SecurityCertified

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Friday, December 31, 2010

Review of Decoding the Virtual Dragon Posted

Posted on 1:45 PM by Unknown
Amazon.com just posted my five star review of Decoding the Virtual Dragon by Timothy L. Thomas. I'm posting the entire review here because it's the sort of content that I believe should get wide exposure.

Decoding the Virtual Dragon (DTVD) is the sequel to Timothy L Thomas' 2004 book Dragon Bytes. A colleague introduced me to both books, and an expert on the Chinese hacker scene was kind enough to secure a copy of the book. I thank all of them for the extraordinary journey presented in DTVD. Published in 2007, DTVD is an historical review of key publications by Chinese information warfare (IW) theorists and thought leaders, as translated by American translators and the Open Source Center, successor to the former Foreign Broadcast Information Service (FBIS). The author is an analyst with the Foreign Military Studies Office, and is a West Point graduate, a retired Army Lt Col, and a former Foreign Area Officer focusing on the USSR and Russia. DTVD covers Chinese IW thought from 2004-early 2007. Thomas' earlier book discusses 1995-2003, and his later book addresses 2007-2009.

My review of DB summarized key Chinese IW themes, all of which extend into DTVD. Therefore I'd like to highlight a few aspects of DTVD that should be of interest to Western digital security specialists.

Chinese military leaders have always promoted development of theory and strategy, but they are now integrating practice into their doctrine. This is difficult for a military that lacks the ops tempo of a force like the US military, with a decade of continuous war experience on hand. However, IW allows continuous practice, since it can be exercised "using a borrowed sword" (i.e., using deception and "camouflage" to lend plausible deniability to Chinese IW offensives against the West).

Chinese thought leaders often see the US as an offensive force. Thomas reports on the views of two theorists thus: "Conflict-oriented strategy still holds a strong place in Western strategic culture. Expansion and the seizure of hegemony are Western strategic targets while China's has been an introvert-type behavior whose targets are peace, safeguarding national territories, and seeking unification and resisting aggression" (p 23). (That's apparently how the Chinese frame their activities in Tibet and their missiles facing Taiwan.)

The two theorists (Peng and Yao) also note that "the seizure of information has become a primary task of modern warfare" (p 30). One form of conflict perpetrated by the West is "strategic psychological warfare (SPW)," which includes "attempts to advance their [Western] political system and life style, to use economic aid as bait, to seek economic infiltration and control, and to promote western values via TV, movies, newspapers and journals, audio and video products, and especially over the Internet" (p 34). China sees this as a threat to their "network sovereignty" (p 124).

War is increasingly a financial affair: "War with the objective of expanding territory has already basically withdrawn from the stage of history, and even war with the objective of fighting for natural resources is now giving way to war with the objective of controlling the flow of financial capital" (p 76). "IW will gradually shift into the primary form of war, and military objectives will shift from eliminating the enemy and preserving oneself to controlling the enemy and preserving oneself" (p 87).

DTVD includes a translation of a Chinese IW dictionary and questions and answers on IW. The definition of Computer Network Attack (CNA) says "various measures and actions taken to make use of security flaws in the enemy's computer network systems to steal, modify, fabricate, or destroy information and to reduce or destroy network utility." The definition of IW mentions "the use of computer network systems to gain enemy intelligence," not just destroy targets. Crucially, "in this day and age, there is no distinction between peacetime and wartime network warfare" (p 127). Hopefully for world peace, "network warfare could develop in another direction and work to create 'network deterrence' or 'network containment.' That is, it may be more valuable for both sides to simply comply with the rulebook of not attacking another's networks if two sides attain a mutual balance of network power" (p 128).

Dai Qingmin notes "an individual can threaten an entire country in the information age" and "in some cases the more technologically advanced a country becomes, the more vulnerable it becomes as well" (p 134). Individuals who conduct IW can be hard to find or retaliate against, hinting at the PLA's interest in leveraging individual civilian hackers. Thomas writes: "Dai's discussion focuses heavily on obtaining key information via reconnaissance of foreign computer systems in peacetime... As he [Dai] states, 'Computer network reconnaissance (CNR) is the prerequisite for seizing victory in warfare.' His focus on CNR provides added context to current Chinese operations aimed at the reconnaissance of US systems" (p 137). A later section in DTVD mentions "intelligence warfare" as another Chinese concept where "two sides in a conflict adopt various means to gather and steal information from one another" (p 207).

Father of IW Dr Shen notes "the goals of war have changed from territorial expansion and economic aggression to information plundering and targeting psychological elements" (pp 160-1). Skilled people are key, according to another author, who writes "the personnel system of the armed forces will have to enlist computer hackers or treat them as wartime reserves and give them preferred treatment to provide technical support for military building and operations" (p 173); hear that, US military?

Finally, Thomas observes the "extensive knowledge that the Chinese have about our concepts and systems," with bookstores in China offering "translations of thirty or forty (perhaps more, depending on the size of the store) US military books... [but] a US military bookstore is usually limited to five Chinese titles" (p 304).

