Cyberweapons are commonly defined as

malware Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

agents employed for

military A military, also known collectively as armed forces, is a heavily armed, highly organized force primarily intended for warfare. Militaries are typically authorized and maintained by a sovereign state, with their members identifiable by a d ...

paramilitary A paramilitary is a military that is not a part of a country's official or legitimate armed forces. The Oxford English Dictionary traces the use of the term "paramilitary" as far back as 1934. Overview Though a paramilitary is, by definiti ...

, or

intelligence Intelligence has been defined in many ways: the capacity for abstraction, logic, understanding, self-awareness, learning, emotional knowledge, reasoning, planning, creativity, critical thinking, and problem-solving. It can be described as t ...

objectives as part of a cyberattack. This includes computer

viruses A virus is a submicroscopic infectious agent that replicates only inside the living cells of an organism. Viruses infect all life forms, from animals and plants to microorganisms, including bacteria and archaea. Viruses are found in almo ...

, trojans,

spyware Spyware (a portmanteau for spying software) is any malware that aims to gather information about a person or organization and send it to another entity in a way that harms the user by violating their privacy, endangering their device's securit ...

, and

worms The World Register of Marine Species (WoRMS) is a taxonomic database that aims to provide an authoritative and comprehensive catalogue and list of names of marine organisms. Content The content of the registry is edited and maintained by scien ...

that can introduce malicious code into existing software, causing a computer to perform actions or processes unintended by its operator.

Characteristics

A cyberweapon is usually sponsored or employed by a state or non-state actor, meets an objective that would otherwise require

espionage Espionage, spying, or intelligence gathering, as a subfield of the intelligence field, is the act of obtaining secret or confidential information ( intelligence). A person who commits espionage on a mission-specific contract is called an ...

or the use of force, and is employed against specific targets. A cyberweapon performs an action that would normally require a

soldier A soldier is a person who is a member of an army. A soldier can be a Conscription, conscripted or volunteer Enlisted rank, enlisted person, a non-commissioned officer, a warrant officer, or an Officer (armed forces), officer. Etymology The wo ...

or spy, and which would be considered either illegal or an act of war if performed directly by a human agent of the sponsor during peacetime. Legal issues include violating the

privacy Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. The domain of privacy partially overlaps with security, which can include the concepts of a ...

of the target and the

sovereignty Sovereignty can generally be defined as supreme authority. Sovereignty entails hierarchy within a state as well as external autonomy for states. In any state, sovereignty is assigned to the person, body or institution that has the ultimate au ...

of its host nation. Example of such actions are

surveillance Surveillance is the monitoring of behavior, many activities, or information for the purpose of information gathering, influencing, managing, or directing. This can include observation from a distance by means of electronic equipment, such as ...

, data theft and electronic or physical destruction. While a cyberweapon almost certainly results in either direct or indirect financial damages to the target group, direct financial gains for the sponsor are not a primary objective of this class of agent. Often cyberweapons are associated with causing physical or functional harm to the system which it attacks, despite being software. However, there is no consensus on what officially constitutes a cyberweapon. Unlike malware used by script kiddies to organize botnets, where the ownership, physical location, and normal role of the machines attacked is largely irrelevant, cyberweapons show high selectivity in either or both of their employment and their operation. Before the attack, cyberweapons usually identify the target using different methods. Likewise, malware employed by

fraud In law, fraud is intent (law), intentional deception to deprive a victim of a legal right or to gain from a victim unlawfully or unfairly. Fraud can violate Civil law (common law), civil law (e.g., a fraud victim may sue the fraud perpetrato ...

sters for the theft of personal or financial information demonstrates lower selectivity and wider distribution. Cyberweapons are dangerous for multiple reasons. They are typically difficult to track or defend against due to their lack of physical components. Their anonymity allows them to hide in systems undetected until their attack is unleashed. Many of these attacks exploit " zero days" (vulnerabilities in software that companies have zero days to fix). They are also significantly cheaper to produce than cyber defenses to protect against them. Oftentimes, cyberweapons from one force are obtained by an opposing force and are then repurposed to be used against the original force, as can be seen with the cyberweapons WannaCry and NotPetya. While the term ''cyber weapon'' is frequently used by the press, some articles avoid it, instead using terms such as "internet weapon", "hack", or "virus". Mainstream researchers debate the requirements of the term while still referring to the employment of the agent as a "weapon", and the software development community in particular uses the term more rarely.

