What's the Most Significant Hack in History?
Illustration : Vicky Leta/Gizmodo  On some level, all of us are waiting for the big onethe hack that downs the internet, paralyzes infrastructure, maybe launches a couple nukes. If that day never arrives, it will be largely thanks to the legions of malefactors who, over the years, have hacked this or that government or corporation and thus forced those institutions to plug up their vulnerabilities, or at least try to. Some of these hacks have been staggering in scopeacts of sabotage and/or theft inconceivable in an unconnected world. For this weeks Giz Asks, we reached out to a number of experts to find out. Advertisement  Director and Professor, Criminal Justice, Michigan State University, whose research focuses on computer hacking and malware, among other things  The first that comes to mind is the Morris worm, from 1988. A college student named Robert Tappan Morris wrote a piece of code that he claimed he thought would simply ping servers and assess the size of the internet at that time. But there was either a deliberate or unfortunate error in the code, and instead of simply pinging and reporting back, it started to replicate and spread, and effectively caused a denial-of-service attack against almost the entire internet. Morris claims this wasnt intentional, but he nonetheless became one of the first people successfully prosecuted for a piece of malicious software, and the whole incident led to the formation of the first Computer Emergency Response Team. Because the internet at that time was mostly limited to universities, NASA, government entities, etc., the idea behind CERT was to get all these different players around the table to try to figure out a rapid solution to eliminate future problems, and then shore up their resources to make sure it couldnt be effectively used again. Another contender for the most significant hack is the Office of Personnel Management data breach around 2014. This was thought to have been performed by China, in order to acquire the sensitive data used for FS86 forms for the government. FS86 forms are essentially the forms you fill out when youre trying to get clearance to handle classified material. No one knows exactly how much information was accessed, because the government has been kind of cagey about it. But millions of these forms and the data they contained were lost. The reason this is critical is that those forms are what individuals fill out to be hired by the FBI or the Secret Service, and contain very private, potentially damaging information, which foreign agents or any other person could potentially leverage to their benefit. For instance, if you have massive amounts of debt reported in your FS86, then thats an indication that you might be a risk for giving away state secrets, if you were paid to do so. Finally, theres the NotPetya hack, from 2017, which [affected Europe and Asia]. It was called NotPetya because it looked like ransomware called Petya, but it wasnteffectively, it caused a given computer to brick, and thats about it. It just destroyed computer systems. Its thought to have been Russian-made in origin, and was implanted on Ukrainian servers. It was installed in the backdoor of tax software that was widely used in Ukraine. Any company or entity that does business in Ukraine would have had to use this software for business purposes, so when the code was executed all those systems that were connecting back to this tax software were affected, and it caused millions of dollars in losses. Lots and lots of equipment had to be replaced. For two weeks, parts of Ukraine had effectively no internet. It impacted shipping and all sorts of physical infrastructure. I think its significant because its not often that the main function of a hack is to just destroy the system itself, and that was very much the goal here. No one knows exactly how much information was accessed, because the government has been kind of cagey about it.  Author of The Darkening Web: the War for Cyberspace  The answer here invariably depends on your perspectiveand probably also your security clearance. But if pressed, I do have a favorite that I think helps set the course of history as well as represent some of the biggest challenges in cyber conflicts. And that hack was the so-called Soviet pipeline attack, which resulted in the biggest non-nuclear explosion ever seen from space. This was in 1982 (or 1983, depending on who asked), way before there was the World Wide Web and even before there was the global Internet that we recognize today. Not only was the hack possibly one of the most significant attacks on critical infrastructure, but it also was an information warfare attack, a psychological operation. It therefore shows the duality of cyber conflict better than anything else. And just by chance it happened almost exactly 41 years before the attack on US pipeline company Colonial Pipeline, with all the disruption it entailed. If it really happened. The story started in a 2004 publication by a key adviser to President Ronald Regan, Thomas Reed, a former Secretary of the Air Force. Reed said that the CIA, which was countering a flood of Industrial espionage attempts by the Soviet KGB aimed at supporting the collapsing economy of the USSR, launched a counter operation called FAREWELL. Central to this operation was to allow the Soviets to steal the technology they were after, but to alter it to make sure that it caused more harm than goodmaybe much more harm. In this particular case, the Soviets were after industrial control system software to better manage gas and oil pipelines. The CIA allowed the KGB to steal the software in question, but slipped a logic bomb into the codemaking sure that at a specific time the system would go haywire. At the appointed time