Black Ice: Cyber-terrorism and the Private Sector

Corporate America is still in denial about the threat of cyber-terrorist attacks against critical facilities in the energy, telecommunications and financial industries.

By Dan Verton

August 11, 2003 12:00 PM ET

Recommended

Computerworld - Editor's Note: Dan Verton's book gets its title from an emergency planning exercise for the 2002 Winter Olympics in Utah, code-named Black Ice. In the simulation, a major ice storm combines with the disruption of utility computer systems to produce regional blackouts, Internet outages, cell phone overload and telephone failures. It demonstrated the devastating effect of physical and electronic attacks on the power grid and everything that depends on power, including computer systems. An earlier exercise, run by the National Security Agency (NSA) and code-named Eligible Receiver, was equally chilling:
Prior to launching their attacks on June 9, 1997, officials briefed the team of 35 NSA computer hackers on the ground rules. They were told in no uncertain terms that they were allowed to use only software tools and other hacking utilities that could be downloaded freely from the Internet through any one of the hundreds and possibly thousands of hacker Web sites. In other words, the Pentagon's own arsenal of secret offensive information warfare tools, which the NSA certainly had, could not be used. And while they were allowed to penetrate various Pentagon networks, the Red Team was prohibited from breaking any U.S. laws. The primary target was the U.S. Pacific Command in Hawaii, which is responsible for all military contingencies and operations conducted in the Pacific theater, including the tension-wracked Korean peninsula.

Black Ice: The Invisible Threat of Cyber-Terrorism

Posing as hackers hired by the North Korean intelligence service, the NSA Red Team dispersed around the country and began digging their way into military networks. They floated through cyberspace with ease, mapping networks and logging passwords gained through brute-force cracking and the more subtle tactic of social engineering - sometimes it was just easier to call somebody on the telephone, pretend to be a technician or high-ranking official, and ask for his password. The team gained unfettered access to dozens of critical Pentagon computer systems. With that level of access, they were free to create legitimate user accounts for other hackers, delete accounts belonging to authorized officials, reformat the server hard drives and scramble the data, or simply shut the systems down. They were able to break through the paltry network defenses with ease, after which they could conduct denial-of-service attacks, read or make minor changes to sensitive e-mail messages, and disrupt telephone services. And they did so without being traced or identified.
The results of the exercise stunned all who were involved. The NSA Red Team, using hacking tools that were available to anybody on the Internet, could have crippled the U.S. military's command

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

Security

Additional Resources

Microsoft

DirectAccess and UAG: Better Together

Here are some of the key reasons why you would want to run Unified Access Gateway with DirectAccess.

Microsoft

Case Study: Energy Firm Tightens Protection, Simplifies IT Work

Review how one energy firm tightened protection and simplified IT work using business-ready security solutions.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Death to PST Files
Download Now

Four Ways to Improve Your TSM Environment with a SEPATON VTL
Watch Now

The Tangled Web: Silent Threats & Invisible Enemies
Download Now

Tape Killed the IT Guy
Watch Now

Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now

BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!

What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now

Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".

eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

All White Papers | All Webcasts