Cybersecurity And Cybercrime - Appunti

Topics

• Introduction to Cybersecurity
• Network Theory
• Threat Modelling Analysis and Social Engineering
• Critical Infrastructures
• Cyberwar and Infowar
• Asymmetric Warfare
• Cyberweapons: Stuxnet and others
• Information Warfare and Psychological Ops
• Digital battlefield
• Military applications of Artificial Intelligence; Lethal Autonomous Weapons Systems
• NSA leaks & CIA leaks
• Surveillance
• Myths and Reality of Cybercrime
• Privacy & Data Protection
• Cyber Arms Control & Disarmament
• Tor and Dark Web

Introduction to cybersecurity and OSINT

Raw data is abundantly available online. Open source intelligence (OSINT) to analyze Big Data but also other sources such as SNA, Social Engineering (acquire ways of penetrating networks through users unknowingly), attack tools (phishing and spear phishing email containing a link that will inject a malware), Sentiment Analysis (used mainly in marketing or political communication), Web Scraping (extract data from browsers), “Dark Web” (web pages are not indexed by web engines and tend to sell illegal resources).

Every layer produces data that are expressed in different formats. Roughly speaking we can group these data as more ‘technical’ (1-7) and ‘social’ (8-10). You can extract information from each one of these layers with different methodologies. We will limit our analysis to the social dimension. Packets are the necessary information to make sense of everything that travels the net.

Threat modeling

Threat modeling is a semi-formal technique that is used to understand threats against your system (it contains a mathematical element but is not preponderant). Threat and risk are often used interchangeably but this is incorrect. For threat we indicate the actor whereas a risk is the probability of a bad thing happening, multiplied by its impact. Threat modeling might be better understood as risk modeling.

It has to do more on social layer because there is always an actor behind a risk. Can be used to create an abstraction of the system, profiles of potential attackers (goals and methods). It is useful because: it increases awareness in the organization, help focus resources, better security assessment, may help bridging techies and generic staff. It usually involves algorithms (set of instructions to do something).

Social network analysis

Social Network Analysis (SNA): examine interactions and the structural constraints between nodes, flows of resources and information. It comprises a paradigm (graph theory, relational theories of social interaction) and a methodology (mainly descriptive statistics: measures of centrality, density, transitivity, reciprocity and brokerage).

For examples see the research on social movements (Diani – McAdam. 2002), on social capital (Lin, 2001), on virtual communities (Adamic – Glance, 2005) and on Florentine politics in the 15 century (Breiger – Pattinson, 1986). According to Wasserman and Faust (1994, pp 17-21) ‘a social network consists of a finite set or sets of actors and the relation or relations defined on them.

Terminology

• Actors: discreet individual, corporate, or collective social units.
• Social ties: linkage or relationship between actors. Dyad if the actors are two; Triad if the actors are three.
• Group: collection of all actors on which ties are to be measured.
• Relation: collection of ties of a specific kind among members of a group.

Particularities of SNA according to Wasserman and Faust

Particularities of SNA according to Wasserman and Faust (1994, ch.1):

• Actors and actions are considered to be interdependent linked by social/relational ties through which resources (material and nonmaterial) flow.
• The network structural environment provides opportunities for and constraints on individual actions.
• Structure (sociopolitical, economic…) as lasting patterns of relations among actors.

Data types in network analysis

Data types in Network Analysis:

• Attribute data: properties, qualities, or characteristics of agents (Scott, 1991). Measured as values of particular variables (income, education…).
• Relational data: properties and qualities related on the contacts, ties and connections which link one agent to another.
• Ideational data: related to meanings and motive definitions.

These data are often collected together. SNA provides a tool for the graphical representation of relations integrating structure and agency. Analysis of terrorist network (9/11): the network was sparse and the nodes were distant à minimizes damages to the network if a cell member is captured.

à Strength of weak ties distant ties are important for finding resources or information (Granovetter, 1973). A low redundancy in ties is linked to resource payoffs. Redundancy can be effective with nonmaterial resources (social bonds and social capital). Structural holes and the relative payoffs for brokers, consultants, and gatekeepers in bridging holes between agents (Burt, 1992).

