U.S. Bracing For Digital Attacks

America’s enemies and competitors — from al-Qaeda to China and Russia— are ramping up their ability to launch devastating cyber attacks, and the nation’s electrical grid and water supply are among our most vulnerable targets, experts said yesterday, as the Pentagon signals its own plan to move to a cyber-war footing.

The e-wars, in fact, have already started.

“The U.S. government is under constant assault in cyber space,” said Travis Sharp of the Center for a New American Security, a Washington, D.C., think tank focused on new threats. Among America’s rivals on the world stage, he added, “You’ve got sort of an arms race going on.”

Sharp recently co-authored a report on the threats posed by cyber warriors, criminals and terrorists and laid out ways the United States can protect itself. U.S. government networks are probed or scanned hundreds of thousands of times per hour by viruses and hackers, Sharp said. An as-yet-unreleased Pentagon cyber strategy paper reportedly proposes treating severe cyber attacks as acts of war.

Al-Qaeda has over the past 18 months expressed interest in launching an attack on critical infrastructure in the United States, Sharp said. An attack on the U.S. power grid, for example, could kill patients in hospitals and paralyze the nation.
“They don’t even have to develop the virus in-house. You can download a cyber-attack (program) on the Internet for free, or buy a more sophisticated one for $250,000,” Sharp said.

Last year, a virus launched from a USB storage device temporarily breached U.S. Central Command’s network. Other high-profile attacks have included breaches at defense contractor Lockheed Martin — via a hack of password tokens made by Bedford-based EMC unit RSA Security — and hacks of U.S. officials’ Gmail accounts. Google, which hosts Gmail, has publicly accused Chinese hackers of perpetrating the breach.

China and Russia are the biggest sources of cyber attacks on the United States, Sharp said, though most of the hits are not considered state sponsored. But both nations are developing strategies to launch cyber attacks in real-world battles. Such a tactic could shut down an adversary’s battlefield communications. The United States, meanwhile, recently created U.S. Cybercom, a military command dedicated to defending and attacking in cyberspace.

Iran’s developing nuclear facility last year came under a sophisticated attack by the powerful Stuxnet virus, which penetrated a closed system and reportedly wreaked havoc on Iran’s uranium refinement equipment. The source of Stuxnet has not been revealed.

Chris Wysopal, co-founder of Veracode, a Burlington computer security firm whose clients include the Federal Aviation Administration and Barclay’s Bank, said he’s seen about a 25 percent uptick in attacks recently. Wysopal said he’s most worried by threats to the energy grid and water supply. While the financial industry and the military do a good job securing networks, local governments and utility companies don’t score as well, he said.

University of Massachusetts at Amherst security researcher Kevin Fu cited the vulnerability of critical infrastructure where computers are used to control mechanical functions, such as sewage systems.

“All it takes is one e-mail to one person in a position of authority,” Fu said.