纪望月

今年5月，一款名為WannaCry的勒索病毒肆虐全球，仅爆发两天就造成150多个国家、至少20万人受害。更可怕的是，这款病毒利用的漏洞程序竟然源自美国国安局。此次事件再度敲响网络安全的警钟，并引发全球范围内关于网络安全治理的讨论：面对来势汹汹、不断升级的网络病毒，国际社会究竟能做些什么？又该如何做呢？

A global outbreak of ransomware1） is rapidly infecting machines in critical and not-so-critical infrastructure across the globe， including the National Health Service in the United Kingdom， a Spanish internet service provider， the German rail system， and mall billboards in Singapore. This digital pandemic illustrates a challenge that the cybersecurity community has been wrestling with2） for nearly a decade： How to counter the spread of malicious cyber capability.

To help inform this conversation， lets first step back and review what we know about WannaCry， the ransomware sprinting across the globe. As has been widely reported， the malware leverages an exploit3） developed by the U.S. National Security Agency. The exploit， which was called EternalBlue， “works reliably against computers running Microsoft Windows XP，” as Ars Technica4） put it. The developers of WannaCry combined this Windows exploit with code that allowed the ransomware to spread without so much as a keystroke5） or click from either the operator or the victim， locking machines and demanding ransom. How， you might ask， did this exploit reach the authors of WannaCry？ In simple terms： The Shadow Brokers6）， the group that has spent the last few months leaking NSA tools， essentially made it open-source.

Because of difficulties associated with pushing patches7） designed to block an exploit out to the public—it takes a long time for everyone to click on those annoying little security updates， and some portion of the population never will—open-sourcing exploits like this is often a bad idea. It simultaneously notifies the software manufacturers and potential attackers of the bug. The Shadow Brokers/WannaCry case is just one demonstration of the growing challenge of countering the spread of malicious cyber capability. The code for Carberp8） （a “botnet9） creation kit”） was posted online and precipitated10） the outbreak of the Carbanak11） malware used to steal cash from ATMs. Rumors persist that versions of the BlackEnergy trojan—twice leveraged to shut off portions of the Ukrainian power grid—have been floating around in malware forums.

In 2013 and in response to the publicity of Stuxnet12）， the campaign that sabotaged the Iranian nuclear enrichment13） program， Gen. Michael Hayden14） noted that the time we live in “has the whiff15） of August 1945. Someone， probably a nation-state， just used a cyber weapon in a time of peace … to destroy what another nation could only describe as their critical infrastructure.” To Hayden， it was abundantly clear that cyber-insecurity could threaten global stability， yet the international community was ill-equipped to handle the problem.

Today， when policymakers around the world contemplate the intersection of cybersecurity and global stability， they focus their time， money， and effort into developing concepts around norms for responsible state behavior—in other words， what states and other international actors should and should not do in cyberspace. They have not paid enough attention to the other side of the same stability-regime coin： limiting what groups can and cannot do. This means a combination of hardening our own systems against attacks and， likely， somehow countering the proliferation of capability—the possibility of which requires a great deal more exploration from researchers.

This research will be important because there are several problems when it comes to countering the spread of malicious software. Chief among the challenges here is the notion that malware， the “weapon of cyberconflict，” is only a portion of the problem. The tool itself isnt the only thing bad actors need—they must have the knowledge of how to leverage it as well. In any case the capability—the code and how to use it—is not physical. Its knowledge or information. And its easier to lock down a physical object than it is to stop the spread of information.

Second， somewhat counterintuitively， there are people who argue that the open spread of malicious capability is actually beneficial to those trying to defend against cyberattacks. If the exchange of tools and practices happens in the open， defenders have a better sense of what and who they are trying to protect against.

Third， the cybersecurity community cannot afford to institute blanket16） restrictions on the exchange of malware. When actively defending against an attack or remediating an incident， defenders and responders share artifacts with colleagues to gain insight on how to counter the attack. More often than not， these artifacts could only be described as malware.

So what can we do？ For starters， the policy community needs to understand that not all malicious cyber capability is made equal. We know that the capability behind the Stuxnet campaign that sabotaged the Iranian nuclear facility at Natanz17） is different from Zeus18）， which enabled financial and other cybercrime around the world， which is different from the Mirai19） botnet， which caused the Dyn20） internet outage in October 2016. And all of these tools are constructed and operate differently from WannaCry. Just as cybertools are vastly different in construction and effect， we likely need a variety of policy tools to address them. Wrapping our heads around21） what these capabilities are， how they differ， and how they spread is a massive first step.

If we can do that， we can then look to other fields， like biosecurity， pathogen22） and disease control， counternarcotic23）， and counter-money-laundering and small arms trade， which could shed light and provide frameworks for addressing diffusion24） problems. This type of framework might be leveraged to help the defensive cybersecurity community address transnational threats like the Mirai botnet and clean up the mess left by widespread ransomware. Similarly， the cybersecurity community can likely draw lessons about where and how to break up illicit markets from the experiences of the counternarcotic community to help address the spread of malware between criminal groups.

Western policymakers are not the only ones who see WannaCry as a catalyst25） to renew discussion. Chinese academic Shen Yi writes， “all countries that are willing to take responsibility， including the United States， should advocate as soon as possible to promote a global cyber non-proliferation mechanism.” In a polarized world， there may be space for some form of transnational cooperation on this issue. But first， we need to fill the knowledge gap.

一款勒索軟件在全球爆发，迅速感染了包括英国国民医疗服务体系、西班牙一家互联网服务提供商、德国铁路系统和新加坡商场广告板在内的全球关键和非关键基础设施的电脑。数字病毒的流行凸显出网络安全领域近十年来一直试图解决的一个问题：如何应对恶意网络力量的传播。

为了使对话双方知晓相关背景，我们先退一步，看一下我们对WannaCry这款光速横扫全球的勒索软件有多少了解。大量报道显示，该恶意软件利用了美国国家安全局开发的一款漏洞利用程序。据美国科技博客Ars Technica称，这款名为“永恒之蓝”的漏洞利用程序可以“有效攻击装有微软Windows XP系统的电脑”。WannaCry的开发人员将这一Windows漏洞利用程序与某种代码结合，使这种勒索软件无需操控者或受害者敲击键盘、点击鼠标便能传播开来，锁定电脑，然后勒索赎金。你可能会问：这个漏洞利用程序是如何落到WannaCry的开发者们手中的？简单来说，一个名为“影子经纪人”的组织近几个月来一直在泄露美国国安局的各种工具，“永恒之蓝”实际上也因此成了开源软件。

由于向公众普及漏洞补丁存在困难——想让每个人都点击那些讨厌的安全升级小程序需要很长时间，有些人甚至从来不升级——故而将“永恒之蓝”这一类漏洞利用程序开源化往往是非常可怕的。……