29 WTF kosten Cyber-Angriffe?

Die ganzen Ransomware-Gangs da draussen verdienen ja richtig
Geld. Darkside verlangte nette 4 Millionen Dollar vom Betreiber
der Colonia Pipeline. Aber was kostet eigentlich so ein
Cyber-Angriff in der Durchführung? Was sind die laufenden Kosten
für Cyber-Operationen? Was kostet Personal? Wie teuer ist die
Entwicklung von Schadsoftware? Über all diese Fragen wissen wir
in der Forschung ziemlich wenig. Kriminelle und Cyberkommandos
sind wenig gesprächig, wenn es um das Thema Kosten geht. Aus dem
Staatshaushalt kann man das auch nicht rauslesen. Deswegen
näheren wir uns in dieser Folge mal dem Thema an und machen
Reverse Engineering: Wir definieren ein paar Grundannahmen und
gucken darüber, welche Komponenten Cyber-Operationen so brauchen
und welchen Einfluss bestimmte Aspekte wie Dauer, Teamgröße und
Auswahl von Schadsoftware auf den Preis hat. Um das ganze etwas
besser nachzuvollziehen hat ein Kollege von mir ein Tool gebaut,
mit dem man die Kosten für verschiedene Angriffskampagnen
modellieren kann. Viel Spaß damit!
Shownotes

Cyber Attack Cost Calculator:
https://percepticon.de/material/open-data/cost-of-cyber-attack-calculator/


Ablon, Lillian, and Andy Bogart. 2017. Zero Days, Thousands of
Nights: The Life and Times of Zero-Day Vulnerabilities and Their
Exploits. Research report RR-1751-RC. Santa Monica, Calif: RAND.
Accessed May 26, 2020.
https://www.rand.org/pubs/research_reports/RR1751.html


Ablon, Lillian, Martin C. Libicki, and Andrea A. Golay. 2014.
“Markets for Cybercrime Tools and Stolen Data: Hackers‘ Bazaar.”


Barzashka, Ivanka. 2013. “Are Cyber-Weapons Effective?” The RUSI
Journal 158 (2): 48–56.
https://doi.org/10.1080/03071847.2013.787735


Browning, Kellen. 2021. “Hundreds of Businesses, from Sweden to
U.S., Affected by Cyberattack.” The New York Times, July 2, 2021.
https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html


Collier, Kevin. 2021. “Luxury Cars and $100 Bills: Police Bust
Ransomware Gang in Ukraine.” Accessed June 17, 2021.
https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199


CompTIA. 2017. “Your Next Move: Cybersecurity Engineer.” Accessed
June 17, 2021.
https://www.comptia.org/blog/your-next-move-cybersecurity-engineer


Cybernews. 2021. “Million-Dollar Deposits and Friends in High
Places: How We Applied for a Job with a Ransomware Gang.”
Cybernews, April 21, 2021.
https://cybernews.com/security/how-we-applied-to-work-with-ransomware-gang/


Deloitte. 2018. “Black-Market Ecosystem. Estimating the Cost of
„Pwnership“.” Accessed July 01, 2021.
https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-risk-black-market-ecosystem.pdf


Jobilize. 2021. “Exploit Developer with Security Clearance Job in
Columbia.” Accessed June 17, 2021.
https://www.jobilize.com/job/exploit-developer-security-clearance-columbia-mount-indie-united-states;jsessionid=e_xYHPefDaUpLRbiI3PaD0IzWOp2-vLK3nILfB0J.web01?src=drblsrch


Lindsay, Jon R. 2013. “Stuxnet and the Limits of Cyber Warfare.”
Security Studies 22 (3): 365–404.
https://doi.org/10.1080/09636412.2013.816122


Malone, Patrick J. 2012. “Offense-Defense Balance in Cyberspace:
A Proposed Model.” Monterey, California. Naval Postgraduate
School. https://calhoun.nps.edu/handle/10945/27863


Payscale. 2021. “Security Operations Engineer Salary in the
United States.” Accessed June 17, 2021.
https://www.payscale.com/research/US/Job=Security_Operations_Engineer/Salary


Pomerleau, Mark. 2017. “Here’s How DoD Organizes Its Cyber
Warriors.” Accessed June 17, 2021.
https://www.fifthdomain.com/workforce/career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors/


Smeets, Max. 2016. “How Much Does a Cyber Weapon Cost? Nobody
Knows.” Council on Foreign Relations, November 21, 2016.
https://www.cfr.org/blog/how-much-does-cyber-weapon-cost-nobody-knows


Whitney, Lance. 2020. “How Cybercrime Will Cost the World $1
Trillion This Year.” TechRepublic, December 7, 2020.
https://www.techrepublic.com/article/how-cybercrime-will-cost-the-world-1-trillion-this-year/


Zerodium. 2021. “Zerodium Exploit Acquisition Program.”
https://zerodium.com/program.html
Hinweise

Kommentare und konstruktives Feedback bitte auf percepticon.de
oder via Twitter. Die Folge erscheint auf iTunes, Spotify,
PocketCast, Stitcher oder via RSS Feed. Apple Podcasts
unterstützt gegenwärtig kein HTML mehr, weshalb das hier alles
etwas durcheinander ist.
Sound & Copyright

Modem Sound, Creative Commons.

Vint Cerf, „Internet shows up in December 1975“, in: IEEE
Computer Society, Computing Conversations: Vint Cerf on the
History of Packets, December 2012.

L0pht Heavy Industries testifying before the United States
Senate Committee on Governmental Affairs, Live feed from CSPAN,
May 19, 1998.

Barack Obama, Cybersecurity and Consumer Protection Summit
Address, 13 February 2015, Stanford University, Stanford, CA.

Michael Hayden, „We kill people based on meta-data,“ in: The
Johns Hopkins Foreign Affairs Symposium Presents: The Price of
Privacy: Re-Evaluating the NSA, April 2014.

Bruce Schneier, „Complexity is the enemy of security, in IEEE
Computer Society, Bruce Schneier: Building Cryptographic Systems,
March 2016.

Beats, Bass & Music created with Apple GarageBand