoid jeopardizing its pursuit of detente with Iran. Alternatively, it is possible that President Obama does not perceive IS to be a significant threat to U.S. national security. He told Jeffrey Goldberg that the Islamic State “is not an existential threat to the United States,” especially when compared to climate change, and reiterated this sentiment in his remarks from Argentina on the Brussels suicide bombings that killed at least 31 people and wounded 270. Alternatively, President Obama may view the struggle against IS as unwinnable. When asked “Why don’t you just go get the bastards [ISIL]?” the President’s reponse is that “we just don’t have the tools in our toolkit to have a huge impact.”
Although it can plausibly be argued that the costs of an intervention capable of defeating IS — or at least eliminating its manifestation as a proto-state in Syria and Iraq — outweigh the threat it represents, the president certainly seems to find these “tools” effective enough each time his policy appears broken.
Whatever the cause, there are significant dangers to the Obama administration’s incrementalism. First, by deploying new assets solely as a reactionary measure, the White House is ceding the initiative in Syria and Iraq to a web of actors — IS, Iran, and Russia — who are pursuing goals in direct opposition to U.S. interests and will shape conditions in the region accordingly. Second, by failing to make clear that it has settled for a policy of containing IS, the Obama administration has created a disconnect between its rhetoric and the resources deployed by its ad hoc escalations. This exacerbates the appearance of American inconstancy evidenced by President Obama’s refusal to enforce the 2013 “red lines” over Assad’s use of chemical weapons, further undermines U.S. credibility in the region, and may lead regional allies to seek help from other great powers. Finally, by repeatedly deploying the minimum resources necessary to prevent the Islamic State’s expansion rather than committing them in a decisive and deliberate fashion, the administration risks prolonging the conflict. Beyond the devastating humanitarian toll in terms of civilian deaths and refugees, this has enabled the self-declared caliphate to serve as an inspiration to “lone wolves” and homegrown jihadists, as well as plan terrorist attacks abroad.
By failing to deploy all relevant assets to the anti-IS campaign at the outset in a deliberate and decisive fashion, the administration has increased the probability that the horrors of Paris, Brussels, and San Bernardino will be repeated. President Obama may be right that such attacks do not threaten the “existence of our nation”, but they certainly pose an existential threat to the lives of U.S. citizens and those of our allies.

A few years ago cyberattacks were on the margins of news stories. But after a series of high-profile attacks against major financial institutions, retailers and healthcare providers, people realize that cyberattacks aren’t going away.
The need to address increasingly sophisticated threats against U.S. businesses has rapidly gone from an IT issue to a top priority for the C-suite and the boardroom.
Cybercrime is among the most urgent threats to U.S. national and economic security, and these threats are increasing in scale, sophistication and frequency. Bad actors from criminals to nation-states use cyberattacks because they are cheap, easy and lucrative. Here in the state of Michigan, hackers attempt millions of attacks every day. According to a McAfee report, the global impact of cybercrime tops $375 billion annually, and the estimated cost to U.S. businesses is 200,000 jobs lost annually. It’s not surprising that a Gallup poll found that people are more concerned about cyber theft and hacking than any other kind of crime.
U.S. businesses are responsible for protecting their cyber networks. This includes not only their intellectual property and trade secrets but also the personal information of their employees and customers. There isn’t a silver bullet to create a more secure and resilient network. However, there are numerous tools available to industry to reduce vulnerabilities and mitigate cyber risk.
One tool that offers an important first line of defense is timely, actionable cyber threat data. This is something the government and private sector agree on, and following a bipartisan push in the House of Representatives and the Senate last year, President Obama signed the Cybersecurity Information Sharing Act into law. This landmark legislation gives businesses the legal protection they need to feel safe when voluntarily sharing or receiving threat data with industry peers and the government.
Yet we’ve still got work to do. In a recent IBM survey of CEOs, 55 percent of respondents said that information sharing is necessary in fighting cybercrime, but only 32 percent said they are willing to share their organizations’ cyber-threat data.
One example of positive, proactive data sharing can be found by looking at an industry pivotal to Detroit. Members of the Alliance of Automobile Manufacturers and the Association of Global Automakers established an auto-specific information sharing and analysis center with Homeland Security to facilitate sharing existing or potential threats to motor vehicle cybersecurity among members of the industry. In addition, members of the two associations have recently released a Framework for Automotive Cybersecurity Best Practices. Building on the auto framework, the industry plans to begin developing automotive cybersecurity best practices and continue collaborating with external stakeholders and cybersecurity experts as appropriate.
Since its founding, the Internet has fundamentally changed how we connect with others, the nature of our work, and how we discover and share news and new ideas. Industry and government are building a strong foundation to preserve our competitive advantage in the global economy and protect the privacy of American people.
But, one thing is certain — protecting America’s critical cyber infrastructure is a team sport.

