Indian Cyber Warfare Discussion

The Military Issues & History Forum is a venue to discuss issues relating to the military aspects of the Indian Armed Forces, whether the past, present or future. We request members to kindly stay within the mandate of this forum and keep their exchanges of views, on a civilised level, however vehemently any disagreement may be felt. All feedback regarding forum usage may be sent to the moderators using the Feedback Form or by clicking the Report Post Icon in any objectionable post for proper action. Please note that the views expressed by the Members and Moderators on these discussion boards are that of the individuals only and do not reflect the official policy or view of the Bharat-Rakshak.com Website. Copyright Violation is strictly prohibited and may result in revocation of your posting rights - please read the FAQ for full details. Users must also abide by the Forum Guidelines at all times.
tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 02 Oct 2010 00:54

What sort of idiots built a process involving Windows machines for programming the PLCs used with SCADA systems. The MNC vendors who come up with this sort of in-secure processes must be suitably blacklisted and heads need to roll in the bureaucracy who have hired a massive army of incompetents at the NIC and the zillions of Information Technology departments PSU/Government wide.
And b t w forbes is the last place one must read about technology news, they are the same guys who carried this article http://www.forbes.com/forbes/2005/1114/128.html
The Indian security circus is working to hard to promote foolish ideas like intercepting blackberry communications or https is going to secure us against us these threats, while doing exactly the opposite.

There is only one major threat to that we need to counter for our cyber-security the threat of stupid end users (windows using bureaucracy) being in control of security policy

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 02 Oct 2010 01:04

Dmurphy wrote:
Raghavendra wrote:Got this from http://www.freehacking.net
Holy Shit!!! Take off this link at once. Look at what the url says...and look where it leads. And it asks for your entire email id and password. Not sure if its wise divulging such sensitive things to a website which openly promotes hacking!

Dmurphy, have you really trained your mind to block certain keywords to not think about them and live in fear of being strayed from the path of dharma. You can't shut off information whatever be its source.
-Tarun

shiv
BRF Oldie
Posts: 34982
Joined: 01 Jan 1970 05:30
Location: Pindliyon ka Gooda

Re: Indian Cyber Warfare Discussion

Postby shiv » 02 Oct 2010 08:21

Cross post

dinesha
BRFite
Posts: 1136
Joined: 01 Aug 2004 11:42
Location: Delhi

Re: Indian Cyber Warfare Discussion

Postby dinesha » 05 Oct 2010 08:43

If we aren't ready for cyberwar, we will lose the next war
http://www.dnaindia.com/opinion/column_ ... ar_1447690

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 05 Oct 2010 17:18

dinesha wrote:If we aren't ready for cyberwar, we will lose the next war
http://www.dnaindia.com/opinion/column_ ... ar_1447690


The article doesn't add any value to the discussion here I am afraid. The DDM catches on a bit slow to the news until some vendor feeds it to them for PR hits and they regurgitate what we read aeons ago.

-Tarun

dinesha
BRFite
Posts: 1136
Joined: 01 Aug 2004 11:42
Location: Delhi

Re: Indian Cyber Warfare Discussion

Postby dinesha » 09 Oct 2010 17:47

Security threat: DRDO to make own OS
http://timesofindia.indiatimes.com/tech ... 719375.cms

Craig Alpert
BRFite
Posts: 1440
Joined: 09 Oct 2009 17:36
Location: Behind Enemy Lines

Re: Indian Cyber Warfare Discussion

Postby Craig Alpert » 11 Oct 2010 03:22

China hitting India via Net worm?
NEW DELHI: The deadly Stuxnet internet worm, which was thought to be targeting Iran's nuclear programme, might actually have been aimed at India by none other than China.

Providing a fresh twist in the tale, well-known American cyber warfare expert Jeffrey Carr, who specialises in investigations of cyber attacks against government, told TOI that China, more than any other country, was likely to have written the worm which has terrorised the world since June.

While Chinese hackers are known to target Indian government websites, the scale and sophistication of Stuxnet suggests that only a government no less than that of countries like US, Israel or China could have done it. "I think it's more likely that China is behind Stuxnet than any other country," Carr told TOI, adding that he would provide more details at the upcoming NASSCOM DSCI Security Conclave in Chennai in December.

Attributing the partial failure of ISRO's INSAT 4B satellite a few months ago -- the exact reason for which is not yet known -- to Stuxnet, Carr said it was China which gained from the satellite failure..........

Karan M
Forum Moderator
Posts: 18826
Joined: 19 Mar 2010 00:58

Re: Indian Cyber Warfare Discussion

Postby Karan M » 11 Oct 2010 04:28

Some are saying US made it for Iran. Others say, no Israel. Then some say, China for India. :??

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 11 Oct 2010 09:46

dinesha wrote:Security threat: DRDO to make own OS
http://timesofindia.indiatimes.com/tech ... 719375.cms

There is plenty of Open Source available, they need to hire maybe a couple of hundred kernel hackers from Bangalore and audit SELinux functionality for complete security.

What India needs really is its own chip design powerhouse which wouldn't cut off supplies to our MIC ( Military Industrial Complex )

http://www.eetimes.com/electronics-news ... sor-design

That was the last we heard of it. MIC dependent on Intel/ARM platforms is not a good idea ( ARM seems to be super-anal about end use certifications from what I heard ), if the supplies are cut off in future as has been done with past, we'll be pushed behind by several years.

-Tarun

shynee
BRFite
Posts: 550
Joined: 21 Oct 2003 11:31
Location: US

Re: Indian Cyber Warfare Discussion

Postby shynee » 11 Oct 2010 10:48


Austin
BRF Oldie
Posts: 23385
Joined: 23 Jul 2000 11:31

Re: Indian Cyber Warfare Discussion

Postby Austin » 11 Oct 2010 11:50

tarun wrote:
dinesha wrote:Security threat: DRDO to make own OS
http://timesofindia.indiatimes.com/tech ... 719375.cms

There is plenty of Open Source available, they need to hire maybe a couple of hundred kernel hackers from Bangalore and audit SELinux functionality for complete security.


Well they already have an OS from C-DAC BOSS , there is no need to reinvent the wheel.

The SELinux thing I heard it just too complicated stuff to work with.

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 11 Oct 2010 13:28

Austin wrote:Well they already have an OS from C-DAC BOSS , there is no need to reinvent the wheel.

The SELinux thing I heard it just too complicated stuff to work with.


Austin, BOSS seems to be an old vulnerable 32 bit kernel distribution targeted at desktops.

http://bosslinux.in/downloads

There doesn't seem to be any security patches or general updates to it. Does CDAC employ any package maintainers who know what they are doing, last I heard its a child's play to create a new distribution with some re-branding but the harder part is to have maintenance ecosystem around it.
Yes SELinux configuration is indeed complicated if one is trying to run it on desktops but its not that hard with standard configs available for many server side deployments which could be useful for maintaining secured systems for critical Internet facing functions.

-Tarun
PS: I personally don't like SELinux's complicated configuration but my gurus tell me it is a must for total security the kind required by gubermints

Austin
BRF Oldie
Posts: 23385
Joined: 23 Jul 2000 11:31

Re: Indian Cyber Warfare Discussion

Postby Austin » 11 Oct 2010 15:08

tarun wrote:Austin, BOSS seems to be an old vulnerable 32 bit kernel distribution targeted at desktops.

http://bosslinux.in/downloads
There doesn't seem to be any security patches or general updates to it. Does CDAC employ any package maintainers who know what they are doing, last I heard its a child's play to create a new distribution with some re-branding but the harder part is to have maintenance ecosystem around it.


Completely Agree , Package Maintenance is a big challenge. May be they can just use Debian Stable and maintain those packages for long term from Debian Tree with local repo of Debian mirror as good will gesture.

Yes SELinux configuration is indeed complicated if one is trying to run it on desktops but its not that hard with standard configs available for many server side deployments which could be useful for maintaining secured systems for critical Internet facing functions.


SELinux is like a black art and misconfigured or default SELinux enable is known to cause many issue.

But if they are using Standard Desktop/Server with standard set of application tools and behind a nice proxy/firewall , one can get a pre-configured SELinux suitable for restricted environment and can be managed by some automated package management system including updated.

ArmenT
BR Mainsite Crew
Posts: 4239
Joined: 10 Sep 2007 05:57
Location: Loud, Proud, Ugly American

Re: Indian Cyber Warfare Discussion

Postby ArmenT » 11 Oct 2010 17:25

dinesha wrote:Security threat: DRDO to make own OS
http://timesofindia.indiatimes.com/tech ... 719375.cms

"We have to protect it (data)," Saraswat said, adding, "Only way to protect it is to have a home-grown system, the complete architecture...source code is with you and then nobody knows what's that." He said DRDO is putting in place a dedicated team of 50 software professionals in the Bangalore and Delhi software development centres to accomplish the task.

