Between Two Nerds: The cyber resistance!

0:03Tom Uren: Hello everyone, this is Tom Uren. I'm here with The Grugq for another Between Two Nerds. G'day, Grugq, how are you? G'day, Tom. I'm finding yourself? I'm very well. This week's edition is brought to you by Island, who make an enterprise browser optimized for corporate use. Find them at island.io. So this week, we've decided to talk about cyber resistance. And we're going to revisit a couple of groups we've spoken about before, particularly the Ukraine IT Army. We did a couple of episodes about them way back now, and also the Belarus Cyber Partisans. So the Ukraine IT Army grew up in a flurry after the initial invasion of Ukraine by Russia.

0:53Tom Uren: We did a couple of episodes about how could Ukraine possibly make use of this outpouring of goodwill, I guess. So there's an influx of people who just want to help. But we spoke about problems of deconfliction. How do you trust any of them? What do you get them to do? I think your bright idea at one point was to get them to function as an initial access broker. Now, since that time, which was a couple of years ago, the IT armies basically disappeared out of the news. We never hear about it anymore. So I thought it would be a good time to just revisit. And given the fullness of time, what's our assessment of whether that was good or not?

1:39Tom Uren: I recall that there was a couple of stories at the time about how particular people claimed to be doing all sorts of amazing things for the IT Army I always took those with a grain of salt in the recent, I guess, couple of years there's been the odd example of a particular hack that has been attributed to a Ukrainian hacktivist group not the IT Army per se and it's always hard to know whether that is a real hacktivist group, a group of independent people operating with no input from the state or a cover for the Ukrainian military. And it's also hard to know exactly what the impact of those hacks have had.

2:26Tom Uren: Right. So that's the kind of background for the Ukraine IT Army. I'll talk about the cyber partisans when we bring them up just to remind people of where they're coming from So the brief part of history of the cyber army basically on the day of the invasion there was this big call for everyone who can help, please help and I think it was Fedorov who went out and said we need a cyber army, if you can do hacking stuff do hacking stuff to help. And there was a big sort of upswelling of support by a lot of people, like Anonymous joined in, and these telegram groups were sort of like organically set up.

3:14And the IT Cyber Army one, I think, grew to 200, 300, 400 ,000, something like that. Just a huge number of volunteers. And you would think with 400 ,000 people, or just 250 ,000 people or whatever the number was, some number of them had to have some skills. One is huge.

3:35Tom Uren: Yeah, yeah. I mean, that's a large enough number that you would think, is that as many hackers as China has? I don't know. You would think that you could do something with them, right? Right, right. It turned out that the vast, vast majority of them were just sort of volunteering their resources of like an IP address and some bandwidth. to like do DDoS attacks, which are not particularly effective as military tools, let's be honest. They're not a game changer. No. And like it just, it didn't really do very much. But one of the things they did do is they did bring people who could do hacking together and sort of directed them generally at Russia.

4:24And so there was this huge amount of just like hacking and leaking going on. There was a lot of places that got wiped. There was a lot of defacements. There was all this DDoS. There was just a froth of activity. Some of it under the umbrella of the Cyber Army. Some of it not. But it was even the stuff under the umbrella was clearly not like, you know, it wasn't like Second Corps Cyber Army, Fourth Division, you know, the Third Brigade, Second Battalion Company.

4:53Tom Uren: Very loosely directed to a.ru range of IP addresses or something. And so I guess the thing we've learned from the last couple of years of war is that sometimes these operations can be effective when they're combined with something else. Yeah. I mean, the way I've come to think of it is that cyber effects need to be converted into an advantage. Like they don't convey advantage just by existing. You have to do something to them. So if you turn out the lights, you can convert that into advantage by kidnapping the leader of another state while the lights are out. But if you turn out the lights and then do nothing, you do not convert that into advantage.

5:33It's just it doesn't produce anything.

