[Music]
foreign
thank you so much for attending it is a
real honor to be here and talk about I
think a very important uh topic and
hopefully numerous topics I think
because this is a strategic issue you
know that affects not only domestic
politics but international relations and
human rights uh Etc I work for a company
called very good security that's not
important what is important though is
half of our companies in Ukraine so some
of you also may have employees in
Ukraine and so then you know how
difficult a time this has been and the
questions that it raises for not only
security but really the very lives of
your employees
so just this little suffice as a CV I'm
a pretty lucky cyber analyst I was in
Estonia in 2007 for the Russian Cyber
attack against the movement of a statue
from estonia's Capital Center and I was
in Ukraine in 2014. I taught a cyber
security class at the University in Kiev
and I did a book for for NATO on the
Cyber dimension of the Russia Ukraine
crisis hence here as a speaker and I
also just happened to meet when I was a
student back in 1992 randomly in front
of the White House Boris Yeltsin the
person who put Vladimir Putin into power
so let's look a little bit about uh what
is cyber war is it a thing or not uh if
you just look at the Sue bookends of
this crisis the first invasion in 2014
uh and the second invasion of Ukraine uh
by Russia on this year you can see how
chaotic cyberspace is and numerous
events have taken place during that time
that we would call cyber War uh or what
what we think or the most powerful cyber
attacks we have seen to date
the power grid attack on on 2015 on
Christmas which was reiterated one year
later on 2016 you could also add the
hack of the democratic party uh that led
to help lead to Donald Trump being in
the White House and that also has been
attributed to the gru or Russian
military intelligence which makes you
have to think okay how are they using
hacking against politics in America the
Russian military that makes you think
that this is a national security issue
for them right this is a military issue
politics in various regions of the world
and of course in in Ukraine and you
probably know but even Vladimir Putin
has called Kiev the mother of all
Russian cities right so why are they so
interested
okay many things happening but let's say
that peace time in cyberspace is a
pretty chaotic environment with a lot
going on
so about Ukraine war this year I don't
think the question really is about
Ukraine
I don't even think it's about Russia
it's about Putin right it's about an old
man trying to stay in power uh and we
have to face up to the facts this is
real
so people want they want Better Health
Care they want better education better
infrastructure for the country and that
doesn't matter whether you're in Moscow
or Washington DC
or elsewhere so we can see here's uh you
know pro-democracy protests in Russia uh
Ukraine Belarus 2020. uh even this year
in Kazakhstan right that governments put
down through autocracy and that includes
computer network operations right of an
internal kind meant to suppress dissent
and to uh project power
so when I was living in in Kiev in 2014
to 2017 I taught a class at the
University in Kiev and uh two of the
chapters were written by uh Ukrainian
government folks and they covered the
cyber attacks during the uh
um the Euro maidan events of of 2014 and
here just some of the things and we're
going to see them
not only in 2014 but in 2022 things like
web defacements then leading into denial
of service
doxing and uh
and more depending on the temperature in
the geopolitical space right so the
cyber attacks or computer network
operations tend to mirror what's
happening in traditional space so the
closer you get to an election the more
malware you see and this is true in
Texas as it is in Australia as it is in
Russia right so I spent a two and a half
years recently for doing data science
for a malware detection company and
geopolitics are absolutely a magnet for
malware no matter where you live right
so that was a cert UA chapter and you
can see the Russian military specific
attacks are more aggressive so they're
you know taking over satellite you know
control centers cutting cables
physically and then moving into the
softer space but stuff that does require
more intelligence and more forethought
stuff like whitewashing Wikipedia right
of stuff of information you don't like
and inserting information in there
trying to that that supports your
political program
and again so I'll just mention uh that
when I talk to my students in kievit
University I used to ask them
occasionally because we're talking about
all these issues
I would say do you feel like in your
personal social media space that you
sends the impact and the penetration of
Kremlin propaganda
and every time every hand would go up
