Loading summary
Transcript94 lines
- [00:04]
A
Hello everyone, this is Tom Uren. I'm here with another Between Two Nerds edition and. Hello, Grok, how are you?
- [00:09]
B
Good morning, Tom. Fine, and yourself?
- [00:11]
A
I'm very well. This week's edition is brought to you by Run Zero. Run Zero is an active and passive network discovery tool that can find all sorts of amazing stuff on your own network, stuff that you probably didn't know was there. Find them@runzero.com so this week, Gruk, there was a report in the Record where they have an exclusive that US officials told the Record that they there was some sort of cyber operation around the US's bombing of Iranian nuclear facilities. And the story is that they did something to some. Something to. Something to disrupt Iranian air defence systems. And the sort of description sounded vaguely plausible to me that there was some keynote in something that wasn't air defense, but because of the connectivity it sort of degraded the whole system.
- [01:05]
B
Right.
- [01:05]
A
And so that was a nice to have in that they didn't say it stopped the whole system. It wasn't a flick, the switch off. The language was a bit caveated. Plus, like we know that the US has stealth aircraft and electronic warfare aircraft and Israel had been bombing Iran's air defense. So it's, it seemed like a nice to have. Now it struck me that we actually have three good examples of, I guess you'd, you'd call them cyber superpowers using some sort of clever cyber operation at a time when they've had the time and space to plan. So there's this example air defense. We've got the recent example of the US reportedly switching off power in Caracas, so electricity grid. And then the third example is actually the Russian invasion of Ukraine where they disrupted communication networks.
- [02:06]
B
Right.
- [02:07]
A
At least two that I'm aware of. So this made me think, and this is what we'll talk about. Is this something that's worth having? If you're like a middle power or a smaller country, should you be investing in your military cyber capability?
- [02:26]
B
Is this as good as it gets? Right. When you are the top cyber superpower and you can turn off the lights in a few neighborhoods in Caracas for a few hours.
- [02:37]
A
I think that's a super important point. This is, it's the best in the world versus maybe not necessarily the worst in the world, but there's definitely a level of overmatch. Yeah, I think in all three of those examples, the receiving country is not prepared. By no stretch of the imagination were they any sort of defensive cyber powerhouse or anything like that.
- [03:01]
B
Just to very briefly, the Ukrainian example, it's not a Ukrainian company that was hacked. Right. So like viasat is run by someone else. And so even if the Ukrainians were, which they weren't, even if the Ukrainians were, you know, on a war footing, super good at defense and all that, they were not the target of that attack. So same thing with holes, I think. Yeah.
- [03:28]
A
Now, I think in those examples, it's at least conceivable that the, particularly the Caracas one, it's conceivable that the US could have done more. Like, it's, it's limited to particular areas by choice because it suited the operation.
- [03:44]
B
Like they, it was restraint, not constraint.
- [03:47]
A
Yes, yes. Like voluntarily targeted rather than. So they, they could have done more. But still, I think I, I could.
- [03:55]
B
Have totally done way more. I just chose not to. You know, I'm holding back, man. You're lucky.
- [04:00]
A
I'm, I'm, I'm hoping you might push back here. But I was thinking that for like, for a country like Australia, middle power, and how much effort should we be spending on like combining military cyber operations with conventional military? And I guess for Australia, because we're part of the five Eyes, we've got a lot of know how that actually kind of makes sense. But then I think it, it drops off fairly rapidly. Like if you're a country, probably a cliff, right.
- [04:30]
B
There's this slightly gentle slope of there's the US and then US partners in Five eyes who basically have to contribute on cyber espionage to some degree, which means you're making the investment to be in the club, to show willing and all this stuff. You may as well get some additional benefit from that existing investment that you're doing anyway, particularly because so much of it can lean on your allies because.
- [05:00]
A
You'Ve got the power already. It's like an incremental investment to be able to use it in this other way.
- [05:07]
B
Yeah. Like take the Netherlands, for example. They punch way above their weight class. They probably wanted the cyber superpowers, or at least a cyberpower to be reckoned with. Is it worth it for them to add cyber to their military? I would say yes, but I would position it like this. Given. Given that the Dutch military is probably not massive, but they are overpowered on cyber, it would make sense that sort of like within NATO, because you have all these smaller countries, the way it sort of should work and kind of tends to work is that they will contribute one arm of military stuff that they will sort of maximize.
- [05:51]
A
Right.
