اريدك ان تكون مترجم سياسي وتترجم للغة العربية هذا  
                                                                                                                                                      
   A Cyber War by Any Other Name
Whether NotPetya was an act of cyber war depends, of course, on
your definition. Upon examination, NotPetya was an operation run
by a military unit, specifically the Main Directorate of the General
Staff of the Russian Federation’s military, often called the GRU or
Russian military intelligence. (In the funny-name-game world of
cyber wonks, the GRU’s hacking team is also known as Fancy Bear.)
The Russian military did not, we suspect, intend to
indiscriminately attack global corporations. What it had intended
was a crippling attack on Ukraine on the eve of its national holiday,
Constitution Day. The GRU had figured out a truly creative attack
vector, a channel that could be used to spread an attack.
What the GRU had noticed was that almost every company and
government ministry in Ukraine used the same accounting software.
Think of the prevalence of QuickBooks in the United States and you
will get the picture. Only in Ukraine, the equivalent software was
known as M.E.Doc, from the Ukrainian software company the Linkos
Group. Like every other similar application, the M.E.Doc program
was periodically updated. Updates were pushed out to licensed users
from a server at Linkos. The updates were digitally signed by Linkos
and recognized by users’ firewalls, thus allowing the M.E.Doc
updates to pass freely into corporate networks.
So the GRU hacked into Linkos and planted a little something
extra in the next update to M.E.Doc: an attack package that exploited
a known vulnerability in Microsoft server software, combined with a
password-hacking tool and instructions to spread to any connected
device on the network, wiping them of all software.
The GRU attack worked almost flawlessly, destroying about 10
percent of all devices in Ukraine, including some in every
government ministry, more than twenty financial institutions, and at
least four hospitals. Almost flawlessly. What the GRU had apparently
not recognized (or maybe they did) was that global companies
operating in Ukraine would also be hit, and from their Ukrainian
offices the attack would spread over virtual private networks (VPNs)
and rented corporate fiber connections back to corporate
headquarters in England, Denmark, the United States, and
elsewhere.
This kind of mistaken collateral damage is not unique to
NotPetya or to the GRU. The software used in the so-called Stuxnet
attack on the Iranian nuclear enrichment plant reportedly carried
out by the United States in 2010 somehow got out into the world,
even though the Natanz plant was not connected to the internet or
any other network. Stuxnet quickly spread around the globe, was
captured by cybersecurity teams in many countries, and was
decompiled, with parts of it later reused in new attack tools.
Stuxnet, however, did not damage anything outside of Natanz,
because it was written in a way that the only thing it could hurt was
the Iranian nuclear enrichment processor. Nonetheless, the fact that
the software spread way beyond its target was reportedly one of the
motivations for President Obama’s subsequent directive, Presidential
Policy Directive 20, which allegedly restricted further offensive use of
cyber tools without his personal approval. (President Trump is
reported to have removed those restrictions in 2018.)
Stuxnet revealed to the world, or at least to anyone who cared
enough to bother to grab a copy, one of the most sophisticated attack
tools ever, containing more than fifty thousand lines of computer
code including numerous tricks never used before (so-called zeroday
exploits). NotPetya revealed not a thing about Russian GRU
attack tools. It exposed nothing of theirs because it was not their
tool. It was America’s.