Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

More documents

Recommendations

Info

C H A P T E R9Losing Trust in Your Friends: SocialNetwork ExploitationO U T L I N EIntroduction 172Do You Really Know All Your LinkedInConnections? Imposters in SocialNetworks 172Duping Corporations and MilitaryPersonnel: Robin Sage 173The Dangers of Transitive Trust 173Getting Your Personal Data CompromisedWhile Trying to Impress the Boss:The Case of the SACEUR Imposter 175Designing Common Knowledge:Influencing a Social Network 177How the Syrian Electronic ArmyAttacked Rivals on Facebook 177The Future of Influencing SocialNetworks 178Summary 181Suggested Further Reading 181INFORMATIONINTHISCHAPTER• Do you really know all your LinkedInconnections? Imposters in social networks• Duping corporations and military personnel:Robin Sage• The dangers of transitive trust• Getting your personal data compromisedwhile trying to impress the boss: The case ofthe SACEUR imposter• Designing common knowledge: Influencinga social network• How the Syrian Electronic Army attackedrivals on Facebook• The future of influencing social networks171
172 9. LOSING TRUST IN YOUR FRIENDS: SOCIAL NETWORK EXPLOITATIONINTRODUCTIONThe early 2000s saw personal interaction and expression on the World Wide Web movebeyond simple homepages and discussion forums to social media and networking sites suchas Twitter, Facebook, and LiveJournal. These sites facilitate the spread of personal informationby leveraging the inherent network structure of human interactions. The result has beenmillions of users maintaining these sites as a means to stay connected with family, friends,and coworkers. However, the security of such sites is often called into question. Individualswanting to express themselves on these sites often do not adhere to the most robust securitypractices. As a result, services such as Facebook pose a significant operational security(OPSEC) issue to both the military and the corporate world alike.In this chapter, we look beyond the simple security issues of social media which wouldallow an adversary to potentially harvest sensitive information in a passive manner. Instead,we focus on events in which cyber warriors exploit social media in a manner to either obtaininformation from or influence the social network. First, we look at how a social engineer canleverage the network to harvest information, particularly leveraging social media to exploitthe propensity of individuals to easily share information with new “friends” on these sites.This point is illustrated by the experiment “Robin Sage” where an American security firmcreated fake Facebook accounts of a fictitious user in order to entice users to befriend herand inappropriately share information. A more recent incident involves the use of falseFacebook accounts to gain information from users at the NATO headquarters. With regardto the second point, we study how cyber warriors influence social networks—specifically citinghow pro-regime hackers in Syria designed a fake Facebook login page in an attempt tosteal login credentials from pro-revolutionary Syrians in 2011. We then look to the futureand discuss how attackers can more efficiently target social networks for a propaganda campaignby leveraging the network structure.DO YOU REALLY KNOW ALL YOUR LINKEDIN CONNECTIONS?IMPOSTERS IN SOCIAL NETWORKSConsider the following hypothetical situation. A businessman signs into his LinkedIn account.He sees a new friend request. He does not remember ever meeting the individual—the picture looks unfamiliar, and the name does not ring a bell. However, he clicks on the user’sprofile and sees that three of his friends are connected with this individual. They also attendedthe same MBA program only graduating in different years. “Ok,” our businessman thinks,“this guy seems legit” and clicks “connect” granting the stranger access to his private profile.If the previous vignette sounds familiar, or you suspect that people in your corporate ormilitary organization act in this manner, please consider the following two case studies. Inthe first, a security firm creates a fake user persona on several major social networkingWeb sites (including LinkedIn) and successfully tricked literally hundreds of people fromvarious corporations and military organizations into befriending her. The second case isa real-world example of an imposter infiltrating a social network using a Facebookaccount—this time “virtually disguised” as the NATO commander (the SACEUR).
