6th European Conference - Academic Conferences

David Rohret and Michael Kraft
by the suspect or an old fashioned stake-out to catch them in the act. Cyber crime investigations are
common place and many are high profile, prompting law enforcement agencies to allocate significant
resources to rapidly solve cases.
4. A paranoid approach to remaining anonymous
Why a paranoid approach to anonymity? Governments, adversaries, corporations, cyber criminals,
even cheating spouses require a repeatable process they can employ to accomplish sensitive activities
across the World Wide Web without detection or retribution. In a recent article prepared for the
North Atlantic Treaty Organization (NATO) Parliamentary Assembly (Myrli, 2010) the cost of cyber
crimes to governments and corporations is reported to be over US $100B annually. In response to
cyber crime, governments and corporations spend billions more on technology and methodologies to
identify, track, and prosecute cyber criminals (Fenwick, 2010). Not only have governments increased
expenditures and resources to combat cyber crime, there is now unprecedented cooperation among
governments and corporations to provide data and information sharing to identify and/or capture offenders
(Golubev, 2005). Therefore, for an adversary or cyber criminal to successfully use the internet
for nefarious reasons and remain anonymous, they must take a holistic view of the security available
to their intended targets; that is to say, they must assume each capability is available and successfully
deployed. Just as a network security officer does not have the luxury of only defending against some
or most of the vulnerabilities on their network, a cyber criminal or cyber warrior cannot depend on a
law enforcement agency to only use some of the methods described in section 3.
This paper is the result of research into adversarial capabilities in cyber warfare, specifically, how a
network-centric red team, acting as the adversary, would prevent positive attribution after conducting
network reconnaissance or an attack. The following case study reflects precautions and actions used
to create the shields in the Praestigiae Cone, described in Figure 1; using combinations of publically
available technology, services, and research. Figure 2 outlines the process of achieving the seven
shields, resulting in complete anonymity. The details are explained using a scenario based on an actual
case study involving a red team assessment on an enterprise network.
Figure 2: A process for remaining anonymous in cyber space
Scenario: The red team’s goal was to emulate a hackers capability to remotely identify and disable an
automated network-controlled surveillance system that included wireless video, fence and ground
sensors, autonomous vehicle sentries, and network security; without being identified as the adver-
216