right so that's the power of information
operations on the web is you know even
you know students admittedly these are
students at a nice University but still
uh it's important that propaganda does
work it does does reach
so this I I want to
um all first of all one of my wife and I
would go on long walks we live in Brazil
now and one of the things we were
talking about just before the war was
this war is not going to go well for
Russia
Ukraine is huge and there's just basic
geography will tell you that 150 000
troops was nowhere close to the number
of people you would need to occupy such
a large space
so in this case in in 2015 on the
Christmas hack
um
here's what what I want you to think
about is
the tanks and the troops are bogged down
in the donbass which is you know Far
Eastern Ukraine Daniels lugonsk
cyber attacks give you a different kind
of tool a different kind of weapon to
reach far beyond the battlefield so
think about 2016 as well the the
election attack in the United States
right no troops or tanks were there but
yet it was a powerful Testament to what
you can do with hacking and doxing right
so in this case uh it was actually an
attack on an electricity grid the Lights
Went Out in Western Ukraine
it's not in the same physical space
and it's not even the same logical space
right it just affects civilians uh but
it's over on the Polish border on the on
the NATO border right so there's just a
number of things to think about that the
sort of hackers hacker tools and tactics
they give you another weapon another
kind of weapon that you can use in a
different time and space and of course
this is in between the two invasions
gives you opportunity to attack
silently in peacetime
I guess one more Point here is that a
lot of hacking if you want to be ready
for war has to be done in peace time
right so that's one of the ironies this
and international relations they call it
the security dilemma the more I prepare
for war the more that's going to
frighten my neighbors right and so so in
part like what's happening in Germany
right now so Germany decided it's going
to you know triple its investment in uh
military equipment right and troops
because of the changing Dynamic
international relations but that's going
to have knock-on effects right in in
Holland and France and and in elsewhere
so it's just it's inevitable right
um which is which is dangerous
so this is a reminder to us all that
um you know traditional power is not
decisive right if you think traditional
power in terms of I've got this many
tanks this many ships
Etc
Ukraine is winning the battle of the
Black Sea with a grand total of zero
ships today right how is that possible
it's possible you know Napoleon said the
the moral is to the physical is three is
to one
right so
saying that the defense has all kinds of
uh advantages that the offense doesn't I
think even even in cyberspace I mean you
can set up honey pots you can set up you
know
um tricks and traps that if you do them
in a unique way the attacker will really
be fooled I think
um but all I want to say here is that
you can have the United States found
this out in Afghanistan and in Vietnam
and in Iraq right you can win every
battle and still lose the war and people
have been learning that lesson forever
cyberpower is a bit different right it
gives you
a very elusive way to fight right we're
talking information operations here
um
information operations is a big topic
right I think uh if we talk computer
network operations there's three basic
kinds of attack right I can pull off I
can steal your information in other
words I can read your email
I can deny you access to information in
other words I can stop you from reading
your email or most uh alarmingly perhaps
to you I could change your email right I
could say don't meet the your contact at
midnight but meet them at noon right
um and that's the most dangerous but I
do think that those are the as you get
across that Spectrum
they get rarer right so above all the
internet is about collecting information
disseminating information and as we're
about to see that is more important than
the more exotic and esoteric attacks
which it takes so much time and effort
and are likely to be of a temporary uh
win type of nature
so here on this timeline you can see
the kinds of things that a military
would do to prepare the battle space for
victory right so strategic intelligence
happens all the time right so Microsoft
put out this report a couple weeks ago
I'm sure you saw it saying that well
over a year in advance
this these hacker teams at the Gru and
in another they actually mentioned three
um apts or advanced persistent threats
um and within those three agencies even
subgroups so six apts right uh and at
least eight malware families but these
are busy all the time collecting
information collecting information
um and that's part of life right
