Cyber War in Perspective:
Analysis from the Crisis in Ukraine
Kenneth Geers / Comodo
NATO CCD COE / Atlantic Council / DSI-Berlin / TSN Univ Kyiv

Ukraine

Revolution: Humans

Revolution: Machines

Russian reaction: invasion, annexation

NATO CCD COE research
●
●

●
●
●

Cyber dimension of conflict
Ukraine / Russia○ Necessary ingredients■ Geopolitical stakes■ IT / hacking expertise
Malware: espionage / crime
Skeptics: no cyber war
International norms○ Limits to state hacking○ Tallinn ManualNATO Warsaw Summit Communiqué - July 2016●●●●

Cyber attacks present a clear challenge
to the security of the Alliance.
Could be as harmful to modern societies
as a conventional attack.
Cyber defence is part of NATO’s core taskof collective defence.
We … recognise cyberspace as a domain ofoperations in which NATO must defend
itself as effectively as it does in theair, on land, and at sea.

US Army FM 3-38: Electromagnetic Cyber Activities
●
●
●
●
●
●
●
●
●
●

project power, apply force through cyberspace
deny, deceive, degrade, destroy, disrupt, [betray]
enemy / adversary -> activity / capabilities
may rise to physical damage
assure access during hostilities
weapons systems / operator decision-making
support land objectives (maneuver)physical / logical (websites, cyber-persona, IPs)
within public infrastructurecomply with the law of war

Context: RU SIGINT

Cyber War in Perspective - authors
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Kenneth Geers - CCD COE
Keir Giles - CSRCJames J. Wirtz - NPSJames A. Lewis - CSIS
Martin Libicki - RAND
Nikolay Koval - CERT UA
Glib Pakharenko - ISACA KYIV
Jen Weedon - FireEye
Tim Maurer - New America
Margarita Levin Jaitner - SDU

11.
12.
13.
14.
15.
16.
17.
18.

Liisa Past - CCD COE
Elina Lange-Ionatamishvili &Sanda Svetoka - STRATCOM COE
Nadiya Kostyuk - U Michigan
Jan Stinissen - CCD COE
Henry Rõigas - CCD COE
Jarno Limnéll - Aalto U
Jason Healey & Michelle Cantos Columbia U
Richard Bejtlich - Brookings

Free download
Complete book:https://ccdcoe.org/sites/default/files/multimed
ia/pdf/CyberWarinPerspective_full_book.pdf
Chapters:
https://ccdcoe.org/multimedia/cyber-war-perspec
tive-russian-aggression-against-ukraine.html
NATO Cyber Defence Library:https://ccdcoe.org/publication-library.html

CERT UA●●●●
●Geopolitical correlation○ Incidents rise w/ tension
2012: defacements○ UA gov
2013: advanced malware○ Red October, MiniDuke, NetTraveler
2014: political doxing○ UA gov
Most advanced hack
○ Central Election Commission (CEC)ISACA Kyiv●●

●EuroMaidan○ Physical / logical attacks○ Servers, smartphones, sites, accounts○ Most serious when shooting startedCrimea○ Severed network cables, commandeeredsatellites, mass changes to Wikipedia
Eastern Ukraine○ Targeting: mobile phone, Wi-Fi○ Isolation via censorship, forensics

SIGINT + WWWPresidential election hack: 25 May 2014
●
●
●
●
●
●
●
●
●
●

CyberBerkut vs. Central Election Commission
Most technically advanced hack (CERT-UA)
2+ months recon / Admin access
Sofacy / APT28 / Sednit malware
Disabled core CEC nodes
Possible Cisco ASA zero-day
Announced “winner” on CEC website
UA Right Sector boss Dmitry Yarosh
Broadcast on Russian TVReal paper ballots guarantee

Christmas 2015: electricity grid hack
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Spear phished IT staff
VPN credentials to SCADA
Backdoor: Black Energy 3
Changed passwords
Disabled backup power
Overwrote firmware: no reconstitution
Opened circuit breakers: 3 power distro centers
Launched KillDisk via logic bomb
50+ substations offline; 200K+ residents in dark
TDoS customer call centers

Russian e-billboard

Military equipment

Social MediaSocial Media

Igor Rosovskiy
●
●
●
●
●

May 2: Odessa fireMay 3: new Facebook account○ “local doctor”
Claims atrocities, anti-semitism○ Like “fascist occupation”
1000s FB, ВКонтакте shares○ Multiples translations
Stolen pic: Ruslan Semenov○ Russian dentist

Cyber War in Perspective●●CND -> CNO -> CNE -> CNA○ Espionage / Sabotage / PSYOPEvolution○ Estonia 2007
■ Availability○ Ukraine 2014
■ Integrity○ USA 2016
■ Confidentiality

CYBERCOM: Cyber Analogies Project●●●

Cyber war
○ Yes it exists○ But likely not decisive
Strategy / tactics○ Can win individual battles○ May gain time and space
ADM Yamamoto○ No WW2 victory at Pearl Harbor○ Adversary will respond○ Attacker beware

National security challenges
●
●
●
●
●
●
●
●
●
●

Defense: connectivity, vulnerability
Attack: peacetime limits?
Intent: CNE or CNA?
Deterrence: proactive, reactive
Security dilemma
Retaliation: laws of war
Critical infrastructure: Big BrotherArms control: prohibition, inspection
Policy / law: tech too fast
Attribution: SECRET (crowdsource?)

Cyber War in Perspective:
Analysis from the Crisis in Ukraine
Kenneth Geers / Comodo
NATO CCD COE / Atlantic Council / DSI-Berlin / TSN Univ Kyiv

Ukraine