- [05:52]
B
And that way it'll be like, you.
- [05:53]
A
Know, it's like International trade and comparative advantage, where you.
- [05:56]
B
Exactly, yeah.
- [05:57]
A
You focus on your specialty rather than just trying to be a jack of all trades.
- [06:02]
B
Right. So if you, if you have like 20 small groups each trying to be the best at everything, who can't invest any resources in doing it properly, you'll have a bunch of very mediocre stuff. Whereas if each of them sort of picks one thing and maximizes on that, you'll end up with like a, A bunch of maximum, like the best Air force, the best Special forces, the best whatever. Like the Dutch, I would say. Yeah, like go for cyber. You can, you can beat anyone else in Europe in cyber. I would say that's your thing. Like own it. It'll be really embarrassing because all you can do is, you know, turn out the lights in the first week of operations and then after that you're basically doing nothing but reading emails, however. So, yeah, like I would say for them, it would be worth it just because of the, the force structure that they're within.
- [06:55]
A
Right, right.
- [06:57]
B
But if you're Germany, for example, who would be like, they're, they're a major power, but they're a major regional power. I don't think it's worth it.
- [07:06]
A
Right, yeah. So the argument I'm hearing then, and I think this plays into Germany as well, is that it makes sense if you've got some specialty in cyber already. It's a dual use. Good. We can alter our doctrine, alter our way of working, work with these other people who are military people and are a bit different, but perhaps we can contribute to operations. There may be space for that. And in the case of Germany, that doesn't work because you wouldn't call them a cyber power in the first place. I was reading just the other week that the. I think the Interior minister was like, talking about bolstering their intelligence capability in the first place. So that's a long way away from, you've got to walk before you run. But the other thing that struck me is that all of the three operations we talked about, there were long lead times and they were all essentially surprise attacks.
- [07:57]
B
Yes.
- [07:58]
A
And so, like, I can't imagine Australia launching a surprise attack on anyone, like, ever.
- [08:05]
B
I don't think Kiwis are expecting anything. So.
- [08:09]
A
That's right. And I think that's true for many countries. I mean, maybe you just plan for those things in case, like, as contingencies. But like, I guess the question is how much time and effort do you put in to plan for a contingency? That the first thought is, oh, yeah, that'll never happen.
- [08:28]
B
Yeah. Australia starts eyeing East Timor going, you know, they're getting a little bit. So here's the thing. I think that it works best during the friction free opening stages of a conflict, which is either a major operation or an invasion of some sort, like a surprise attack or whatever. That's when you can coordinate kinetic forces and cyber forces together. You have the lead time to prepare your cyber attacks so that they happen when you need them to. You don't have any sort of like weird buffer space of like, yeah, we need two more weeks, but also your kinetic forces can meet those deadlines as well. It's not like all we need to do is overcome their first line of defense, get past the minefield, overcome the tech traps, and then we will absolutely be there by 6am you sort of, you need both of those things together and it's only during the beginning phases that you really get there. So the difficulty is the things that cyber is really good at do not match military understandings of capabilities. So the military wants something where they could say, here's a plan, we're going to plan, task, execute, assess. So they're going to say, here's the thing we want to do. Or it might be task, plan, execute, assess. Anyway, it doesn't matter. Point is that it's like you come up with something, you give it to someone, you run your attack and then you see what has happened. Like, did it work? Did it do the thing I wanted? And that's very easy if you're blowing stuff up, but because you can see is it blowed up or not. Right? Like, or did we kill the people? Did we capture that hill? So when they use cyber, they like to use cyber in a way that can match that sort of mental model, that framework that they have of like.
- [10:18]
A
Do a thing, deploy cyber fires.
- [10:22]
B
Right, yeah. They need something they can execute and then assess. Like, do it now. Okay. If the lights are off, it has worked. That's what they're looking for. To me, the value of cyber is that you can do all of these other things that look nothing like something that is not as good as a missile at blowing things up or something that is better than a missile could ever be at things that a missile cannot do.
- [10:48]
A
Right, right, right, right. Like, so, like, this is reminding me of asd, the Australian Signals Directorate. They spoke publicly about tackling ransomware, I think it was. And the way they did that was they basically infiltrated the criminal forums that a particular ransomware developer was working on, making his living on they fiddled with his malware so that it didn't work, and then they basically, you know, planted stories and threads that. That tried to destroy his reputation.
- [11:25]
B
Right, right.
