DOCSLIB.ORG

A Politics of Cybersecurity

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Politics of Cybersecurity Malware Ecologies: A Politics of Cybersecurity Submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Andrew Carl Dwyer Mansfield College University of Oxford Trinity 2019 Abstract Computation, in popular imaginations, is at perennial risk of infection from the tools of nefarious hackers, commonly referred to as malware. Today, malware pervade and perform a crucial and constitutive role in the insecurities of contemporary life from financial transactions, to ‘critical national infrastructures’ – such as electricity, water, and transportation – to devices in our ‘smart’ homes and cities, and even to potential ‘cyberwar.’ Yet, critical security research has rarely turned its attention to malware. In contrast, I explore malware and their politics, situated and extended beyond, an (auto)ethnographic study of the malware analysis laboratory of the UK endpoint protection business, Sophos. I argue that malware are currently processed through a patho-logic that conflate organic and non-organic materialities, permitting analogies between biology and computation, and are generative of particular forms of security that relegate malware to the intent of their authors. I explore how endpoint protection businesses are imbibed with these logics in order to attend to how malware are analysed, detected, and curated beyond them. By drawing on my method of ‘becoming-analyst,’ I critically reflect on how malware become known, are responded to by ad hoc political groups, and can assist in rethinking the role of computational agency in geography, international relations, security studies, and beyond. I instead conceive of malware as performative political actors making limited choices in broader computational ecologies. I therefore advocate for an eco-logical repositioning of malware, where cyberspace is not simply a neutral domain; but is central to the formation of choice that gives space for malware to be political. With four cases – Conficker, Stuxnet, the Dukes, and WannaCry / (Not)Petya – I write new stories on how malware are encountered and dealt with in the twenty-first century. In doing so, I challenge contemporary discourses of cybersecurity to ask if conventional notions of who and what (per)form security are adequate, and how these are reconfigured through a radical ‘more-than-human’ politics, where malware are not just objects of security, but are active participants in its production and negotiation. i ii Acknowledgements There are innumerable people to thank over the course of (almost!) five years traversing new (inter)disciplinary spaces. I have had the privilege of encountering so many people, things, and spaces I thought I would never do. Inevitably there are omissions, so I start with that recognition. Various awkward moments, materialities, affects, and politics have informed and shaped how I have perceived, felt, and negotiated the world – so if I’ve had a coffee or too many beers with you, met through Twitter interactions, or you just listened to malformed thoughts – you’re all crucial. In the most perverse way, I thank the multiple malware forms that have been such a crucial interlocutor that are so nebulous, performative, and plural. Yet, for an empirical piece of work – thank you Sophos, you were incredibly supportive of a social scientist entering your space and dealing with me as I learnt and often failed to ‘do’ malware analysis and detection. I couldn’t have done this without you. Nor could I have done this without both of my examiners, Prof. Claudia Aradau (King’s College London) and Prof. Tim Schwanen who have given me new directions and thoughts to move beyond this work. At Oxford, it was Andrew Martin and the CDT in Cyber Security (a fantastic place