DOCSLIB.ORG

Operaciones Militares Cibernéticas : Planeamiento Y Ejecución En El Nivel Operacional / Gus- Tavo Adolfo Trama ; Evergisto Arturo De Vergara

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Operaciones Militares Cibernéticas : Planeamiento Y Ejecución En El Nivel Operacional / Gus- Tavo Adolfo Trama ; Evergisto Arturo De Vergara EDITORIAL VISIÓN CONJUNTA . BIBLIOTECA CONJUNta OPERACIONES MILITARES CIBERNÉTICAS Planeamiento y Ejecución en el Nivel Operacional General de División (RE) Evergisto de Vergara Contraalmirante (RE) Gustavo Adolfo Trama Escuela Superior de Guerra Conjunta de las Fuerzas Armadas OPERACIONES MILITARES CIBERNÉTICAS Planeamiento y Ejecución en el Nivel Operacional Escuela Superior de Guerra Conjunta Editorial Visión Conjunta BIBLIOTECA CONJUNTA DIRECTOR Brigadier Fabián Otero Editor Y ProPietArio Escuela Superior de Guerra Conjunta de las Fuerzas Armadas Av. Luis María Campos 480, 2° piso, CI1426BOP, CABA > [email protected] Autores General de División (RE) Evergisto de Vergara Contraalmirante (RE) Gustavo Adolfo Trama Colaboradores Brigadier (RE) Marcelo Noel Uriona Doctor Javier Ulises Ortiz Asesora Metodológica Dra. Lucía Alejandra Destro OPERACIONES MILITARES CIBERNÉTICAS Planeamiento y Ejecución en el Nivel Operacional Escuela Superior de Guerra Conjunta de las Fuerzas Armadas Trama, Gustavo Adolfo Operaciones militares cibernéticas : planeamiento y ejecución en el nivel operacional / Gus- tavo Adolfo Trama ; Evergisto Arturo de Vergara. - 1a ed . - Ciudad Autónoma de Buenos Aires : Escuela Superior de Guerra Conjunta de las Fuerzas Armadas, 2017. 270 p. ; 23 x 16 cm. ISBN: 978-987-29264-7-2 1. Estrategia Militar. 2. Conflictos Bélicos. I. Vergara, Evergisto Arturo de II. Título CDD 355.4 Fecha de catalogación: 11/12/17 ISBN: 978-987-29264-4-1 Queda hecho el depósito que previene la Ley 11.723 Buenos Aires, diciembre de 2017 La Escuela Superior de Guerra Conjunta de las Fuerzas Armadas autoriza la reproducción parcial del trabajo citando debidamente la fuente. Este escrito es presentado en cumplimiento parcial de los requerimientos de la Secretaría de Investigación de la Escuela Superior de Guerra Conjunta. Las opiniones expresadas son propias de los autores y no reflejan las políticas o posturas de las Fuerzas Armadas de la República Ar- gentina, del Ministerio de Defensa o del Gobierno Nacional. OPERACIONES MILITARES CIBERNÉTICAS ÍNDICE Presentación 11 Introducción 13 CAPÍTULO 1: Términos y definiciones 21 Introducción 21 Análisis de los distintos términos contemplados en la Directiva de Política de Defensa Nacional 23 Cibernética 24 Espacio cibernético 27 Guerra cibernética 35 Agresión cibernética 40 Operaciones cibernéticas 47 Ciberdefensa y Ciberseguridad 64 Capacidades operacionales en la dimensión ciberespacial 58 Análisis de los términos Internet profunda, gobernanza de Internet y otros conceptos asociados 70 La Internet profunda 70 La gobernanza de Internet 80 Conclusiones del capítulo 86 CAPÍTULO 2: Estrategias o políticas nacionales en el campo de la ciberdefensa y la ciberseguridad Introducción 91 Reino de España 97 República de Francia 100 Reino Unido de Gran Bretaña 104 Estados Unidos de Norteamérica 104 China 110 Sudamérica 112 7 Evergisto de Vergara | Gustavo Adolfo Trama República Federativa de Brasil 112 República de Chile 114 República Argentina 116 Conclusiones del capítulo 119 CAPÍTULO 3: Doctrinas militares en el campo de la ciberdefensa y la ciberseguridad Introducción 121 República de Francia 124 Otros países de la Unión Europea 126 Reino de España 128 Estados Unidos de Norteamérica 130 República Federativa de Brasil 131 República Argentina 135 Conclusiones del capítulo 136 CAPÍTULO 4: Las operaciones militares en el espacio cibernético Introducción 139 La estructura piramidal del poder cibernético