“An aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches,” Panetta said, speaking at the Intrepid Sea, Air and Space Museum in New York, adding that China, Russia, Iran and militant groups are the biggest likely perpetrators of such an attack.
He raised a specter of a cyber-attack that would do far worse than steal sensitive information from government departments. “They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals. They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country.”
Other countries are already feeling the cyber-warfare bite. In August, Saudi Arabia’s state oil company, Saudi Aramco, saw more than 30,000 systems infected. While critical functions like oil production were unaffected, being on separate systems, basic operations were shut down by the attack. Shortly after, Qatari liquified natural gas company RasGas suffered a malware attack that had the same modus operandi. In his speech, Panetta said that Iran is suspected to be behind those attacks as retaliation for US sanctions.
Meanwhile, Israeli Prime Minister Benjamin Netanyahu recently warned that “there have been increasing efforts to carry out cyberattacks on Israel's computer infrastructure.”
Citing the recent rash of financial sector hacks, Panetta said that the rising threat has led the US to consider preemptive action. The military "has developed the capability to conduct effective operations to counter (cyber) threats to our national interests,” he noted.
That is something that security researchers believe is already being played out on the world stage. "If we look for offensive cyberattacks that have been linked back to a known government, we mostly find attacks that have been launched by United States, not against them,” said Mikko Hypponen, chief research officer at F-Secure. “So far, antivirus companies have found five different malware attacks linked to operation 'Olympic Games' run by US and Israel. When New York Times ran the story linking US Government and the Obama administration to these attacks, White House started an investigation on who had leaked the information. Note that they never denied the story. They just wanted to know who leaked it.”
The US and Israel are widely believed to be behind the Stuxnet Trojan in 2010, which took aim at Iran’s nuclear program by invading and compromising a uranium enrichment facility at Nantanz, shutting down centrifuges. That gambit was likely state-sponsored, intelligence sources have said, with the New York Times first linking the development of the virus to Israeli and US governments.
The policy could well backfire, Hypponen warned. “As [the] United States is doing offensive cyberattacks against other countries, certainly other countries feel that they are free to do the same,” he said. “Unfortunately, the United States has the most to lose from attacks like these."
State-sponsored attacks are unlikely to wane. Kaspersky Lab researchers say that recently, government-sponsored cyberwarfare is on the rise, thanks to deployment of malware like Flame, Duqu, Gauss and Stuxnet, and a newly identified cyber-espionage threat, miniFlame.