5:36Tom Uren: So the default cyber attack is an inconvenience or an imbuggance. And then you've got to do something to make use of it. Something else. you have to convert it into advantage it doesn't convey advantage by existing like it doesn't just make it better for you because it happened like this has to be exploited it can't just exist on its own that's my that's my current framing from my phd work is narrowing it down like this and one of the huge problems with this you know 200 000 people mob trying to help in any way they could and every way that they could including quite a lot that they shouldn't have um yep you can't convert that into advantage if you don't know about it right yeah so if i remember the we spoke about this in some btn episode and one takeaway or one thought was what you have to do is direct them away from things that are really important to you so that your own services have the space to operate without getting on, conflicting with each other, stumbling upon each other's operations.

6:48Tom Uren: And so that became a problem of how do you prioritise things to be like the most impactful things that you don't really care about? I think I remember that was our takeaway. And that became quite hard because obviously you don't want to devote time to things you don't really care about, even if it's just managing a whole lot of other people. Right. Right. And, you know, as we said, this was just sort of like, there was a mob, really. And because there was direction over a large amount of them, but there were also people just acting independently within that group. Right, yeah. I mean, it would take, if you had 200 ,000 people turn up, it would take quite some time to figure out a command structure that would work.

7:34Organically, right? That's right, yeah. It's like you don't even show up with an existing structure where you're now, oh, no, we have 200 ,000 people. How do we expand what we're already doing? I think there's a lot of problems in managing them. But some of the problems that they were causing, like not just the issues of confliction or they would try and operate on something that you were already on. And because they were so much noisier, they would get detected. and then in the roll-up of their operation, yours would get found out as well, sort of as collateral damage. So that's an issue that exists.

8:11But one of the other ones was that the heavy media coverage of all the cyber activity against Russia caused Russia to become very, like they got more secure. They improved their security posture because all of these Russian companies were now seeing in the news all the time so-and-so got hacked and leaked, such-and-such got defaced.

8:30Tom Uren: there's a ddos going on like right so your contention is that the the noise and froth of it army hacking right well not just not just them exclusively now i'm just going to say like the entire like anonymous all of the all of the hacktivists that were helping yep cause this and the it army is a shorthand in this case for that group but it's okay yep yep and and so the like incident response, also even companies that don't get hacked are motivated to improve their security. Right, which then makes it more difficult if they're legitimate targets. Now the low-hanging fruit is slightly less low-hanging, which is annoying, right?

9:19So particularly at a time when you have few resources and you don't want to, you know, you want to be able to do your job without it being harder than it needs to be. And so seeing this sort of shut down ports, get services upgraded, make people apply patches, that would be sort of very annoying. Apparently, though, one of the largest impacts it had was it made, there's a like DDoS protection company. They got rid of their free tier.

9:51That was sort of like the number one impact that this had overall is it made this one company very profitable. A Russian company? Yes, it was a Russian company.

10:02Tom Uren: So since then, what you've described is a froth of activity that drove domestic Russian security improvements, just out of necessity. That activity wasn't particularly directed, so it didn't really achieve much. How long did that take? It actually couldn't achieve anything because it was never integrated into the state. So there was no way of converting anything they did into advantage. Right. And so is that the first six months or a year? That's almost two years, I think. So the worst of it in terms of the most damage done was in the first six months, probably even less. When you say damage, do you mean to Russia or?

10:49Damage done to Ukrainian interests.

10:50Tom Uren: Right, okay. And that's just because it's cutting off opportunities. So it's really the opportunity cost that is the damage here. Yes, yes. So the opportunity cost plus like conviction, which would cause some disruptions. And then there'd be delays. Like if you're trying to attack a target and it gets DDoSed, you can't do that. You just have to wait until they're done. you know like get it out of their system sort of work it through okay so so it caused delays which i mean that's not such a big deal like a day here or there like that's not as annoying as having access that you could have had cut off because someone broke in did a hack and leak and then the company became very serious about security and now it's it's much harder to gain access right so there was like uh there's just a lot of things that were going on and then it sort of consolidated into this ddos thing that would be directed on a regular basis against specific targets and that was a lot more manageable because you could say okay this week they're doing the you know vladivostok shoe factory we won't do any of our vladivostok shoe factory hacking this week and in a way like this the positive gains to cyber or from from the cyber activity let's be generous i would say minimal right

