Geostrategy and Geopolitics Department 1 49069 Osnabrueck Cyber war Methods and Practice 07 Jul 2019 Summary Cyberwar (Cyber war, Cyber Warfare) is the military confrontation with the means of information technology. This paper presents the current state and deals with the theoretical and practical problems. In practice, cyberwar is an integral part of military action, but cannot be completely separated from espionage, since the intrusion into and reconnaissance of target systems is essential for further action. After an overview of attack methods, attackers (Advanced Persistent Threats), spy tools, cyber weapons and cyber defense, a particular focus is on the attribution of cyber-attacks and the Smart Industry (Industry 4.0). Afterwards, the cyberwar strategies of the US, China, Russia and further leading actors will be discussed. A final chapter deals with biological applications. Cyber war 07 Jul 2019_English 1 apl. Prof. Dr. Dr. K. Saalbach Table of Contents 1. Fundamentals ....................................................................................................... 6 1.1 Introduction ............................................................................................................... 6 1.2 Background ............................................................................................................... 6 1.3 Cyberwar Definition ................................................................................................. 8 1.4 Cyberwar and Espionage ........................................................................................ 10 1.5 Terminology ............................................................................................................ 10 1.6 Cyber warfare and International Law ..................................................................... 12 1.7 The Geostrategy of Cyberspace .............................................................................. 14 1.7.1 Physical control of data exchange .................................................................... 14 1.7.2 Control of critical elements .............................................................................. 16 1.7.2.1 Rare Metals ................................................................................................... 16 1.7.2.2 Relation USA - China ................................................................................... 17 1.7.2.3 The Huawei Conflict ..................................................................................... 17 1.7.3 The centralization trend ................................................................................... 18 2. Methods .............................................................................................................. 20 2.1 General issues ......................................................................................................... 20 2.1.1 Physical damage of computers and communication lines ............................... 20 2.1.2 Electromagnetic Pulse EMP ............................................................................ 20 2.1.3 The attack on and manipulation of computers and networks .......................... 20 2.2 Attack on Computers .............................................................................................. 20 2.2.1 Basic principles of cyber attacks...................................................................... 20 2.2.2 Communication lines of cyber attacks ............................................................. 21 2.2.3 Strategy ............................................................................................................ 22 2.2.3.1 Introduction ................................................................................................... 23 2.2.3.2 Gain access.................................................................................................... 25 2.2.3.3 Install malware and start manipulation ......................................................... 34 2.2.3.4 Cyber espionage tools ................................................................................... 35 2.2.3.5 Offensive Cyber Weapons ............................................................................ 36 2.2.4 Cyber war ......................................................................................................... 38 2.2.5 Insider Threats ................................................................................................. 39 2.2.6 Information warfare ......................................................................................... 41 3. The Practice of Cyber war ................................................................................. 44 3.1 Introduction ............................................................................................................. 44 3.2 Cyber war from 1998-today .................................................................................... 44 3.2.0 Cold war: Pipeline explosion in the Soviet Union ........................................... 44 3.2.1 Moonlight Maze 1998-2000 ............................................................................ 44 3.2.2 Yugoslavian war 1999 ..................................................................................... 44 3.2.3 The Hainan- or EP3-incident 2001 .................................................................. 45 3.2.4 Massive attacks on Western government and industry computers 2000-2011 45 3.2.5 The attack on Estonia in 2007 .......................................................................... 46 3.2.6 The attack on Syria 2007 ................................................................................. 46 3.2.7 The attack on Georgia 2008 ............................................................................. 47 3.2.8 Intrusion of US drones 2009/2011 ................................................................... 47 3.2.9 Attacks in the Ukraine ..................................................................................... 47 3.2.10 North Korea ................................................................................................... 48 Cyber war 07 Jul 2019_English 2 apl. Prof. Dr. Dr. K. Saalbach 3.2.11 Local cyber conflicts ...................................................................................... 49 3.2.12 Cyber warfare against Islamic State (‘IS’)..................................................... 49 3.2.13 Cyber conflicts in 2019 .................................................................................. 52 4. Attribution .......................................................................................................... 53 4.1 Introduction ............................................................................................................. 53 4.2 Cyber-attack attribution .......................................................................................... 53 4.3 Hackers ................................................................................................................... 56 4.4 Cyber War Attribution ............................................................................................ 59 5. Malware and Advanced Persistent Threats ........................................................ 60 5.1 Sophisticated malware ............................................................................................ 60 5.2 Advanced Persistent Threats (APTs) ...................................................................... 62 5.2.1 The Equation group.......................................................................................... 66 5.2.1.1 Detection history - The ‚digital first strike’ .................................................. 66 5.2.1.2 Equation group cyber tools ........................................................................... 70 5.2.1.3 The Shadow Brokers incident ....................................................................... 73 5.2.2 The Longhorn Group/Lamberts/Vault 7 incident ............................................ 75 5.2.3 Sauron/Strider and Slingshot ........................................................................... 77 5.2.4 APT28 and APT29 ........................................................................................... 77 5.2.4.1 APT28 (aka Sofacy, Pawn Strom, Csar Team, Sednit, Fancy Bear, Strontium) ................................................................................................................. 77 5.2.4.2 APT29 (aka Cozy Duke/Cozy Bear)............................................................. 78 5.2.4.3 The German Parliament Bundestag hack ...................................................... 79 5.2.4.4 The DNC hack/Attacks on voting systems ................................................... 81 5.2.4.5 The WADA hack .......................................................................................... 82 5.2.4.6 The Macron hacks ......................................................................................... 83 5.2.4.7 The Yahoo hacks........................................................................................... 83 5.2.4.8 The LoJax firmware campaign ..................................................................... 83 5.2.4.9 Further activities ........................................................................................... 83 5.2.5 The Waterbug group (aka Turla/Snake/Ouroburos/Venomous Bear/Krypton/Group88) ...........................................................................................