I think Dr. Saraswat is seriously underestimating the # of people needed to do this. The term "software professional" also makes me cringe. Gives me visions of people who've done an Oracle Operator course somewhere and then declare themselves as "software professional with 4 years experience." Considering the # of so called "software professionals" from India, I don't see that many Indian contributions to free OS development or even bugtraq exploits.

@Austin and Tarun: I think SELinux is overrated personally. How many exploits for Linux have you seen on bugtraq that say "does not work if SELinux is enabled"? On the other hand, security need not be that complicated either. Take the case of the OpenBSD OS. It is fairly easy to set up once one reads the documents (which is one of its best features, everything is well documented). Since they take a proactive approach to OS security, one often sees exploit reports on bugtraq that say something like "Does not work on OpenBSD. They fixed this issue two years ago." Security is a process, not a program.

SaiK
BRF Oldie
Posts: 36400
Joined: 29 Oct 2003 12:31
Location: NowHere

Re: Indian Cyber Warfare Discussion

Postby SaiK » 11 Oct 2010 18:01

If worms don't have strategies to attack device driver loop holes, then we could perhaps re-use many codes already written with various OS abstraction layers. We can tweek to make it more secure at each device level communications.

Pranav
BRF Oldie
Posts: 5280
Joined: 06 Apr 2009 13:23

Re: Indian Cyber Warfare Discussion

Postby Pranav » 11 Oct 2010 18:54

Since India does not have any semiconductor fabrication capabilities, we are highly vulnerable to hardware Trojans planted in IC chips.

There do not exist any reliable methods to detect such hardware Trojans.

See Cyberwar - Old Trick Threatens the Newest Weapons http://www.nytimes.com/2009/10/27/science/27trojan.html

AdityaM
BRFite
Posts: 1932
Joined: 30 Sep 2002 11:31
Location: New Delhi

Re: Indian Cyber Warfare Discussion

Postby AdityaM » 12 Oct 2010 02:21

headlinesToday catches up on insat-Stuxnet
http://headlinestoday.intoday.in/site/h ... tId=50&p=0

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 12 Oct 2010 14:24

Summarizing the viewpoints I heard on forums including this one regarding the new OS, rumored be developed by DRDO:-

1. Don't reinvent the wheel, there is plenty of Open Source to build upon Debian Stable/OpenBSD are both good choices. Creating a small subset for a secure OS including the kernel with all the device drivers would be easier to audit than auditing 1000s of packages.
2. Massively under-staffed for creating an OS which is both secure and windows compatible, just ask these folks how hard is it to get windows apps to work on a secure Linux like OS http://www.winehq.org/ or maybe these folks http://www.reactos.org/en/index.html
3. Maintenance Ecosystem is more important, the chinese built their version of Linux based on Redhat Linux and its nowhere to be used, unless patches are released regularly and updated for known exploits its not useful to have an OS written from the scratch but practically as in-secure as the dominant proprietary OS out there.
4. There is still no protection against hardware based kill-switches or dial home instructions unless the whole stack of CPUs/ASICs/Network switches/Storage Equipment is Open Source which can be audited by anyone, 'given enough eyes all bugs are shallow'. Else its another EVM like nonsensical claim of being secure because 'we' the 'all powerful' bureaucracy says its secure so it must be secure

Austin
BRF Oldie
Posts: 23385
Joined: 23 Jul 2000 11:31

Re: Indian Cyber Warfare Discussion

Postby Austin » 12 Oct 2010 16:11

Tarun , How easy will it be for a country like US/Russia/Israel to have a dormant hardware or software based kill switch on military hardware we import from them.

Say for eg an aircraft engine these days are as much of hardware and software driven like Microprocessor based FADEC in engine , where a software bug can remain dormant unless activated by some event ( date,time ) or triggered externally by RF source.

Is it possible and if it is so can we detect these bugs on such hardware like engines,aircraft or something similar ?

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 12 Oct 2010 17:48

Austin wrote:Tarun , How easy will it be for a country like US/Russia/Israel to have a dormant hardware or software based kill switch on military hardware we import from them.

Say for eg an aircraft engine these days are as much of hardware and software driven like Microprocessor based FADEC in engine , where a software bug can remain dormant unless activated by some event ( date,time ) or triggered externally by RF source.