- [11:26]
A
So, I mean, with a missile, you could clearly blow that person up if you could find them.
- [11:31]
B
Well, it's not. It's not warheads on foreheads, which is what they want. Right. But yeah, like, that's like, you can't blow up a reputation with a tomahawk.
- [11:41]
A
Yeah. One of the things, like, going back to the story at the beginning about degrading Iranian air defence, I was kind of initially surprised that they spoke about it at all, because, like, the rationale is that you don't speak about these things so that you ret capability. But I was thinking in this particular example, it's like, well, we've got a capability that is not as good as a bomb, and so if they find it and fix it, we'll just blow the things up. If we ever.
- [12:05]
B
We'll go back to the better one. That's right. It's probably the bomb people trying to sabotage the cyber guys, like, give it back. That was ours. So, to a degree, I agree with you. But I think that the, like, the use it and lose it argument is false on false in the short term and truer in the long term than people think. So the way it's usually framed is you have a specific capability, and if you use that capability, the. The victim or the enemy will figure out how it works and then we'll block it and then you'll never be able to use it again, which is sort of not how things work in the real world. Like, it's slow. You have to. If it's a bug that needs to be reported to Microsoft, then you have to wait until they get around to fixing it, like, all of this stuff. So you use your capability and eventually it'll get patched. But given that the most popular CVEs are all like 20, 20, 2018, sometimes, like, it's just. It's not that big a deal. But what does happen is the entire sector that you targeted will get more secure in general because now they'll be aware of the attack. So while you might be able to retain that specific capability, the use of any capability is going to degrade. So it's a. Like, it's a slightly different argument than use it and lose it. Right.
- [13:29]
A
Yeah.
- [13:29]
B
So you can continue to keep using it. It's just you'll no longer be able to use anything eventually.
- [13:35]
A
Right.
- [13:35]
B
Is what you're getting towards.
- [13:37]
A
Yeah. And in the case of air defense, well, that's why we've got systems to destroy air defenses, so whatever.
- [13:44]
B
Yeah.
- [13:44]
A
I mean, talk about it all we like.
- [13:48]
B
Exactly that. And I mean, the Americans can never shut up every time they do something with cyber. Right.
- [13:54]
A
Like, it's just in their nature.
- [13:58]
B
Yeah. Like, I don't know what drives them, but for some reason, you're guaranteed to read about it in the Washington Post within, like, a few months, like, they'll have come out and bit like, okay. Actually, what happened was the question I.
- [14:11]
A
Started with was, if you're a smaller power, is it worth investing in it? And my answer so far is like, no. But it also seems like the sort of thing where it just seems, like, very attractive. Like, it's an attractive sales pitch that if you give us all this money and time, we'll invest in these elite hacker type people and they'll give us these magic powers and we'll be able to do things that we can't do.
- [14:42]
B
So in Max Smitzer's book, no Shortcuts, he talks about, like, when do you get a cybercom? Essentially, when does the military start investing in cyber? And his finding was that it's sort of. It's not when your enemy starts getting cyber and you realize, okay, well, we're going to have to counter this. We need our own cyber. Like, if your enemy starts getting tanks, you get tanks, because you need to deal with that. If they get cyber, it doesn't actually change what you're doing. However, if one of your allies gets cyber now, you get cyber. Right. So it seems to be much more of a keeping up with the Joneses or, like, trying to fit in with the other kids. It seems a little bit like a high school clique where, like, one person gets an earring and within a week, like, everyone else has an earring, which they were going to do anyway, you know? Totally. It's just, you know, like, it's. It's like this little fashion trend that takes over militaries of like, oh, yeah, we're going to get a cyber now. You know, the Dutch have a cyber. We should get a cyber, too. That'll be. That'll be a cyber. It'll be good, I guess. And none of them know what to do with it because, like, no one knows what to do with the cyber. Like, no one knows how to use cyber for military stuff because you end up with this, like, pseudo kinetic whatever. And it's like, it's impressive if you're selling it to, like, a politician. Of like, look what we were able to do with all that money you gave us. We could like reach out and pinpoint, turn off, blah, blah, blah. But like to a military person you're like, look, we were able to turn out the lights for three hours and they go, okay, and this costs how much? More than sending one plane with one bomb.
- [16:17]
A
I also go back to the like, it just seems that for most countries the operations you would do that it would suit are just vanishingly rare.
- [16:27]
B
Right. Not a lot of cross border invasions happening these days. I mean like, honestly they just aren't.
