Future cyber attacks could prove catastrophic, say online security experts

Is the cyber security analyst Eugene Kaspersky the most dangerous man in the world? After more than 15 years researching cyber-crime and running the international online security firm Kaspersky Lab, he is certainly the most paranoid.

Cyber threats are developed as quickly as new technologies themselves, he told a session at the DLD13 conference in Munich on Monday, and with computers now such a critical part of our infrastructure – from our smartphones and cars to national energy systems and even prisons – the potential for damage and danger is catastrophic.

He points to Stuxnet, which was confirmed as the culprit behind three incidents of cyber-terrorism: one in Estonia, one on an Iranian nuclear facility and one on oil companies in Saudi Arabia, which destroyed data on 30,000 computers. If viruses can damage hardware, as in 1998 and 1999 when 10,000 notebooks were destroyed with one virus, are we ready to reinstate human-operated mechanical control systems as roadblocks? It won’t happen, but things are only going to get worse, he warns.

Co-speaker Mikko Hypponen, chief research officer at F-Secure, dismisses the “happy teen hacker” image of the last decade. “In the late 1990s the enemy was simple – happy hackers writing for fun. Those days are behind us – now the hackers have motives.”

Hackers now are either criminals out to make money, activists out to protest or governments engaged in targeting their own citizens or attacking other governments, whether for espionage or cyberwarfare. Hypponen flashed up some mugshots of hackers, mostly convicted criminals and one Estonian who ran a rogue ISP that produced enough money to employ experienced hackers, fund its own servers, test and quality control on its malware. That level of resource and sophistication makes life very difficult for those charged with defending networks from attack, said Hypponen.

The biggest threat, both agreed, is state involvement. Where a rogue phisher or malware attack might be the criminal equivalent of a street mugger, state-sponsored attacks come with all the resources and technological sophistication of James Bond. Resistance, if not futile, is extremely hard. Attacks are also very difficult to attribute to anyone; they could be written in a Chinese version of Word to make it appear the attack originated in China, or could be routed via Canada.

We are at the beginning of a new and dangerous era of cyberwarfare, both concluded. Hypponen pointed out that it is essential to identify what kind of attack it is; governments should be encouraged to cooperate to defeat criminals, but will also be engaging in cyber espionage against each other.

Karspersky was characteristically jolly, but painted a neurotic Alice in Wonderland scenario. “It’s a totally new world and we are trying to work out how to behave in the right way. We are trying different doors and different drinks… that’s the view of a paranoid man, but I do believe we will survive.”