Newsletter Sign-Up

Receive the latest technology news and information.

Black Ice: Cyber-terrorism and the Private Sector

Corporate America is still in denial about the threat of cyber-terrorist attacks against critical facilities in the energy, telecommunications and financial industries.

By Dan Verton

August 11, 2003 12:00 PM ET

Computerworld - Editor's Note: Dan Verton's book gets its title from an emergency planning exercise for the 2002 Winter Olympics in Utah, code-named Black Ice. In the simulation, a major ice storm combines with the disruption of utility computer systems to produce regional blackouts, Internet outages, cell phone overload and telephone failures. It demonstrated the devastating effect of physical and electronic attacks on the power grid and everything that depends on power, including computer systems. An earlier exercise, run by the National Security Agency (NSA) and code-named Eligible Receiver, was equally chilling:
Prior to launching their attacks on June 9, 1997, officials briefed the team of 35 NSA computer hackers on the ground rules. They were told in no uncertain terms that they were allowed to use only software tools and other hacking utilities that could be downloaded freely from the Internet through any one of the hundreds and possibly thousands of hacker Web sites. In other words, the Pentagon's own arsenal of secret offensive information warfare tools, which the NSA certainly had, could not be used. And while they were allowed to penetrate various Pentagon networks, the Red Team was prohibited from breaking any U.S. laws. The primary target was the U.S. Pacific Command in Hawaii, which is responsible for all military contingencies and operations conducted in the Pacific theater, including the tension-wracked Korean peninsula.

Black Ice: The Invisible Threat of Cyber-Terrorism

Posing as hackers hired by the North Korean intelligence service, the NSA Red Team dispersed around the country and began digging their way into military networks. They floated through cyberspace with ease, mapping networks and logging passwords gained through brute-force cracking and the more subtle tactic of social engineering - sometimes it was just easier to call somebody on the telephone, pretend to be a technician or high-ranking official, and ask for his password. The team gained unfettered access to dozens of critical Pentagon computer systems. With that level of access, they were free to create legitimate user accounts for other hackers, delete accounts belonging to authorized officials, reformat the server hard drives and scramble the data, or simply shut the systems down. They were able to break through the paltry network defenses with ease, after which they could conduct denial-of-service attacks, read or make minor changes to sensitive e-mail messages, and disrupt telephone services. And they did so without being traced or identified.
The results of the exercise stunned all who were involved. The NSA Red Team, using hacking tools that were available to anybody on the Internet, could have crippled the U.S. military's command

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

Security

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Share our Strength
Download Now

Extending Client Refresh - 11 Steps to Maximize Savings
Register Now!

Can Heuristic Technology Help Your Company Fight Viruses?
What is Heuristic Technology and how can it help safeguard your business against viruses? Learn more.

Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!

Eradicate Spam & Gain 100% Asurance of Clean Mailboxes
Get this paper now!

Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!

Mastering eDiscovery: The IT Manager's Guide to Preservation, Protection & Production
Get this paper now!

Consolidate Your Servers and Storage to Lower Costs with Oracle Database 11g
Register for this webcast!

Not Just Words: Enforce Your Email and Web Acceptable Usage Policies
Get this paper now!

The Commercialization of ITIL: Lessons Learned
Register for this event today!

All White Papers | All Webcasts

Computerworld Reports

8 Questions To Ask About Your Intrusion-Security Solution

Computerworld Technology Briefings IT Service Management

Computerworld Briefing - Analytics: The Art and Science of Better

All Computerworld Reports

	Security
	Virus and Vulnerability Roundup
	Computerworld Daily News (First Look and Wrap-Up)
	Computerworld Blogs Newsletter
	The Weekly Top 10
	Cloud Computing

resource center