Is it possible and if it is so can we detect these bugs on such hardware like engines,aircraft or something similar ?


For firmware it should be possible to do an audit after forcing a shared source license as a pre-condition for procurement with documentation of all obscure functions and having a really great team of whitebox testers/verification folks who can run through all the edge cases. If there was an advantage India gained by having R & D backoffices of every major chipmaker it should be utilized here to the fullest.
However these competent folks addicted to MNC salaries wouldn't work for the kind of salaries that government might offer them.

I have forwarded the question to a friend in chip design industry, prima facie he thinks there is no easy way to put in a kill switch if the firmware is well audited because its the firmware that controls the chip, however he is going to ask around a bit and come with an answer he feels more confident about.

tarun
BRFite
Posts: 107
Joined: 27 May 2009 17:45

Re: Indian Cyber Warfare Discussion

Postby tarun » 12 Oct 2010 22:24

Marten wrote:DRDO regularly hires contractors and outsources work (basically uses software firms as headhunters). There are a large number at CAIR, DARE, and at their sister orgs. Not sure of LRDE, but I have met on occasion a few folks who have worked there via their firms (not sure though what precise work they performed at these premises).

Is a step forward for sure, though better to have dedicated in-house folks who don't cause organizational amnesia when the outsourcing company's employees leave.

Austin
BRF Oldie
Posts: 23385
Joined: 23 Jul 2000 11:31

Re: Indian Cyber Warfare Discussion

Postby Austin » 12 Oct 2010 22:45

Tarun Thanks for your views , I am not sure how many of these companies would be willing to give a sneak peek into firmware and let you audit it , considering an aircraft would have many such electronic devices with black boxes and their own firmware and software codes to run these hardware.

US for e.g. is just offering us a modular way to attach new or additional functionality to the original software code for new hardware or weapon system that India would want but wants to keep the entire source code closed.

I personally think with modern weapons system being so much software driven and with so many blackboxes having their own firmware and instructions to run , it is quite easy for any one to sneak in some code that can respond to certain events would just fail to function or worst just crash completely , after all you just need one key system to go down to get a mission kill.

I think higher the sophistication of system employed so much easier it is to sneak in some malicious stuff.

Karan M
Forum Moderator
Posts: 18826
Joined: 19 Mar 2010 00:58

Re: Indian Cyber Warfare Discussion

Postby Karan M » 13 Oct 2010 02:37

ArmenT wrote:I think Dr. Saraswat is seriously underestimating the # of people needed to do this. The term "software professional" also makes me cringe. Gives me visions of people who've done an Oracle Operator course somewhere and then declare themselves as "software professional with 4 years experience." Considering the # of so called "software professionals" from India, I don't see that many Indian contributions to free OS development or even bugtraq exploits.


The 50 guys will be a mix of people who are fairly experienced. DRDO does a lot of s/w intensive work. But they will be supported by a large number of people from Indian IT companies, if we see the interview. Thats where the expense part comes from.

Pranav wrote:Since India does not have any semiconductor fabrication capabilities, we are highly vulnerable to hardware Trojans planted in IC chips.


DRDO is setting up a national facility to audit the chips we purchase from foreign sources

Pranav
BRF Oldie
Posts: 5280
Joined: 06 Apr 2009 13:23

Re: Indian Cyber Warfare Discussion

Postby Pranav » 14 Oct 2010 06:59

Karan M wrote:
Pranav wrote:Since India does not have any semiconductor fabrication capabilities, we are highly vulnerable to hardware Trojans planted in IC chips.


DRDO is setting up a national facility to audit the chips we purchase from foreign sources


Hopefully they know what they are doing ... the US handles these issues by getting involved at the Foundry stage with its "Trusted Foundry Program".

“Trust cannot be added to integrated circuits after fabrication; electrical testing and reverse engineering cannot be relied upon to detect undesired alterations in military integrated circuits.” - Defense Science Board Task Force, "High performance microchip supply" Office of the Under Secretary of Defense For Acquisition, Technology, and Logistics. Feb. 2005.

Craig Alpert
BRFite
Posts: 1440
Joined: 09 Oct 2009 17:36
Location: Behind Enemy Lines

Re: Indian Cyber Warfare Discussion

Postby Craig Alpert » 16 Oct 2010 04:19

Pakistan, China hackers tried to deface CWG sites
NEW DELHI: The audience at the Jawaharlal Nehru Stadium might have given a rousing welcome to the Pakistani contingent during the opening ceremony, but state-supported hackers in Pakistan and China were hard at work trying to deface official sites and disrupt data networks.

