Your Computer is a Combat Zone
by James Dunnigan
September 11, 2005

Cyberwar specialists are watching with great interest recent battles between cybercrime gangs. The military sees wartime use for the new skills the online gangsters are developing. Online crime has become big business, and certain online assets are worth fighting for. While some of the gangs in Eastern Europe still deal with competition by, literally, killing them, that is not always possible. Online criminals hide their identities not just from law enforcement, but also from each other. You can’t have someone murdered if you don’t know who they are. But you can do your cybercompetition serious damage online. That’s where the money is, and online gangs are now writing viruses that not only disable anti-virus program on computers they secretly take over, but also try to disable rivals who have gotten their first. Compromised PCs are called “Zombies,” and networks of them are called “botnets.”

Some users have found their home computers so fouled with all these stealthy programs that they throw away the box and buy a new computer. It’s the home computers, connected to a broadband connection, that are most in demand by online criminals. A single home computer, with a broadband connection, can be worth several dollars a month to a criminal gang that secretly controls it. The user may note the machine slowing down at times, and the high-speed Internet connection getting sluggish occasionally, but otherwise, the user is unaware that a bunch of gangsters in Bulgaria has control of their home computer. Gangs often control over 100,000 of these PCs, and there is not an unlimited number to be had. Office PCs, and an increasing number of home PCs, are protected by firewalls and anti-virus software. Many ISPs also search for While hackers can defeat the defenses, the gangs prefer an undefended PC with a high speed connection and a user that leaves it on and connected all the time. Thus zombies are valuable assets, and worth fighting for.

Cyberwarriors and terrorists keen to do damage via the Internet, also recognize botnets as a valuable asset. Equally valuable are the tools used to turn PCs into zombies, and disable those of competitors. Those tools are the “viruses and worms” you hear about. There’s constant competition among the Internet gangsters to develop new ones. This is necessary both because Internet and operating system software keeps changing, making older viruses and worms obsolete. The cyberwarriors envy the online gangsters, because these crooks go out on the net and do whatever they want. After all, they are outlaws. In wartime, the cyberwarriors will have to use many of the same tools, and do many of the same dirty deeds.

In peacetime, the only real cyberwarriors are the online criminals. So the military pays close attention to the crooks. Very close. In some countries, it’s hard to tell the crooks from the cyberwarriors. North Korea, in particular, appears to allow its cyberwarriors to do whatever they want. North Korea has not got many Internet experts, but it is believed the ones they have are particularly deadly.

Some 23 percent of the 237 million computer system attacks made in the first half of 2005, were directed as U.S. government computers. Spam, and nuisance (as opposed to destructive) viruses declined. More of the attacks had clear criminal intent. Most of this was your basic frauds, extortion and theft (of information.) The number of emails carrying dangerous payloads (like a virus) went up from about two percent 18 months ago, to three percent a year ago, to about four percent now. While various bits of defensive software (spam filters and the like) stop most of these malicious messages, some get through. Not only that, but the increase in malicious messages can be traced to the increased participation of criminal organizations. In the past, most of the bad stuff being tossed around was from geeks gone bad (young guys with too much time on their hands, and Internet access). Now people are out to make a buck. You also have intelligence agencies out looking for information. Many attacks against government computers appear to be concentrated, and out for specific types of information. The big problem is that the only intruders you catch are the less skillful ones. The really good ones get in, get what they want, and get away without ever being detected. U.S. Department of Defense computer security experts know for sure this is how it works, because they have pulled it off on foreign computer systems. They have also found out about some network penetrations, long after the fact, from informers. There’s no reason to believe such attacks are not still being directed at Department of Defense computers. Actually, it’s not a matter of “if” it’s being done, but “how much.”

Your Computer is a Combat Zone by James DunniganSeptember 11, 2005

Your Computer is a Combat Zone
by James Dunnigan
September 11, 2005