with lots of wonderful people) that gave me the opportunity to do cybersecurity with incredible support from David Hobbs, Maureen York, and Katherine Fletcher. I made wonderful friends here - Jan Silomon, Richard Baker, Kris Wilson, Alastair Janse van Rensburg, and Louise Axon – and critical perspectives from politics and international relations - Lucas Kello, Monika Kaminska, Jamie Collier, Florian Egloff, and James Shires. Yet none are more influential than Beth Greenhough and Derek McCormack, my supervisors on this journey. In particular, Beth agreed to supervise an oddity wanting to return to geography and she was central to me exploring malware at all. Beth’s expert tack to translate my often convoluted thinking into a pithy summary as well as Derek’s incisive comments (particularly around my theoretical wanderings) are ones I shall miss. Others in geography have made the five years worth it – Helge Peters, Ian Klinke, Peter Martin, Liam Saddington, Daniel Bos, Marion Ernwein, Alex Vasudevan, Jamie Lorimer, Hanno Brankamp, Negar Behzadi, Thomas Jellis, Adam Packer, and Gillian Rose. Beyond Oxford, people have been so influential and beyond helpful and kind – Louise Amoore (who I will always owe an inextricable amount of debt to), N. Katherine Hayles, Sam Kinsley, James Ash, Nat O’Grady, John Morris, Ingrid Medby, iii Peter Forman, Emma Fraser, Georgios Glouftsios, Clancy Wilmott, Esmé Bosma, Phil Garnett, Sam Hind, and Dorothea Kliene (including the rest of the ‘Digital Geographies Working Group’ at the RGS-IBG, as it was then known). The ‘sister’ CDT at Royal Holloway and Mansfield College always provided sanctuary. From Mansfield, Baroness Helena Kennedy and Ros Ballaster for supporting me as MCR President, to the amazing life-long friends at the Cowley Road Breakfast Club, Joe Shaw and Irene Scarpa. At Royal Holloway, Pete Adey, and friends who I cannot imagine life without, who exposed me to so much among the general gallivanting around London - Pip Thornton, Nick Robinson, Adam Badger, Alex Hardy, and Andreas Haggman. Thanks also go to the different institutions that have supported me on the way, including Joyce Tait and Gill Haddow at the Innogen Institute at the University of Edinburgh. Also to the reading groups I attended and in particular ‘Life Itself in Theory and Practice’ at TORCH in Oxford that really helped when I was attempting to ‘contextualise’ my work, thanks to Sam Gormley for putting this together. And happily to my new colleagues Andreas Langenohl, Carola Westermeier, Amina Nolte, and Philipp Lottholz at the SFB/TRR 138 ‘Dynamics of Security’ project in Marburg and Gießen, Germany, which gave me the space, time, and freedom, to finish this thesis. And nearing an end, to thank those closest to me. Friends from home; Jessica Wilson who always reminded me of good drinking spots in Sheffield, and to Kerry-Anne Scothorne Allen, Billy, the boys, Brooklyn and Ronny and the new one, Crimson. Those who I met at Durham, where I developed a love of geography, politics, and technology; Alice Cree, Louise Harper, Emma Holloway, and many more. To those who I lost in this time; my grandparents, Joan Green, Brian Green, and Winifred (Ann) Dwyer. And lastly, to thank those I love the most: Mum, Matthew, and the one who has had to deal with more than enough grievances from me, Oliver. iv This thesis is dedicated to my wonderful Mum, Deborah Jayne Green, who never seeks recognition and to Jessica Wilson, whose panic one day made malware all too real for me. v vi Contents ABSTRACT I ACKNOWLEDGEMENTS III CONTENTS VII FIGURES IX CHAPTER ONE || INTRODUCTION 1 MOTIVATIONS 3 THESIS STRUCTURE 7 CHAPTER TWO || COMPUTATIONAL ECOLOGIES 13 ORGANICISM AND CYBERNETICS 14 ECOLOGISING COMPUTATION 19 MORE-THAN-HUMAN COMPUTATION 27 A MALWARE ECOLOGY 36 CHAPTER THREE || RESEARCHING MALWARE 