12:20Tom Uren: so just from a narrow cyber perspective like in terms of intelligence gained or russian capability lost or whatever you're giving them a positive but not much a non-zero a non-zero score but less than one yeah out of 10 they got non-zero that's right yep so you know on the ledger you would say that the the the cyber benefit was very small the cost was very high that's a net loss right and i said no it's not well i was going to say are you talking about no benefit whatsoever plus net lost or are you saying there were some things that probably yeah just probably were good thing good things were annoyances for russia the state but they were offset by the opportunity cost of ukraine not having freedom i guess if you're a military person you would say freedom of maneuver Yes, very much so.

13:21Tom Uren: Right. But I would not say it was a loss overall. So I'd say that the political benefits that were accrued to the Ukrainian resistance effort, like the war efforts overall from this very, very public cyber movement of support, that far outweighed the losses, like the opportunity cost to cyber operations at that time. So it was a tremendous example of people pitching in, I guess. And it feels like it generated a number of stories about how you could help. I guess that, I don't know, does it rally outside support? I think it rallies outside support. It provides very positive news coverage of Ukrainian resistance.

14:15But all of it, and I think here's the real benefit, is that a lot of it was framed from a local perspective. So it was sort of like local boy helps Ukraine resist Russian aggression, which is a sort of more compelling story than Ukraine resists Russian aggression.

14:32Tom Uren: So you mean, like, for example, in Germany, there might be German hero helps Ukrainian resistance. and in the Netherlands and in France. Every country, someone would find that story, I guess. They could do their local, you know, the local hacker who is doing his part, like doing his bit, and who still works at the McDonald's for his shift every day. Yep, yep, yep. And I think that that was very positive overall, to have that sort of coverage, particularly because it was local. It was linked to, like, here is one of us doing something. and it gave at least the impression of successful resistance, even when things were not necessarily going great on the actual front, like the actual war was grinding into this attritional stalemate and Ukraine wasn't necessarily making huge advances or gains or anything.

15:28They pushed back everywhere. But at least they were winning in the minds of people who believed that this cyber war thing was going on. Yep.

15:37Tom Uren: Yep. So I think that that was very beneficial. And I also think that just having, if you have 200 ,000 people who believe that they are personally invested to a degree in supporting Ukraine and they feel very viscerally, this is a thing that I am doing to help. Yep. I think that that translates into some sort of political sentiment. Well, it probably translates directly into some sort of funding, I would have thought. Like you would get people who would chip in a few bucks. If you've got, I don't know, maybe 50 ,000 people chipping in a few bucks every now and then, that probably adds up over time.

16:14Yeah.

16:14Tom Uren: Yeah. 100 ,000 here, 100 ,000 there. Soon enough, you're talking about real money. You know, there's that aspect. You've got political involvement. you know if if their governments don't support ukraine actively enough there's a chance that there will be these these vocal supporters in the voting public that could help shift political sentiment i mean there's just there's a lot of benefits that you get out of it so there's a sort of like information war this this political angle the uh financing and i think all of those were the real benefit that this gave. And anyone reading it as a cyber thing is confused and misreading it.

17:01Tom Uren: Too narrow, right. So a strategic communication win and a cyber nothing burger. Bit of a cyber loss, but you can make it up on volume, I guess. So moving on to another example of a group in a kind of similar but different situation, the Belarus cyber partisans. So I first heard of them maybe 2021 or something like that, where they conducted a very successful hack against the Belarusian government. So the government there is pretty authoritarian. They are allied with Russia and Putin. and there's a relatively, I believe, small group of technically-minded people, very competent people, who are regularly hacking the Belarusian government.