Experts from the department of information and technology had to keep a sharp vigil to prevent the hackers from either crashing sites or putting up demeaning messages intending to show India in poor light. The effort to foil the hackers' intent on embarrassing India was no less intensive than on ground security.

The attacks were traced to servers in Pakistan and China and while the hackers were purported to be individuals or "non-state" actors, the deniability for their sponsors was thin. The exercise is suspected to have been monitored by official agencies in both countries with the "searchnet" worm being the preferred weapon of attack.

The attacks launched from China were the handiwork of students studying in technical institutes who are encouraged to take a go at targets identified by official agencies. Some of these universities are in close proximity to military establishments specialising in technical and IT-based offensive systems.

There were hundreds of attacks on the CWG's official website which were intended to put up insulting messages while the more serious attempts were aimed at data management systems.

Within a couple of hours of the opening ceremony of the mega event on October 3, hackers -- mostly traced to servers in China -- attacked the Games' website, www.cwgdelhi2010.org, forcing cyber security agencies to pay more attention to cyber security.

"Though the cyber attackers have been traced to Pakistan as well, most of the hackers' servers were found to be located in China," said a top government official.


With athletes, officials, visitors and security personnel given highly-secured accreditation cards and vehicle tags, the details of which were also on CWG websites, manipulation of these sites could have created a major logistics and security problem.


"Persons could enter venues and the Games village only after the computerized system screens the signal. Any breakdown in system would have been disastrous," said the official.


The government had a dedicated unit to counter cyber attacks and to design firewalls. Many government agencies had chipped in to protect this attack and officials worked round the clock throughout the Games period to fend India through such threats.good job :twisted:

This is not the first time that Chinese hackers have targeted Indian sites. A few months ago an exhaustive investigation by a team of Canadian researchers assisted by NTRO had traced a major network of servers who had attacked targets ranging from PMO to the Sainik School admission lists and major newspapers.

venku_Raj
BRFite -Trainee
Posts: 75
Joined: 14 Oct 2010 19:08

Re: Indian Cyber Warfare Discussion

Postby venku_Raj » 16 Oct 2010 08:26

Good job done by cyber team protecting the site

venku_Raj
BRFite -Trainee
Posts: 75
Joined: 14 Oct 2010 19:08

Re: Indian Cyber Warfare Discussion

Postby venku_Raj » 16 Oct 2010 08:30

Major attack on Indian website are done by Arab and Pakistani hackers now even china joined in ,cant a system be designed which will detect this servers and start counter attack on its own , this will have a counter effect on this hackers , since some operate on their own they will not like to see their laptop becoming e-waste ,powerful servers in India can protect Indian internet grid and take out this small part time hackers

shiv
BRF Oldie
Posts: 34982
Joined: 01 Jan 1970 05:30
Location: Pindliyon ka Gooda

Re: Indian Cyber Warfare Discussion

Postby shiv » 16 Oct 2010 16:08

nyahaha
nothing here.
Last edited by shiv on 16 Oct 2010 21:05, edited 1 time in total.

Raghavendra
BRFite
Posts: 1252
Joined: 11 Mar 2008 19:07
Location: Fishing in Sadhanakere

Re: Indian Cyber Warfare Discussion

Postby Raghavendra » 16 Oct 2010 17:10

nothing to see hear :mrgreen:
Last edited by Raghavendra on 16 Oct 2010 21:17, edited 1 time in total.

shiv
BRF Oldie
Posts: 34982
Joined: 01 Jan 1970 05:30
Location: Pindliyon ka Gooda

Re: Indian Cyber Warfare Discussion

Postby shiv » 16 Oct 2010 18:54

Raghavendra - would you be able to do the honors? :mrgreen:
Marten wrote:Shiv saar, I found an updated version online.

here you go.
Last edited by shiv on 16 Oct 2010 21:28, edited 2 times in total.

Raghavendra
BRFite
Posts: 1252
Joined: 11 Mar 2008 19:07
Location: Fishing in Sadhanakere

Re: Indian Cyber Warfare Discussion

Postby Raghavendra » 16 Oct 2010 19:09

nothing to see hear :mrgreen:
Last edited by Raghavendra on 16 Oct 2010 21:17, edited 1 time in total.

