CYBER WARFARE AN ANALYSIS OF THE MEANS AND MOTIVATIONS OF SELECTED NATION STATES INSTITUTE FOR SECURITY TECHNOLOGY STUDIES AT DARTMOUTH COLLEGE November 2004 Charles Billo Revised December 2004 Welton Chang 45 Lyme Road Hanover, NH 03755 603-646-0700 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ Authors of this report: Charles G. Billo Senior Research Associate, ISTS Welton Chang Research Intern, ISTS ACKNOWLEDGEMENTS We are grateful for the numerous comments received from our anonymous reviewers as well as ISTS reviewers. In particular, the substantive suggestions received from Professor David Kotz, Eric Goetz, and Colleen Hurd, were especially helpful. We would like to thank Sarah Brooks and Jocelyn Troy for their help. We would also like to thank George Bakos, Kathleen Cassedy, Amy Gannon, Robert Hillery, Dennis McGrath, and the Technical Analysis Group at ISTS. DISCLAIMERS All Internet links and citations contained within were active at the time of publication. We cannot guarantee that the links will remain active indefinitely, although an effort was made to ensure that each citation contained enough information for the cited source to be located in print or other forms of media. Information available prior to November 1, 2004 was used in this report. Copyright © 2004, Trustees of Dartmouth College. All rights reserved. This project was supported under Award No. 2000-DT-CX-K001 from the Office for Domestic Preparedness, U.S. Department of Homeland Security. Points of view in this document are those of the authors and do not necessarily represent the official position of the U.S.Department of Homeland Security. 2 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ FOREWORD This study, written in response to a grant provided by the Department of Homeland Security, assesses potential foreign computer threats to information technology networks in the United States. In focusing on overseas cyber threat capabilities, one of the thrusts of this study is to dispel popular myths and anecdotal understanding about the nature and degree of the cyber threat—taking into account public and private digital network vulnerabilities. Our goal is to examine the open source evidence to develop a rigorous and dispassionate assessment of both cyber “offense” by selected nation states and the likely impact of an attack through the wires on the United States. Cyber warfare involves units organized along nation-state boundaries, in offensive and defensive operations, using computers to attack other computers or networks through electronic means. Hackers and other individuals trained in software programming and exploiting the intricacies of computer networks are the primary executors of these attacks. These individuals often operate under the auspices and possibly the support of nation-state actors. In the future, if not already common practice, individual cyber warfare units will execute attacks against targets in a cooperative and simultaneous manner. A key premise of the present report is that information processing—whether by equipment (computers) or by humans— is becoming a “center of gravity” in future warfare. Nation-states, including the United States, reconnoiter and probe to identify exploitable digital network weaknesses among potential adversaries. Our immediate goal is to both imagine and define how foreign cyber attack capabilities might threaten information networks in the United States and what potential effects they might have. The discussion focuses on relatively arcane, non- sensational concepts and terms such as packet-switched networks, grid topologies, bandwidth, reconnaissance, asymmetric doctrine, and convergence. The Institute for Security Technology Studies at Dartmouth College is concerned, in part, with securing computer systems against intrusion and building secure trust relationships among networked computing devices. It is our hope that by making the findings in the present study accessible to the general reader, we will illuminate current issues, foster practical discussions, and stimulate appropriate policy solutions to the challenges identified. 3 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ 4 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ TABLE OF CONTENTS ACKNOWLEDGEMENTS ......................................................................................................... 2 FOREWORD................................................................................................................................. 3 TABLE OF CONTENTS ............................................................................................................. 5 EXECUTIVE SUMMARY .......................................................................................................... 7 I. INTRODUCTION AND STUDY METHODOLOGY......................................................... 11 II. CHINA .................................................................................................................................... 25 III. INDIA .................................................................................................................................... 41 IV. IRAN...................................................................................................................................... 59 V. NORTH KOREA ................................................................................................................... 75 VI. PAKISTAN ........................................................................................................................... 97 VII. RUSSIA.............................................................................................................................. 107 VIII. CONCLUSION................................................................................................................ 119 APPENDIX A: MORE CRITICAL VULNERABILITIES.................................................. 135 APPENDIX B: TERMINOLOGY ISSUES............................................................................ 140 5 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ 6 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES ___________________________________________________________ EXECUTIVE SUMMARY The purpose of this report is to provide a realistic assessment of the capabilities, means, and motivations of selected nation-states to conduct a remote, computer-to-computer attack either against the United States or against regional adversaries. We take as a given that there is no such thing as “perfect” IT security. For example, hackers seem always able to keep one step ahead of the latest software security patch, and some secure portions of the U.S. Department of Defense computer systems (pertaining to procurement and logistics) are connected to the public-switched network. The consequences of an attack “through the wires,” and the degree of potential disruption, will often hinge on the pervasiveness (and therefore importance) of the network impaired by the attack: national versus regional, local, or municipal in scope. Relying exclusively on open source information, our task is to assess the relative capabilities of certain countries identified in the literature (China, India, Iran, North Korea, Pakistan, and Russia) to wage an effective cyber attack against an adversary. The words “effective cyber attack” by no means translate into the proverbial “take down” of the Internet; on the contrary, such attacks might involve intrusions into unprotected networks for the purpose of compromising data tables, degrading communications, interrupting commerce, or impairing critical infrastructures (such as transportation or medical and emergency services) in such a way that trust is undermined at the expense of a smoothly running economy and society. While the degree of damage that could be caused in a cyber attack bears no resemblance to an electronic “Pearl Harbor,” inflicting significant economic costs on the public and private sectors and impairing performance of key infrastructures (via IT networks linked to embedded computer systems, for example) seem both plausible and realistic. Most computers are connected to each other in some way. They usually share the same operating system software and communicate with all other computers using the standard set of TCP/IP protocols. The ease and speed of dispersion of recently devised worms and viruses such as Nimda and Sasser underscores the links among networked computers. The country-by-country analysis in this report rests on a uniform methodology. Our first category of evidence addresses specific links to cyber warfare capability as depicted in published U.S. government reports and foreign official doctrinal statements. Our second category of evidence concerns links of a more circumstantial nature, such as the presence of a robust information technology infrastructure useful in supporting nation state cyber warfare operations. A synopsis of our individual country studies follows: China Within the framework of an integrated national plan, the People’s Liberation Army (PLA) has formulated an official cyber warfare doctrine, implemented appropriate training for its officers, and conducted cyber warfare simulations and military exercises. Beijing’s intelligence services continue to collect science and