Table of Contents

Title Page

Copyright

Dedication

About the Author

About the Technical Editor

Credits

Acknowledgments

Introduction

Chapter 1: Computer Network Exploitation

Operations

Operational Objectives

CNE Revisited

A Framework for Computer Network Exploitation

Summary

Chapter 2: The Attacker

Principle of Humanity

Life Cycle of an Operation

Principle of Access

Principle of Economy

Economy Summary

Attacker Structure

Summary

Chapter 3: The Defender

Principle of Humanity

Principle of Access

The Defensive Life Cycle

Principle of Economy

The Helpful Defender

Summary

Chapter 4: Asymmetries

False Asymmetries

Advantage Attacker

Advantage Defender

Advantage Indeterminate

Summary

Chapter 5: Attacker Frictions

Mistakes

Complexity

Flawed Attack Tools

Upgrades and Updates

Other Attackers

The Security Community

Bad Luck

Summary

Chapter 6: Defender Frictions

Mistakes

Flawed Software

Inertia

The Security Community

Complexity

Users

Bad Luck

Summary

Chapter 7: Offensive Strategy

Principle 1: Knowledge

Principle 2: Awareness

Principle 3: Innovation

Principle 4: Precaution

Principle 5: Operational Security

Principle 6: Program Security

Crafting an Offensive Strategy

Modular Frameworks

A Note on Tactical Decisions

Summary

Chapter 8: Defensive Strategy

Failed Tactics

Crafting a Defensive Strategy

Cloud-Based Security

Summary

Chapter 9: Offensive Case Studies

Stuxnet

Flame

Gauss

Dragonfly

Red October

APT1

Axiom

Summary

Epilogue

Appendix: Attack Tools

References

Bibliography

End User License Agreement

Pages

v

vii

ix

xi

xvii

xviii

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

73

74

75

76

77

78

79

80

81

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

189

190

191

Guide

Cover

Table of Contents

Introduction

Begin Reading

List of Illustrations

Chapter 1: Computer Network Exploitation

Figure 1.1 CNO disciplines

Figure 1.2 Operational categories

Figure 1.3 Positional access

Figure 1.4 Principles of CNE

Chapter 2: The Attacker

Figure 2.1 Ideal operational life cycle

Figure 2.2 Real operational life cycle

Figure 2.3 Unlikely products

Figure 2.4 Total vulnerabilities

Figure 2.5 High-severity vulnerabilities

Figure 2.6 Sample corporate network

Figure 2.7 Network with inbound access

Figure 2.8 Network with outbound access

Figure 2.9 Network with bidirectional access

Figure 2.10 Air-gapped network

Chapter 3: The Defender

Figure 3.1 Strategic Defensive Life Cycle counters the Offensive Life Cycle

Chapter 4: Asymmetries

Figure 4.1 Network address translation

Figure 4.2 Layered network address translation

Figure 4.3 Attacker efficiency criteria

Figure 4.4 Defender efficiency criteria

Chapter 6: Defender Frictions

Figure 6.1 All Adobe Updates

Figure 6.2 Blaster Worm time line

Chapter 7: Offensive Strategy

Figure 7.1 CNE principles

Figure 7.2 Ideal program security

Figure 7.3 Example capability diffusion

Figure 7.4 Modular architecture

Chapter 8: Defensive Strategy

Figure 8.1 Password reuse at HBGary

Figure 8.2 Split server and web proxy setup

Chapter 9: Offensive Case Studies

Figure 9.1 Internal Windows Update server

Figure 9.2 Flame internal Windows Update server

Figure 9.3 Gauss encrypted payload

Figure 9.4 Compromised ICS software producers

Figure 9.5 Pick a card, any card

Appendix: Attack Tools

Figure A.1 Network tunneling

Figure A.2 Persistence levels

List of Tables

Chapter 7: Offensive Strategy

Table 7.1 Sample Calculation of Points of Access

Network Attacks & Exploitation

A Framework

Matthew Monte

This does not constitute an official release of CIA information. All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the Central Intelligence Agency (CIA) or any other U.S. Government agency. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or CIA endorsement of the author's views. This material has been reviewed solely for classification.

Network Attacks & Exploitation

Published by
John Wiley & Sons, Inc.
10475 Crosspoint Boulevard
Indianapolis, IN 46256
www.wiley.com

Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-1-118-98712-4

ISBN: 978-1-118-98708-7 (ebk)

ISBN: 978-1-118-98723-0 (ebk)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make. Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services please contact our Customer Care Department within the United States at (877) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2015941933

Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc., and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc., is not associated with any product or vendor mentioned in this book.

To those who toil in the shadows

About the Author

Matthew Monte is a security expert with 15 years' experience developing computer security tools and strategies for corporations and the U.S. government. His career includes technical and leadership positions in industry and the U.S. Intelligence Community. He holds a Master of Engineering in Computer Science from Cornell University.

