Here's How Cyber-Warfare Started And Where It's Going

Reuters

When America dropped its two atom bombs, Little Boy and Fat Man, over Japan in August 1945, it launched the world into a devastating new era of warfare. Nearly 70 years later, humanity is still trying to contain the fallout. But in its zeal to check nuclear proliferation, America--along with Israel--opened up yet another theatre of war: cyberspace.

In 2007 a computer worm called Stuxnet was detected for the first time by virus-scanning software, although signs of it may have existed unnoticed before that. At least three more versions followed, seeking to wreak havoc upon Iran's uranium-enrichment facility at Natanz. Stuxnet made itself busy. It turned valves on and off and meddled with the centrifuges, wasting uranium and damaging equipment. It succeeded in slowing Iran's uranium enrichment, and by extension its purported nuclear-weapons programmes, making Stuxnet the first documented case of cyber-warfare intended to cause physical damage.

Where Stuxnet fell short was in remaining hidden, thanks to a series of "flubs that should never have occurred", writes Kim Zetter in "Countdown to Zero Day", an authoritative account of Stuxnet's spread and discovery. In June 2010 a tiny antivirus firm in Belarus stumbled upon Stuxnet while investigating a malfunctioning machine in Iran. The worm contained a "zero-day exploit"--a previously undiscovered software bug--that brought it to attention. An unprecedented five "zero-day exploits" were eventually found in the code. Researchers also discovered that Stuxnet had used a stolen digital certificate, the foundation of the internet's web of trust, bringing the worm further renown.

Such attention-grabbing tactics were the first mistake. The second was failing to anticipate the willingness of security experts to make up for the shortcomings of Iranian investigators. Researchers at Symantec, and Kaspersky, an American and a Russian computer-security company, tore apart Stuxnet and its siblings for more than two years in a bid to reveal the full range of their abilities.

Had Ms Zetter, a reporter at Wired, stopped at simply recounting this saga, "Countdown to Zero Day" would be an interesting record of an intriguing worm of little interest beyond security specialists. But the book deserves a wider audience for its sobering message about the vulnerability of the systems--train lines, water-treatment plants, electricity grids--that make modern life possible. These industrial control systems are increasingly hooked up to the internet, allowing remote access. Passwords are seldom changed from the systems' defaults. Security updates are rare. Firewalls and network logs are inconsistent. Warnings are ignored. Little surprise, then, that researchers have been able to simulate shutting down energy grids, infiltrating water plants and destroying generators. A 14-year-old in Poland derailed four trams in 2008. Another teenager took down communications at a Massachusetts airport. Utilities today encourage the use of internet-connected "smart meters" in homes. The attackers of tomorrow could very well use them to black out entire cities.

Despite the opportunity, the world has yet to see a sequel to Stuxnet. But "given the varied and extensive possibilities for conducting such attacks," Ms Zetter writes, "...it is only a matter of time until the lure of the digital assault becomes too irresistible for someone to pass up." Containing this new proliferation will be even harder. It takes money, raw materials and large facilities to develop nuclear weapons. A cyberwarrior needs only a computer and an internet connection to wreak havoc.

Click here to subscribe to The Economist