39 APPROACHING MALICIOUS SOFTWARE 41 ETHNOGRAPHY 50 BECOMING ANALYST 53 RECORDING, REFLECTING, AND ETHICS 67 CHAPTER FOUR || LINEAGES TO UNDERSTANDING MALWARE 73 THE GROWTH OF CYBERSECURITY 75 ARCHITECTURES OF MALICIOUSNESS 82 PATHOLOGICAL IMAGINATIONS 86 ANTI-VIRUS 97 CONTEMPORARY APPROACHES 103 CHAPTER FIVE || THE ANOMALOUS AND THE MALICIOUS 105 THE LAB 106 THE ALLURE OF ENVIRONMENT 108 STATIC STRATEGIES 110 CONTEXTUAL STRATEGIES 117 DATA 131 CRAFTING SIGNALS 136 vii BLENDING LOGICS 137 CHAPTER SIX || CURATING MALICIOUSNESS 141 EMBODYING MALWARE 142 THE FALSE POSITIVE 146 THE POTENTIALLY UNWANTED APPLICATION 151 MAKING SENSE OF MALICIOUSNESS 156 MOVING TO ECOLOGY 163 CHAPTER SEVEN || MALWARE POLITICS 167 ECOLOGICAL CURATIONS 168 THE CASES 171 CASE 1 | STUXNET 172 CASE 2 | THE DUKES 178 CASE 3 | WANNACRY/(NOT)PETYA 183 MALWARE MATERIALITIES 193 CHAPTER EIGHT || ECOLOGICAL CONCLUSIONS 199 THE CONFICKER WORKING GROUP 200 THE CYBER DOMAIN 207 THE OBJECT-IVE CYBERWEAPON? 210 DRAWING A CLOSE 214 FUTURE DIRECTIONS 218 BIBLIOGRAPHY 221 APPENDIX 243 CONSENT FORMS 243 viii Figures Figure 1: A simplified depiction of the 'layers' of computation that form the materialities and spaces of 'cyberspace.' Adapted from a presentation by Hayles (2018). Author’s own image. ________________________________________________________________ 31 Figure 2: A screenshot of the Ingress game, where players work together in teams to capture ‘portals’ from other teams through GPS locations and performing ever-more complicated tasks. Author’s own image. ______________________________________ 50 Figure 3: Research diary with coded strips highlighted. Author’s own image. ___________ 69 Figure 4: New malware forms over the past decade using data from independent anti-virus product testers, AV-Test (2018, p.2). _________________________________________ 101 Figure 5: A screenshot of the Menu Bar on MacOS with 'Sophos Anti-Virus' presented as the small icon shaped like a shield with an
Load more

Recommended publications
  • Wikileaks and the Institutional Framework for National Security Disclosures
    THE YALE LAW JOURNAL PATRICIA L. BELLIA WikiLeaks and the Institutional Framework for National Security Disclosures ABSTRACT. WikiLeaks' successive disclosures of classified U.S. documents throughout 2010 and 2011 invite comparison to publishers' decisions forty years ago to release portions of the Pentagon Papers, the classified analytic history of U.S. policy in Vietnam. The analogy is a powerful weapon for WikiLeaks' defenders. The Supreme Court's decision in the Pentagon Papers case signaled that the task of weighing whether to publicly disclose leaked national security information would fall to publishers, not the executive or the courts, at least in the absence of an exceedingly grave threat of harm. The lessons of the PentagonPapers case for WikiLeaks, however, are more complicated than they may first appear. The Court's per curiam opinion masks areas of substantial disagreement as well as a number of shared assumptions among the Court's members. Specifically, the Pentagon Papers case reflects an institutional framework for downstream disclosure of leaked national security information, under which publishers within the reach of U.S. law would weigh the potential harms and benefits of disclosure against the backdrop of potential criminal penalties and recognized journalistic norms. The WikiLeaks disclosures show the instability of this framework by revealing new challenges for controlling the downstream disclosure of leaked information and the corresponding likelihood of "unintermediated" disclosure by an insider; the risks of non-media intermediaries attempting to curtail such disclosures, in response to government pressure or otherwise; and the pressing need to prevent and respond to leaks at the source. AUTHOR.
