Despite the fact that the opportunities offered by information technology and the globalization of telecommunications are unquestionable, experts in cybersecurity are quick to remind us that these possibilities also open up a range of opportunities for cyberespionage, sabotage, extortion, and violations of rights, among other things. Although this may sound like a science fiction film, it has, unfortunately, been a reality for years.

Paralyzing a country’s systems for energy distribution, transport, or health, or any other critical pieces of infrastructure by technological means, is becoming more feasible due to the connectivity of systems that until now had remained isolated. In the society we knew up until now, sabotaging a critical piece infrastructure was up to spies like James Bond, but today all this is possible at the click of a mouse.

In fact, this is not something new… there are several historic battles that we computer scientists like to blabber on about at Christmas dinners that illustrate this situation quite well.

THE STORY OF ESTONIA

We can go back to 2007 and travel to Estonia, a leading country in terms of governmental digitalization. As I already warned you at the beginning of this article, not everything that glitters is gold: due to the country’s great digital dependency, that year Estonia fell victim to several sustained Denial of Service attacks, for weeks, in which networks of computer bots sent massive amounts of messages and online requests to saturate the servers of various official bodies, financial entities, and commercial sites.

This prevented Estonian citizens from leading normal lives and carrying out daily activities such as accessing their bank accounts online and making online purchases. In the case of the Financial sector, the attack went even further: Estonian banks, fearing that their systems could be compromised, and following the principle of prudence, decided to put a hold on their services. That was when the team leading the attack decided to impersonate these organizations in order to attack other international entities, causing the international financial community to isolate Estonia’s banking network.

THE STORY OF NATANZ

Another of our favorite films is one called Blackhat, which features code from a 2010 virus known as Stuxnet that attacked an Iranian nuclear power plant in Natanz (that’s right, the attackers were thinking big). And yes, we’re talking about the year 2010… because, as I said, this is nothing new.

To give you a bit of context, in the 1980s Iran managed to get hold of designs stolen from Europe for centrifuges used in the uranium enrichment process. The complexity of the systems meant that they couldn’t be fully replicated by Iran. The Iranians had to establish procedures to work with what they had, and their versions often failed. These processes were complex and, basically, they had to stop phases of the production process in order to release some of the pressure generated using valves that they themselves had designed. These valves became the point of attack for Stuxnet.

The pressure valves were monitored with PLCs, and Stuxnet infiltrated the system by posing as a PLC configuration file. In this first version, the virus wasn’t able to spread, and acted discreetly:

• It let production take its course naturally.
• It would isolate the stages of the centrifuges so that the pressure would rise, and it would de-calibrate the sensors so that the pressure release valves wouldn’t work.
• It provided the control system with readings that it reproduced in a loop. In this way, to the engineering team, the system’s performance seemed normal.
• It decided when to stop the attack.

This was due to the fact that the aim was not to destroy the plant (which would have caused an investigation into the problem and brought about a solution to it), but rather to go unnoticed, causing many more problems in the rotors, generating system shutdowns and keeping the engineering team busy during all these system faults, thereby delaying the nuclear program.

The second version of Stuxnet, on the other hand, did spread by infecting USB drives so that it could travel between computers and eventually reach its final target: the high-speed PLCs for the centrifuge rotors, a weak point in the system.

Once a month Stuxnet would take control of the rotors and significantly reduce their speed, only to immediately speed them back up again, forcing the systems through critical speeds that would reduce their service life.

That is how the virus managed to slow down the nuclear power plant’s production – and James Bond didn’t even have to travel to Natanz.

THE STORY OF PARIS

But, it really isn’t necessary to go as far as Iran. During the 2011 presidential elections in France, our neighboring country, a cyberattack was carried out against the Elysée Palace’s systems using a simple method: phishing.

The victims received a false invitation to resources on the Palace’s local network by email. The attackers had secured the addresses by adding Facebook to their targets, and the link received by email led to a fake website requesting the victim’s username and password. After login credentials were stolen using this method, the attackers introduced a spy virus on the targeted computers, which then spread and infected other machines on the French presidential network.

Noteworthy capabilities of the virus included taking screenshots, copying files, and recording audio. Thus, the attackers managed to put a microphone in each and every office.

The computers affected included those of advisers to then-President Nicolas Sarkozy, from whom secret notes and strategic plans belonging to the French government were obtained.

Simple, cheap, effective, and without any risk. Bond may as well retire.

THE STORY OF THE USA

But, what about the plot to manipulate and propagate fake news through Facebook to influence American public opinion and the vote in the 2016 presidential election?

The scheme consisted of the massive creation of fake Facebook profiles (designed to appear to be of American origin, but instead managed from foreign countries) through which the attackers published fake news and controversial content.

With 2.9 billion active accounts around the world (175 million in the USA), Facebook’s power is enormous. False and misleading posts – often designed to be sensationalist and provocative – reach a massive audience in a matter of seconds, generating an information bubble that reinforces the beliefs and attitudes of those who consume them, thus increasing social polarization and misinformation. In this case, it was also possible to demonstrate the use of paid advertising to maximize diffusion and reach specific audiences that were of interest for the election.

WHO STARTED THE WAR?

Well, who knows? The attribution of these attacks to governments or specific interest groups is usually done by deducing who might be most interested in attacking, in terms of political strategy.

Many speculated that, in the case of Estonia, the attacks originated from Russia, and that Estonian security forces managed to identify the people involved, although the Russian government denied any involvement in the events, and refused to bring those people to justice. In the case of Stuxnet, despite the fact that it hasn’t been proven, all eyes are on the United States and Israel. In the case of the US elections, an intelligence report concluded that it was Russia that tried to influence the elections in favor of Trump.

But, as I said, there is no undeniable proof that it was the armies of these countries that started or carried out these attacks, of a type often carried out as false flag operations.

So, as we have seen, locking up an entire country, attacking critical energy infrastructures, government espionage, manipulating public opinion, and interfering in presidential elections are just some of the examples of what can be done by computer. No biggie!

Although there is nothing we like more than a good classic, this article could fill pages and pages with other similar and more recent attacks. Unfortunately, we have more than enough material for a Netflix series.

But, if you don’t mind, we’ll leave that for the next season.