Raghavendra
BRFite
Posts: 1252
Joined: 11 Mar 2008 19:07
Location: Fishing in Sadhanakere

Re: Indian Cyber Warfare Discussion

Postby Raghavendra » 16 Oct 2010 20:18

^Thanks for tech tips and the files, downloaded images and updating now

shiv
BRF Oldie
Posts: 34982
Joined: 01 Jan 1970 05:30
Location: Pindliyon ka Gooda

Re: Indian Cyber Warfare Discussion

Postby shiv » 16 Oct 2010 21:04

Marten wrote:NP. I'll let you know later when the SVG is updated.

Shiv saar, could you please edit the link out of your message? Please let me know over email if you need any other images edited. Thanks.


Done. Many thanks fellow jingotvadi!

animesharma
BRFite
Posts: 269
Joined: 29 Nov 2008 20:56

Re: Indian Cyber Warfare Discussion

Postby animesharma » 17 Oct 2010 02:53

Some more update about CWG network attacks
http://www.indianexpress.com/news/1-000-cyber-attacks-on-Games--most-from-China/698324
1,000 cyber attacks on Games, most from China

Key points:
*Six cyber networks of the Delhi Commonwealth Games faced at least 1,000 “potential” attacks in the 12 days of the event that concluded last night — that is, more than three attacks every hour.

*Some attempts to penetrate CWG circuits were made from Mumbai as well, top sources in the CMG said.

*“In all, our systems detected around 5,000 incidents, about 20 per cent of which could be described as potential attacks. Many were ‘denial-of-service’ attacks, which, if successful, would jam entire networks. But none of these attempts succeeded in penetrating even the first of the three layers of cyber security systems that we had installed,” said a member of the CMG.

*The six networks, including those of Games data, security, venues, Internet services and Mahanagar Telephone Nigam Ltd (MTNL), were linked to the Command Centre, which constantly monitored over 3,000 computers, 3,000 CCTVs and 1,800 network switches. A special software detected and mapped all “deviant behaviour” on logs, which were examined by the CMG several times a day.

*“The cyber security systems used in the CWG are now a model which can be replicated in major national networks, and used for cyber security in critical sectors such as railways, aviation and telecommunications.”