    [Show full text]
  • Wikileaks, the First Amendment and the Press by Jonathan Peters1
    WikiLeaks, the First Amendment and the Press By Jonathan Peters1 Using a high-security online drop box and a well-insulated website, WikiLeaks has published 75,000 classified U.S. documents about the war in Afghanistan,2 nearly 400,000 classified U.S. documents about the war in Iraq,3 and more than 2,000 U.S. diplomatic cables.4 In doing so, it has collaborated with some of the most powerful newspapers in the world,5 and it has rankled some of the most powerful people in the world.6 President Barack Obama said in July 2010, right after the release of the Afghanistan documents, that he was “concerned about the disclosure of sensitive information from the battlefield.”7 His concern spread quickly through the echelons of power, as WikiLeaks continued in the fall to release caches of classified U.S. documents. Secretary of State Hillary Clinton condemned the slow drip of diplomatic cables, saying it was “not just an attack on America's foreign policy interests, it [was] an attack on the 1 Jonathan Peters is a lawyer and the Frank Martin Fellow at the Missouri School of Journalism, where he is working on his Ph.D. and specializing in the First Amendment. He has written on legal issues for a variety of newspapers and magazines, and now he writes regularly for PBS MediaShift about new media and the law. E-mail: [email protected]. 2 Noam N. Levey and Jennifer Martinez, A whistle-blower with global resonance; WikiLeaks publishes documents from around the world in its quest for transparency, L.A.
    [Show full text]
  • An Oft Overlooked Response Option to Hostile Cyber Operations
    The Plea of Necessity: An Oft Overlooked Response Option to Hostile Cyber Operations Louise Arimatsu and Michael N. Schmitt 97 INT’L L. STUD. 1171 (2021) Volume 97 2021 Published by the Stockton Center for International Law ISSN 2375-2831 The Plea of Necessity Vol. 97 The Plea of Necessity: An Oft Overlooked Response Option to Hostile Cyber Operations Louise Arimatsu∗ and Michael N. Schmitt∗∗ CONTENTS I. Introduction ........................................................................................... 1172 II. Uncertainty and Limitations in the Law of Self-Defense ............... 1175 III. Uncertainty and Limitations in the Law of Countermeasures ....... 1179 IV. Necessity as a Response Option ......................................................... 1181 A. Threshold .................................................................................... 1183 B. Limitations................................................................................... 1191 C. Assistance by Other States? ...................................................... 1194 D. Geography ................................................................................... 1197 V. Concluding Thoughts ........................................................................... 1198 ∗ Distinguished Policy Fellow, Centre for Women, Peace and Security, London School of Economics. ∗∗ Professor of International Law, University of Reading; Francis Lieber Distinguished Scholar, U.S. Military Academy at West Point; Charles H. Stockton Distinguished Scholar- in-Residence,
    [Show full text]
  • Stuxnet, Schmitt Analysis, and the Cyber “Use-Of-Force” Debate
    Members of International Telecommunications Union and UN Institute for Training and Research confer on cyber security UN (Jean-Marc Ferré) UN (Jean-Marc Stuxnet, Schmitt Analysis, and the Cyber “Use-of-Force” Debate By ANDREW C. FOLTZ All Members shall refrain in ne of the many seemingly advance the specific criteria states will use in intractable legal issues sur- making such determinations. their international relations rounding cyberspace involves As discussed in this article, several ana- from the threat or use of force O whether and when peacetime lytic frameworks have been developed to help against the territorial integ- cyber operations constitute a prohibited use of assess when cyber operations constitute a use force under Article 2(4) of the United Nations of force.3 One conclusion these frameworks rity or political independence (UN) Charter. Notwithstanding a significant share is that cyber operations resulting in of any state, or in any other body of scholarly work on this topic and physical damage or injury will almost always manner inconsistent with extensive real-world examples from which to be regarded as a use of force. When these draw, there is no internationally recognized frameworks were developed, however, there the Purposes of the United definition of a use of force.2 Rather, what has were few, if any, examples of peacetime, state- Nations. emerged is a general consensus that some sponsored cyber coercion. More importantly, cyber operations will constitute a use of force, the prospect of cyber attacks causing physical —Article 2(4), Charter of the but that it may not be possible to identify in damage was largely theoretical.4 Beginning United Nations1 Lieutenant Colonel Andrew C.