as the approach as the troops are
amassing on the border uh the web
defacements become uh visible right so
in Ukrainian and polish and in Russian
there's a lot of web defacements against
Ukrainian government infrastructure in
January and February warning right of uh
of a threat right to to Ukraine
and you could say well as the attacks
get more serious
you as a Defender and that's why you
know on your your network security teams
it's good to have a traditional
intelligence analyst right so who's not
just doing hacking or anti-hacking but
who can read the newspaper every day and
kind of be aware of what's happening in
the world
that might bring malware your way
okay so about 10 days before the actual
Invasion and The Invasion took place on
February 24th
DDOS attacks and these are sort of the
you know the um the maybe the aerial
suppression sort of uh
analogy in cyber attacks right the
bombers or the jet fighters are you know
trying to take out the missiles trying
to take out the air defense Etc
um so about 10 days before and
specifically focused on the Ukrainian
government
DDOS attacks which according to the
Ukrainian government with the largest it
had ever seen so these are meant to
probably intimidate as well but also to
confuse to raise the uh let the amount
of fog in the uh in war
then on the 23rd of February and the
24th of February there were new wipers
that were seen right and these are like
maybe artillery right so as you as you
if you're reading the news now in
eastern Ukraine
artillery will come in for a while right
and try and kill uh and frighten
everyone and then the troops will try
and Advance right so you can think about
the wipers when these coming in on the
23rd of February the 24th of February uh
and you're familiar I guess from 2017
with not petya attack right that's a
wiper I come in I wipe your data and
then I destroy the boot record on your
computer so all of a sudden your
computer sitting here is a paperweight
right can't really do anything with it
actually an expert has to come in and
rebuild your computer rebuild the data
right and that takes time and effort
so so that's you know you know things
are probably getting serious if your
agency or your your institution or your
country uh is is
um is under attack
by a wiper
and then as the troops cross the border
uh we see psychological operations uh
start and um before I describe that uh
in any more detail I'll just say that I
just have one slide on each of these uh
DDOS computer wiping and psychological
operations
so this is the intelligence headquarters
in Kiev and I was super lucky you know
yeah as a foreigner there I live just
just to the left of this building and
then the university is just to the right
of this building if you know you know
Kia if you know what I'm talking about
and so I got to live on this street you
know and enjoy uh beautiful uh my Dawn
and beautiful Kiev and thank goodness
that it hasn't been destroyed right
during this War uh because it's a
beautiful historic city
um and you might not even know this but
just just uh maybe behind a little on
the right is the Opera and the Opera in
1917 is where karensky the uh the
Russian politician was murdered in 1917
as the uh Bolshevik Revolution uh was
taking hold in in St Petersburg so very
famous street uh and you know
um intimately tied with Russian politics
you know 100 years ago as it is today
but in the DDOS what you can see is
these are really focused on Ukrainian
government right again largest DDOS ever
for 10 days and attribution or or saying
who's responsible for an attack is often
very slow and tedious and uncertain I
was in in Estonia in 2007
and still even to this day who did it
right it's still who done it really sort
of episode of all those DDOS attacks
um because
you know
you know Estonia was hey there's Russia
who's Russia you know but you know
where's there's no there's been no
conviction you know no no arrest Etc you
see my point in this case in February
18th the White House came out with a
report at a briefing at the white house
uh Jen saki right she said
known technical Gru infrastructure we
have associated with this attack in
other words attribution is Russian not
just Russia but Russian military
intelligence right so that's important
so I have two candidates for the biggest
hack in this war right and so this is
the first one
on February 24th
um now we know that this hack took place
one hour before Russian troops crossed
the border one hour right so again one
of your if you all do analysis on on
malware even in a tactical sense one of
your best friends is a timeline right so
start putting together a timeline of
what you see on your network right it
just you know detected malware here
detected malware here
what can you coordinate or correlate
with the with those events that happened
in you know VIP Travel or the
installation of new uh
