Module 4 - Non-State Organizations Flashcards
What is scope?
Every nation that has government sponsored cyber warfare programs also have NSOs operating within borders.
May be hired by military or government orgs
Types of NSOs
6 types:
- Individuals
- Self-identified groups of hackers
- Loose collection of individuals functioning as a group
- Corporations/businesses
- Organized crime
- Terrorists, but rarely
Russian Hactivists
- Problem for Russian government
- Sought out by military and mafia
- Loosely connected to youth groups
Chinese Hactivists
- Problem for Chinese government (attack targets internal to the country)
- Sought by PLA and recruited to attend universities
Rogue State / non-state Hacktivists
- Cyber Criminals for own gain
- Iran and Hezbollah alliance
- Patriotic hacking when non-state actors feel imperative to act on behalf of state (Israel & Palestine conflict, India and Pakistan conflict)
Targets and Techniques
3 main
- web site defacement (political message)
- DDoS through bots
- Theft (Identity, Credit Cards, Info to transfer to currency)
Skillsets of NSOs
- Script kiddies
- Malware authors
- Social engineers
Script Kiddies
often derogatory
Use code and tools developed by others
No particular skill in launching attacks
Malware Authors
specialized skill
knowledge of OS of the target
Possibly identify zero day exploits
Social engineers
gain valuable information by preying on poor OPSEC
Corporations (as NSO)
- espionage to gain competetive advantage
- theft of trade secrets and research
- domestic or international
Organized Crime (as NSO)
- theft of data and money
- identity theft
- advanced malware such as Zeus and SpyEye
- Botnets capable of sending large quantities of spam
- money transferred internationally
- in countries such as Russia and Ukraine, form a relation to the government and law enforcement
Communication methods
IRCs with encrypted comms
hacker forums
Leetspeak and handles
Notable NSO actors - Hammond events
Jeremy Hammond (aka Robin Hood), assoc with LulzSec
2006-2007
attack conservative group website
Notable NSO actors - LulzSec events
2011, Jeremy Hammond
Target: Stratfor
- release list of clients 5 million emails to WikiLeaks
- Stratfor -> 1.75 million for lawsuits
2011, Raynaldo Rivera (age 20)
Target: Sony game system
Attack: SQL Injection
Notable NSO actors - Anonymous events
Motivations: social issues
Target: Syrian websites - OpSyria Initiative
Comms through social networking, Pastebin, and 4chan.org
--- 2011 Christopher Weatherhead Target: PayPal Attack: DDoS Cost to fix: 3.5 million pounds
Target: Stratfor (intel company)
Barrett Lancaster Brown, 31
Charges: access device fraud, trafficking in stolen authentication features, identity theft related to sharing credit card info
Notable NSO actors - CabinCr3w
offshoot of Anonymous
Higinio O. Ochoa III
Target: >= 4 websites of US law enforcement
- website defacement, content loaded
- 1 picture contained EXIF data (geolocation)
Name 5 notable NSO hactivist groups:
LulzSec Anonymous CabinCr3w Project PM (positive) Izz ad-Din al-Qassam Cyber-Fighters
Notable NSO actors - Project PM
online entity with intent to develop new ways to use the Internet for positive change to encourage others to adapt such methods.
- Operation MetalGear
- Operation Pursuant
Operation MetalGear
- associated with Project PM group
- crowd-sourced investigation into intelligence contracting industry and role in development of “persona management” software
- wiki.echelon2.org
Operation Pursuant
- involves encouraging individuals to form their own pursuants in order to pursue similar crowd-sourced investigations or otherwise engage in online activism of whatever sort they choose.
- check on corrupt institutions
- wiki.echelon2.org
Notable NSO actors - Izz ad-Din al-Qassam Cyber-Fighters
2012
Target: US Banks
Attack: DDoS
Motive: YouTube video casting Islam in a negative light
Catching NSOs
- some feel most likely to be caught
- indiv. do not have resources to hide their attacks/attribution
- Indiv, do not receive protection of respective governments
- Skill levels vary greatly from script kiddies to seasoned hackers/crackers
Positive NSOs
- some NSOs serve as positive participants in cyber warfare and enable defensive measures.
(security research firms, public universities, anti-virus firms)
Protective Roles (Rattray and Healey)
7 different roles: User (mixed) Attacker (negative) Target (negative) Source (negative) Responder (positive) Provider (positive) Improver (positive)