    [Show full text]
  • Cyber Warfare: Surviving an Attack
    14 Cyber Warfare: Surviving an Attack By Devabhaktuni Srikrishna Cyberspace is a new domain of warfare. Created to minimize the vulnerability of United States communications networks to a crippling nuclear first strike by the Soviet Union, the Internet that was originally envisioned to enhance U.S. security is turning into a battlefield 1 for nations or sub-national groups to launch virally spreading attacks 2 and induce network failures potentially involving critical infrastructure systems.3 Cyber warfare and cyberoffense 4 have been a part of U.S. military operations for decades.5 Treaties and rules of engagement define what is off-limits during a cyberwar.6 The more vulnerable the system is, the more policy is necessary to deter adversarial nations from launching attacks, and vice-versa. Some cyberattacks are analogous to air forces probing one anotherʼs defenses or perhaps to espionage during the Cold War, which occurred though there was no official war and no physical harm. Cyberespionage largest recent cyberattacks in their book, but due to a gap in theory and practice. operations of China, for example, against the United States and its allies Cyber War: The Next Threat to National Organizations are vulnerable to the extent have been going on for years and will Security and What to Do About It. Once a they want to be and to how much they want never really end.7 virus or malware is inadvertently to spend to address vulnerabilities. 14 And downloaded onto a networked personal cyber vulnerabilities can be completely U.S. Air Force General Kevin Chilton, computer (PC) by a user9, the PC can be eliminated -- unlike conventional, nuclear, former Commander-in-Chief of commandeered to perform cyberattacks chemical, or biological which are permanent Strategic Command, has stated that ranging from electronic banking crimes, vulnerabilities due to laws of nature.
    [Show full text]
  • Software Analysis for Security
    Software Analysis for Security Spiros Mancoridis Department of Computer Science College of Engineering Drexel University Philadelphia, PA 19147, USA E-mail: [email protected] Abstract ware architecture to assure the system’s security. The qual- ity of a security architecture, however, also depends on the This is a survey of the processes, practices, and technolo- security of the applications that constitute the system. In gies that can help software maintenance engineers improve low security operating environments, such as most commer- the security of software systems. A particular emphasis is cial operating systems, it is assumed, albeit optimistically, placed on validating security architectures, verifying that that these applications are trustworthy. Therefore, it is im- the implementation of an architecture’s constituent appli- portant to articulate the practices to support the secure cod- cations adhere to secure coding practices, and protecting ing of applications and the tools for detecting malware. Se- software systems against malicious software. In addition to cure coding involves programming practices and run-time surveying the state-of-the-art, research challenges pertain- mechanisms that can be used to limit the vulnerabilityof ap- ing to software security are posed to the software mainte- plications to dangerous malware that exploit, for example, nance research community. buffer overflows, format string vulnerabilities, and integer vulnerabilities to attack computer systems. One approach to software security is to verify that (a) the security mechanisms used are trustworthy; (b) the security 1. Introduction architecture has been validated against the security policy; and (c) the software applications that constitute the system The goal of computer security is to protect computer as- are trustworthy (e.g., they have been developed using secure sets (e.g., servers, applications, web pages, data) from cor- coding practices, or they are not malware).
    [Show full text]
  • Wikileaks: a Guide for American Law Librarians*
    LAW LIBRARY JOURNAL Vol. 104:2 [2012-20] WikiLeaks: A Guide for American Law Librarians* James p. Kelly, Jr.** In posting confidential and classified information, WikiLeaks has become one of the world’s most controversial web sites. This paper examines the federal law concerning WikiLeaks and the use of WikiLeaks as an information source. It raises questions librarians must ask themselves as technology advances and leaks continue. Background . .246 Legal Troubles. .248 Financial Troubles . .249 The Espionage Act. 250 New York Times Co. v. United States. .251 United States v. Rosen. .253 Other Relevant Statutes . .254 18 U.S.C. § 641. 254 50 U.S.C. § 421. 254 18 U.S.C. § 1030(a)(1). 254 Prosecuting WikiLeaks Under Current Law. .254 Proposed Legislation. 255 Cases Involving WikiLeaks. .257 A Host of Research Problems. .258 The Congressional Research Service and the Library of Congress. 258 Reliability and Moral Quandaries. .259 Conclusion . 261 ¶1 WikiLeaks has become one of the world’s most controversial web sites. In posting confidential and classified information from governments, businesses, and organizations around the world, it has become a target for those in power. Others have vigorously defended the web site, saying it promotes and defends the ideals of a free press and free speech that are vital to democracy. For librarians generally, WikiLeaks represents a new source for information that might otherwise be unavailable. However, how this information was acquired can present significant legal and ethical problems for its users. ¶2 This article examines WikiLeaks from a legal and a library perspective. While the legal status or problems of WikiLeaks in other countries is occasionally * © James P.
