[Infowarrior] - Forget North Korea – the real rogue cyber operator lies much closer to home

[Richard Forno]

Forget North Korea – the real rogue cyber operator lies much closer to home

A cyber-attack on Sony Pictures distracted attention from a more worrying story about a piece of malware used by GCHQ

John Naughton

Saturday 6 December 2014 19.05 EST

http://www.theguardian.com/technology/2014/dec/07/north-korea-sony-pictures-regin-gchq-nsa-snowden-belgacom

Were you to measure significance in column inches, the massive cyber-attack on Sony Pictures would appear to be the story of the week. Company executives had to post notices on office entrances telling staff not to log into the network when they reached their desks. The company’s entire network had to be taken offline as it grappled with a ransom demand that threatened to release confidential documents and not-yet-released films unless money changed hands.

The big question was: who was responsible for the attack? Fevered speculation led some people to point the finger at North Korea, on the grounds that one of the forthcoming films, The Interview, poked fun at the country’s leader, Kim Jong-un. This seemed implausible to this columnist: North Korea may be distinctly humourless on the subject of its beloved leader, but seeking a ransom would be uncool even for that nauseating regime.

In the event, no money seems to have changed hands: some confidential documents, eg spreadsheets giving salaries of top Sony executives, made their way online and the embargoed movies began to pop up on piracy sites.

Exciting stuff, eh? But the really big cyber story of the past two weeks is less glamorous but rather more worrying in the longer term. It concerns Regin, a piece of malware that has only recently come to light, although it’s been around for years. The security firm Symantec describes it as “a complex piece of malware whose structure displays a degree of technical competence rarely seen. Customisable with an extensive range of capabilities depending on the target, it provides its controllers with a powerful framework for mass surveillance and has been used in spying operations against government organisations, infrastructure operators, businesses, researchers and private individuals.”

The company goes on to speculate that developing Regin took “months, if not years” and concludes that “capabilities and the level of resources behind Regin indicate that it is one of the main cyberespionage tools used by a nation state”.

Ah, but which nation states? Step forward the UK and the US and their fraternal Sigint agencies GCHQ and NSA. A while back, Edward Snowden revealed that the agencies had mounted hacking attacks on Belgacom, a Belgian phone and internet services provider, and on EU computer systems, but he did not say what kind of software was used in the attacks. Now we know: it was Regin, malware that disguises itself as legitimate Microsoft software and steals data from infected systems, which makes it an invaluable tool for intelligence agencies that wish to penetrate foreigners’ computer networks.

Quite right too, you may say. After all, the reason we have GCHQ is to spy on nasty foreigners. The agency was, don’t forget, originally an offshoot of Bletchley Park, whose mission was to spy on the Germans. So perhaps the news that the Belgians, despite the best efforts of Monty Python, are our friends – or that the UK is a member of the EU – had not yet reached Cheltenham?

Spying on friends as well as enemies is an ancient principle of statecraft. It used to be done for reasons of “national security”; now it is done for reasons of “cybersecurity” and therein lies a new problem. What is cybersecurity, really? What are GCHQ and the NSA trying to secure? Is it the security of the cyberspace – ie the internet? Or of some part of the network? And if so, which part?

Here, some throwaway lines in one of the Snowden documents become particularly interesting. “The facts contained in this program,” they read, “constitute a combination of the greatest number of highly sensitive facts related to NSA/CSS’s overall cryptologic mission. Unauthorised disclosure… will cause exceptionally grave damage to US national security. The loss of this information could critically compromise highly sensitive cryptologic US and foreign relationships, multi-year past and future NSA investments, and the ability to exploit foreign adversary cyberspace while protecting US cyberspace.”

Note that last clause. “Cybersecurity” actually means two things: first, national security, and second, that the only corner of cyberspace that we care about is our own. We can exploit every other virtual inch of it for our own (national) purposes. This gives us carte blanche to, for example, undermine everybody’s online security by weakening the encryption used for commercial transactions; purchase “zero-day exploits” from hackers for use against targeted organisations; and spread malware such as Regin anywhere we goddamn please. Welcome to our networked world.


---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.