{"id":339108,"date":"2017-04-24T08:30:02","date_gmt":"2017-04-24T00:30:02","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1480249"},"modified":"2017-04-24T08:30:02","modified_gmt":"2017-04-24T00:30:02","slug":"why-the-wikileaks-cia-dump-was-the-most-damaging-one-yet","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/why-the-wikileaks-cia-dump-was-the-most-damaging-one-yet\/","title":{"rendered":"Why the Wikileaks CIA dump was the most damaging one yet"},"content":{"rendered":"

<\/p>\n

\n

Eric O’Neill<\/span> Contributor<\/span><\/p>\n

Eric O’Neill<\/a> is the national security strategist for Carbon Black<\/a> and a former operative for the FBI, where he conducted national security field operations against terrorists and foreign intelligence agents.<\/p>\n<\/div>\n

It\u2019s impossible to keep up with the nonstop news coverage and multiple storylines around the recent Wikileaks CIA dump. The initial Vault 7 data drop led to Assange\u2019s press conference about \u201chelping\u201d private companies patch vulnerabilities, all while fear started to spread around the intelligence community listening in to our internet-connected Samsung TVs and Apple products at home, and Cisco disclosing<\/a> that its routers and Internet switches had been hacked.<\/p>\n

Most recently, CIA Director Mike Pompeo criticized<\/a> WikiLeaks in his first public address since being confirmed, calling the organization a \u201cnon-state hostile intelligence service.\u201d Pompeo makes an undeniable point about the far-reaching consequences of a leak such as this one \u2014 which, speaking from an intelligence perspective, is likely the most frightening yet.<\/p>\n

The truth of the matter is that the breach of the CIA\u2019s attack tools not only placed the U.S. at a deficit in our offensive cyber capabilities, it has threatened the world\u2019s most critical businesses, organizations and national security peace of mind. To echo Pompeo\u2019s statements, we are now all more vulnerable.<\/p>\n

If WikiLeaks releases details on the vulnerabilities, attackers of all stripes will soon have the ability to weaponize the CIA\u2019s tools \u2014 not just nation states with advanced cyber programs like China, Russia, North Korea and Iran, but anyone<\/em> with adequate internet access and some technical knowhow.<\/p>\n

This isn\u2019t just a dump of information by a disgruntled employee that saw the new Snowden movie and thought they could be a hero. It appears to be a calculated breach by a spy.<\/p>\n

\"\"<\/p>\n

Cyber espionage has been the new normal for years<\/strong><\/p>\n

There are no hackers anymore \u2014 now it\u2019s all about the spies we in the intelligence and security communities are trying to stop. The \u201cinsiders\u201d have known this for some time, but it\u2019s becoming more apparent to the business community and now individuals. Numerous criminal and espionage attacks plague computer systems in all industries, public and private.<\/p>\n

For the CIA breach, it\u2019s imperative for the FBI to determine how it occurred. We hope that the breach was a single employee or contractor that acted out of \u2018hacktivism.\u2019 More concerning is the thought that a foreign intelligence service could have recruited an insider traitor to extract the hacking tools. The recent DOJ indictment around the Yahoo breach shines a light on Russia\u2019s recruiting tactics<\/a>.<\/p>\n

The intelligence community may have a serious trusted insider problem. There\u2019s a fine line between whistleblowing and leaking information that directly aids foreign intelligence services. Leaks of classified information can be incredibly harmful \u2014 especially when they reach the wrong hands.<\/p>\n

\"\"<\/p>\n

\u00a0(Photo: SAUL LOEB\/AFP\/Getty Images)<\/p>\n<\/div>\n

The real threat of WikiLeaks\u2019 CIA dump: the rise of non-malware<\/strong><\/p>\n

Despite news coverage mainly focusing on spying capabilities for consumer-level devices, there is a silent killer lurking in the shadows of the dump: several of the tools released were non-malware attacks (often called fileless attacks or \u201cliving-off-the-land\u201d attacks).<\/p>\n

Non-malware attacks gain control of computers without downloading malicious software. Instead, they use trusted, native operating system tools, such as PowerShell, and exploit running applications, such as browsers, to \u201clive off the land.\u201d These attacks pose a bigger risk than malware attacks because they are harder to detect and cause more damage.<\/p>\n

The security industry has noticed the rise of these attacks as criminals and spies use them more. The CIA was also exploiting these attack methods \u2014 given that they\u2019re a nearly undetectable way to breach a system \u2014 but the Vault 7 release gives these tools to a large number of potentially malicious actors.<\/p>\n

Non-malware attacks will become more commonplace, more advanced and more frequent, and security practitioners everywhere need to be on high alert. Based on previous history, I expect WikiLeaks to make these vulnerabilities public immediately after tech companies create a patch. If they follow this route, that will allow attackers to use the tools to conduct surgical strikes and weaponize every asset available.<\/p>\n

\"\"<\/p>\n

What happens next, and what needs to happen to mitigate our risks<\/strong>\u00a0<\/strong><\/p>\n

Russia will never stop spying. Similarly to what we\u2019ve done with China, we should try to limit espionage to government against government, not government against the private sector. There have been discussions about enacting a \u2018Digital Geneva Convention,\u2019 but that will hinge on our ability to come to agreements across the board.<\/p>\n

Our best move against Russia, China, North Korea, Iran and countless others to defend against cyber attacks is not necessarily in policy or diplomacy, but in stronger cybersecurity across our nation\u2019s mission critical systems.<\/p>\n

Cybersecurity relies on a partnership between the public and private sectors. Private industry is attacked as often as government, and must therefore invest in robust cybersecurity technology, software and personnel. The government has been deficient in cyber defense and needs to invest similarly. Both public and private must coordinate cyber efforts and share threat information among a defense community.<\/p>\n

The uphill battle for individuals and the business community is still awareness \u2014 I\u2019m shocked that the very high profile attacks on the DNC and Clinton campaign, the extraordinary amount of ransomware attacks and the high profile government breaches haven\u2019t brought home the very present threat to a more general public.<\/p>\n

I fear that the message won\u2019t hit home for most people until a cyber attack rises to the level of a kinetic attack. At some point attackers will successfully target our critical infrastructure \u2014 once the lights are out for a significant period of time, cybersecurity will be taken more seriously, but the hope is that we can begin to wake up before then.<\/p>\n

Featured Image: Bryce Durbin\/TechCrunch<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

\"\" There are no hackers anymore — now it’s all about the spies we in the intelligence and security communities are trying to stop. The “insiders” have known this for some time, but it’s becoming more apparent to the business community and now individuals. Read More<\/a><\/p>\n

\n<\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-339108","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/339108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=339108"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/339108\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=339108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=339108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=339108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}