the White House and the satellite analysts were warned not to be too concerned when they saw a large explosion in Siberiathe biggest non-nuclear explosion ever seen from space, as it was all part of the plan. Thissupposedlywas not the first or the last time the Poisoned chalice cyber stratagem was used. But it was devastatingly effective. Supposedly. There are real doubts that this event ever took place. Until 2012 It was even mocked. However, in 2012, a Canadian TV documentary provided many additional details, and featured a number of credible witnessesincluding a former Soviet deputy minister. He said the event took place in 1983, on a different pipeline than Reed suggested, and even caused dozens of fatalities. And then of course there was the issue that Reeds account was actually publicly re-produced by the CIAs own academic research organization. Clearly this was a story that someone wanted to be told. As we know now, when Reeds account was reproduced by US intelligence they were launching OLYMPIC GAMES, the internal codename for what is now known as the Stuxnet cyberattack on the Iranian uranium enrichment program. Its possible that someone thought it was important to support the evolving cyber strike with an information warfare attackto remind certain audiences not only that this had happened before, but that it had been worse. Whether or not it was true, a message may have been sent. But then again, it may have all been a coincidencea combination of bureaucratic errors and overactive imaginations. The Soviet pipeline attack may have been the first cyber attack in historypaving the way for the CUCKOOS EGG cyber espionage case a couple of years later. But what it certainly is is an example of how cyber warfare and information warfare can overlapfeed into each other, or even masquerade as each other. This is the most important takeaway from the storynot that attacks on critical infrastructure could occur and be incredibly devastating, but that information warfarepropaganda and covert influencing attacksare an ever-present shadow of cyber activities. As every true hacker knows, the most effective hacks are those that target human decision making. Technologyand dataare often just enablers to this end. The Soviet pipeline attack may have been the first cyber attack in historypaving the way for the CUCKOOS EGG cyber espionage case a couple of years later. But what it certainly is is an example of how cyber warfare and information warfare can overlapfeed into each other, or even masquerade as each other.  Giz Asks Other notable recent hacks and breaches 2010 The Stuxnet superworm caused substantial damage to Iran's nuclear program, ruining a fifth of its nuclear centrifuges, according to military and intelligence experts. The United States is widely credited with having deployed the cyberweapon, which some experts claim Israel had a hand in developing. Neither country has admitted responsibility. 2012 A Windows virus called Shamoon, which infected 35,000 workstations of a Saudi Arabian oil company, became notorious because its purpose was so overtly destructive. Known as a wiper, the virus is meant to completely erase all data on infected computers. It also gave rise to fears of oil prices surging internationally. Security researchers widely suspect Iran in the attack. 2013, 2014 Using a subcontractors credentials, Chinese military hackers infiltrated the U.S. Office of Personnel Management (OPM) in an attack that remained undetected for over a year. Roughly 22 million records are stolen, including a database of more than 5 million fingerprints, as well as intensive documentation used to determine which U.S. government employees are eligible for security clearances. 2014 Hackers calling themselves the Guardians of Peace infiltrate Sonys computer network and steal upwards of 100 terabyte of data before unleashing a destructive wiper and dumping sensitive employee data, emails, and unreleased films online. The attack is attributed to North Korea, with the claim that Sony had been targeted over the comedy film The Interview (James Franco, Seth Rogen) in which Kim Jong-un is assassinated. 2014 In 2016, Yahoo claimed this breach exposed one billion user accounts. In 2017, it was disclosed by its new owner Verizon to have been three billion. 2016 Prior to the Democratic National Convention, WikiLeaks and DCLeaks publish confidentials emails attributed to Democratic nominee Hillary Clinton and other top Democrats in her circle. A hacker known as Guccifer 2.0, whom U.S. intelligence later finger as a persona created by Russian spies, accepts credit for the hack while leaking various damaging documents to U.S. journalists during the height of the election. The impact on the 2016 vote is likely to remain inestimable; however, the U.S. government has repeatedly stated that Moscows intention was to ensure Donald Trumps victory. 2017 The Equifax data breach has been characterized as one of the most massive in U.S. history. The personal data of at least 145 million people were compromised. Last year, the U.S. Justice Department indicted four members of the Chinese military, though none are ever likely to see trial. The greater impact of the breach has been to serve as a constant reminder of the inadequate privacy protections available under U.S. law. 2017 The WannaCry ransomware attack drew widespread attention due to the swiftness with which it affecting hospitals, public utilities, and corporations on a global scale. Among its payload was EternalBlue, an exploit developed by the National Security Agency and leaked by the hacking group Shadow Brokers a year prior to the hack. British hacker Marcus Hutchins, a.k.a. MalwareTech, discovered a killswitch hardcoded into the malware, which helped greatly curtail the spread of the initial variant. The U.S. government holds North Korea responsible. 