Examples

The following malware agents generally meet the criteria above, have been formally referred to in this manner by industry security experts, or have been described this way in government or military statements: * Duqu * Flame * Great Cannon * Mirai * Stuxnet * Wiper * Pegasus

History

Stuxnet was among the first and one of the most influential cyberweapons. In 2010, it was launched by the United States and Israel to attack Iranian nuclear facilities. Stuxnet is considered to be the first major cyberweapon. Stuxnet was also the first time a nation used a cyberweapon to attack another nation. Following the Stuxnet attacks, Iran used cyberweapons to target top American financial institutions, including the

New York Stock Exchange The New York Stock Exchange (NYSE, nicknamed "The Big Board") is an American stock exchange in the Financial District, Manhattan, Financial District of Lower Manhattan in New York City. It is the List of stock exchanges, largest stock excha ...

. Stuxnet was subsequently followed by Duqu in 2011 and Flame in 2012. Flame's complexity was unmatched at the time. It used vulnerabilities in Microsoft Windows to spread. It specifically targeted Iranian oil terminals. In 2017,

data breach A data breach, also known as data leakage, is "the unauthorized exposure, disclosure, or loss of personal information". Attackers have a variety of motives, from financial gain to political activism, political repression, and espionage. There ...

es showed that supposedly secure hacking tools used by government agencies can be obtained − and sometimes exposed − by third parties. Furthermore, it was reported that after losing control of such tools the government appears to leave "exploits open to be re-used by scammers, criminals, or anyone else − for any purpose". Claudio Guarnieri, a technologist from

Amnesty International Amnesty International (also referred to as Amnesty or AI) is an international non-governmental organization focused on human rights, with its headquarters in the United Kingdom. The organization says that it has more than ten million members a ...

states: "what we learn from the disclosures and leaks of the last months is that unknown vulnerabilities are maintained secret even after they've been clearly lost, and that is plain irresponsible and unacceptable". Also in that year

WikiLeaks WikiLeaks () is a non-profit media organisation and publisher of leaked documents. It is funded by donations and media partnerships. It has published classified documents and other media provided by anonymous sources. It was founded in 2006 by ...

released the Vault 7 documents series that contain details of CIA exploits and tools with

Julian Assange Julian Paul Assange ( ; Hawkins; born 3 July 1971) is an Australian editor, publisher, and activist who founded WikiLeaks in 2006. He came to international attention in 2010 after WikiLeaks published a series of News leak, leaks from Chels ...

stating that they are working to "disarm" them before publication. Disarmament of cyber weapons may come in the form of contacting respective software vendors with information of vulnerabilities in their products as well as potential help with or autonomous development (for open source software) of patches. The exploitation of hacking tools by third parties has particularly affected the United States National Security Agency (NSA). In 2016, information about NSA hacking tools was captured by a Chinese hacking group, ATP3, that allowed them to reverse engineer their own version of the tool. It was subsequently used against European and Asian nations, though the United States was not targeted. Later that year, an anonymous group called the " Shadow Brokers" leaked what are widely believed to be NSA tools online. These two groups are not known to be affiliated, and ATP3 had access to the tools at least a year before the Shadow Brokers leak. The leaked tools were developed by the

Equation Group The Equation Group, also known in China as APT-C-40, is a highly sophisticated Threat (computer)#Threat agents or actors, threat actor suspected of being tied to the Tailored Access Operations (TAO) unit of the United States National Security Age ...

, a cyberwarfare group with suspected ties to the NSA. Among the tools leaked by the Shadow Brokers was EternalBlue, which the NSA had used to exploit bugs in Microsoft Windows. This prompted Microsoft to issue updates to guard against the tool. When the Shadow Brokers publicly released EternalBlue, it was quickly used by North Korean and Russian hackers, who formed it into the ransomware WannaCry and NotPetya, respectively. NotPetya, which was initially launched in Ukraine but subsequently spread around the world, encrypted hard drives and forced users to pay a ransom fee for their data, despite never actually giving the data back. In September 2018, the United States Department of Defense officially confirmed that the United States uses cyberweapons to advance national interests.

Potential Regulations

While there has been no full regulation of cyberweapons, possible systems of regulation have been proposed. One system would have cyberweapons, when not being used by a state, subject to criminal law of the country and, when being used by a state, subject to international laws on warfare. Most proposed systems rely on international law and enforcement to stop the inappropriate use of cyberweaponry. Considering the novelty of the weapons, there has also been discussion about how previously existing laws, not designed with cyberweapons in mind, apply to them.

References

External links