Home » Posts tagged 'hackers' (Page 2)
Tag Archives: hackers
C4ISTAR for Hacking and Cyber Conflict
As per http://en.wikipedia.org/wiki/C4ISTAR
C2I stands for command, control, and intelligence.
C3I stands for command, control, communications, and intelligence.
C4I stands for command, control, communications, computers, and (military) intelligence.
C4ISTAR is the British acronym used to represent the group of the military functions designated by C4 (command, control, communications, computers), I (military intelligence), and STAR (surveillance, target acquisition, and reconnaissance) in order to enable the coordination of operations
I increasingly believe that cyber conflict will develop its own terminology and theory and paradigms in due time. In the meantime, it will adopt paradigms from existing military literature and adapt it to the unique sub culture of cyber conflict for both offensive, defensive as well as pre-emptive actions. Here I am theorizing for a case of targeted hacking attacks rather than massive attacks that bring down a website for a few hours and achieve nothing but a few press headlines . I would also theorize on countering such attacks.
So what would be the C4ISTAR for -
1) Media company supporting SOPA/PIPA/Take down Mega Upload-
Command and Control refers to the ability of commanders to direct forces-
This will be the senior executives including the members of board, legal officers, and public relationship/marketing people. Their name is available from corporate websites, and social media scraping can ensure both a list of contact addresses (online) as well as biases for phishing /malware attacks. This could also include phone (flooding or voicemail hacking ) attacks , and attacks against the email server of the company rather than the corporate website.
Communications- This will include all online and social media channels including websites of the media company , but also those of the press relations firms handling communications , phones,websites- anything which the target is likely to communicate externally (and if possible internal communication)
Timing is everything- coordinating attacks immediately is juevenile, but it might be more mature to attack on vulnerable days like product launches or just before a board of directors meeting
Intelligence-
Most corporates have an in-house research team, they can be easily targeted using social media channels, but also offline research and digging deep. Targeting intelligence corps of the target corporate is likely to produce a much better disruption. Eventually they can be persuaded to stop working for that corporate.
Computers- Anything that runs on electricity and can be disabled – should be disabled. This might require much more creativity than just flooding.
surveillance- This can be both online as well as offline, and would be of electronic assets, likely responses for the attack, and the key people who are to be disrupted.
target acquisition- at least ten people within each corporate can and should be ideally disrupted, rather than just the website. this would call for social media scraping, and prior planning. even email in-boxes can be disrupted (if all else fails)
and reconnaissance-
study your target companies, target employees, and their strategies.
Then segment and prioritize in a list of matrix of 10 to 10, who is more vulnerable and who is more valuable to attack.
the C4ISTAR for -a hacker activist organization is much more complicated but forensics reveal that most hackers tend to leave a signature style (in terms of computers,operating systems,machine ids,communication, tools, or even port numbers used)
the best defense for a media rich company to prevent hacking attacks is to first identify its own C4ISTAR structure for its digital content strategy and then fortify as well as scrub vulnerabilities (including from online information regarding its own employees)
(to be continued)
http://www.catb.org/~esr/faqs/hacker-howto.html
The Hacker Attitude
SOPA RIP
- Any effort to combat online piracy must guard against the risk of online censorship of lawful activity and must not inhibit innovation by our dynamic businesses large and small (AJ-yup)
- We must avoid creating new cybersecurity risks or disrupting the underlying architecture of the Internet. (AJ-note this may include peer-to-peer browsers, browser extensions for re-routing and newer forms of encryption, or even relocation of internet routers in newer geographies )
We must avoid legislation that drives users to dangerous, unreliable DNS servers and puts next-generation security policies, such as the deployment of DNSSEC, at risk.
While we are strongly committed to the vigorous enforcement of intellectual property rights, existing tools are not strong enough to root out the worst online pirates beyond our borders.
We should never let criminals hide behind a hollow embrace of legitimate American values
and
We should all be committed to working with all interested constituencies to develop new legal tools to protect global intellectual property rights without jeopardizing the openness of the Internet. Our hope is that you will bring enthusiasm and know-how to this important challenge
Authored by
Victoria Espinel is Intellectual Property Enforcement Coordinator at Office of Management and Budget
————————————————————————–
AJ-Why not sponser a hackathon, White House and create a monetary incentive for hackers to suggest secure ways? Atleast a secure dialogue between policy makers and policy breakers could be a way forward.