    [Show full text]
  • Computer Viruses and Malware Advances in Information Security
    Computer Viruses and Malware Advances in Information Security Sushil Jajodia Consulting Editor Center for Secure Information Systems George Mason University Fairfax, VA 22030-4444 email: [email protected] The goals of the Springer International Series on ADVANCES IN INFORMATION SECURITY are, one, to establish the state of the art of, and set the course for future research in information security and, two, to serve as a central reference source for advanced and timely topics in information security research and development. The scope of this series includes all aspects of computer and network security and related areas such as fault tolerance and software assurance. ADVANCES IN INFORMATION SECURITY aims to publish thorough and cohesive overviews of specific topics in information security, as well as works that are larger in scope or that contain more detailed background information than can be accommodated in shorter survey articles. The series also serves as a forum for topics that may not have reached a level of maturity to warrant a comprehensive textbook treatment. Researchers, as well as developers, are encouraged to contact Professor Sushil Jajodia with ideas for books under this series. Additional tities in the series: HOP INTEGRITY IN THE INTERNET by Chin-Tser Huang and Mohamed G. Gouda; ISBN-10: 0-387-22426-3 PRIVACY PRESERVING DATA MINING by Jaideep Vaidya, Chris Clifton and Michael Zhu; ISBN-10: 0-387- 25886-8 BIOMETRIC USER AUTHENTICATION FOR IT SECURITY: From Fundamentals to Handwriting by Claus Vielhauer; ISBN-10: 0-387-26194-X IMPACTS AND RISK ASSESSMENT OF TECHNOLOGY FOR INTERNET SECURITY.'Enabled Information Small-Medium Enterprises (TEISMES) by Charles A.
    [Show full text]
  • What Are Kernel-Mode Rootkits?
    www.it-ebooks.info Hacking Exposed™ Malware & Rootkits Reviews “Accessible but not dumbed-down, this latest addition to the Hacking Exposed series is a stellar example of why this series remains one of the best-selling security franchises out there. System administrators and Average Joe computer users alike need to come to grips with the sophistication and stealth of modern malware, and this book calmly and clearly explains the threat.” —Brian Krebs, Reporter for The Washington Post and author of the Security Fix Blog “A harrowing guide to where the bad guys hide, and how you can find them.” —Dan Kaminsky, Director of Penetration Testing, IOActive, Inc. “The authors tackle malware, a deep and diverse issue in computer security, with common terms and relevant examples. Malware is a cold deadly tool in hacking; the authors address it openly, showing its capabilities with direct technical insight. The result is a good read that moves quickly, filling in the gaps even for the knowledgeable reader.” —Christopher Jordan, VP, Threat Intelligence, McAfee; Principal Investigator to DHS Botnet Research “Remember the end-of-semester review sessions where the instructor would go over everything from the whole term in just enough detail so you would understand all the key points, but also leave you with enough references to dig deeper where you wanted? Hacking Exposed Malware & Rootkits resembles this! A top-notch reference for novices and security professionals alike, this book provides just enough detail to explain the topics being presented, but not too much to dissuade those new to security.” —LTC Ron Dodge, U.S.
