Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYBF 670 > Module 3 - PRC > Flashcards

Module 3 - PRC Flashcards

1
Q

PLA Roles:

A
  • Defend countries against foreign invasions
  • Maintain internal security and stability
  • Engage in economic development of the country
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Name of formal information warfare strategy?

A

Integrated Network Electronic Warfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the Five Year Plan?

A

2011-2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the Blue Army?

A

May 2011, small group with highly developed skills.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

China Goals

A

Political: economic and technological superiority
Political: Ensure there is one political voice
Military: Disable enemy communication; eliminate enemies’ ability to obtain, control, and use information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

China Doctrine

A

President Hu Jintao official proclamation that PLA is to conduct cyber warfare in name of Chinese self-preservation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Role of State

A

Largely considered to be state-sponsored hacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Role of Universities

A

state-controlled universities “recruit” individuals and give training. Universities such as Science and Engineering University is tied to military.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

People’s Liberation Army (PLA)

A

Military Centers associated with cyber attacks:

  • General Staff Department
  • 4th Department
  • General Staff Department 3rd Department
  • Technical Reconnaissance Bureaus
  • Information Warfare Militia Units (2002)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

State Sponsored (actors in):

A
  • Universities
  • PLA
  • State-owned Enterprises
  • Hacktivists
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Role of State-owned Enterprises

A
  • Direct & indirect ties to PLA

- Cyber espionage used to gain economic advantage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Role of Hacktivists & 4 types of operations

A
  • not directly controlled by govn’t
  • motives orig. aligned with government’s
  • Orig targets: Taiwan & Japan
  • 4 types of operations
    • virtual sit-ins and blockades
    • automated e-mail bombs
    • web hacks and computer break-ins
    • viruses and worms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

China History: Earliest

A

date back as far as 2001; doctrine goes back into 1990s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

China History: 2002

A

global energy industry attacked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

China History: 2006

A

Air Force was tracking several individuals / groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

China History: 2010

A

Establishment of Chinese Cyber Command

17
Q

Titan Rain

A

Nov 1 2004 - Dec 14 2005
Source: Guangdong province of China
Targets: US government systems
- US DISA, Naval Ocean Systems Center, US Army Space and Strategic Defense, US Army Information Systems Engineering Command.

18
Q

State-owned Enterprises: the numbers

A
  • 150 corporations that report directly to central government
  • ~154,000 business where government has controlling interest through subsidiary relationships.
  • SOEs with links: Huawei Technologies Co Ltd & Zhongxing Telecom Ltd (ZTE)

Lenovo purchased by IBM in May 2005.

19
Q

PLA & Hactivists

A

PLA using hacker community for clandestine attacks

20
Q

Hactivist Toolsets

A
  • spam, phishing, spoofing
  • pharming
  • DoS, DDoS
  • Viruses, Trojans, Worms, Malware (other), Spyware
  • BotNets
21
Q

Advanced Persistent Threat

A
  • originally term used by US Air Force in 2006 to discuss specific actors in Asia-Pacific region
  • More publicly in 2008-2009 conferences
  • mainstream in 2010 with Operation Aurora.
  • Attacks from foreign < 2006.
  • Shift in meaning from specific atacker/actor to attack with specific characteristics with no attribution
22
Q

Cloppert’s Kill Chain

A 
2009
Desire to break chain as far to the left as possible.
Defensive / protective measures vs clean-up costs
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- C2
- Exfiltration

-> not effective for all characteristics of life cycle. (btw C2 & exfil lots of activity)

23
Q

Modified Kill Chain

A
  • expands Cloppert’s Kill Chain to draw attention to lateral movement across network (iterative process).
    Same External (minus exfil + initial installation)
    Repeat internal
    Persistence
    Mission Fulfillment
24
Q

APT Group One

A

Tin Snake

  • since 2004
  • 2007 started malware (trojans, viruses)
  • 2008 selling electronics but not shipping
  • 2010 campaigns to penetrate US industries and defense contractors
  • Windows and Unix
  • keyloggers, domain parking, port relay tools
  • scam / hacking cycles
25
Q

APT Group 15

A

Gold Crow

  • since 2005
  • attacks since 2007
  • sell knock-offs / low quality goods
  • hits energy sector and DoD companies, non-US based defense entities
  • domains registered to Canadian addresses
26
Q

APT Group 12

A

NightDragon

  • since 2010
  • unencrypted HTTP for C2
  • break in 2011, resumed 2012
  • highly targeted, no scams or other crimes
  • uses Sykipot malware (PDF exploits during phising attacks with relevant titles)
  • attacks against petroleum industry in 2010 and US DoD.
27
Q

APT Group 20

A

Red Fly

  • since 2005
  • high yield investment schemes and e-gold scams
  • targeted DoD contractors
  • hardcodes C2 servers and HTTP requests in malware, with no obfuscation attempt.
  • Windows\Fonts, PsExec, phishing, PDF exploits, Poison Ivy
  • uses HTTP for C2
28
Q

Operation Shady RAT

A

infiltration of 72 networks
Goal: exfiltration of data
Objective: competetive advantage
Targets: US government, U.N.

29
Q

Chinese Exercises

A

2010, October 2011

- joint effort testing of offensive and defensive capabilities

30
Q

Name 4 APT Groups

A

1 (Tin Snake)
15 (Gold Crow)
12 (NightDragon)
20 (Red Fly)

31
Q

Operation Aurora

A

Operation Aurora was a cyber attack which began in mid-2009 and continued through December 2009.[1] The attack was first publicly disclosed by Google on January 12, 2010, in a blog post.[2] In the blog post, Google said the attack originated in China. The attacks were both sophisticated and well resourced and consistent with an advanced persistent threat attack.

32
Q

Relative strength of connections:

A

Strong to weak

PRC and PLA
PRC and SOE
PRC and Hacktivists (weak)

Medium
Hacktivists and SOE

Weak
PLA and Hacktivists ( hard to control)
PLA and SOE

33
Q

Apt groups - name

A

1-Tin Snake
15 - Gold Crow
12 - NightDragon
20 - Red Fly

CYBF 670 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions