Computer hackers here and on the mainland with online nicknames including “Crazian,” “Seal” and “Wanderer” attempted to gain access to University of Hawaii, Hawaii National Guard, Hawaiian Airlines and other networks Friday and Saturday, officials said.
It sounds like a major breach, but in this case, the hackers were invited, and the would-be victims were waiting for the intrusion.
This weekend saw the first test of one of the few civilian “cyber ranges” across the country designed to pit hacker against system administrator as a way to better defend against the all-too-frequent real-life probes, the state said.
In this case, the attacks were launched on computer networks replicated at UH using about $2 million worth of servers and routers that make up the cyber range.
The university and state Defense Department are partners on the anti-computer-access project.
There are plenty of actual attacks, meanwhile, that make the defensive practice warranted.
“For the University of Hawaii, we are constantly probed and attacked daily,” said Jodi Ito, UH’s information security officer.
Most of those efforts are unsuccessful, but “it goes on extensively,” she said. She suspects most of the attempts are by amateurs.
Just in July alone, though, the University of Delaware, Stanford University, Apple and the NASDAQ stock market were among institutions revealing data breaches,
according to the Privacy Rights Clearinghouse.
Communications company Verizon looked at more than 47,000 reported cybersecurity incidents and 621 confirmed data breaches over the past year and found that in 84 percent of the cases, the initial compromise took hours or less.
In 66 percent of the cases, the breach wasn’t discovered for months or even years. A total of 19 percent of the attacks analyzed by Verizon were conducted by state-affiliated actors — in other words, espionage.
The majority of financially motivated cyberattacks originated in the United States or Eastern Europe, particularly Romania, Bulgaria and Russia. Espionage cases were primarily attributable to East Asia.
Maj. Gen. Darryll D.M. Wong, state adjutant general and homeland security adviser for the state, said building a cyber range at UH provides a “huge” homeland security benefit.
The lab also is expected to have an economic benefit with consideration being given to charging companies in the future to use the facility to gauge network protection.
“Cyber defense is tremendously important as so much of our lives — banking, transportation, power, communications and more — are all tied to computer networks,” Wong said in a release.
Those participating in the exercise replicated parts of their computer networks in the lab so any breaches would be contained there and not affect actual data.
Part of the cyber range’s purpose is to raise awareness about breaches, which can range from basic intrusions to attacks having catastrophic results, said Col. Reynold Hioki, the state Defense Department’s chief information officer.
“Collectively, I think everyone agrees we are being attacked on a continual basis,” Hioki said.
The Defense Department said the exercise, Friday through today, had “some of the top hackers in the world” take on cyber defense teams from the Hawaii National Guard, Pacific Air Forces, several utilities and private companies. A review of the exercise is expected today.
More than 120 “cyber warriors” and observers were involved, including about 25 “Red” team attackers and 70 “Blue” team defenders, officials said.
The state Defense Department said most of the volunteer hackers participating didn’t want to be named, but Hioki said the “lead” Red team member was Summer Lee, who works in information technology on Oahu.
Hioki said Lee and Hawaii Air National Guard member Staff Sgt. David Decker volunteered countless hours to help develop the inaugural exercise.
The cyber range was cobbled together at a cost of a couple of thousand dollars using donations of older servers and routers from the Maui High Performance Computing Center, Army, Air Force and state Defense Department, officials said.
“From the university’s perspective, we’re very enthusiastic (about the cyber range) because it provides us with a lot of opportunities,” Ito said.
“We’d like to see the range incorporated into the curriculum as well as a place for both students, government, military and industry partners to come together and be able to share experiences and learn together,” she said.