    [Show full text]
  • Designation of North Korea As a State Sponsor of Cyberterrorism, On
    Science and Technology Law Review Volume 18 Number 4 Article 3 2015 Designation of North Korea as a State Sponsor of CyberTerrorism, On Justin L. Koplow Follow this and additional works at: https://scholar.smu.edu/scitech Recommended Citation Justin L. Koplow, Designation of North Korea as a State Sponsor of CyberTerrorism, On, 18 SMU SCI. & TECH. L. REV. 405 (2015) https://scholar.smu.edu/scitech/vol18/iss4/3 This Article is brought to you for free and open access by the Law Journals at SMU Scholar. It has been accepted for inclusion in Science and Technology Law Review by an authorized administrator of SMU Scholar. For more information, please visit http://digitalrepository.smu.edu. On Designation of North Korea as a State Sponsor of CyberTerrorism Justin L. Koplow* I. INTRODUCTION There are ample reasons to be wary of labeling an event an act of "cyberterrorism." For too long the term has been employed as both a dodge and a hustle; the former by those who minimize the importance of investing in cybersecurity until confronted with a "cyber 9/11" and the latter by those fear-mongering beyond all reasonable limits to obtain enormous sums of se- curity dollars., While clearly one must watch his wallet either way when "cyberterrorism" is invoked, what is less clear is the meaning of the term, itself. Indeed, although coined some thirty years ago, cyberterrorism has many definitions, which means it really has no single accepted definition. The basics seem clear enough-use of computer networks to perpetrate harm and incite terror-but the devil is in the details.
    [Show full text]
  • Quantifying Complexity and Code Reuse in Malware Development Alejandro Calleja, Juan Tapiador, and Juan Caballero
    1 The MalSource Dataset: Quantifying Complexity and Code Reuse in Malware Development Alejandro Calleja, Juan Tapiador, and Juan Caballero Abstract—During the last decades, the problem of malicious platforms as soon as these acquired a substantial user base, and unwanted software (malware) has surged in numbers and such as the recent case of smartphones [7]. sophistication. Malware plays a key role in most of today’s cyber attacks and has consolidated as a commodity in the underground The surge in number, sophistication, and repercussion of economy. In this work, we analyze the evolution of malware malware attacks has gone hand in hand with much research, from 1975 to date from a software engineering perspective. We both industrial and academic, on defense and analysis tech- analyze the source code of 456 samples from 428 unique families niques. The majority of such investigations have focused on and obtain measures of their size, code quality, and estimates of the development costs (effort, time, and number of people). Our binary analysis, since most malware samples distribute in results suggest an exponential increment of nearly one order of this form. Only very rarely researchers have access to the magnitude per decade in aspects such as size and estimated effort, source code and can report insights gained from its inspection. with code quality metrics similar to those of benign software. (Notable exceptions include the analysis of the source code of We also study the extent to which code reuse is present in our 4 IRC bots by Barford and Yegneswaran [8] and the work of dataset.
    [Show full text]
  • Spying and Fighting in Cyberspace: What Is Which?
    Spying and Fighting in Cyberspace: What is Which? Gary Brown* INTRODUCTION Traditionally, espionage has inhabited a niche between order and chaos. States have recognized the existence of espionage and enacted domestic legisla- tion to prohibit it, but international law is silent on the subject.1 On the other hand, States accept espionage as part of the business of international relations and are generally tolerant of it. That may be changing, however. Cyberspace, especially the Internet, has become an integral part of everyday life. The use of cyberspace for espionage has generated difficult discussions about the nature of cyberspace, the extent of national sovereignty, and the importance of individual privacy, among other issues, all of which are relevant in a conversation about espionage. This article focuses on another issue, which is the overlap of espionage and aggressive cyber operations. Confusion about the intent behind an intrusion could lead to a misreading of aggressive intent, unnecessary escalation of tensions, or a false sense of security in the opening act of significant cyber aggression. This article also discusses the United States’ stance on dividing espionage into categories depending on the purpose. Rapid improvements in computer technology and techniques, as well as the exponential rise in the amount of data stored online, have driven a closer look at the subject of cyber espionage, in particular how it differs from traditional methods of spying. The speed of access and exfiltration in cyber espionage operations can rapidly result in libraries of information, dwarfing the informa- tion that can be obtained through more traditional methods of espionage.2 Although some of the issues discussed here are also relevant in traditional espionage operations, they have seemed less so in the past.
    [Show full text]