Countries brace for The Code War

LAS VEGAS -- Repeated and constant cyber attacks against the United States have turned the country's assessment of national security threats on its head.

Just five years ago, the CIA was mostly worried about physical threats like bombings or chemical warfare. But now, the CIA thinks cyber attacks have the second greatest potential for national destruction behind only a nuclear attack.

"Cyber will be part of any future conflict -- whether it's a nation state or terrorism," said Cofer Black, former director of the CIA's counterterrorist center, at the Black Hat cybersecurity conference in Las Vegas on Wednesday.

It's not just that cyber will become part of warfare. It already has.

McAfee, a cybersecurity company owned by Intel (INTC, Fortune 500), announced late Tuesday that it uncovered a wide-ranging, global cyber attack that impacted 72 organizations.

A total of 36 corporations, 12 non-profits and 22 government organizations were affected, including 15 U.S. government agencies and the United Nations.

The broad-based nature of the attack means that every country and company must assume that they have been compromised, an executive at McAfee argued.

"You can't just deploy a firewall and assume you're safe," said Toralv Dirro, security strategist at McAfee. "Someone one way or another will get into a computer and attack your system."

McAfee found that a country launched a sponsored cyberespionage scheme, but it didn't go so far as to pin down the nation responsible. Though McAfee informed the companies and agencies that were spied on, most of those attacked didn't want the security company to name them publicly.

How they hack you

The scariest part of the scheme wasn't that it impacted so many organizations around the world, but that it has been going on, undetected, for the past five years. McAfee actually discovered the attack when the hackers finally made a mistake -- they left logs of their attacks on a command and control server that McAfee uncovered in 2009.

Cyberespionage poses a great threat since it gives the nations sponsoring the attacks a leg up in diplomacy, business competition and, should a conflict arise, warfare.

Countries have already shown how cyberattacks can be used to mitigate rivals' defenses.
In September 2007, Israeli F15s and F16s bombed a nuclear reactor construction site in Syria, but Syrian radars never picked up the planes crossing the border. That's because Israel had hacked Syria's radar software.

The most infamous example is Stuxnet, a bug so sophisticated that it significantly delayed Iran's nuclear program. The worm, which was likely loaded into the system on a thumb drive, ordered the centrifuges in an Iranian nuclear facility to spin out of control, ultimately destroying it. While that was happening, Stuxnet made all the readings tell Iranian engineers that everything was normal.

"I am here to tell you, and you can quote me, the Stuxnet attack is the Rubicon of our future," said Black. "Physical destruction of a national resource is huge."

It might not just be nations sponsoring these attacks one day, however. Black said Al Qaeda's abilities to launch physical attacks against the United States have largely been neutralized, but the group's potential ability to commit cyber warfare could wreak havoc on our resources.

"The natural inclination for Al Qaeda would be to fall back and enter the cyber world," he argued.

Though nations are unlikely to attack our systems for fear of response from the United States, terrorists wouldn't hesitate. That's a worry, since our government is woefully unprepared for such an event.

"Like the terrorist threat before 9/11, our leaders hear it but they don't believe it," Black said to the room of about 8,500 hackers and security professionals. "We're counting on you. The Code War is your war."