Robert OHarrow - Zero Day: The Threat In Cyberspace

The digital universe came to life on Oct. 29, 1969, when researchers at UCLA sent a single message to the Stanford Research Institute. It wasnt much of a message, just one word: login. In fact, only the first two letters made it through before the system crashed. But a communications revolution had begun.

In the coming years, as networks spread and computer power exploded, hundreds of million of people found their way online. And then an idea that first emerged in science fiction became a vital reality: Cyberspace.

Cyberspace is now the most complex man-made environment on earth. It expands every moment, warping notions of time and space and diminishing the distinction between machines and people. The electronic impulses that carry the data online move at lightning speed. A roundtrip from Washington, D.C., to Beijing online occurs in less time than it takes a major league fastball to cross home plate.

An uncounted variety of devices have been linked in to cyberspace, offering almost magical features and services. Smart phones, industrial control computers, railroads, satellites, jet fighters, new cars, laptops, data routers, medical equipment, elevators, video cameras, ATMs, toll booths and GPS systems. The list grows by the hour. A researcher at Cisco estimates that more than 12 billion devices have connected so far, a number that will more than quadruple over the next decade.

Dr. David Clark, a senior research scientist at MIT, helped developed the architecture of the Internet in the 1970s. He and his colleagues had no idea what was coming.

People say to me, Did you imagine hooking every computer in the world together, Clark said. And I said, Oh yes, we thought there might be 10,000 of them.

Because security was not a priority, hacking has always been a problem. But something changed in 2012. The world became aware. It seemed as though everyone the president, lawmakers, corporate executives and regular people began acknowledging that the threats to all the systems in cyberspace were unprecedented, unrelenting and possibly existential.

Attacks on computers and networks now occur every hour of every day. Espionage of military communications. Theft of money and intellectual property. Disruption of water service and nuclear processing facilities. Invasions of privacy. And yet, because it is often impossible to know who is behind a hack, or where it originates, or even when it has occurred, the best that defenders can do is react quickly and well. Resilience became a mantra in 2012. Deterrence remained only a hope.

The most destructive scenarios involve cyber actors launching several attacks on our critical infrastructure at one time, in combination with a physical attack on our country, Defense Secretary Leon Panetta said in October 2012

Attackers could also seek to disable or degrade critical military systems and communication networks. The collective result of these kinds of attacks could be a cyber Pearl Harbor.

A panel of the nations top scientists told the Pentagon not long ago that the cyber-universe is complex well beyond anyones understanding and exhibits behavior that no one predicted, and sometimes cant even be explained well.

The Washington Post decided to try. For more than a year, reporter Robert OHarrow devoted himself to exploring and explaining the nature of cyberspace and the threats proliferating there. His stories spelled out the technical underpinnings of network vulnerabilities, the hacks used to exploit those systems and the consequences.

This e-book, Zero Day: The Threat in Cyberspace, is a compilation of that reporting. With narratives built around hackers, security researchers and corporate executives, OHarrow illuminated the mind-bending challenges online. He had a simple goal: to help regular people, lawmakers and others to better understand one critical aspect of a fast-changing world.

All of cyberspace is driven at the most fundamental level by computer code, 1s and 0s in trillions of combinations, the simplest of man-made creations. Computer code has created unimagined benefits. But because of the worlds accelerating dependence on code, it also has brought pervasive vulnerabilities.

At last count, there were more than 53,000 different vulnerabilities in software systems that can be exploited to take control. Many of them have never been patched. But there are also uncounted number of unidentified vulnerabilities known as zero days flaws in software that could enable intruders to infiltrate computer systems, take them over and steal information.

And since no one knows except the attacker about [zero days], its really hard to defend against them. So you cant just look for the attack because youve never seen one before, said Charlie Miller, a former hacker for the National Security Agency and a leading security researcher.

And so you figure software has millions and millions of lines of code and there could be lots of these flaws lurking in there deep somewhere and you cant find them all, he said. So theres always going to be flaws in software and its always a race to see, can the good guys or the vendors find these flaws first or can the bad guys?

So much of the worlds activity takes place in cyberspace now including commerce, banking and communications the Pentagon has declared cyberspace a new domain of war. Battles in cyberspace are increasingly considered an inevitability. The cyberwarriors are already preparing to both defend and attack.

Its going to happen, said former National Defense University Professor Dan Kuehl. And when that day comes, and in our opinion it will, if were not prepared for it, the problems and repercussions will be magnified.

Part I

Digital Universe Riddled with Holes

(Matt McClain)

Sunday June 3, 2012

Charlie Miller prepared his cyberattack in a bedroom office at his Midwestern suburban home.

Brilliant and boyish-looking, Miller has a PhD in math from the University of Notre Dame and spent five years at the National Security Agency, where he secretly hacked into foreign computer systems for the U.S. government. Now, he was turning his attention to the Apple iPhone.

At just 5 ounces and 4 1/2 inches long, the iPhone is an elegant computing powerhouse. Its microscopic transistors and millions of lines of code enable owners to talk, send e-mail, take photos, listen to music, play games and conduct business, almost simultaneously. Nearly 200 million iPhones have been sold around the world.