militar 140 Los sistemas cibernéticos cerrados o abiertos 141 Las operaciones de red de computadoras y las operaciones de información 143 Las operaciones cibernéticas en red de computadoras 144 Las operaciones en el espacio cibernético y las fases de la campaña 148 El derecho internacional aplicable a las operaciones cibernéticas 150 El Comandante del Teatro de Operaciones y las operaciones cibernéticas 153 Conclusiones del Capítulo 156 CAPÍTULO 5: Las operaciones cibernéticas en el planeamiento y ejecución de las operaciones militares de nivel operacional Introducción 159 Las operaciones cibernéticas en las operaciones militares 160 Las operaciones cibernéticas y los niveles de la guerra 167 Las operaciones cibernéticas y los principios de la guerra 172 Principio del objetivo 174 Principio de masa o concentración 175 Principio de la maniobra 177 Principios de simplicidad y seguridad 179 Los nuevos principios de la guerra para la guerra cibernética 180 Las operaciones cibernéticas y el Plan de Campaña 182 Las operaciones cibernéticas y el arte y diseño operacional 183 El análisis de la situación cibernética 184 8 OPERACIONES MILITARES CIBERNÉTICAS El centro de gravedad cibernético 190 Las capacidades, vulnerabilidades y requerimientos críticos en las ciberoperaciones 192 El punto decisivo cibernético 197 Las operaciones cibernéticas durante y después de la confrontación 197 Las operaciones cibernéticas y las funciones operacionales 199 Reglas de empeñamiento en las operaciones cibernéticas 203 Conclusiones del capítulo 205 CAPÍTULO 6: El empleo de las capacidades cibernéticas en apoyo de las operaciones de información Introducción 209 Las operaciones de información en las doctrinas militares 211 Antecedentes 216 El ambiente de la información 222 El empleo de las operaciones de información en los conflictos recientes 231 Las operaciones de información en el planeamiento operacional 239 La organización de un Estado Mayor para las operaciones de información 253 Conclusiones del capítulo 255 Conclusiones generales 257 Reflexiones Finales 265 Bibliografía 267 Libros 267 Revistas 268 Documentos electrónicos 269 Periódicos 277 Manuales y Reglamentos 278 Documentos oficiales 278 Glosario de términos del ámbito tecnológico asociados a los ataques cibernéticos 282 Anexos 290 Objetivos estratégicos y líneas de acción de una Política de Ciberdefensa 290 Contenido tentativo del Anexo de Operaciones de Información a un Plan de Campaña 299 Ejemplos Reglas de Empeñamiento para operaciones cibernéticas 303 9 OPERACIONES MILITARES CIBERNÉTICAS PRESENTACIÓN os aspectos que influyen en la vida diaria con respecto al uso del espacio ciberné- tico tienen amplia difusión. Todas las acciones que se desarrollen en este campo L afectarán al componente armado del poder nacional desde varias perspectivas. La primera de ellas es el uso de la fuerza convencional militar como respuesta a un ataque cibernético masivo. Se contempla esta posibilidad porque los países más pode- rosos en aplicaciones cibernéticas de uso diario son justamente los más vulnerables en este aspecto. Se dice que los efectos de un ataque masivo cibernético multiplicado varias veces a lo ocurrido en Estonia en el año 2007 tendrían los mismos resultados devasta- dores que un ataque nuclear. No todos los países adhieren a esta postura porque daría lugar al uso arbitrario de la fuerza convencional por causas que luego originarían discul- pas efusivas, pero sin efectos que puedan retrotraerse. La segunda implica el uso del poder militar convencional de los países ante el ataque cibernético a infraestructuras civiles. Las consecuencias sobre la población civil de un ataque a las infraestructuras críticas1 podrán requerir el empleo inmediato de fuerzas militares para paliar los efectos en tareas que seguramente excederán a la ayuda