- [16:35]
A
Yeah, no, that's right. Yeah.
- [16:37]
B
And you know, the ones that do happen tend to be between countries that don't have a lot of computers in general, let alone like highly, highly digitized armed forces where the use of cyber to like blind the enemy is going to be like a major part. It's a whole lot of like there's dudes in trenches and they go over the top.
- [16:59]
A
Yeah. I was thinking of India, Pakistan actually or India, China where it seems that they do have flare ups that become like physical at times. Like people die, but they don't seem to be like planned operations. It's like right. Like literally a responsive flare up for one reason or another.
- [17:20]
B
Yeah. Someone was looking at someone a bit funny and it sort of escalates a little bit, gets slightly out of control and then calms down again. Which is not a situation where cyber is useful because you need that lead time.
- [17:32]
A
Yeah.
- [17:33]
B
All of which is to say I don't think that kinetic, like kinetic simulation or like a pseudo kinetic, basically this use of cyber is not the best use of cyber. Like this is not where you're getting real value in my opinion. There's a lot you can do with cyber that you can't do with anything else and it's a lot more impressive. So if you're fighting a country and you want to degrade their ability to fight using cyber against their economic engines in ways that might not show up. Right. So rather than like, you know, DDoS, the bank, if you can break into a bunch of banks and then make it so that they stop being able to do like their end of day accounting starts being wrong every single day, you will cause problems for their central banks to, you know, manage money. And that's going to be a huge problem in terms of like being able to fight the war. Right. But that's not necessarily going to show up in the same way as turning out the lights.
- [18:40]
A
So I'm thinking of Israel, Iran, where for quite A long while there was Predatory Sparrow, which was this sort of thinly veiled Israeli group that would kind of go around destroying things for Mossad may, you know, for propaganda purposes, in that they weren't on a scale that would like, you know, make a difference to a whole state, but they were, they were spectacular and they were intended to be hinged to things like breaking of sanctions. But then when there was actually that kinetic conflict, they did go and wipe a bank. I think it was a particular bank that had been involved in sanctions and.
- [19:23]
B
A crypto exchange or two.
- [19:25]
A
Yeah.
- [19:26]
B
Like they.
- [19:27]
A
Yeah. So there was this escalation, but it, at the same time that, that still felt like an annoyance rather than something that would ever tip the scales.
- [19:37]
B
Yeah. So I, I could see how in theory, you could be like, trying to target the regime by destroying their bank accounts so that they, they don't have money. But from my understanding, which is a bit limited, of course, was that it just, it basically affected regular people far more then, you know, like, if you've got a multi millionaire and you steal a million of his, like, and you steal a million dollars from him, he will feel that. But if you have like a whole bunch of people who collectively have a million dollars and you take all of that, all of them are going to feel it and it's going to be a huge deal because that's everything for them. Right.
- [20:16]
A
I feel like if you're, you know, tremendously wealthy and you can't access your bank accounts, everyone trusts that you will get your money back and you're good for your word. But if you've got no money more.
- [20:26]
B
Than one bank account, I think is the thing. Right. Is you've got like, well, I'll always have the 10 beachfront properties and like my garage full of Lamborghinis and. Exactly, yeah. People are going to trust, like, oh, okay, he can't get to his, like, main bank account, but give it a week and he'll have access again.
- [20:44]
A
Whereas the poor person who can't get to their bank account, they're just even more poor. So why would you trust them, I guess, is the sort of sad dynamic there. I was also wondering about. So the UK had their doctrine of cognitive effects, where the national cyber force talked about trying to influence very small groups of people. And so I guess the ASD example I spoke about of targeting would fall into that category. And that seems like if ASD had never spoken about that, we would never know about it. One Russian ransomware developer falling on hard times. That's not News.
- [21:26]
B
I mean, part of the reason that attack worked is that it was indistinguishable from him actually just having bad malware. There's no reason to assume. I mean, it sounds like a conspiracy theory. If you're like, no, no, guys, my malware works. The Australian Signals Directorate has been screwing around with my laptop. And so that's, you know, it's not me, it's the Australians. Yeah, no one would have believed that, but it was true. And I think that that's a good example of how cyber can do things you can't do with other capabilities. And they don't necessarily show up in ways that you can measure. ASD could have measured. Did this guy go away? Yes or no. But if you're doing something else, like if you're degrading the internal cohesion of a group so that it degrades their ability to operate from once every month to once every three months, there's more friction internally, they are less cooperative, et cetera. That's harder to judge. Like, did we cause that or did they decide for political reasons to reduce their op tempo, or is it because the pressure we had on their financials? Anything.
