I first came across this statement in a Hindi Text Book that had a lesson on a brave subedar. Somehow, Hindi Chini Bhai Bhai stuck with me and only grew as modern day literature spoke about the triangle initially, that would undo the power accumulated by the European & American countries on the international stage; this triangle had China – India – Russia as it’s constitutents and all three were apparently taking their steps in unison. Now Brazil has joined this triangle (based on economic performance & indications for the future) and has cause the triangle to be renamed BRIC.
While Russia has been a friend for long, China has been a “hot & cold” lover – there are many diplomatic visits, hours of discussion and signing of agreements, comments on prime time TV and super white smiles and handholding for the camera all to be followed by minor intrusions into sovereign Indian territory by their forces. India can never take on China in a head-on war because we only know how mighty China is, but one thing that keeps the Chinese at bay even though they know their power is the respect and friendship (apparently, I have no documentry evidence of this but this is what everyone says so) India has managed to earn for itself in the global arena. And bless our good luck, China is everyone’s enemy.
Apart from the physical intrusions, China’s cyber-warfare army is relentlessly marching on while India has suffering silently (which, I have no idea why, since we are supposed to be IT Gods). Over the past one and a half years, Government officials say that China has mounted almost daily attacks on Indian computer networks, both government and private, showing its intent and capability. The sustained assault almost coincides with the history of the present political disquiet between the two countries and these attacks are not isolated incidents of something so generic or basic as “hacking” – they are far more sophisticated and complete – and there is a method behind the madness. Publicly, these officials, when questioned, take refuge under the argument that “hacking” is a routine activity and happens from many areas around the world, but privately, they acknowledge that the cyber warfare threat from China is more real than from other countries.
The core of the assault is that the Chinese are constantly scanning and mapping India’s official networks. This gives them a very good idea of not only the content but also of how to disable the networks or distract them during a conflict which apparently is the Chinese way of gaining “an asymmetrical advantage” over potential adversaries. The big attacks that were sourced to China over the last few months included an attack on NIC (National Infomatics Centre), which was aimed at the National Security Council and on the MEA. Other government networks, said sources, are routinely targeted though they haven’t been disabled. A quiet effort is under way to set up defence mechanisms, but cyber warfare is yet to become a big component of India’s security doctrine. Dedicated teams of officials – all underpaid, of course – are involved in a daily deflection of attacks. But the real gap is that a retaliatory offensive system is yet to be created. And though sources say it’s not difficult since the Chinese networks are very porous – and India is an acknowledged IT giant, the fact that we are currently backward does nothing to soothe the nerves!
There are three main weapons in use against Indian networks – BOTS, key loggers and mapping of networks. According to sources in the government, Chinese hackers are acknowledged experts in setting up BOTS. A BOT is a parasite program embedded in a network, which hijacks the network and makes other computers act according to its wishes, which, in turn, are controlled by “external” forces. The controlled computers are known as “zombies” in the colourful language of cyber security, and are a key aspect in cyber warfare. According to official sources, there are close to 50,000 BOTS in India at present – and these are “operational” figures.
What is the danger? Simply put, the danger is that at the appointed time, these “external” controllers of BOTNETS will command the networks, through the zombies, to move them at will. Exactly a year ago, Indian computer security experts got a glimpse of what could happen when a targeted attack against Estonia shut that country down – it was done by one million computers from different parts of the world – and many of them were from India! That, officials said, was executed by cyber terrorists from Russia (a good friend of India that we could ask some help from), who are deemed to be more deadlier.
The point that officials are making is that there are internal networks in India that are controlled from outside – a sort of cyberspace fifth column. Hence, the need for a more aggressive strategy. Key loggers is software that scans computers and their processes and data the moment you hit a key on the keyboard. This information is immediately carried over to an external controller – so they know even when you change your password. Mapping or scanning networks is done as a prerequisite to modern cyber warfare tactics. MEA has a three-layered system of computer and network usage – only the most open communication is sent on something called “e-grams”. The more classified stuff uses old-economy methods – ironically, probably the most secure though a lot more time-consuming. The same is true of other critical areas of the government. But the real gap inside the national security establishment is one of understanding the true nature of the threat. National security adviser M K Narayanan set up the National Technology Research Organization, which is also involved in assessing cyber security threats. But the cyber security forum of the National Security Council has become defunct after the US spy incident. This has scarred the Indian establishment so badly that it’s now frozen in its indecision. This has seriously hampered India’s decision-making process in cyber warfare.
Meanwhile, hackers worked overtime in October and defaced over 143 Indian websites during the month compared to just 60 sites that were defaced during September. According to India’s Computer Emergency Response Team (CERT-In), that has been closely monitoring all incidents of defacement to know which are the targeted domains and the exact vulnerabilities being exploited by hackers, of the total number of sites that were hacked and defaced in October, an overwhelming majority were in the .com domain (90 cases) followed by 26 in the .in domain. As many as 11 defacement incidents were also recorded in the .org domain.
Of all hacking incidents in the month, about 61% related to phishing, 27% unauthorized scanning and 8% to virus/worm under the malicious code category. “As compared to the previous month, the number of phishing incidents have decreased while scanning incidents have increased,” it said. Like the West, India too has been witnessing a massive rise in phishing attacks. Such incidents in 2006 were 180% higher than 2005, and that trend has carried through into 2007.
According to experts, even though India over the years has been recording the maximum of defacements during August, to coincide with the country’s Independence Day, this year saw February and March record the highest such cases with 858 and 738 websites defaced respectively. August saw 345 websites defaced. While January saw 332 cases of defacement and April 306. the numbers dipped in the months of May, June, July with 110, 33, and 48 cases of defacement recorded respectively.
Website defacement is when a hacker breaks into a web server and alters the hosted website or creates one of his own. A message is often left on the webpage stating his or her pseudonym. Sometimes the defacer makes fun of the system administrator for failing to maintain server security. In most case, the defacement is harmless. However, it can sometimes be used as a distraction to cover up more sinister actions such as uploading malware. According to experts, ”Hackers in India are defacing websites for four reasons – post politically motivated messages, prove technical skill, have fun and do it for the sake of it without realizing the consequences. Most of the websites defaced are in the .com category because they are less secure and have multiple hosting in a single server. The months of February and March saw mass defacement which occurs when multiple websites are hosted on a single server.”
The top hacker groups involved in defacement activities in India have been found to be Lord, CyberLord, yusufislam, Devil-X, ardeshackerlar and crackers child.
And I, even as I write this blog sipping my cool sherbet, think the world is so good!