huma- nitaria, como por ejemplo la prevención de saqueos y vandalismos. Este empleo militar forzoso en ayuda humanitaria puede, además, complementarse con un ataque militar convencional al país afectado, ya que distraerá tropas de otros lugares. La tercera acción tiene dos facetas: la primera de ellas es la lucha entre redes y siste- mas de redes para afectar, en operaciones cibernéticas defensivas - activas y pasivas - y de exploración, el uso de los sistemas automatizados de comando y control que proporcio- nan poder de combate a las fuerzas militares enemigas. La segunda es el uso del espacio cibernético como herramienta para las operaciones de información que buscan engañar al enemigo para que tome decisiones erróneas. En estas operaciones de información, la cibernética puede ser usada en operaciones de apoyo de información a las operaciones mi- 1 Art. 5.° Las Partes convienen en que un ataque armado contra una o varias de ellas, ocurrido en Europa o en América del Norte, será considerado como un ataque dirigido contra todas, y, en consecuencia, convienen en que si tal ataque se produce, cada una de ellas, en el ejercicio del derecho de legítima defensa, individual o colectiva, reconocido por el art. 51 de la Carta de las Naciones Unidas, asistirá a la Parte o Partes atacadas tomando individualmente, y de acuerdo con las otras, las medidas que juzgue necesarias, comprendido el empleo de las fuerzas armadas para restablecer la seguridad en la región del Atlántico Norte. 11 Evergisto de Vergara | Gustavo Adolfo Trama litares (MISO – ex operaciones psicológicas), de engaño militar, de guerra electrónica y en operaciones de inteligencia tales como el espionaje y descifrado de claves. En esta obra se profundiza en el uso e influencia de la cibernética en las operaciones militares convencionales y, específicamente, en los aspectos que deben tenerse en cuen- ta en el nivel operacional de guerra, cuando llega el momento de implementar la direc- ción estratégica. El desarrollo del espacio cibernético aún es incipiente y evoluciona día a día. Por las características únicas de este ámbito ya se puede hablar de un nuevo ambiente que ha de sumarse a los conocidos de aire, espacio, mar y tierra. La Organización del Tratado
Load more

Recommended publications
  • Celebration P9 Benefits P7 Anniversary P4
    octobeR 23 - octobeR 29, 2013 • VoL. 14 • no. 43 washington heights • inwood • haRLeM • EAST HARLeM NORTHERN MANHATTAN’S BILINGUAL NEWSPAPER EL PERIODICO BILINGUE DEL NORTE DE MANHATTAN NOW EVERY WEDNESDAY TODOS LOS MIERCOLES Love letters p13 Photo: Madeleine Cummings Festival literario p13 Celebration p9 Anniversary p4 Benefits p7 PUT CARE ON YOUR CALENDAR IN OCTOBER Visit us at the At EmblemHealth Neighborhood Care you’ll fi nd new programs Neighborhood Room every month to help you stay healthy, get well and live better. All 215 West 125th Street classes are FREE and open to the public. 23 Wednesday 26 Saturday 30 Wednesday Caregiver Support Group Tai Chi Healthwise Handbook: Self Care 2:00–3:30 pm 11:30 am–12:30 pm for You & Your Family - NEW (Must RSVP by 10/21) (EmblemHealth Members Only) 12:00 Noon–1:00 pm 24 Thursday Mindfulness Eating - NEW Shifting the Victim Paradigm - NEW 1:00–2:00 pm Getting Healthy After 31 Thursday Domestic Violence Halloween at EHNC! 28 Monday 12:00 Noon–2:00 pm Walk Away the Pounds 4:00–6:00 pm Kick Food Cravings to the Curb - NEW 11:00 am–12:00 noon 5:30–6:45 pm Low Impact Zumba 6:00–7:00 pm 25 Friday Medicare Sales Seminar - NEW 29 Tuesday 10:00 am–12:30 pm Are You Informed About Health Care Reform? - NEW 10:00–11:30 am *HIP Health Plan of New York (HIP) is a Medicare Advantage organization with a Medicare contract. Group Health Incorporated (GHI) is a Medicare Advantage organization and a standalone prescription drug plan with a Medicare contract.