Threat model vocabulary

Threat Model vocabulary:

• Threat: actions/activities that potentially can harm computers/networks or some other organization’s assets.
• Attack: actual realization of threat.
• Vulnerability: weakness or opening that may allow a threat to become an attack (not necessarily a defect).
• Risk: probability that the vulnerability is found and it is exploited.
• Risk management: all activities/actions undertaken to control or reduce the risk (preventive).
• Mitigation: actions/activities undertaken to reduce the effects/consequences of the attack (post-event).
• Threat modeling: identifying/assessing threats, understanding threats-to-assets, developing strategies for responding.

Not all users have privileges within the network to access or undertake actions.

Methodology

Methodology:

• Thinking who your attacker can be and your asset.
• Attack surface: what can the attacker attack?
• Attack Vectors: probable means of attack.
• You can collect as much data as possible on how secure your system is and, on the attackers, (BD).

Example

Example:

• Someone with physical access to a system/data and with unlimited time.
• Provided that certain security measures are taken.
• Who has access? What privileges? Assets?
• Worst possible outcome?

CIA cybersecurity rules

CIA’s Cybersecurity as a set of rules to guarantee:

• Confidentiality: only authorized users can access specific computers/data.
• Integrity: data stored can only be modified by authorized users.
• Availability: data and systems should be promptly available everywhere to authorized users.

Types of attackers

Types of attackers:

• Amateurs: opportunistic attackers.
• Hackers: non malicious.
• Crackers: malicious.
• Insiders.
• Hacktivists.
• Cyber-terrorists.
• Large organization/corporations and structured networks (private companies, organized crime, specialized organizations serving government – cyber mercenaries).
• Nation-state cyber-warriors: more resources à Worst menaces classified in APT (Advanced Persistent Threat) numerical classification.

Botnet: numbers of computers controlled externally to launch an attack a DoS or DDoS that force a lot of traffic into a computer that cannot process. The main motivation is related to cybercrime, the rest is cyber espionage and warfare.

Crypto AG

Crypto AG:

• Swiss cryptography firms that sold its equipment to governments and militaries after WWII. Secretly controlled by CIA and after 2018 sold.
• Selling backdoor crypto equipment to benefit the US, UK and defense intelligence.
• Revealed on Feb 11, 2020, by media.

Stuxnet

Stuxnet worm designed for sabotage and that's the target is a specific industrial process and actually target a particular subsystem of a scale industrial control system (ICS) of a specific producer which is Simmons so once injected spread silently through a windows infrastructure looking for a specific PLC programmable logic controller to reprogram/alter the functionality of this PLC while at the same time showing normal running condition to the monitoring system.

It was first reported in mid-June 2010, and it is defined as a military grade cyber weapon with the goal to hit and produce real world physical targets so through virtual cyber through the virtual cyber war world you produce physical damages on physical systems operating the machinery, implies deep insider knowledge so this is a mixture of cyber war, cyber weapon technology and intelligence.

The goal of Stuxnet was to be able to disrupt the production mechanism of the centrifuges used in an in a uranium enrichment facility in Iran. Stuxnet placed itself in between the two so intercept the communications between the PLC and the industrial control system, to modify the PLC internal code and to change the operational parameters, it hides the piercing infection through a rootkit functionality.

Stuxnet lives and operates in two different environments: the windows environment and the PLC environment where the payload is parachuted, injected and executed. A worm is a segment of code able to replicate and travel autonomously through the networks without human intervention, the difference with viruses is that the virus to activate and to move around the network needs some kind of human activity while worms are completely autonomous and usually contain a payload to attack the specified target.

An example of one of the first worms appeared on the networks, Code Red (2001), incredible capability to travel networks. Worms go around by themselves and there are many cases in which they ended up in nuclear power plants for example.

In 2003 Slammer Worm has been able to enter a nuclear power plant in Ohio and disable for a few hours the safety monitoring system; in 2008 in Georgia there was an automatic shutdown of the nuclear power plant after the application of a software update to a single computer; in 2014 a South Korean nuclear power plant was hacked to access blueprints of reactors floor Maps and other internal information (this is very likely an intelligence operation).

Critical infrastructures like distribution of electricity production and distribution of electricity pipelines water chemical and food production are controlled by software (Industrial Control Systems). SCADA stands for Supervisory Control and Data Acquisition controls very dispersed assets to centralise data acquisition and control over critical system operations.

At the lowest level there are PLCs (Programmable Logic Controllers), low level devices controlling real world processes at the interface between the virtual world and the real world (ex: sensors actuators, pumps…). SCADA general architecture have control centres with human interfaces for the operators to control the framework, and communication links through many different technologies (cable, radio links, satellite links…) and remote sites where you can have local intelligence sensors, remote telemetry units.