SOPA in its current form is dead. We live to fight another day.
—————————————————————————–
Quote-
Let us never negotiate out of fear. But let us never fear to negotiate. John F K
Poets and Hackers
My latest book , a collaboration with many fine artists is now up. Its called Poets and Hackers
Enjoy!
Poets & Hackers v5http://www.scribd.com/embeds/66419481/content?start_page=1&view_mode=list&access_key=key-23x8ifmmz5noevn8m4vn//
Poets and Hackers
analysts analyze bloggers blog but scientists research
if hackers hack and writers write why dont poets poe
or maybe everybody is a closet poet
some write prose some write code
some play in ones and zeros some play with images
some with video while most stick to playing with A to Z
we all have our favorite toys some we choose most are given to us
poets and hackers playjoes and crackers
choosing to play in a divine farmville playing till we slacken
Top 25 Errors in Programming that lead to hacker attacks
I am elaborating an earlier article on http://decisionstats.com/top-25-most-dangerous-software-errors/ based on my continued research into cyber conflict and strategy. My inputs are in italics – the rest is a condensed article for further thought.
The Department of Homeland Security of the United States of America has just launched a list of top 25 errors in programming or creating software that increase vulnerability to hacking attacks. The list which is available at http://cwe.mitre.org/top25/index.html lists down a methodology fo measuring vulnerability called Common Weakness Scoring System (CWSS) and uses that score to rank the various errors as well as suggestions to eliminate these weaknesses or errors.
Measuring Weaknesses
The importance of a weakness (that arises due to software bugs) may vary depending on business usage or project implementation, the technologies , operating systems and computing environments in use, and the risk or threat perception.The Common Weakness Scoring System (CWSS) provides a mechanism for scoring weaknesses. and provides a framework for prioritizing security errors (“weaknesses”) that are discovered in software applications.
Identifying Weaknesses
For example the number 1 weakness is shown with
1CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’).
The rest of the weaknesses are
RANK SCORE ID NAME
[1] 93.8 CWE-89 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
[2] 83.3 CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
[3] 79.0 CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4] 77.7 CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
[5] 76.9 CWE-306 Missing Authentication for Critical Function
[6] 76.8 CWE-862 Missing Authorization
[7] 75.0 CWE-798 Use of Hard-coded Credentials
[8] 75.0 CWE-311 Missing Encryption of Sensitive Data
[9] 74.0 CWE-434 Unrestricted Upload of File with Dangerous Type
[10] 73.8 CWE-807 Reliance on Untrusted Inputs in a Security Decision
[11] 73.1 CWE-250 Execution with Unnecessary Privileges
[12] 70.1 CWE-352 Cross-Site Request Forgery (CSRF)
[13] 69.3 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[14] 68.5 CWE-494 Download of Code Without Integrity Check
[15] 67.8 CWE-863 Incorrect Authorization
[16] 66.0 CWE-829 Inclusion of Functionality from Untrusted Control Sphere
[17] 65.5 CWE-732 Incorrect Permission Assignment for Critical Resource
[18] 64.6 CWE-676 Use of Potentially Dangerous Function
[19] 64.1 CWE-327 Use of a Broken or Risky Cryptographic Algorithm
[20] 62.4 CWE-131 Incorrect Calculation of Buffer Size
[21] 61.5 CWE-307 Improper Restriction of Excessive Authentication Attempts
[22] 61.1 CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
[23] 61.0 CWE-134 Uncontrolled Format String
[24] 60.3 CWE-190 Integer Overflow or Wraparound
[25] 59.9 CWE-759 Use of a One-Way Hash without a Salt
Details of each weakness is given by http://cwe.mitre.org/top25/index.html#Details
It includes Summary , Weakness Prevalence, Consequences, Remediation Cost, Ease of Detection ,Attacker Awareness and Attack Frequency .In addition the following sections describe each software vulnerability in detail- Technical Details ,Code Examples ,Detection Methods ,References,Prevention and Mitigation, Related CWEs and Related Attack Patterns.