    [Show full text]
  • DNS Spoofing 2
    Professor Vahab COMP 424 13 November 2016 DNS Spoofing DNS spoofing, also known as DNS Cache Poisoning, is one of the most widely used man-in-the-middle attacks that capitalizes on vulnerabilities in the domain name system that returns a false IP address and routes the user to a malicious domain. Whenever a machine contacts a domain name such as www.bankofamerica.com, it must first contact its DNS server which responds with multiple IP addresses where your machine can reach the website. Your computer is then able to connect directly to one of the IP addresses and the DNS is able to convert the IP addresses into a human-readable domain name. If an attacker is able to gain control of a DNS server and change some of its properties such as routing Bank of America’s website to an attacker’s IP address. At that location, the attacker is then able to unsuspectingly steal the user’s credentials and account information. Attackers use spam and other forms of attack to deliver malware that changes DNS settings and installs a rogue Certificate Authority. The DNS changes point to the hacker's secret DNS name server so that when the users access the web they are directed to proxy servers instead of authorized sites. They can also start to blacklist domains and frustrate the user with their day to day activities. All blacklisted domains would have their traffic dropped instead of forwarded to their intended destination. Based on the rogue Certificate Authority the system has no sign that an attack is taking place or ever took place.
    [Show full text]
  • Secure Shell- Its Significance in Networking (Ssh)
    International Journal of Application or Innovation in Engineering & Management (IJAIEM) Web Site: www.ijaiem.org Email: [email protected] Volume 4, Issue 3, March 2015 ISSN 2319 - 4847 SECURE SHELL- ITS SIGNIFICANCE IN NETWORKING (SSH) ANOOSHA GARIMELLA , D.RAKESH KUMAR 1. B. TECH, COMPUTER SCIENCE AND ENGINEERING Student, 3rd year-2nd Semester GITAM UNIVERSITY Visakhapatnam, Andhra Pradesh India 2.Assistant Professor Computer Science and Engineering GITAM UNIVERSITY Visakhapatnam, Andhra Pradesh India ABSTRACT This paper is focused on the evolution of SSH, the need for SSH, working of SSH, its major components and features of SSH. As the number of users over the Internet is increasing, there is a greater threat of your data being vulnerable. Secure Shell (SSH) Protocol provides a secure method for remote login and other secure network services over an insecure network. The SSH protocol has been designed to support many features along with proper security. This architecture with the help of its inbuilt layers which are independent of each other provides user authentication, integrity, and confidentiality, connection- oriented end to end delivery, multiplexes encrypted tunnel into several logical channels, provides datagram delivery across multiple networks and may optionally provide compression. Here, we have also described in detail what every layer of the architecture does along with the connection establishment. Some of the threats which Ssh can encounter, applications, advantages and disadvantages have also been mentioned in this document. Keywords: SSH, Cryptography, Port Forwarding, Secure SSH Tunnel, Key Exchange, IP spoofing, Connection- Hijacking. 1. INTRODUCTION SSH Secure Shell was first created in 1995 by Tatu Ylonen with the release of version 1.0 of SSH Secure Shell and the Internet Draft “The SSH Secure Shell Remote Login Protocol”.
    [Show full text]
  • Threat Modeling and Circumvention of Internet Censorship by David Fifield
    Threat modeling and circumvention of Internet censorship By David Fifield A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Graduate Division of the University of California, Berkeley Committee in charge: Professor J.D. Tygar, Chair Professor Deirdre Mulligan Professor Vern Paxson Fall 2017 1 Abstract Threat modeling and circumvention of Internet censorship by David Fifield Doctor of Philosophy in Computer Science University of California, Berkeley Professor J.D. Tygar, Chair Research on Internet censorship is hampered by poor models of censor behavior. Censor models guide the development of circumvention systems, so it is important to get them right. A censor model should be understood not just as a set of capabilities|such as the ability to monitor network traffic—but as a set of priorities constrained by resource limitations. My research addresses the twin themes of modeling and circumvention. With a grounding in empirical research, I build up an abstract model of the circumvention problem and examine how to adapt it to concrete censorship challenges. I describe the results of experiments on censors that probe their strengths and weaknesses; specifically, on the subject of active probing to discover proxy servers, and on delays in their reaction to changes in circumvention. I present two circumvention designs: domain fronting, which derives its resistance to blocking from the censor's reluctance to block other useful services; and Snowflake, based on quickly changing peer-to-peer proxy servers. I hope to change the perception that the circumvention problem is a cat-and-mouse game that affords only incremental and temporary advancements.
