Organized hackers from multiple foreign countries are said to be the culprits behind a major cyber-attack on oil and natural gas giant, Saudi Arabian Oil Company. The attack “targeted the whole economy of the country, not just Aramco as an entity,” according to the company’s vice president for corporate planning. The incident emphasizes the growing concern of threats of international cyber-warfare.
Saudi Aramco — as it is more commonly known — has been cited as the world’s biggest oil company. Headquartered in Dhahran, Saudi Arabia, the company produces more than 7.9 million barrels of crude oil a day and 2.9 billion barrels a year, according to its 2010 annual review.
On Sunday, company officials said an investigation has revealed that an earlier cyber-attack was carried out by individuals from “several foreign countries.”
The cyber-attack occurred in August, when a spear-phishing email launched a computer virus known as Shamoon and infected over 30,000 computers on the company’s networks, destroying data on servers and individual computer hard drives. The incident also prompted the company to take its main websites offline.
Saudi Aramco declined to identify which countries were involved in the cyber-attack, citing the ongoing investigation. A spokesman for the Interior Ministry said in a press conference Sunday that “the attack failed to reach its ultimate goal, which was to stop the flow of Saudi oil.”
The company’s vice president for corporate planning, who also headed the company’s team involved in the investigation of the incident, stressed that the goal of the attack was broader than targeting Saudi Aramco alone. “The aim was to stop pumping oil and gas to domestic and international markets,” Abdullah al-Saadan told reporters.
U.S. officials, including Defense Secretary Leon Panetta, have recently expressed concerns that a growing international cyber-war could cripple governments and major infrastructures. In an interview with TIME magazine in October, Panetta cited the Saudi Aramco attack as evidence of such threats and the dangers posed by the emerging capabilities of cyber-warfare.
“It is the kind of capability that can basically take down a power grid, take down a water system, take down a transportation system, take down a financial system,” he told Time editors. “We are now in a world in which countries are developing the capability to engage in the kind of attacks that can virtually paralyze a country.” […]
“We are facing the threat of a new arena in warfare that could be every bit as destructive as 9/11 — the American people need to know that. We can’t hide this from the American people any more than we should have hidden the terrorism-attack threat from the American people.”
“The three potential adversaries out there that are developing the greatest capabilities are Russia, China, Iran.”
“Out of a scale of 10, we’re probably 8 [in cyber-war skills. But potential foes] are moving up on the scale – probably the others are about a 3, somewhere in that vicinity, but they’re beginning to move up.”
Such security concerns influenced the previously proposed Cybersecurity Act of 2012 (CSA), which was rejected by lawmakers on August 2nd and again in the Senate on November 14th. That legislation failed to pass largely because of worries over unnecessarily burdensome business regulations, as well as concerns from civil rights organizations about the potential privacy infringements regarding private communications. Those concerns have been bipartisan in nature, and while both sides of the political aisle agree that some sort of legislation should be considered in order to protect the nation’s critical infrastructure, there is widespread disagreement on how best to implement such a solution without stifling civil rights, infringing upon privacy or inadvertently hurting businesses. Meanwhile, in the absence of cybersecurity legislation, there is mounting anxiety that the Obama administration will implement a regulatory system by way of executive order.
Some experts believe that the threat of cyber-war is exaggerated and the rhetoric overly hyped, perhaps for the benefit of the growing cybersecurity industry. Indeed, that industry is expected to increase by 50 percent over the next four years, according to industry analysts. Even the Obama administration proposed a 35 percent increase in cybersecurity spending for 2012. The emergence of entities like Wikileaks and the hacker collective Anonymous have, perhaps ironically, also sparked more spending in the cybersecurity industry.
But somewhere between hype and apathy is a component of reality in acknowledging the dangers of various cyber-crimes, especially where national security is concerned.
Recently, the U.S. government indicated that Iran launched cyber-attacks on our nation’s banks, as well as on other energy companies in the Persian Gulf. And for several years, China has been accused of unleashing multiple attacks on various U.S. information networks. Several other countries, like Russia, also present a growing threat to the U.S. in the escalating cyber-war.
While the U.S. government has not yet viewed the hacker collective Anonymous at the same high level of cyber-threat as state-sponsored hackers, there is increasing concern that rogue elements of the collective could potentially become as great a threat, specifically if recruited – knowingly or not – by U.S. adversaries like Al Qaeda or foreign government entities.
In the wake of Sunday’s revelation that the cyber-attack on Saudi Aramco was the handiwork of individuals from several foreign governments, including circumstantial evidence that points to Iran as one of those culprits, the issue of cybersecurity is sure to remain one of significant ongoing concern.
COMMENTS
Please let us know if you're having issues with commenting.