Exponential increase in social media, mobile and IoT devices in our personal and professional life has created tremendous dependency on the internet. Recent spur of cyber-attacks has raised global concerns. News of CIA losing the control of hacking arsenal can create havoc if it falls into wrong hands.

The concern is neither about non-availability of the data, stealing of credit card details nor asking for ransom amounts.

Increase in the usage of IoT devices in most of the national critical infrastructure systems like utilities, smart grids, healthcare systems, etc. ,  provides a launch pad for cyber attackers, from any corner of the world.

Compromise of these systems can create the war like situation.

Cyber Weapons – What Are Those?       

There is no standard definition for either cyber warfare or cyber weapons. We can distinguish cyber crime and warfare by the immediate and long-term impact on the human life. Cyber crimes are activities that can create damage to business in terms of monetary or reputational losses. The Cyberwarfare is a war like situation where state or nation is impacted, damages human life and it has long term effects.

Let us look at the weapons these attackers used in cyber warfare.  The NATO Cooperative Cyber Defense Centre of Excellence has defined, Cyber weapons are cyber means of warfare designed, used or intended to cause either injury or death of people or damage to or destruction of objects.

The definition more broadly accepted is, any software, virus, and intrusion device that can disrupt critical infrastructures of other countries, from military defense systems to communications to electric power smart grids to financial, healthcare systems and air traffic control.

“We worried for decades about WMDs – Weapons of Mass Destruction. Now it is time to worry about a new kind of WMDs – Weapons of Mass Disruption.”  ― John Mariotti

Destructive Power of Cyber Weapons

We can find the first recorded incident of cyber weapon usage in the year of 2009.  Stuxnet, the complex piece of malware, was the first cyber weapon used to severally impact the production of uranium in Iranian nuclear reactor.

First Evidence

Stuxnet was targeted to a specific vulnerability in the software which was used to operate the centrifuges in the nuclear facilities in Iran. Unlike any other malware which hijacks the targeted computer system or steals the data by exploiting a vulnerability, this malware was developed to physically damage the hardware i.e. centrifuge machines. This attack impacted 15 Iranian nuclear facilities and 164 centrifuges were damaged. This was a major setback to the Iranian nuclear program. More technical details of Stuxnet malware are available at Stanford.edu.

Stuxnet is considered as a first cyber weapon that was introduced in the computer systems via USB drive and the physical destruction has nationwide impact.

Second Evidence

Though Stuxnet is the first cyber weapon, however, the very less discussed attack in 2008, on the oil pipelines in Turkey is the first known cyberweapon attack. In this attack, the attackers exploited the vulnerability to suppress the alarms reaching to the control and command room to hide the explosion. The pipelines were super pressurized and exploded and response to this explosion was late as the signal supposed to reach to the command and control center were never reached.

Third Evidence

The most recent attack on Ukraine’s energy grid to shut down 27 substations and blackout of 186 cities is considered as part of Russia’s ongoing war over the Crimean peninsula. This was caused by the hacking of the computers by injecting BlackEnergy malware. This malware has ties with Russia.

The above examples demonstrate the destruction capabilities of these cyber weapons.

Similarly, the cyberweapon attacks on the nation’s telecommunication infrastructure or any other national critical infrastructure are capable of creating a war-like situations to completely upset the day to day life of citizens and can create life threating situations.

Conclusion

Many times when the people with malicious intention create a malware and spread it over the internet, they are not aware of the consequences it can create in the larger picture of this interconnected world.

For the traditional war, there are economical investments required for weapons and troops to use those weapons. The physical weapons have the limit to coverage and destruction (we are not considering the nuclear and biological weapons here as they are banned globally).

For Cyber weapons, the investment can as minimal by using the BOT net for computing power required, which is almost free of cost, and launch weapons using any computer connected to the internet.

To avoid the cyber warfare, there is a need for the international level of regulations and controls that can identify and stop the attacks before they are materialized.