17:53Tom Uren: They've got a public presence. They get representatives that turn up at different cyber-related conferences. Yeah, so that's the background. And how do you rate their success? Yes. So I'd say that there's a few sharp contrasts with the IT Army. One of them is sort of size and purpose. So they're small. They have a very specific goal that they're trying to achieve. And they're very purposeful and directed. Like they know what they're trying to do. They're all on board with sort of doing this. You don't have 200 ,000 people sort of showing up with a, you know, what can I do to help? You have, I don't know, 3, 5, 10, 15, 20, whatever it is, just here's what we're doing.

18:42Tom Uren: I guess on that dimension, it's the exact opposite, right? It's not crowdsourced. It's vetted. Very, very much so. And then the next thing that they have that I think is very impressive is that they have an actual strategy. Like they have a theory of victory. They've figured out, here's how us doing cyber will achieve regime change in Belarus. And they've thought about it and they're executing it. Like they've written it down. They've figured out how it's going to achieve their goals. And they are attempting to do that. So it ranges from things like they don't leak all of the information they have at once.

19:24Because then it sort of saturates the market and people get sort of bored by it. So instead they sort of stage things out. They do editorial culling to make sure that the more interesting stuff is at the top. So like the narratives are there for people. Like I think that they've put more thought, effort, and sort of analytical rigor into their understanding of how cyber can achieve political aims than most countries have ever done. I think that they are far, far ahead of NATO, for example. NATO seems to be looking to do a thing that they could do. Right. Whereas these guys are like, here's how we do it, here's what the impact is going to be, and here's how it's going to lead to our strategic outcome.

20:16Here's the means and the ends, and it's going to work.

20:21Tom Uren: Now, Belarus is still ruled by Lukashenko, right? You're a dictator there. Yeah. So I don't think that they're wrong, but I think that the impact that they expect might be, they're hoping for too much, I think, from what it can actually do. Yeah. It seemed to me that if you're relying solely on cyber means, you just have to be at the right place at the right time. And maybe what you do can tip circumstances in a particular direction. like you know but if you're not if you're at the wrong place at the wrong time it's kind of well this goes back to what i was saying is like it needs to be converted into advantage right yeah right and i think that what they're doing is stuff that makes sense but there's there's not someone there's not a force or a movement or anything that can convert this into an advantage and topple the government they're they're not in that position yet i think they're going to keep going until they are.

21:18So good for them. But, you know, by itself, as, you know, as I've been saying, like cyber just doesn't confer advantage by existing. It has to be used in some way. And I think that that's missing. Hopefully, hopefully they'll find that opportunity to, to free their country from regime that is extremely authoritarian and bad. That said, they, they have been participating as like a supporting force that they've been helping Ukraine as well. I think possibly the biggest cyber attack that had an impact so far by a non-state actor was when they used ransomware to stop the Belarusian railways. Right, yep.

22:02Right. And that held up.

22:03Tom Uren: That was relatively early on in the war, was it? Yeah, yeah. It was sort of like the first or second month or something. It was very early on. And they caused a delay that made the – first of all, their ransomware demand was hilarious, which was stop supporting Putin and close the borders to Russian troops. And then we'll let the trains go. Which I love. So I think that that's very funny. But what I find annoying actually is in the academic literature, they're like – and then they sort of resorted to using ransomware like a common criminal. And it's like that is not what happened. Like, how could you read that as ransomware in the same vein, right?

22:47So that was very funny. And it actually did cause a delay in moving troops through Belarus by like eight hours or something. So, like, that's not nothing. That is a small group of individual civilian hackers who got together and delayed the Russian army for eight hours, which is an incredibly oppressive feat. But out of the four years of war that we've had, that eight hours doesn't necessarily amount to very much in the long run. But I think it's great that it happened. It shows that, I mean, to me what it shows is that even a successful cyber attack is not that successful.

