Cyberwarfare History Class 1 — Attacking Serbian Cyberspace

Sapphire
4 min readJan 18, 2019

There’s a lot of stories nowadays about breaches, intrusions and events around the world. Cyber security is a very fast paced environment where both attack and defense are always evolving, but sometimes is good to know where all started, looking back into history, especially when we talk about cyberwarfare and information warfare.

Both are substantially important for every State to consider specially today when the cyber arena is real, it’s something we hear about every single day and has a real impact on the field, like the Russian attack on the Ukrainian power grid or stuxnet back then, developed by the Israeli and north Americans services.

In this story I wanted to show you how things has changed and has gained more weight in the last decades, but the idea and the methodologies remains basically the same. It hasn’t changed at all.

Let’s go back to 1995. Yugoslavia

The United States along with other NATO members enforced the Dayton Accords in 1995 ending the war in Yugoslavia and the brutal war campaign of Slobodan Milosevic, through the SFOR(Stabilization Force), which was prepared for war but its task were more focused in maintaining the peace agreement. They basically put boots on the ground once Milosevic signed it.

Spanish and French peacekeeper forces

Another task for the SFOR was to hunt down war Serbian war criminals and make sure that the next elections(1997) were democratic and fair. However the whole SFOR wasn’t just those Ops, but there was also “black ops” forces, integrated by spies and special forces.

The problem in that moment was that Milosevic wasn’t complying the agreement at all but also wasn’t doing enough to stop war crimes as he complied on the Dayton accords.

The US put this task on the J-39, a secret unit from the Pentagon who collaborated with the NSA, the 609th Information Warfare Squadron and the Air Force Information Warfare Center among others.

Operation Tango

On July 10th 1997, British specops teams dressed as Red Cross officials, captured four of the most wanted Serbian war criminals by using GPS tracking in their cars, phone taps and hidden cameras. On later events, once NATO troops increased its number, a problem popped out. Serbian citizens started to walk out to the streets in protests as a reaction against foreign troops. But these protests wasn’t just spontaneous. These protests had an origin in TV newcasters who argued against the western “visitors” and orchestrated these riots at time and location.

Officials were aware of this problem and they wanted a solution, so the J-39 started to think on it.

Analysts detected 5 TV towers transmitting broadcasts that may impacted to 85% of the serbian population. To combat this messages, Serbians who worked for these black ops teams, installed “boxes” capable of switch off the tower, on the transmitters in order to shutdown that signal or told to the guards to install these boxes as a new component for the transmitter for “high resolution”. Once everything was setup, SFOR engineers monitored the stations.

They weren’t just capable to shutdown the “pro-riot” signal but also to transmitt to the Serbians popular TV shows like “Baywatch”, creating a good distraction that permitted to decrease tension on the streets. Serbs definitely prefered girls in bikinis rather than go out and throw stones to soldiers.

Distraction or “shut down” the towers. The official’s choice.

Operation Allied Force

Once the Dayton Accord were out and broken, NATO decided to start with the air strikes against Milosevic’s military key targets. In this scenario, the Pentagon’s unit, started to work to “hack” into the enemy’s systems, specially air-defense systems and soon they discovered that they had civilian telecommunications systems underneath. Once they had permission from the Secretary of Defense for offensive ops(William Cohen on that moment), they started a plan to discover how it worked, what was actually on that network and where was the vulnerability.

They had luck. The Serbians decided to upgrade their systems with a new provider. That provider gave security codes to US Intelligence. They were now able to have presence in the network, shutting down lines and thus cutting communications between military system’s peers.

But the US and his allies had another problem. The air-defense systems. So the J-39 once they gained persistence in the network, they were able to penetrate the systems and spoof the radar’s signal, popping up subtle false information about the planes on the airspace.

The Air Forces were able to escape from the air-defense systems not only by flying at high altitudes but also with the help of the J-39 intrusion.

It worked. Serbian officials blamed on mechanical flaws and they didn’t suspected sabotage.

On June 4th, Milosevic surrendered.

It was a prelude of the modern warfare scenarios. Air Strikes weren’t enough to win the war by themselves, but with the help of the first cyber-warriors from different US units they were able to win the war because its clear impact on information, disruption and deception.

Cyberwarfare was a new and tested field that suited Air, Land and Sea needs and proved the importance of the dominance and operations in the cyberspace as a new and powerful asset for warfare.

--

--

Sapphire

Kimchi and Ransomware. Incident Responder and sort of malware analyst in my free time. Personal blog, opinions are my own.