product line or something like that at
your company
in any case one hour before Russian
troops cross the border
um via sat via
malicious firmware update which is
another huge indicator right uh red flag
saying that these hackers whoever it is
really know what they're doing right
malicious firmware update
affects user modems across Europe all
the way from Ukraine to Morocco so this
is similar to not petya right with so
much collateral damage
um around
but one hour before the troops crossed
the border
satellite modems in Ukraine unusable
bricked so again these things have to be
physically replaced by vsat right so
according to the Ukrainian government
this was a huge comms loss and just on
May 10th so a couple of days ago the
United States government
published a report UK government as well
as the EU saying this was Russia and
saying that it was targeting Russian
military command and control right so a
very specific attack against a strategic
Target and if you listen to what the
ukrainians are saying this had a major
impact on
defending the country so candidate
number one right for
um
strategic cyber war attack
um
with potentially decisive right
hopefully from the attacker's
perspective decisive uh impact
so here's a little bit more on the
wipers what I want to say here is that
you want allies in cyberspace right so
think about it when you have Microsoft
and ESET and many many others
coming to your defense right uh so in
this fight Ukraine has not been alone I
think there's a common understanding of
who the aggressor is
uh in this fight and there have been so
many people to stand up uh and support
Ukraine in very in various ways
so in this case you can see uh ESET
Slovakian company I think based in San
Diego now
you know basically coming out you know
with an important report on the day of
in this case prior to the attack and
then explaining in detail not only the
indicators of compromise and the type of
attack but also how to uh
how to best defend against it
so psychological operations kind of came
in as the troops crossed the border and
look at this so it can be pinpoint
propaganda pinpoint targeting of
um victims and targets so in this case
soldiers might get a
a text that says you know swap sides you
know one of them she's the woman in this
photo she's holding up a machine and it
says that
um when the snow melts they will find
your body in the snow
right so they're meant to frighten
intimidate Etc soldiers received that
citizens receive something different
citizens received hey did you know that
the ATMs in the country are not working
right so this is uh again causing panic
this is the thing from Estonia in 2007
the biggest single aspect I think to
that attack was that the um the banking
infrastructure was knocked offline for a
couple of hours right so then the
question is could a couple of hours have
been a couple of days or a couple of
weeks and then how long does it take
before you have a national security
crisis on your hands if people can't as
the estonians put it by you know eggs
and bread
government workers were receiving yet
another message that asked them to
switch their allegiance from Ukraine to
Russia right so
that obviously has not happened I think
you know the Russians vastly
overestimated their appeal especially
among Russian speakers turns out Russian
is just a language right it is not a
political allegiance
we can see hacked social media and TV
hacked uh Ukrainian military Facebook
accounts seeing of senior leaders
asking the troops to surrender
zelenski asking uh the country to
surrender in a deep fake right so these
are operations that are you know the
attacker at least hopes are going to
have a strategic impact uh and one of
the things that you can do is try and
educate your citizens your employees
about about deep fakes and about
information operations
here is candidate number two for our
biggest hack of the War uh at least thus
far right so
here you can see you know you've got
Russia
Belarus and Ukraine and one of the
things this is pretty strategic I think
that that in 2020 uh when a young woman
won the election right in Belarus but
was forced out of the country and
basically the pro-democracy movement
their own maidan was suppressed with
violence and torture
Belarus then had to submit to Russia in
a way that it hadn't previously and so
Russia was going to use Belarus to send
troops in war materiel into Ukraine via
these rail networks right
so
the thing about hacking you know is um
especially tactically it works right the
question is is whether you can achieve
some kind of strategic effect
so in this case it looked like it may
have been a an amalgam of hackers and
spies
defectors and we know that in Belarus
there's a lot of anti-lucashenko
sympathy right so they want change we
know that in in Belarus there were came
out in the streets in their millions in
2020.
