Feeds

The cyber-weapons paradox: 'They're not that dangerous'

A war boffin talks to El Reg

Next gen security for virtualised datacentres

When it comes to bombs, the more powerful they are, the bigger their impact. With a cyber-weapon, the opposite is true: the more powerful it is, the more limited the damage it causes. The deeper a bug can get into any given system, the less likely it is to trouble anything else.

And that's why cyber-weapons aren't real weapons, says Thomas Rid, a reader in War Studies at Kings College London and co-author of a new paper published today in the security journal RUSI Journal.

Rid, the war boffin who brought us the theory that cyber war wouldn't actually be war because no one gets killed, has some more soothing common sense for those worried about cyber-geddon:

[Having] more destructive potential is likely to decrease the number of targets, the risk of collateral damage and the political utility of cyber-weapons.

Rid's point is that cyber weapons that can attack any web target tend to be low-level and quite crap: DDoS bots that can take a website offline temporarily or deface it, tools that cause inconvenience and sometimes embarrassment.

Bugs or malicious software threats that could cause significant damage to a system – eg, penetrating databases for specific sensitive internal data or causing particular real-world machines to malfunction – would need to be so specific to their target that they would be harmless to almost everything else and cause little to no collateral damage.

Take say, the worst of the worst – Stuxnet – the virus that allegedly set the Iranian nuclear programme back two years: it spread over 100,000 Windows computers en route to Iran's critical computer network and didn't damage any of its carriers.

Cyber-weapons with aggressive infection strategies built in, as popular argument goes, are bound to create uncontrollable collateral damage. The underlying image is that of a virus escaping from the lab to cause an unwanted pandemic. But this comparison is misleading.

What we shouldn't worry about

So while a DDoS can cause what Rid describes as "second order" damage, in itself the code doesn't harm a system, take data or cause any physical damage to a person.

Also - we don't need to fret too much about crazed warrior hackers from North Korea reducing all figures in the stock exchange to zero. Most high profile systems that provide services like the Stock Exchange have active protection and back-up systems.

Weaponised code does not come with an explosive charge. Potential physical damage will have to be created by the targeted system itself, by changing or stopping ongoing processes.

Simply knocking a site offline would alert the target to the problem immediately and probably cause a back-up to kick in. Serious damage would require an intelligent malware agent that was capable of changing ongoing processes while hiding the changes from their operators, Rid says. To our knowledge, this has not yet been created, and making something as complex would require the backing and resources of a state, he added.

But even if new smart high-power cyber weapons were created, though they "open up entirely new tactics" they also have "novel limitations".

He adds that "all publicly-known cyber-weapons have far less 'firepower' than is commonly assumed". Concluding: "At closer inspection cyber-weapons do not seem to favour the offence."

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.