2018 Personal data belonging to nearly every Indian citizen was exposed after a breach of the countrys vast biometric database, Aadhaar. Among other details, the breach exposed the 12-digit identification numbers of some 1.1 billion people. While Indias governing party downplayed the severity of the incident, calling it fake news, security researchers found much of the exposed data on the black market. Advertisement  Professor of Criminology, Director of HateLab at Cardiff University, UK, and author of The Science of Hate    My area of expertise is the human dimension in cybersecurity, so my greatest hack comes more in the form of social engineering rather than intrusion via software/hardware shortcomings. Humans, not technology, are the weakest link in the cybersecurity chain, and hackers that exploit the shortcomings in our psychology, via fabrication, misdirection and obfuscation, can cause as much damage as those who hack code. The creation of the fake MartinLutherKing.org website by the white supremacist Don Black (as part of the Stormfront hate forum) is one of the most insidious hacks in history. Up until the beginning of 2018, when it was reported to Google as being owned by Stormfront, the site frequently appeared in the top four hits on searches for Martin Luther King. At first glance, there was no hint of white supremacist rhetoric, apart from the note at the bottom of the page in small font that read Hosted by Stormfront. Heres a little MLK quiz to coincide with the upcoming MLK holiday! Enjoy! All of the questions criticized or defamed Dr King. One asked According to whose 1989 biography did King spend his last morning on earth physically beating a woman?; another, Whom did King plagiarize in more than 50 complete sentences in his doctoral thesis? At the end of the quiz schoolchildren got to tot up their scores. The site purported to offer A True Historical Examination. Links to Rap Lyrics led to the text: Heres what black rappers say, and what their followers do. Keep in mind that most of this is produced and distributed by Jewish-run companies, alongside lyrics that described black people committing violence and sexual acts against whites. The webpage encouraged children to download and print off pamphlets for distribution in schools on Martin Luther King Day. The pamphlets called for the abolition of that national holiday and accused King of domestic and sexual violence. MartinLutherKing.org was a sock puppet site; a gateway to the extreme right in America, targeting the most vulnerable in society with disinformation in an attempt to sow division and foster hatred between races. Advertisement  My area of expertise is the human dimension in cybersecurity, so my greatest hack comes more in the form of social engineering rather than intrusion via software/hardware shortcomings.  Founding Director of the NYU Center for Cyber Security and Vice Dean for Academics and Student Affairs at the NYU Tandon School of Engineering, whose research interests include digital forensics, biometrics, data compression, network security, and security & human behavior. This might seem like an obvious answer, but I view SolarWinds as one of the most significant hacks for a number of reasons related to its scale and the challenges it poses. SolarWinds was a huge wake-up call: the hackers vehicle of delivery was just the kind of highly trusted systems-update software which we all use to fix bugs and enhance system performance  in this case, for SolarWinds Orion network management system. And so the attackers here damaged more than just their targets: they also damaged our sense that official updates are trustworthy. The targetsincluding Microsoft, Intel and Cisco, and a dozen or so federal agencies including Treasury, Justice and Energy departments, the Pentagon, and ironically the Cybersecurity and Infrastructure Security Agencyalso evince the attacks level of sophistication and the peril we face going forward as a result: the attack deliberately hit the sort of monitoring software that touches every node in a system. It was FireEye, an outside organization, that detected irregularities. And maybe most importantly, the combination of those factors illuminated something many of us in cybersecurity have long seen comingthat cyber systems are the next major global battlefield. SolarWinds brought the reality of that to the forefront for the general public, as well as some in government. We need to be training cybersecurity professionals the way we train soldiers, where we equip professionals with an arsenal of very effective and tactical tools, while at the same time training people how to adapt to and counter an evolving threat landscapefor example through simulation exercises and other means of instilling a security mindset. Some organizations are relying on professionals who have gone through a 6-week cybersecurity certification, and I just dont believe thats enough to address the level of threats were seeing. And if we dont start taking this more seriously and train properly, the effects have the potential to be wide-ranging and hugely impactful in peoples daily lives, as weve seen with the Colonial Pipeline. With traditional wars, the people closest to the battlefield are impacted. With cybersecurity, were all at risk. Advertisement  SolarWinds was a huge wake-up call: the hackers vehicle of delivery was just the kind of highly trusted systems-update software which we all use to fix bugs and enhance system performancein this case, for SolarWinds Orion network management system. And so the attackers here damaged more than just their targets: they also damaged our sense that official updates are trustworthy.  Additional timeline by Dell Cameron. Email us at tipbox@gizmodo.com.