so it takes a team right
um in this case uh there was also
Windows XP that was being used by the
role the the signal cabinets on the
railways
um so at the beginning of the war
hackers and people on the ground tried
to slow this equipment and to disrupt
the railway Networks
and it's one of those questions you know
how you know was it was it decisive was
it uh a strategic hack
um maybe
but there's belief that it contributed
to the 40-mile Convoy north of Kiev in
other words the difficulty of putting
troops in material into what was the the
ultimate goal at the beginning of this
war was you know take over the capital
and kick out zielinski and put in a
puppet leader
um and then those all those trucks and
and tanks became Sitting Ducks right for
for the attackers and so so this this is
a candidate for the the biggest you know
or the most strategic or impactful hack
of the War uh so far
so you know you could pick any of these
dots and sort of drill into it but I do
think Ukraine is benefiting from an
incredible level of connectivity and
sympathy
so I think so far in the war
um we can say that information
operations have outshined uh simple info
Ops have outshined complex computer
hacking uh so far it's an incredible
amount of connectivity so think about it
we are still in the as of steel plant
where these soldiers that are
underground fighting the Russians still
to this day
we still have connectivity with them
they're still sending out videos and
their family members are still
communicating with them via video chat
after all of these attacks and
bombardments every day strategic bombing
against this facility so connectivity is
incredibly important
and maybe even decisive ultimately right
I mean in other words you can you can
hack my computer
yeah it works but I'm going to grab
another device or a friend's device you
know or my telephone and so in Ukraine
among the things that are happening are
any any Ukrainian civilian can use any
telecommunications Network right now for
free
right you don't have to have you to
subscribe to anything or have any money
as long as you've got a smartphone you
have connectivity
and this has led things to like
zielinski being able to talk to you know
parliaments around the world in tailored
speeches asking for money and asking for
weapons you know if you know despite
constant bombardment if you can't stop
that you know you're going to have
trouble as an attacker
so what else so the United States has
they have a Shields up website which has
Intelligence updates on the war
um best practices and computer security
relative to the conflict Etc
um the EU has had cyber forces in there
because the EU you may or may not know
is trying to have its own security
apparatus right
um NATO I'm sort of associated with the
NATO cyber Center or Think Tank there in
Estonia well guess who the latest member
is actually that's not true the latest
members last week is South Korea
but prior to that it was Ukraine a few
weeks ago right and so uh if if you look
at
the number of members I think it's about
30 now I'm super fortunate I was the
first researcher ever posted there in
2007 a year before it even opened I
helped to to build the place for for the
Pentagon and now we're up to 30 members
um let's talk about loan hackers
Anonymous right Anonymous contributing
in its own way right Anonymous coming
out and tweeting we are fighting on
behalf of
the Ukrainian government
distributed denial of Secrets right over
six million documents have been posted
to the web that have been stolen from
the the Russian government 500
000 from the uh the body in Russia that
manages censorship and manages control
of the of runet right so not only I.T
firms but I.T SEC firms basically coming
out this is this is a tough environment
for Russia to operate in and I think it
may be one reason why we haven't seen
this dramatic Cyber attack from Moscow
it's because where are they going to
start right so I recently moved from
Africa to Brazil just before we moved uh
we were on uh safari park and we
followed for about an hour a lion and
the lion was circling this huge group of
zebra and wildebeest that were all in a
tightly packed formation looking outward
and this a lion it was just circling for
about an hour and then finally just you
know wandered off into the jungle there
was nowhere for the lion to attack it
was one of the most interesting things
I've ever seen
so in the same way I think one of the
biggest stories of the war so far has
been the the United nature of the
western response right to to what's
happening uh in in Ukraine and and
Russia
um and that's in the traditional
Battlefield space as well as in
cyberspace
um but you know if you think so some of
the big stories like from China for
example there was there was a story of
Russia getting hacked from Western
infrastructure
but at least according to the authors of
the article it was in fact Chinese
actors they're taking advantage of the
situation right to Target Russia from
making it look like a western attack
um so
what you want I think are allies and the
the the the broader point I want to make
is and this applies whether you're in
your company or in your home or in your
nation
um cyberspace is kind of
the strength of it is in community and
the strength of it is in
um
working with you know maybe researchers
or Allies that you don't even know right
and so it's just it's a it's a
similarity of philosophy you want to
take advantage of the power of the web
uh to to succeed
so the mid War assessment I do think
that that this
information operations and connectivity
are key you know if you want to survive
conflict if you want to
succeed right uh denial of service
attacks work
[Music]
um
computer Espionage Works
um all of these these you know exploits
can be arrayed against vulnerabilities
in an effective way
um but if you can't stop this you know
you can't stop uh ultimately your goal
is strategic in this in this case for
sure
um and you want to achieve and so just
like those three main kinds of of Cyber
attack I think theft denial and
manipulation