    [Show full text]
  • Thesis That TW-OR Forwards All DNS Queries to a Resolver in China
    The Impact of DNSSEC on the Internet Landscape Von der Fakult¨atf¨urIngenieurwissenschaften, Abteilung Informatik und Angewandte Kognitionswissenschaft der Universit¨atDuisburg-Essen zur Erlangung des akademischen Grades Doktor der Ingenieurwissenschaften genehmigte Dissertation von Matth¨ausWander aus Lubin (L¨uben) Gutachter: Prof. Dr.-Ing. Torben Weis Prof. Dr.-Ing. Felix Freiling Tag der m¨undlichen Pr¨ufung:19. Juni 2015 Abstract In this dissertation we investigate the security deficiencies of the Domain Name System (DNS) and assess the impact of the DNSSEC security extensions. DNS spoofing attacks divert an application to the wrong server, but are also used routinely for blocking access to websites. We provide evidence for systematic DNS spoofing in China and Iran with measurement-based analyses, which allow us to examine the DNS spoofing filters from van- tage points outside of the affected networks. Third-parties in other countries can be affected inadvertently by spoofing-based domain filtering, which could be averted with DNSSEC. The security goals of DNSSEC are data integrity and authenticity. A point solution called NSEC3 adds a privacy assertion to DNSSEC, which is supposed to prevent disclosure of the domain namespace as a whole. We present GPU-based attacks on the NSEC3 privacy assertion, which allow efficient recovery of the namespace contents. We demonstrate with active measurements that DNSSEC has found wide adoption after initial hesitation. At server-side, there are more than five million domains signed with DNSSEC. A portion of them is insecure due to insufficient cryptographic key lengths or broken due to maintenance failures. At client-side, we have observed a worldwide increase of DNSSEC validation over the last three years, though not necessarily on the last mile.
    [Show full text]
  • Protecting Browsers from DNS Rebinding Attacks
    Protecting Browsers from DNS Rebinding Attacks Collin Jackson Adam Barth Andrew Bortz Stanford University Stanford University Stanford University [email protected] [email protected] [email protected] Weidong Shao Dan Boneh Stanford University Stanford University [email protected] [email protected] ABSTRACT these security goals, modern browsers implement the same- DNS rebinding attacks subvert the same-origin policy of origin policy that attempts to isolate distinct “origins,” pro- browsers and convert them into open network proxies. We tecting sites from each other. survey new DNS rebinding attacks that exploit the inter- DNS rebinding attacks subvert the same-origin policy by action between browsers and their plug-ins, such as Flash confusing the browser into aggregating network resources Player and Java. These attacks can be used to circumvent controlled by distinct entities into one origin, effectively con- firewalls and are highly cost-effective for sending spam e- verting browsers into open proxies. Using DNS rebinding, mail and defrauding pay-per-click advertisers, requiring less an attacker can circumvent firewalls to spider corporate in- than $100 to temporarily hijack 100,000 IP addresses. We tranets, exfiltrate sensitive documents, and compromise un- show that the classic defense against these attacks, called patched internal machines. An attacker can also hijack the “DNS pinning,” is ineffective in modern browsers. The pri- IP address of innocent clients to send spam e-mail, commit mary focus of this work,
    [Show full text]
  • Dns / Opennic / Dnscrypt
    dns / opennic / dnscrypt Serial: 2015111401 What is DNS ● Domain Name System ● In simple words when you are looking for hackerspace.gr you 're looking for the IP of the server that hosts the hackerspace site. ● But how ? How DNS works public/open dns ● Goodle dns – 8.8.8.8 2001:4860:4860::8888 – 8.8.4.4 2001:4860:4860::8844 ● OpenDNS – 208.67.222.222 2620:0:ccc::2 – 208.67.220.220 2620:0:ccd::2 ● norton dns/comodo/dns advantage/dns.watch ● fdn/freeDNS/Verisign ● BUT THEY ALL track what you are watching!!!! https://www.opennicproject.org/ ● OpenNIC is an alternate network information center/alternative DNS root which lists itself as an alternative to ICANN and its registries. ● Total DNS Neutrality ● Have A Say In Your DNS ● Protect Your Privacy ● No More ISP DNS Hijacking ● No Cost (Gratis) ● Freedom From Government Intervention openic website/wiki New Top Level Domains .bbs .ing .dyn .micro .free .neo .fur .null .geek .oss .gopher .oz .indy .parody 1. How does opennic work? . 82796 IN NS ns9.opennic.glue. 82796 IN NS ns3.opennic.glue. 82796 IN NS ns8.opennic.glue. 82796 IN NS ns4.opennic.glue. 82796 IN NS ns10.opennic.glue. 82796 IN NS ns6.opennic.glue. 82796 IN NS ns7.opennic.glue. 82796 IN NS ns2.opennic.glue. ;; Received 174 bytes from 94.242.59.170#53(94.242.59.170) in 126 ms 2. gr. 172800 IN NS gr-br.ics.forth.gr. gr. 172800 IN NS gr-at.ics.forth.gr. gr. 172800 IN NS estia.ics.forth.gr.