wig
BRFite
Posts: 1776
Joined: 09 Feb 2009 16:58

Re: Indian Cyber Warfare Discussion

Postby wig » 18 Oct 2010 10:29

an informative article by former Lt Gen Daulat Singh
Chinese are preparing for cyber warfare on a massive scale. The principal targets are USA and India. A very recent assessment by a highly reputed London-based think-tank that cyber warfare between nations is a reality and cannot be brushed aside as fanciful should make us sit up and take notice. The warning is contained in an annual report, The Military Balance, issued by the International Institute for Strategic Studies (IISS). This in-depth document analyses each year the competitive arms race that goes on between major nations and predicts its possible fall-out from the point of view of military capabilities and defence economics.
The latest analysis, apart from citing threats in cyberspace, refers to dangers arising from the conflict in Afghanistan, the determined Chinese exercise to diversify its military prowess and the nuclear ambitions of Iran. As a Western analysis, it naturally devotes considerable attention to what is happening in China and North Korea, especially on the cyber front. Releasing the report, the IISS said: "Despite evidence of cyber attacks in recent political conflicts, there is little appreciation internationally of how to assess cyber-conflict. We are now, in relation to the problem of cyber-warfare, at the same stage of intellectual development as we were in the 1950s in relation to possible nuclear war." This may appear to be a strong statement, but it is obviously intended to shake policy makers out of their ignorance and complacence.
It is relevant to recall here events of the past few years in which some small and hapless nations were subjected to a major cyber offensive from their adversaries. First was the attack in 2007 on Estonia, whose economic life was paralysed by Denial of Service (DoS) attacks unleashed from about a million computers, many of which were traced to Russia. It is an open secret that relations between the two nations have been frosty for quite some time. Estonia was under Soviet occupation from 1944 and obtained its freedom only in 1991.
Next was the Russian offensive against Georgia in 2008 as part of a dispute over South Ossetia. Apart from military exchanges, the occasion saw the hijacking of Georgian computers through cyber attacks originating from Russia. Even the Georgian President's official computers were not spared. In July 2009, German espionage agents complained of Internet spying operations by Russia and China with the objective of stealing vital information on critical infrastructure and defence plans. In December, Seoul reported attempts by North Korean computers to hack into the former's databases relating to US-South Korean defence strategies in the event of a war in the Korean peninsula.Also, Google recently launched an investigation into attacks on Internet accounts of human rights activists in China. This has actually ballooned into a major controversy, as a result of which Google has decided not to submit itself to censorship imposed by the Chinese authorities and also revealed the possibility of it pulling out of China altogether.
All this is evidence enough to substantiate the growing feeling that the wars of the future will be fought in cyberspace rather than on traditional battle fields. It is this assessment that has persuaded the Pentagon to prepare itself for a war in cyberspace on par with land, sea and aerial combat. According to one report, it will deploy a large number of cyber experts to look after its 15,000 computer networks spread over 4,000 installations. I presume our South Block has a similar core of trained cyber security team. Or else, in these troubled times, with several hostile neighbours around us, we could be in trouble.
All reports suggest that the al Qaeda is still very active. Its principal foes are the US and the UK. India comes a close third. It is the expert estimate that the al Qaeda may not any longer aim at our defence establishments. It is likely rather to concentrate on our weakest spot, namely, the financial sector. The latter may be strong in terms of business acumen. But what it is generally lax about is in respect of protection of its valuable information networks. The stock market is especially vulnerable. Any interference with its online traffic relating to financial transactions, through tactics such as DoS attacks could be disastrous. Any deliberate corruption of data relating to deals carried out by large-scale credit agencies will be equally ruinous. These are not imaginary but real threats of which financial managers in government and the private sector need to be aware. Any large-scale disruption of the financial market, especially at a time like the present, when economies are passing through a lean phase, could greatly affect political stability. Expert apprehensions of a terrorist use of weak information networks run by financial institutions cannot therefore be ignored.I would like to draw reader attention to an interesting piece, Cyber Warriors by James Fallows in the latest issue of Atlantic, in which he has a lot to say about threats emanating from the Chinese mainland. Its huge population and high computer literacy (with hundreds of millions of Internet users) give an advantage that is difficult to surpass. In crude terms, China could raise a formidable team of young hackers who could cause havoc to other nations with whom China does not enjoy good relations. This is an army that has the might to bring about a total breakdown of the commercial life of any nation of any size. This is an interesting analysis worth pondering over.
James Fallows refers to a forthcoming novel Directive 51 by John Barnes, which depicts a situation where there is such a breakdown. I am sure it is worth waiting for. We can possibly also draw from it some lessons on how to look after our networks!

http://www.dailyexcelsior.com/

abhishek_sharma
BRF Oldie
Posts: 9664
Joined: 19 Nov 2009 03:27

Re: Indian Cyber Warfare Discussion

Postby abhishek_sharma » 21 Oct 2010 11:01

William Lynn, U.S. Deputy Secretary of Defense on Cyber-security

http://www.charlierose.com/view/interview/11247

Vril
BRFite
Posts: 285
Joined: 19 Mar 2010 20:05

Re: Indian Cyber Warfare Discussion

Postby Vril » 22 Oct 2010 14:30

Govt plans to cut internet services in case of cyber attacks

Code: Select all

Indian law enforcement and national security officials are drawing up plans that will give them technology capabilities to cut off all internet services during emergencies.

After a series of recent meetings on cyber security held at the prime Minister’s Office at South Block, all government departments have been asked to jointly work on developing technologies and also invest in enhancing R&D capabilities to enhance the Centre’s control on internet services within the country, officials aware of the development told ET.

Officially, these steps are aimed at protecting Indian infrastructure from cyber attacks, but analysts fear that this may lead to greater government controls over internet as in China. Globally many countries are working on securing their communication networks from crippling cyber attacks that target the IT infrastructure of banks, airports, railways and government offices, all of which are often connected to the internet.

As the first step, the Centre wants to control national gateways, the points at which all data and internet connects to the outside world. Currently, many of these points are under the control of telecom and internet companies. These firms have capabilities to install filters that can slow down or block certain objectionable content on the directions of the government

The possibility of the Centre taking charge of the internet during emergencies and cyber wars were discussed at a recent meeting at the Prime Minister’s Office, chaired by the national security advisor Shivshankar Menon with representatives from all intelligence agencies and key department such as IT, telecoms, atomic energy, defence and space.

