IEEE Technology and Society Magazine - Fall 2014 - 19

to cyberwarriors for hire suggests that reliance on a
in any of the entities that comprise cyberspace. Moura
strict delineation between the two activities. Cyberfound that certain types of attacks were more likely to
crime and cyberattacks may, in the long run, lead to
originate from certain nations or regions. for instance,
increased cyberattacks.
75% of the Internet Service Providers (ISPs) containCyberattacks have the ability to disrupt the way in
ing the most phishing scams are located in the United
which ordinary individuals live their lives (e.g., the
States. Ordinary spam primarily originates in India
chaos that would arise if none of the automatic teller
and Vietnam, while the largest concentration of spammachines (ATMs) in a country were operational).
mers per Internet address is in Nigeria [15]. Moura
The interconnectedness of global financial instituargues that analyzing where malicious hosts are contions, enabled by modern communications technolcentrated could enhance prediction of future attacks.
ogy, increases this risk [23]. A few
Several technological methods are
years ago, we witnessed the impact of
used to launch attacks in cyberspace.
Cyberattacks
the 2003 northeastern blackout in the
In this section, we briefly present some
use a variety of
U.S. that affected electrical grids spanmethods used for attacks in cyberning from Ohio to New York, and even
space. We also present a sample heuvectors, both
stretching to the Canadian province of
technological and ristic diagram for the classification of
Ontario. While it lasted for only a few
cyberattack types.
organizational.
days, it's important to ask what would
be the impact of something similar,
Methodological Approaches
or on a larger scale, that was deliberately caused for
The DTAG honeypot system also identified the five
a prolonged period of time. When Estonia was submost popular types of attacks detected in May 2013.
jected to a barrage of cyberattacks, it was forced to cut
These tended to be targeted towards cyber or Internet
its external Internet connections so that people within
technologies. As illustrated in Table IV, 78% of these
the country could continue to use their conventional
attacks were on Server Message Block (SMB) proservices [9]. With external Internet service access distocols. SCADA systems are particularly vulnerable
abled, an Estonian traveler in another country could
to attacks, and hence attractive to potential cyberatnot retrieve money from an ATM machine or use a
tackers. Known as the "workhorses of the information
bank issued credit card. Despite taking 30 000 comage," computer control systems are also the weak link
puters off-line, the Sharmoon virus was ultimately not
in critical infrastructure systems [10], [24]. These syssuccessful in that it did not significantly disrupt oil
tems regulate the operation of the infrastructure. for
production in either Saudi Arabia or Qatar. But, what
instance, they manage the flow of natural gas through
if it had? What would the impacts have been?
a pipeline, or they manage the production of chemiThe United States has identified cyberattacks on its
cals, etc. SCADA systems are increasingly being
critical infrastructure as a matter of national security, and
connected to other networks, including the Internet,
has declared cyberspace a domain of war [10]. Critical
making them vulnerable to external cyberattacks.
infrastructures are physical or virtual systems and assets
Given the extent of damages, such as serious injuries,
that are so crucial to a nation that any harm done to them
deaths, unavailability of crucial daily services that can
will have a drastic effect on security, national economic
result if the operations of a SCADA system are dissecurity, national public health, or safety [11]. Sperupted, it is not surprising that these attacks are concifically, these attacks are referring to agriculture, food,
sidered cyberterrorism or cyberwar. SCADA systems
water, public health, emergency services, government,
defense, industrial base, information and telecommunications, energy, transportation, banking and finance,
chemical industries, and postal and shipping systems
Table IV
Top 5 Attack Types in May 2013 [5]
[12]. It is the potential destabilizing effects of disruptions to these infrastructures that concern the political
Description
Number of Attacks
decision-makers who ultimately label such disruptions
Attack on Server Message
5 970 973
as a cyberattack or a cyberwar. This is why cyberattacks,
Block (SMB) protocol
or cyberwar, often extend beyond a physical battlefield.
Attack on Secure Shell (SSH)
660 350
Although the above-mentioned disruptions cause no
protocol
physical injury or damage, they can nevertheless be conHoneytrap Attacker on
439 981
sidered acts of war (i.e., by political leaders).
Port 161

How Cyberwar Occurs

Attack on Port 5353

288 136

Cyberattacks use a variety of vectors, both technological and organizational. They seek out vulnerabilities

Attack on Netbios protocol

269 211

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

fALL 2014

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Fall 2014