    [Show full text]
  • DNS and the DNS Cache Poisoning Attack
    Lecture 17: DNS and the DNS Cache Poisoning Attack Lecture Notes on “Computer and Network Security” by Avi Kak ([email protected]) June 25, 2021 3:21pm ©2021 Avinash Kak, Purdue University Goals: The Domain Name System BIND Configuring BIND Running BIND on your Ubuntu laptop Light-Weight Nameservers (and how to install them) DNS Cache Poisoning Attack Writing Perl and Python code for cache poisoning attacks Dan Kaminsky’s More Virulent DNS Cache Poisoning Attack CONTENTS Section Title Page 17.1 Internet, Harry Potter, and the Magic of DNS 3 17.2 DNS 5 17.3 An Example That Illustrates Extensive DNS 13 Lookups in Even the Simplest Client-Server Interactions 17.4 The Domain Name System and The dig Utility 28 17.5 host, nslookup, and whois Utilities for Name 42 Lookup 17.6 Creating a New Zone and Zone Transfers 45 17.7 DNS Cache 48 17.7.1 The TTL Time Interval 51 17.8 BIND 56 17.8.1 Configuring BIND 58 17.8.2 An Example of the named.conf Configuration File 64 17.8.3 Running BIND on Your Ubuntu Laptop 68 17.9 What Does it Mean to Run a Process in a 70 chroot Jail? 17.10 Phishing versus Pharming 73 17.11 DNS Cache Poisoning 74 17.12 Writing Perl and Python Code for Mounting a 81 DNS Cache Poisoning Attack 17.13 Dan Kaminsky’s More Virulent Exploit for 92 DNS Cache Poisoning 17.14 Homework Problems 99 Computer and Network Security by Avi Kak Lecture 17 Back to TOC 17.1 INTERNET, HARRY POTTER, AND THE MAGIC OF DNS If you have read Harry Potter, you are certainly familiar with the use of owl mail by the wizards and the witches.
    [Show full text]
  • A Review of Man-In-The-Middle Attacks
    A Review of Man-in-the-Middle Attacks Subodh Gangan Abstract: This paper presents a survey of man-in-the-middle (MIM) attacks in communication networks and methods of protection against them. In real time communication, the attack can in many situations be discovered by the use of timing information. The most common attacks occur due to Address Resolution Protocol (ARP) cache poisoning, DNS spoofing, session hijacking, and SSL hijacking. Introduction Man-in-the-Middle (MIM) attacks make the task of keeping data secure and private particularly challenging since attacks can be mounted from remote computers with fake addresses. Whereas communications security was primarily that of breaking of encryption transformations (as in the case of the Enigma machine during the Second World War [1]), the problem of security in computer networks also involves active interference by intruders, and of these MIM attack is one of the most spectacular. The MIM attack takes advantage of the weaknesses in the authentication protocols being used by the communicating parties. Since authentication is generally provided by third parties who issue certificates, the system of certificate generation becomes another source of potential weakness. The MIM attack allows the intruder or the unauthorized party to snoop on data through the backdoor. This intervention is also being used by companies to pry upon their employees and for adware. For example, in early 2015, it was discovered that Lenovo computers came preinstalled with adware called Superfish that injects advertising on browsers such as Google Chrome and Internet Explorer. Superfish installs a self-generated root certificate into the Windows certificate store and then resigns all SSL certificates presented by HTTPS sites with its own certificate.