" China has been able to establish controls which enable it to choke the internet at will. The number of vulnerabilities in cyber space could be reduced by ensuring that closed loop information systems are not connected to the internet," said the minutes of this meet, which were seen by ET.

The model similar to that of China is being explored where key government departments work together on cyber space related issues with a long term vision. A move to make many networks closed group and not connected with internet is also being explored. The departments have also been asked to tap competencies and R&D capabilities of private organizations and academia to identify and plug gaps in the country’s cyber security apparatus.

Non possession of full web gateway control has resulted in economic losses for governments in past. In April 2007, when Estonia removed the Russia . war memorials from its territory, it was met with a massive denial of service attack allegedly from Russia. In the days that followed, IT infrastructure in Estonia government, banks, news organizations were crippled and banks suffered losses. In 2008, Russians attacked Georgian news agencies during Ossetia war crashing their servers.

"Shutting the internet would be like closing your shop whenever somebody starts throwing stones on it," says Vikas Desai, technical lead at IT security firm RSA. "Many solutions like a massive firewall, log management should be installed to monitor security, not content," he adds.

The Centre also attempting to map the cyber assets of adversaries (like Pakistan and China) amongst others so that India can retaliate and also launch offensive cyber operations against these nations when subject to an attack.

‘This would involve development of capabilities to observe, understand and react to treats as well as to understand the behavioral dynamics of players in cyber space. It will also be important to develop standards and patents in the next generation technologies in order to control the cyber space," the minutes of the meet chaired by Mr Menon says, while adding this would the only way by which India would attain a bargaining position in the cyber world.

The Centre is also becoming wary of foreign IT security providers like US based ‘Symantec and McAfee’ who are currently entrusted with the tasks of reporting vulnerabilities in Indian cyber space, and have remote access to Indian internet gateways.

"International companies are unlikely to share information beyond India specific domains. These issues need to be addressed through robust regulatory and R&D strategies," the minutes state..

Emails sent to US based Symantec and McAfee on the government's concerns about them did not elicit any response.

A denial of service attack happens when a server is requested for a particular information like a website millions of times in a fraction of second by a computer, that it leads to crashing of the server. In a distributed denial of service attack, many computers attack on the same server, millions of times in a second. This makes it difficult for a firewall to block a particular IP address since millions of other IP addresses are attacking at the same time. However, switching off the internet might bring some relief temporarily to a country, till vulnerabilities are fixed.


http://economictimes.indiatimes.com/tec ... 791296.cms

JTull
BRF Oldie
Posts: 2679
Joined: 18 Jul 2001 11:31

Re: Indian Cyber Warfare Discussion

Postby JTull » 22 Oct 2010 15:19

Vril wrote:Govt plans to cut internet services in case of cyber attacks

http://economictimes.indiatimes.com/tec ... 791296.cms


So, if anyone launches a serious attachk then Indian gvt. would beat them by launching it's own "denial of service" attack on Indian consumer. :eek:

Sounds more like an ostrich sticking it's head in the sand.

Perhaps they should focus their effort on building a capability to fight back rather than meekly surrender to the threat.

Vivek Raghuvanshi
BRFite
Posts: 149
Joined: 08 Apr 2010 22:50
Location: Noida, National Capital Region
Contact:

Re: Indian Cyber Warfare Discussion

Postby Vivek Raghuvanshi » 22 Oct 2010 16:49

Cyber Warfare is a subset of Information Warfare.

Maybe GoI may like to hire and train Black Hats to take care of the enemy.

anjan
BRFite
Posts: 448
Joined: 08 Jan 2010 02:42

Re: Indian Cyber Warfare Discussion

Postby anjan » 23 Oct 2010 03:00

JTull wrote:So, if anyone launches a serious attachk then Indian gvt. would beat them by launching it's own "denial of service" attack on Indian consumer. :eek:

Sounds more like an ostrich sticking it's head in the sand.

Perhaps they should focus their effort on building a capability to fight back rather than meekly surrender to the threat.


If you see the network as primarily enabling economic activity with things like electronic transfers and bill payment then it makes great sense to take India of the internet in the event of a really threatening attack. The US govt was proposing a similar thing recently. Of course given the volume of the internet hosted from there they won't get hit as bad. Still, essential services would mostly survive even in our case. You might lose BRF but you'll still have Railways reservations and the like.


Return to “Military Issues & History Forum”

Who is online

Users browsing this forum: brar_w, nithish, sgrover and 39 guests