About the Technical Editor

Dave Aitel started work for the NSA at age 18, long before anyone named Edward Snowden was a thing. Following that, he worked for @stake, and then started a company focused on offensive information security, Immunity, Inc.

Credits

Executive Editor

Carol Long

Project Editor

Tom Dinse

Technical Editor

Dave Aitel

Production Editor

Dassi Zeidel

Copy Editor

San Dee Phillips

Manager of Content Development & Assembly

Mary Beth Wakefi eld

Marketing Director

David Mayhew

Professional Technology & Strategy Director

Barry Pruett

Business Manager

Amy Knies

Associate Publisher

Jim Minatel

Project Coordinator, Cover

Brent Savage

Proofreader

Kathy Pope, Word One New York

Indexer

John Sleeva

Cover Designer

Michael E. Trent/Wiley

Cover Image

© iStock.com/Mak_Art

Acknowledgments

First and foremost, thank you to my beautiful wife Jessica. From the initial idea through the last review, this book would not have been possible without her encouragement and support. Thank you for being my sounding board and for taking on so much while I hid away behind my laptop.

Thank you to my children Annabelle and Levi, just for being you. You are the best kids a father could hope to have. Thank you for your smiles, patience, understanding, and welcome interruptions.

Thanks to my mother and departed father for their ever-present encouragement, including helping start my journey into the digital world long ago with a Commodore 64 and a guide to BASIC.

Thanks to everyone who contributed their time and effort including:

Dave Aitel, for agreeing to review this book and using his extensive experience to provide feedback and examples. This is a clearer, richer, and all-around better book for his challenging critiques and suggestions.

Carol Long, for seeing the potential in the early manuscript; to Tom Dinse for his guidance throughout the editing and publication process, and to the rest of the staff at Wiley for their diligent efforts.

David Nadwodny, for his thoughts and encouragement, and for demonstrating what can be accomplished with duct tape and string given ingenuity and initiative.

Dave N., for his thoughtful feedback early on that helped shape many of the presented ideas.

Finally, thank you to the people I did not name, those that I've worked with and learned so much from over the years, and those whose countless hours of research and analysis I relied upon. My gratitude to those that toil in the shadows, that try not, but do.

Introduction

Why are you arming, brother? And have you thought of sending someone to spy on the Trojans?

—Menelaus, the Iliad

Remember, hacking is more than just a crime. It's a survival trait.

—Hackers (1995)

This is not a book about Cyberwar, Cyber 9/11, or Cybergeddon. These terms are thrown about to generate page hits or to secure funding or business. They are designed to grab attention or shock you into action, and perhaps for that there is a use, but they are not particularly helpful in framing what to actually do about computer security. If Digital Pearl Harbor, a reference to a massive devastating surprise attack, is imminent, what must you do to prevent it? Update antivirus software? Be careful with attachments? Make sure your password has at least two n3mber5? The comparison to such events does not help you understand an attack or illuminate a strategy to prevent it.

Depending on what definition you use and who you ask, Cyberwar will never happen, is about to happen, or is already happening. Yet regardless of what verb tense is used for describing the state of Cyberwar, there is no question that cyber espionage is real and ongoing. Computer security companies meticulously detail immense spying campaigns with names such as Red October, Flame, or Aurora. Meanwhile the media runs story after story about the alleged capabilities of the National Security Agency and different Chinese PLA Units. While the meaning of Cyberwar is debated, the latest incarnation of an old profession is in full swing.

The sheer number of reported intrusions makes exploiting computer networks sound easy. The attackers are unattributable and unstoppable, the victims unwitting and powerless. In reading the news, you would think that every time a company loses its credit card data, discloses sensitive internal e-mails, or loses military secrets, the compromise was inevitable.

This attitude is lazy. The reasons given are invariably the same: an outdated system was neglected, a warning sign was missed, or a careless user exercised poor judgment. If only XYZ had been done, the attack would not have succeeded. And yet as countless companies and government agencies are repeatedly penetrated, it becomes clear that explaining what tactics were used is not good enough.

To understand the failure of computer security, you must move beyond analyzing a specific event to understanding the inherent properties of computer operations. Is there an intrinsic offensive advantage? What contributes or detracts from this advantage? What strategy must an attacker employ to remain successful? How can this strategy be countered? How can you keep pace with rapid technological change?

These are not easy questions. Answering them requires a framework for reasoning about the strategies, technologies, and methods for executing or defending against computer operations. This book attempts to form such a framework to address these and other questions, inferring and identifying those aspects of the subject that are enduring.

Computer espionage is increasing in frequency, sophistication, and impact. Political, military, intellectual property, personal, and financial information is being siphoned off at an unprecedented rate. As the legal and moral doctrines for dealing with this predicament emerge from infancy, the onslaught will continue. It is therefore critical for business leaders, IT professionals, and policy makers to start addressing the issues at a strategic level, and to do this, you first must understand the principles of network attack and exploitation.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!