the biggest one by far is connectivity
is access is bandwidth
um is saying your piece and then even if
you know you get knocked offline guess
what I'm going to appear over here and
that's the way censorship works as well
you know in your country you can try and
censor information and people are going
to go around it and find some other way
some other way to communicate some other
way to collaborate and that's of course
what the web is all about right one of
the stories about the founding of the
web is it was meant to
um to be a way to survive nuclear war or
when a way to survive and attack by a an
aggressor
so just a couple of slides on what's
happening at NATO because I think this
helps to provide some information
perhaps if you don't know it but also
some guidance right in terms of advice
and best best practices
um so NATO has said that cyberspace is a
domain of military operations right it's
a it's a space that we are going to
defend
um the same as Land Air and sea
this is important right because what's
happened so far in the war
um Putin wanted to diminish NATO and
instead it's getting twice as big for
Moscow right because Finland is so long
right that it's it's now uh the Border
Russia's border with uh with uh NATO has
grown to immensely
cyber security is a core task of
collective defense for the alliance
international law applies in cyberspace
so NATO is saying we don't need any new
law for cyberspace we already have
international law we have about
sovereignty and about promotion of you
know you know rule of law Etc
this applies in cyberspace let's figure
out how how it translates
one of the strengths is diversity and a
defensive philosophy and again this this
is good I think that dictatorships
are very fragile uh politically but
they're also fragile in cyberspace
because I can say this is the way this
is the only one true way but I've got so
many people who are going to say
something uh that I don't expect from an
angle that I don't expect from at a time
uh that I don't expect and then the
Strategic partner with the European
Union is critical because
cyberspace of course relies on
technology and firms and citizens and
non-governmental organizations Etc and
so there's a political side to it that
you have to work in Tandem and so NATO
and EU if you look at their literature
working ever more closely on Cyber and
some of the tactics that are happening
okay how do you take these strategic
guidelines and and Implement them in the
right way each of the nations of NATO
has have has pledged to understand
information security to promote
information security within their space
one place I've lived is Luxembourg and
Luxembourg only has about 300
traditional soldiers right but because
of the banking sector there they would
have many thousands actually of
information security Personnel right so
think about that and that that makes all
of a sudden Luxembourg also just joined
the NATO Center in Estonia
um but places like Iceland Estonia you
know these small countries can actually
have a big impact uh in this cyber
domain where everything can be quite
asymmetric right even one person you
know creating Wikipedia who's thinking
this this idea might work changes the
world right so
then in order to deconflict have you
ever been in government this word
deconfliction is kind of important your
agency and my agency need to at least
coordinate on what we're doing the
United States is not very good at that
but
um in this case the NATO cyberspace
operations center uh is supposed to
deconflict uh cyber operations that
countries may be running right malware
information sharing platform partnership
with industry you get the idea it's how
do you implement these things in
practice and here on the right this
picture is locked Shields so I presented
at black Defcon I think well over 10
years ago on the first effort to do lock
shields uh and that's when you know 15
years ago we were just in the sound of
having a vodka talking about how cool it
would be to you know connect a couple of
computers together and to hack and
defend right
today locked Shields is well over 2 000
people working on it every year and
maybe 50 blue teams huge red team uh
incredible and if you're interested you
can actually you know participate at
some level as well you can you can apply
to be a part of a blue team for example
that uh that defends against uh and is
very critical infrastructure focused
even back then in 2010 we had all these
scale models of dams and factories and
they actually had fireworks on the back
and the Ultimate Prize if the hackers
could figure it out was to actually blow
up the little models that had fireworks
on them
so here's an example and I think this is
my last slide but it's just an example
of what the NATO cyber Center is putting
out
maybe a thousand Publications by now
because it's been around for 15 years
and I can say because I was the first
researcher there I just want to give
props to black hat I submitted a talk to
black hat in 2008 black hat Tokyo is
called cyberspace and the changing
nature of warfare and it got accepted
and so I flew from Estonia to to uh to
Tokyo to give it and it became the first
document it still is if you sort by time
on the this NATO cyber Center Library
I'm lucky enough to have the very first
uh publication and it was at placad so
that's why I'm mentioning it here but
this is one of the latest or it's about
a year old or so but it is the
result of many nations and many actually
private firms as well and consulting
firms and so it's a kind of example of a
strategic product if you want to think
about your your country if you're
working on behalf of Singapore a lot of
the things that you need to think think
about from the Strategic to the Tactical
so that's my talk thank you so much
we're out of time I don't know if I can
take a question or not but I'll set I'll
definitely be around for a little while
if you want to chat about these things
but thank you so much for your time I
really appreciate it and it's an honor
to be here uh and hope to see you again
thank you very much
[Applause]
[Music]