Other important software weaknesses are -
[26] CWE-770: Allocation of Resources Without Limits or Throttling
[27] CWE-129: Improper Validation of Array Index
[28] CWE-754: Improper Check for Unusual or Exceptional Conditions
[29] CWE-805: Buffer Access with Incorrect Length Value
[30] CWE-838: Inappropriate Encoding for Output Context
[31] CWE-330: Use of Insufficiently Random Values
[32] CWE-822: Untrusted Pointer Dereference
[33] CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)
[34] CWE-212: Improper Cross-boundary Removal of Sensitive Data
[35] CWE-681: Incorrect Conversion between Numeric Types
[36] CWE-476: NULL Pointer Dereference
[37] CWE-841: Improper Enforcement of Behavioral Workflow
[38] CWE-772: Missing Release of Resource after Effective Lifetime
[39] CWE-209: Information Exposure Through an Error Message
[40] CWE-825: Expired Pointer Dereference
[41] CWE-456: Missing Initialization
Mitigating Weaknesses
Here is an example of the new matrix for migrations that also list the top 25 errors . This thus shows a way to fix the weaknesses and relative impact on each weakness by the following mitigations.
http://cwe.mitre.org/top25/mitigations.html#MitigationMatrix
Effectiveness ratings include:
- High: The mitigation has well-known, well-understood strengths and limitations; there is good coverage with respect to variations of the weakness.
- Moderate: The mitigation will prevent the weakness in multiple forms, but it does not have complete coverage of the weakness.
- Limited: The mitigation may be useful in limited circumstances, only be applicable to a subset of this weakness type, require extensive training/customization, or give limited visibility.
- Defense in Depth (DiD): The mitigation may not necessarily prevent the weakness, but it may help to minimize the potential impact when an attacker exploits the weakness.
Within the matrix, the following mitigations are identified:
- M1: Establish and maintain control over all of your inputs.
- M2: Establish and maintain control over all of your outputs.
- M3: Lock down your environment.
- M4: Assume that external components can be subverted, and your code can be read by anyone.
- M5: Use industry-accepted security features instead of inventing your own.
The following general practices are omitted from the matrix:
- GP1: Use libraries and frameworks that make it easier to avoid introducing weaknesses.
- GP2: Integrate security into the entire software development lifecycle.
- GP3: Use a broad mix of methods to comprehensively find and prevent weaknesses.
- GP4: Allow locked-down clients to interact with your software.
| M1 | M2 | M3 | M4 | M5 | CWE |
|---|---|---|---|---|---|
| High | DiD | Mod | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | ||
| Mod | High | DiD | Ltd | CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | |
| Mod | High | Ltd | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | ||
| Mod | High | DiD | Ltd | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | |
| Mod | DiD | Ltd | CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) | ||
| Mod | DiD | Ltd | CWE-131: Incorrect Calculation of Buffer Size | ||
| High | DiD | Mod | CWE-134: Uncontrolled Format String | ||
| Mod | DiD | Ltd | CWE-190: Integer Overflow or Wraparound | ||
| High | CWE-250: Execution with Unnecessary Privileges | ||||
| Mod | Mod | CWE-306: Missing Authentication for Critical Function | |||
| Mod | CWE-307: Improper Restriction of Excessive Authentication Attempts | ||||
| DiD | CWE-311: Missing Encryption of Sensitive Data | ||||
| High | CWE-327: Use of a Broken or Risky Cryptographic Algorithm | ||||
| Ltd | CWE-352: Cross-Site Request Forgery (CSRF) | ||||
| Mod | DiD | Mod | CWE-434: Unrestricted Upload of File with Dangerous Type | ||
| DiD | CWE-494: Download of Code Without Integrity Check | ||||
| Mod | Mod | Ltd | CWE-601: URL Redirection to Untrusted Site (‘Open Redirect’) | ||
| Mod | High | DiD | CWE-676: Use of Potentially Dangerous Function | ||
| Ltd | DiD | Mod | CWE-732: Incorrect Permission Assignment for Critical Resource | ||
| High | CWE-759: Use of a One-Way Hash without a Salt | ||||
| DiD | High | Mod | CWE-798: Use of Hard-coded Credentials | ||
| Mod | DiD | Mod | Mod | CWE-807: Reliance on Untrusted Inputs in a Security Decision | |
| High | High | High | CWE-829: Inclusion of Functionality from Untrusted Control Sphere | ||
| DiD | Mod | Mod | CWE-862: Missing Authorization | ||
| DiD | Mod | CWE-863: Incorrect Authorization |
