CYBER TERRORISM IS A GROWING THREAT & GOVERNMENTS MUST TAKE ACTION
Thousands of Israelis continue to live in fear after Iranian hackers stole their personal details, including sexual orientation and HIV status, from the dating site Atraf, popular in the LGBTQ community. Leaking the information could have devastating consequences for the victims. This attack is part of a growing trend of states engaging in cyber terrorism, which targets civilian infrastructure and services in order to endanger lives, cause fear, and create panic, just like traditional terrorism. But because cyber terrorists can attack with a click, from afar, the consequences could be much more far-reaching than suicide bombers or missiles. Cyber terrorism is a weapon that can be used daily, not just in wartime. While countries have long relied on cyber tools for legitimate uses such as sending messages to other states, the fact that some are now using them to provoke fear and cause bodily harm to members of the general population means that their actions have crossed a line to become terrorism. Cyber terrorism is also different from cybercrime, where the attackers are private groups rather than states, and the motive is often money, either through extracting ransom payments or acquiring information to sell on the Dark Web. It is a growing threat to everyone and every society, and the stakes are high. It has become clear that cyberattacks can be fatal: Some legal experts and surviving family members have blamed ransomware attacks on hospitals, including in Germany and the United States, for causing patient deaths, although the parties and motivations behind those attacks remain unclear. Governments around the world, whose duty it is to protect their citizens from such harm and fear, must take further steps. This will help businesses, which are often the gateway to attacks, be more vigilant and effective at stopping or mitigating damage from potential attacks. Regulation Is Needed, but That’s Not Enough in recent years, many governments have increased the funding and departments tasked with preventing cyber terrorism, with the United States saying last summer that it would give investigating ransomware attacks the same priority as investigating terrorism. But governments also need to dedicate more resources to prevention. Most cyber-terrorism threats to the United States and Western countries stem from state-backed actors in countries that also pose the largest military threats, including Iran, China, North Korea, and Russia. Remember that cyber terrorists are striking private companies and organizations in order to access data they can use to cause fear and panic or invoke other damage. The software supply chain is another growing potential avenue for cyber terrorism. Software suppliers — which can ultimately lead to access to high-value targets like utility companies, airports, and police departments — offer attackers another indirect route to potentially disrupt or cut off services, endangering lives. In fact, the hackers got into the Atraf dating site via the servers of Web hosting company Cyberserve. Expanding cybersecurity regulations — now limited to sectors such as government, as well as financial and energy companies — to all sectors, including the software supply chain, would help somewhat. But regulations, which are rarely actually enforced, are not enough on their own. All organizations, big and small, also need experts to evaluate and secure their digital assets on a daily basis, and to keep up with the latest cyber intelligence about new threats. Advocacy and Public Education Governments also need to invest in educating their populations about the increasing risk and dangers of cyber terrorism. This could help companies realize that compliance with regulations isn’t enough, and that they need to understand their real-world vulnerabilities. If organizations understand how easily cyber terrorists could take advantage of their vulnerabilities, they will be more likely to invest in repairing them. Civilian populations also need to understand that every person — and the passwords they choose, as well as their ability to distinguish secure sites and online connections from suspicious sites and recognize phishing attempts — plays a role in mitigating or preventing cyber terrorism. This will not only improve security but empower citizens who feel they could make a difference and positively contribute to public safety. We are still in the early days of cyber terrorism. This challenge is new; even Israel, which is considered a world leader in fighting traditional terrorism, is not adequately prepared for the continuing and growing threat of cyber terrorism. In addition to the Atraf attack, Iran has been blamed for many cyberattacks targeting civilians in Israel, including on water infrastructure and on an insurance company, all with potentially devastating consequences for thousands of civilians. With all of its benefits of deniability, relatively low costs, and the ability to attack from anywhere, at any time — as well as the risk of copycat attacks — there is no doubt that cyber terrorism will increasingly threaten civilians everywhere. Governments and private companies must stand up to this challenge for the sake of protecting all of society.
“CYBER-ATTACKED” – LOCKED OUT OF MY DIGITAL LIFE
Vodafone Portugal was attacked by an unidentified set of hackers. Although the network integrity has been compromised, 24 hours after the attack it is already possible to make some use of the 3G and 4G networks (5G is still mostly inaccessible). Among all the trouble I saw coming, there was one thing I had never thought of: what if I needed technical support to be granted a duplicate SIM card? What if I lost my phone? Delete my e-sim? Incredible as it may seem – my “e-sim” was erased from my iPhone. So I needed a duplicate SIM. But the telecom operator has no access to its databases. Therefore, I am unable to access my number and unable to access a multitude of services that reside in the phone number for authentication. As an example WhatsApp, banking apps, travel apps, delivery apps. In a digital world where the mobile number functions as the “key” to many services and platforms, we cannot afford to be without the number for long periods of time. The phone number ends up also being a part of our identity, an access card to our digital life. Having said that, I’ve been wondering about what might have been the cause of this “life-changing” event. Was it a DDoS Attack? A DDoS attack aims to make a server, service, or infrastructure unavailable. The attack can take many forms: an overload of the server’s bandwidth to make it unavailable, or a drain on the machine’s system resources, preventing it from responding to legitimate traffic. At the time of a DDoS attack, a series of requests are sent at the same time from various points on the web. The intensity of this “crossfire” makes the service unstable, and in the worst case, unavailable. It seems it was not a DDoS attack. According to industry experts, it is believed that the network management system that links customer information to the service provided was accessed inappropriately and reset. Who had the access to do this? Portugal also had a similar attack weeks ago that targeted a major media provider…Are we approaching the “Cyberwar”? Cyberwarfare? To be considered as part of a cyberwar, an attack must involve targets, perpetrators, and tools that point to a conflict between different nations and public funding in the actions. But there is also another very important parameter: intent. In a way, if one country attacks another is not automatically characterized as the beginning of a cyberwar. Without the aim of harming a nation or responding to something of a political nature, even if it causes serious damage, a cyberwar can be just … a cyberattack. Cyberattacks, on the other hand, are the most common form of digital crime. There are elements in a cyberattack that help us understand its true nature: the targets, the threat actors behind the attack, as well as the tools used There are several cyberattacks and these can occur from several techniques, such as social engineering, which uses human emotional weaknesses to trigger attacks or perform fraud. Another very common technique present in cyber attacks is the “lures” that result in the (very famous) phishing attacks. The user is led to believe that by downloading a certain file, such as an e-mail attachment, or by entering his personal data, he will be able to obtain a prize or another thing that will lead him/her/they to download the file. There is also CyberTerrorism, which, unlike the above, involves a punctual but devastating action for the victims, and can affect several targets in an unexpected and agile manner, something like what would happen in an act of traditional terrorism. Cyber-terrorism also “gave birth” to cyber-terror, which is the trauma and constant fear of a possible new attack, a real consequence that makes many victims all the time, affecting even countries that have not suffered from the act but, because they are in international conflicts, are more susceptible to believing in false threats. This culture of fear was quickly adopted in several cybercrimes and cyber warfare throughout history, as fear of the improbable is fortified with ignorance of technology and the possibilities in the use of networks around the world. Cyber-terrorists want attention and that makes them choose public systems such as government, hospitals, public safety programs, and any other target that could make the population doubt the supremacy of their own government and thus cause internal conflicts and the country also suffers from external pressures. The motivations for an act of cyber terrorism can involve politics, as in the case of cyber warfare, but it can also revolve around ideological reasons, an unfriendly disagreement against a group of people, or even revenge. This major attack on an important telco operator seems to be a case of cyberterrorism, but there is too much information still kept private from the public eye. Regardless of what happened, I will have to continue to live without access to my digital life. Making abstinence from Uber, from the convenience of digital banking, from Apple Pay, from the app that allows me to buy and sell cryptocurrencies…. this may seem easy, but in a highly techno-dependent life – it is not.
STRANGE WORLD OF CYBER TERRORISM
Cyber terrorism is not a new concept, but it is one with enough lethal potential to be a terrorist’s weapon of choice. Given its immense potential for inciting, recruiting and propagating certain ideology or agenda, it is the ultimate means of reaching out to billions across the globe. This is duly recognised by intelligence agencies in many states who have taken due steps to block web sites promoting terror. But how does one control the explosive growth of thousands of blogs that crop up every day without hampering the freedom of speech doctrine. This is exactly what happened recently when a webhosting company BurstNet shut down one of its very popular blogs titled Blogetery.com on receiving a warning from the law enforcement officials concerning postings of terrorist nature. Apparently, 70,000 bloggers used the site to post their thoughts on varied subjects. Angry at having the site shut down without notice, many bloggers are fuming as to have lost their blogs in cyber space. According to the law, the Federal Investigation Agency—allegedly behind the tip-off sent to the web hosting company—is not authorised to close any website. Any closure on such grounds needs a judicial order. However, in lieu of the violations of acceptable use policy, any web company is mandated to scrutinise and remove objectionable material from the site. This is an apt example of how cyber space is the new zone for waging assymetrical warfare. While it is hard to imagine living without the internet and free exchange of ideas with virtual strangers in today’s digital age, it is harder to monitor and control the zillion bytes of information being exchanged every second. Despite tightening of cyber security, the domain remains an alien territory with terrorists coming up with new identities and means of establishing contact with like-minded people or those experimenting online. We have heard of crimes associated with social network sites often resulting in abuse against children and other victims. We now know that terrorism is the bigger contender in the world of cyber crime. Not only does it give terrorist groups a big advantage in terms of propagation it gives endless opportunities to proliferate. The success generated so far in attracting recruits and sympathisers is a testament to this phenomenon that has become a real security concern worldwide. At the same time it is rather tricky to discriminate between potential terrorists and those who accidentally come across such material for curiosity or research sake. Previously, some cases were reported in Britain where some Muslim students were arrested in charges of looking at terror web sites. It is indeed unfortunate that paranoia and persecution are now dominating logic and reason in the age of new world terrorism. As with every means of communication the cyber world remains vulnerable to exploitation and abuse. It is up to the authorities to implement stringent cyber security guidelines and inform people of the grey areas so those accidental surfers can steer clear of exposing themselves to suspicion.