23:30Tom Uren: Right, right. What I wrote about last week or this newsletter was Iranian attacks on American water infrastructure. Right. So this is a very different situation. But it seems to me that in all these cases, what you're trying to achieve is like a political outcome, right? Right. And so for the Iranians. It's cyber war as a sort of politics by other means kind of thing. Yeah, that's right. Yeah. And it's not the cyber attack itself or the impact. It's can you get the opponent to change their mind? And to me, it seems clearest in the US case because it's a very unpopular war. And so even though cyber attacks are just encumbrances or a pain, annoyances, like for the US population, annoyances are actually what you want, right?

24:26Tom Uren: I mean, a better attack would be to make the price of petrol go even higher with cyber means. But I think it's the same thing, right? That's one of the reasons the war isn't popular. It's hurting them in the hip pocket. And also, if you have to boil water, what's this stupid war? And so it feels like the cyber partisans have the right theory of victory to achieve that political goal. It's just that the circumstances aren't right. So, you know, I think that that's an interesting point in that, you know, we often talk about how one of the problems with the cyber attack is that it's just, it's annoying.

25:08Tom Uren: Yeah. Right. Like it's not a deadly event. It's an annoying event. It's an inconvenience. It's a hassle to deal with. It could be very expensive as well, but it's sort of, it's just these things that suck basically. and in the case of iran that's sort of perfect for them as a tool because they don't want a deadly attack right like that would be very counterproductive they don't they don't want something that actually causes a response of like we have to get these guys for what they did to us yeah you want a response of like why is everything more annoying because we are doing this thing i disapproval.

25:44Tom Uren: You don't want cyber Pearl Harbor. Whatever we do. You want cyber stubbed toes. That's right. You want to cyber move the furniture around at night so that people, you know, bark their shit in the morning when they're trying to go to the bathroom or something. That's what you're looking for is just making things more annoying and aggravating because that's the sentiment you're looking for to get the political outcome you want to achieve. and so in a way cyber is perfect for this sort of political warfare i guess like this sort of if that's the goal you're trying to achieve cyber is good for you if you're trying to defeat a state by hard power cyber is probably not very useful yeah and it feels like the cyber partisans are a bit more in that second category where yeah they can be very annoying but annoying a state doesn't really help much when the people are not voting i guess you're right yeah so i i think they're in a hard situation because they they don't have a mechanism of converting anything they do into advantage right like they do need some sort of hard power at some point and i know that they're they're working with other groups and dissident politicians who sort of outside the country sort of activate, like working for change and things like that.

27:11So, you know, I have every hope that they all succeed in the end. But, you know, I think that cyber is not going to be sufficient, which, you know, I'm pretty sure that they accept as well. Like, I don't think this is news. They're not going to be sitting like, oh, why didn't we think of that?

27:31Tom Uren: BTN thinks we're screwed. Yeah. Announcing we're disbanding after BTN episode. 178. So it seems like we've got the clearest case, Iran. It seems like there's a, I don't know if this is their theory of victory, but mine is you increase annoyance at the ballot box that applies political pressure to President Trump. Whether it's their intended goal or not, it seems like that's how it could work if it's going to work. That seems to me to be a sensible theory of victory. Right. And it seems like because his motivations are finely balanced, they've tried to come to a deal many times. Perhaps that could be the straw on the camel's back that gets an enduring deal.

28:24Tom Uren: Right. That seems plausible to me. so when it comes to the cyber partisans they they have a strategy i think which actually like the the plan when carried out does delegitimize does undermine the belarusian government so it's achieving a political goal but it's that right now is just not enough right it's insufficient on its own at this point so and and i guess there's the you know it's adding to their political aims or whatever it's it's taking a step in that direction that's just the right on balance the the situation is not that that step is close enough right right it's um you can delegitimize the government but when the government doesn't rely on legitimacy to stay in power right yes it's not necessarily beneficial and then yeah ukraine it's not so much a benefit for because it attacks Russia or does anything really to harm rudder.

29:24Tom Uren: It's more a rally around the flag. It's not a cyber war. Right, right. So it's still achieving a political goal, though. Yeah. Yeah. So, I mean, here we go. The takeaway here is that cyber war is politics by other means of politics.

29:42Thanks, Scott. Thanks a lot, Tom.

29:50Bye.