I strongly recommend reading DTVD and Thomas' other works if you want to better understand Chinese IW history and thinking.
Tweet
Email ThisBlogThis!Share to XShare to Facebook
Posted in china, reviews | No comments
Newer Post Older Post Home

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

  • DojoCon Videos Online
    Props to Marcus Carey for live streaming talks from DojoCon . I appeared in my keynote , plus panels on incident response and cloud secur...
  • Bejtlich Speaking at TechTarget Emerging Threats Events in Seattle and New York
    I will be speaking at two events organized by TechTarget , for whom I used to write my Snort Report and Traffic Talk articles. The one-da...
  • SANS WhatWorks Summit in Forensics and Incident Response
    I wanted to remind everyone about the SANS WhatWorks Summit in Forensics and Incident Response in DC, 8-9 July 2010. The Agenda looks gre...
  • A Book for the Korean Cyber Armies
    I've got a book for the Korean cyber armies, North and South. That's right, it's my first book , The Tao of Network Security Mo...
  • Sguil 0.7.0 on Ubuntu 9.10
    Today I installed a Sguil client on a fresh installation of Ubuntu 9.10. It was really easy with the exception of one issue I had to troubl...
  • Microsoft Updates MS09-048 to Show XP Vulnerable to 2 of 3 CVEs
    Microsoft published a Major Revision of MS09-048 to show that Windows XP Service Pack 2 and Windows XP Service Pack 3* are now Affected So...
  • Understanding Responsible Disclosure of Threat Intelligence
    Imagine you're hiking in the woods one day. While stopping for a break you happen to find a mysterious package off to the side of the t...
  • Embedded Hardware and Software Pen Tester Positions in GE Smart Grid
    I was asked to help locate two candidates for positions in the GE Smart Grid initiative. We're looking for an Embedded Hardware Penetr...
  • BeyondTrust Report on Removing Administrator: Correct?
    Last week BeyondTrust published a report titled BeyondTrust 2009 Microsoft Vulnerability Analysis . The report offers several interesting ...
  • Human Language as the New Programming Language
    If you've read the blog for a while you know I promote threat-centric security in addition to vulnerability-centric security. I think ...

Categories

  • afcert
  • Air Force
  • analysis
  • announcement
  • apt
  • attribution
  • bestbook
  • blackhat
  • books
  • breakers
  • bro
  • bruins
  • certification
  • china
  • cisco
  • cissp
  • cloud
  • clowns
  • commodore
  • conferences
  • controls
  • correlation
  • counterintelligence
  • cybercommand
  • cyberwar
  • dfm
  • education
  • engineering
  • feds
  • fisma
  • freebsd
  • GE
  • ge-cirt
  • hakin9
  • history
  • impressions
  • information warfare
  • ipv6
  • law
  • leadership
  • malware
  • mandiant
  • microsoft
  • mssp
  • nsm
  • offense
  • oisf
  • packetstash
  • philosophy
  • pirates
  • powerpoint
  • press
  • psirt
  • reading
  • redteam
  • reviews
  • russia
  • sans
  • sec
  • sguil
  • snorby
  • spying
  • threat model
  • threats
  • Traffic Talk
  • training
  • tufte
  • tv
  • ubuntu
  • usenix
  • verizon
  • vulnerabilities
  • wisdom
  • writing

Blog Archive

  • ►  2013 (16)
    • ►  September (1)
    • ►  August (1)
    • ►  June (2)
    • ►  April (2)
    • ►  March (1)
    • ►  February (3)
    • ►  January (6)
  • ►  2012 (60)
    • ►  December (4)
    • ►  November (5)
    • ►  October (3)
    • ►  September (10)
    • ►  August (2)
    • ►  July (6)
    • ►  June (6)
    • ►  May (4)
    • ►  April (2)
    • ►  March (9)
    • ►  February (6)
    • ►  January (3)
  • ►  2011 (108)
    • ►  December (3)
    • ►  November (7)
    • ►  October (11)
    • ►  September (9)
    • ►  August (18)
    • ►  July (10)
    • ►  June (5)
    • ►  May (4)
    • ►  April (13)
    • ►  March (17)
    • ►  February (2)
    • ►  January (9)
  • ▼  2010 (193)
    • ▼  December (14)
      • Best Book Bejtlich Read in 2010
      • Reflections on Four Tufte Books
      • Review of The Dragon's Quantum Leap Posted
      • Review of Decoding the Virtual Dragon Posted
      • Review of Dragon Bytes Posted
      • Steve Jobs Understands Team Building
      • Trying PC-BSD 8.2-BETA1
      • Trying VirtualBSD 8.1
      • FreeBSD on Amazon EC2
      • Bejtlich Teaching at Black Hat DC 2011
      • Speaking at RSA 2011
      • Courtesy of APT
      • Splunk 4.x on FreeBSD 8.x using compat6x Libraries
      • Bruce Schneier, Cyber Warrior?
    • ►  November (11)
    • ►  October (6)
    • ►  September (16)
    • ►  August (15)
    • ►  July (26)
    • ►  June (15)
    • ►  May (15)
    • ►  April (15)
    • ►  March (16)
    • ►  February (19)
    • ►  January (25)
  • ►  2009 (123)
    • ►  December (10)
    • ►  November (17)
    • ►  October (21)
    • ►  September (13)
    • ►  August (20)
    • ►  July (21)
    • ►  June (21)
Powered by Blogger.

About Me

Unknown
View my complete profile