Page 2 and 3:
INTRODUCTION TOCYBER-WARFARE
Page 4 and 5:
INTRODUCTIONTO CYBER-WARFAREA Multi
Page 6 and 7:
ContentsPreface ixForeword xiIntrod
Page 8 and 9:
CONTENTSviiHow Real-World Dependenc
Page 10 and 11:
PrefaceSince Stuxnet emerged in 201
Page 12 and 13:
ForewordThe concept of cyber warfar
Page 14 and 15:
IntroductionIt is 2006. An American
Page 16 and 17:
INTRODUCTIONxvinfamous hacking grou
Page 18 and 19:
BiographyPaulo Shakarian, Ph.D. is
Page 20 and 21:
C H A P T E R1Cyber Warfare: Here a
Page 22 and 23:
IS CYBER WAR A CREDIBLE THREAT?3sec
Page 24 and 25:
ATTRIBUTION, DECEPTION, AND INTELLI
Page 26 and 27:
INFORMATION ASSURANCE74. Time: Temp
Page 28 and 29:
P A R T ICYBER ATTACKInformation ha
Page 30 and 31:
C H A P T E R2Political Cyber Attac
Page 32 and 33:
RUDIMENTARY BUT EFFECTIVE: DENIAL O
Page 34 and 35:
THE DIFFICULTY OF ASSIGNING BLAME:
Page 36 and 37:
ESTONIA IS HIT BY CYBER ATTACKS17FI
Page 38:
ESTONIA IS HIT BY CYBER ATTACKS19Th
Page 41 and 42:
22 2. POLITICAL CYBER ATTACK COMES
Page 43 and 44:
24 3. HOW CYBER ATTACKS AUGMENTED R
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
34 4. CYBER AND INFORMATION OPERATI
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
44 5. CYBER ATTACK AGAINST INTERNAL
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
68 6. CYBER ATTACKS BY NONSTATE HAC
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
100 6. CYBER ATTACKS BY NONSTATE HA
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Intentionally left as blank
Page 133 and 134:
114 7. WHY CYBER ESPIONAGE IS A KEY
Page 135 and 136:
Page 137 and 138:
Page 139 and 140: 120 7. WHY CYBER ESPIONAGE IS A KEY
Page 177 and 178: Intentionally left as blank
Page 179 and 180: 160 8. DUQU, FLAME, GAUSS, THE NEXT
Page 189: 170 8. DUQU, FLAME, GAUSS, THE NEXT
Page 193 and 194: 174 9. LOSING TRUST IN YOUR FRIENDS
Page 205 and 206: 186 10. INFORMATION THEFT ON THE TA
Page 219 and 220: 200 11. CYBER WARFARE AGAINST INDUS
Page 229 and 230: 210 12. CYBER ATTACKS AGAINST POWER
Page 241 and 242:
222 12. CYBER ATTACKS AGAINST POWER
Page 243 and 244:
224 13. ATTACKING IRANIAN NUCLEAR F
Page 245 and 246:
Page 247 and 248:
Page 249 and 250:
Page 251 and 252:
Page 253 and 254:
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
242 CONCLUSION AND THE FUTURE OF CY
Page 263 and 264:
Page 265 and 266:
246 APPENDIX I. CHAPTER 6: LULZSEC
Page 267 and 268:
Page 269 and 270:
Page 271 and 272:
Page 273 and 274:
Page 275 and 276:
Page 277 and 278:
258 APPENDIX II. CHAPTER 6: ANONYMO
Page 279 and 280:
Page 281 and 282:
Page 283 and 284:
Page 285 and 286:
Page 287 and 288:
Page 289 and 290:
Page 291 and 292:
Page 293 and 294:
Page 295 and 296:
Page 297 and 298:
Page 299 and 300:
Page 301 and 302:
Page 303 and 304:
Page 305 and 306:
Page 307 and 308:
Page 309 and 310:
Page 311 and 312:
Page 313 and 314:
Page 315 and 316:
Page 317 and 318:
Page 319 and 320:
Page 321 and 322:
Page 323 and 324:
Page 325 and 326:
Page 327 and 328:
308 GLOSSARYDDoS distributed denial
Page 329 and 330:
310 GLOSSARYNIST National Institute
Page 331 and 332:
Page 333 and 334:
314 INDEXCyber exploitation (Contin
Page 335 and 336:
316 INDEXNATO (Continued)high-level
Page 337:
318 INDEXTechnical intelligence (TE
show all

Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

Create successful ePaper yourself

Delete template?

Save as template?