Cyber extortion emerged as a strong trend in 2015, and is expected to continue in 2016, according to the latest threat report by security firm F-Secure.
The most common form of cyber extortion in recent months is the use of malware to encrypt organizations’ files and demand ransom payment in return for the decryption keys.
2015 saw the rise in popularity of several families of so-called ransomware, especially Cryptowall, Crowti and Teslacrypt, the report said.
While the Angler exploit kit delivered Alpha Crypt, Reveton and ransomware, the Nuclear exploit kit delivered CTB-Locker and Troldesh. However, Cryptowall and TeslaCryp was delivered by both, with Cryptowall also delivered by the Magnitude and Fiesta exploit kits.
In the first quarter of 2016, F-Secure said several large organizations had been hit by consumer-type ransomware, including some hospitals and local government authorities, causing “a considerable amount of pain” for those organizations.
Exposing data
However, cyber extortion is being increasingly conducted using the threat of distributed denial-of-service (DDoS) attacks and the threat of exposing sensitive commercial data.
This data typically includes intellectual property and information relating to legal cases or mergers and acquisitions, according to Sean Sullivan, security advisor at F-Secure Labs.
“We expect 2016 to be the year of cyber extortion, with big company database breaches followed up by demands for payment not to publish the data,” he told Computer Weekly.
In the past ten years, said Sullivan, malware as a service has become entrenched as a business model in the hands of organized professionals, moving beyond commoditized malware to hacks of corporate databases.
“If corporations have not started segregating and segmenting their data into isolated zones on the network, that is tantamount to negligence,” he said.
Far too many organizations are keeping mission-critical documents and intellectual property on network shares, said Sullivan. These can be accessed by hackers and even commoditized malware. “Just by moving laterally across a network, sensitive data is often easily accessible to attackers because there are no barriers or controls,” he said.
In 2015, Sullivan said there was plenty of evidence that organizations are not able to prevent intrusions by commoditised malware. “If organizations were not prepared for commoditized malware and dumb bots in the past year, they are unlikely to be prepared for human hackers following the bot in 2016,” he said.
Cyber extortion
F-Secure researchers predict there will be a shift towards intelligent, targeted attacks aimed mainly at extorting money from organizations.
Sullivan believes the attack on Sony Pictures Entertainment in November 2014 fell into this category. It was the first of this kind of attack to make headlines.
Although the attack has been linked to North Korea’s anger over the film The Interview, Sullivan said the initial emails relating to the attack demanded money, which means cyber extortion was more likely the prime motive for the attack.
Similarly, he said the attacker behind the Ashley Madison breach may have disapproved of the company’s business, but the prime motive was extortion and data was dumped only when the company failed to give into demands.
Sullivan suspects there may have been several other similar cases that have not made the headlines because targeted companies elected to pay off the cyber extortionists.
“In 2016, I think we will see an example of a large corporation dealing with customer data facing threats of that data being dumped onto the internet if they fail to make a certain payment,” he said.
Exploit kits
Another key finding of the report is that exploit kits face a disruptive future in the light of the fact that prominent exploit kits such as Angler, Nuclear and others mostly took advantage of vulnerabilities in Adobe Flash.
Sullivan predicts that Google Chrome will kill Flash support in early 2017, and Mozilla Firefox and Microsoft Edge will follow. This could mean that, by early 2017, Flash will no longer bear fruit for exploit kit makers.
Exploits, which have become one of the most common vehicles for malware in the past decade, need out-of-date software to accomplish their goal of getting through security holes. However, that software will become increasingly difficult to find, according to Sullivan.
For example, with HTML 5’s capability to “do it all”, the need for third-party browser plugins has mostly been eliminated. Today’s browsers themselves are auto-updated, without the need for the user to intervene, so users always have the latest version.
Hopefully exploits will die, said Sullivan, with Microsoft’s software being much more secure than it used to be; with Adobe’s other software becoming increasingly cloud based; and with browser developers forcing Java into a restricted place.
Macro malware makes a comeback
However, he said, cyber attackers will move onto something else. This will most probably be, for the short term, falling back on email attachment-based malware schemes. One such scheme is macro malware, which re-emerged in 2015 after lying low since the early 2000s.
Malware authors use the macro feature in Microsoft Office to implant malicious code to documents they email as attachments.
With Office 2003, Microsoft changed default settings to no longer run macros automatically, making attacks much more difficult. But now macro malware attempts to get around Microsoft’s default settings by displaying text in the open document that claims it is a “protected” document that requires the user to enable macros.
“In the past, we have seen attackers revert to older methods, such as when the Blackhole exploit kit was shut down, the attackers behind the GameoverZeus Trojan switched to using zip files and macro documents to distribute the malware,” said Sullivan.
As attackers are less able to exploit browser plugins to install malware on the disk, F-Secure also expects attackers to turn to malware that is resident only in memory and does not require installation on disk. “Cyber extortion through encrypting critical files does not necessarily require persistence, it only has to life long enough to locate and encrypt the targeted data,” said Sullivan.

Greater focus on browsers
As third-party plugins are phased out, F-Secure expects greater focus on using browsers as a way to infect computers.
“Even though there has been a concerted effort to harden browsers, there are probably tricks up attackers’ sleeves that they haven’t used yet,” said Sullivan.
To defend against these tactics, he said organizations should ensure they have usable backups that are not cloud based or connected to the corporate network in any way.
“In 2016, organizations should really be focusing on protecting their data, because that is what attackers are going after more than ever,” said Sullivan.