    [Show full text]
  • Attack Packet Victim Response Rate
    CS 361S Attacks on TCP/IP, BGP, DNS Denial of Service Vitaly Shmatikov slide 1 Reading Assignment “SYN cookies” by Bernstein “IP spoofing demystified” from Phrack magazine “It’s the end of the cache as we know it” by Kaminsky (BlackHat 2008) slide 2 Warm Up: 802.11b NAV (Network Allocation Vector) • 15-bit field, max value: 32767 • Any node can reserve channel for NAV microseconds • No one else should transmit during NAV period … but not followed by most 802.11b cards De-authentication • Any node can send deauth packet to AP • Deauth packet unauthenticated … attacker can repeatedly deauth anyone slide 3 Internet Is a Network of Networks backbone ISP local network Internet service provider (ISP) Autonomous system (AS) is a local network collection of IP networks under control of a single administrator (e.g., ISP) TCP/IP for packet routing and connections Border Gateway Protocol (BGP) for route discovery Domain Name System (DNS) for IP address discovery slide 4 OSI Protocol Stack email, Web, NFS application presentation RPC session TCP transport IP network Ethernet data link physical slide 5 Data Formats application Application data message layer transport TCP TCP TCP segment layer header data header data header data network IP TCP packet layer header header data data link Ethernet IP TCP Ethernet frame layer header header header data trailer slide 6 IP (Internet Protocol) Connectionless • Unreliable, “best-effort” protocol Uses numeric addresses for routing Typically several hops in the route Alice’s computer Bob’s ISP Packet Alice’s
    [Show full text]
  • Wrestling Observer Newsletter February 24, 1992
    Wrestling Observer Newsletter February 24, 1992 A few weeks ago I started hearing speculation about the significant lost revenue from those avenues. A potential sprint possible demise of Hulk Hogan and even the potential demise race by sponsors in the wrong direction and domino effect of of Titan Sports. While in a worst-case scenario of what could television stations which would cause a lessening of exposure happen, one couldn't completely rule that out as a possibility. would indirectly lead to a major effect on live attendance and all But it was maybe a 200-to-one longshot, at best. Most of this other revenue sources. At the same time, a promoter like Don talk was incredibly premature and so unlikely at the time that it King, who in comparison makes Vince McMahon seem like a didn't seem to be worth serious discussion. saint, has survived and prospered even though most Americans have an idea of what kind of a person he really is. People will It's still premature. It's still unlikely. But it's also worth serious pay money to see an entertainment/sport even if the owner has discussion. Make no mistake about it. Friday night, if it were not a shady rep forever because they are paying to see the for some incredible luck, the Titan empire may have been in a performers. But boxing isn't marketed as a kids show and aired race to avoid crumbling before Wrestlemania. Even with the in syndication primarily on Saturday mornings, so parts of that incredible luck, it may be too late for Titan to inevitably avoid analogy doesn't hold up.
    [Show full text]
  • Whac-A-Mole: Six Years of DNS Spoofing Lan Wei John Heidemann {Weilan,Johnh}@Isi.Edu University of Southern California/ Information Sciences Institute
    Whac-A-Mole: Six Years of DNS Spoofing Lan Wei John Heidemann {weilan,johnh}@isi.edu University of Southern California/ Information Sciences Institute ABSTRACT cryptographic signature that can verify each level of the DNS is important in nearly all interactions on the Internet. DNS tree from the root. Unfortunately, DNSSEC deployment All large DNS operators use IP anycast, announcing servers is far from complete, with names of many organizations in BGP from multiple physical locations to reduce client la- (including Google, Facebook, Amazon, and Wikipedia) still tency and provide capacity. However, DNS is easy to spoof: unprotected [23], in part because of challenges integrating third parties intercept and respond to queries for benign or DNSSEC with DNS-based CDN redirection. Even for domains malicious purposes. Spoofing is of particular risk for services protected by DNSSEC, client software used by many end- using anycast, since service is already announced from mul- users fail to check DNSSEC. tiple origins. In this paper, we describe methods to identify While there has been some study of how DNS spoofing DNS spoofing, infer the mechanism being used, and identify works [10], and particularly about the use of spoofing for organizations that spoof from historical data. Our methods censorship [15], to our knowledge, there has been little pub- detect overt spoofing and some covertly-delayed answers, lic analysis of general spoofing of DNS over time. (Wessels although a very diligent adversarial spoofer can hide. We currently has an unpublished study of spoofing [36].) Increas- use these methods to study more than six years of data about ing use of DNSSEC [11], and challenges in deployment [5] root DNS servers from thousands of vantage points.
    [Show full text]