- [22:48]
A
Yeah. So that ASD example seems quite attractive to me. That makes sense to me as a use of cyber capability. Now, in Trump's first term, apparently they kicked around a whole lot of ideas to use cyber operations to effect overthrow the Maduro regime. And so the one that seems most compelling to me is that they caused payment problems for the Venezuelan military. Like, they held up payments, but they, they also did things like they wiped an intelligence agency's computer network, which is like, well, that's not going to overthrow a regime. Like, there was.
- [23:33]
B
They even reported if they could get away with not mentioning it. I mean, that sounds like.
- [23:37]
A
So they did, like, so some of these in retrospect seem like, here are big picture things that sound impressive but aren't going to achieve anything. Whereas the manipulation of trust within Maduro's inner circle, maybe. Yeah, maybe that's the thing. But there's been no public reporting of that and in the end they just went in and nabbed him anyway. So obviously it didn't work. They tried.
- [24:03]
B
Yeah. So I don't know that overthrowing a regime is a thing that you can do with cyber, but if it was, it would not be by turning out the lights or another sort of pseudo kinetic capability. It would absolutely be some sort of cognitive effect. Things like, yeah, like, if the military doesn't get paid, that's a big problem. Right? If their police forces don't get paid, same thing. Right. If they, they don't have a security force and at the same time there's a lot of, you know, protests in the streets and they try to have a crackdown, but people are waiting for their money. Maybe something could happen. Like there seems to be like a lot of like, little things around the edges you could do, but I don't know if that. You could. Yeah. Just do the whole thing with cyber. On the other hand, if I was looking for budget and I ran a cybercom, that is not the line I would take.
- [25:00]
A
Why is that? Because, like, it seems like both of us like the idea.
- [25:06]
B
So I think realistically it would be difficult, but I think I could get a lot of money to try.
- [25:12]
A
Right.
- [25:13]
B
You know, a lot of headcount to.
- [25:14]
A
Try the sort of overthrow by manipulating communications between like trusted networks and all that sort of stuff. Yeah, yep.
- [25:22]
B
Yeah.
- [25:23]
A
Like, because that falls into the magic weapon category, I guess, of here's something we can do that's special and different and we can't do with any other way. So give me a whole lot of capability to do it.
- [25:35]
B
The way it would work, I think, is that you'd want to find people who have a really, really deep cultural understanding of the target because then they could figure out the things that matter. Right. So if it's like, yeah, trust is a huge thing for these people. If they feel that someone else is embezzling more than their fair share, that's going to be a huge problem. And if you know that you're like, okay, well, we can manipulate embezzlement traces. We can make them embezzle a huge amount. That's easy. On the other hand, if they're in a culture where get as much as you can is kind of the assumption, that's not going to move the needle at all. Right. That's just going to. It's going to do nothing.
- [26:20]
A
Aren't there stories of the CIA doing something similar with terrorist groups and manipulating the funding to.
- [26:28]
B
The Israelis did that with the, the PLA or the plo, I think.
- [26:32]
A
Right.
- [26:33]
B
Yeah, they, they. There was a spreadsheet that tracked all of the, like, how the funds were being distributed, like just the budgets and stuff. And they say they manipulated it to make it seem like one person was embezzling a lot and it didn't do anything except that everyone else started embezzling that amount as well.
- [26:58]
A
So I mean, that does degrade organizational capability because presumably they're not spending that money on really bad stuff. They're just enriching themselves. I mean, that's how I would spin it, right?
- [27:11]
B
It's not a failure. It's a success beyond what we initially imagined.
- [27:17]
A
It's just other dimensions.
- [27:20]
B
Our earlier plan was limited and restricted to just ask this one guy. But instead, we've managed to degrade the capabilities of the entire organization by attacking their finances in this way. So it's actually a better success than what we were planning.
- [27:36]
A
So it seems like the sort of takeaway from all this is that the stories that I like talking about are actually not the most important ones, and it's the ones that are invisible, that are probably the ones that are changing the world, that unfortunately, we'll never hear about.
- [27:56]
B
I think that does make it an absolutely magic capability. It's I changed the world, but you didn't see it.
- [28:08]
A
Thanks a lot.
- [28:09]
B
Thanks a lot, Tom.