July 12, 2007:
Cyber War commanders are resigned to the fact
that they will have to use mercenaries if they want to survive any future
Internet based conflict. Much use is being made of mercenaries right now, in
the race to build up stockpiles of munitions. In Cyber War, the ammo is
information. That is, knowledge of vulnerabilities in software connected to the
Internet, or major networks not connected to the Internet.
The software vulnerabilities are basically
bugs that enable a hacker to gain access to a computer they are not supposed be
in. Not all vulnerabilities are equal. Some are much more valuable than others.
Commercial Internet security firms offer rewards to people (usually software
engineers who spend too much time on the Internet) who first discover a "zero
day vulnerability" (this is a bug that has not yet been put to use by a hacker
to create a "zero day exploit.") The rewards can sometimes exceed $100,000. The
commercial security firms, which provide services for corporate and government
clients, offer the rewards openly. There is a more lucrative underground
market, financed by criminals and some governments, that offer even larger
rewards.
The commercial firms get after the software
publishers to fix the bugs, but they have noted that this takes, on average,
348 days. The publishers know that every time they open their source code to
repair something, there is high risk of creating more bugs. Moreover, it's
expensive to fix the bug, test the patched software, and then distribute it to
their customers. Thus, unless the bug is highly likely to be exploited, it is
not attended to right away. The problem with this approach is that the software
publisher may not be aware of how exploitable the bug is. Criminals and Cyber
Warriors have an interest in finding ways to exploit bugs that appear relatively
harmless. That turns the bug into ammunition, for the Cyber War, and a way to
make money, for the criminals.
In preparation for a Cyber War, ammo supply
is critical. Put simply, whoever has the largest number of vulnerabilities
(unpatched, of course), and has turned them into exploits, will win. There's a
lot of evidence that the United States and China have both compiled large
arsenals, and tested a lot of their stuff. Other countries are players as well,
but the U.S. and China appear to be the superpowers of Cyber War.
The U.S. has an edge in the number of
potential "mercenaries" (commercial security firms, and freelance experts) it
could enlist for the war effort. China openly encourages its hackers to go out
and practice on foreigners, especially the Japanese (still hated for World War
II era atrocities) and the United States. China is also believed to have
arrangements and understandings with the gangs that specialize in Internet
based crime. Remember, China is still a police state, and communist secret
police organizations have long been known to use criminal organizations for all
sorts of things.
In the United States, some police agencies
have been known to at least open up communications channels with Internet
criminals. If only for intelligence purposes. But in wartime, offers of
employment might made as well.
There hasn't been a full out, no-holds-barred
Cyber War yet. But there's no longer any doubt that it is possible. And the
major powers are getting ready.