Stuxnet is specialised for ICSs which are becoming more and more vulnerable infrastructures because of their underlying layer of ICT of cyber and digital technologies. These control systems for large infrastructures historically used to be more isolated than they are now, closed environments, less effective and flexible but probably a bit safer.

Now tendency to start connecting SCADA systems to the general network, convergence between control networks and component corporate networks, SCADA components are being standardised, extensive use of ICT protocols. Each one of them come with its vulnerabilities (ex: the monitoring framework communicating with remote devices without any encryption).

Afterwards, it's difficult to take control again of the device, in some cases had to be rebooted or power cycled but in case of industrial frameworks and systems you may not be able, or you may don't want to power cycle something important.

Stuxnet is a cyber weapon, probably the first Stuxnet infection was caused by USB key and it's very likely that the person who plugged the USB key with the Stuxnet inside into the first computer of the local area network of the plant was not even aware of injecting the worm (not clear whether that was done on purpose).

Immediately Stuxnet installs on that machine a rootkit so that it hides files and activities on that machine, it tries to connect to a Command and Control (C&C) server - if he finds a way out to the external - if it doesn't the Stuxnet is completely autonomous, from that point on it infects all USB keys inserted into that machine then it starts spreading this to the enterprise network, starts spreading to all the nodes through print servers and file services.

It doesn't do this very quickly - the worm is stealthier, even more difficult to figure out what's going. Then establishes a Peer-to-Peer network (P2P) for self-update and again tries to access a Command-and-Control server external if it if it finds one.

It it's what the military terms is called a “fire and forget launching” it does everything by itself completely autonomous you don't even have to tell where the target is the weapon goes and look for the target. Infects any new USB flash drive inserted on any computer at that level then it goes down in depth so through databases network and printer and file shares.

It spreads through windows vulnerabilities but also vulnerabilities of the Siemens software and goes down one step-by-step, start infecting all the machines at that level and proceeds infecting 7 project files which are project files of the industrial control system until it gets at the very bottom here to the PLCs and starts fingerprinting them – infecting only the one necessary applying the payload (15,000 lines of code).

So, what it does is to replace the communication library used by the control system with the Stuxnet library. The new library is able to control the communication between PLC’s input values from sensors and give fake pre-recorded data to the legitimate monitoring programme. The functionality of the inserted code was varying the rotational speed of the centrifuges slowly over a month.

It uses 7 different propagation mechanisms to propagate, in addition establishing a peer to peer in connexion to C&C servers to download and execute code update, rootkit on the windows infrastructure and a rootkit at the PLC level so it not only hides itself and the activity in the files on the windows infrastructure, but it does the same at the lower level. NSA jumps the air gap by having a transceiver planted inside the USB key connecting short a short distance to a different station.

Other cyberweapons and malware

• Duqu (2011) a remote access Trojan, not self-replicating similar to Stuxnet but targeting computers rather than ICSs, more an information gathering worm, so it had a back door recording keystrokes and system information (cyber reconnaissance) unless it was a precursor of something. The targets were limited, and it was designed to destroy itself after 36 days.
• Flame (2012) was optimised for espionage and was mainly found in Iran and the Middle East apparently. Large and complex espionage capabilities: recording voice Skype conversations screenshots keyboard activity network traffic. No automatic replication propagation, it had a self-destruct module to eliminate traces.
• Gauss (2012) a nation state sponsored banking Trojan to get information and monitor bank accounts and money flow. The main distribution is in the Middle East.
• Shamoon (2012) sabotage on Saudi oil-company Aramco.
• Red October (2013) it's an advanced cyber espionage network targeting diplomatic and governmental agencies and scientific research organisations. Contained more than thousand modules for advanced infections. Most of the tasks as one-time events so you get a DLL code for the specific task from an attacker server, executed in memory and then it's immediately discarded. It used targeted email to specific persons and through attachment Red October was able to be injected, undetected for more than five years, relying on Java exploit for infection. It goes very slowly at the beginning; it gathers information for a few days then module deployment and compromises and a resurrection module if you update the system or if the C&C servers are shutdown you can regain control over the previously infected machine with a simple email.

Logic bombs you can implant things that wait for specific conditions before activating. Possibly a cyber-attack on the electric power grid in Ukraine causing a blackout (2016), Steel mill.