DOCSLIB.ORG

India-Canada Collaboration to Curb Digital Black Markets Sameer Patil

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
India-Canada Collaboration to Curb Digital Black Markets Sameer Patil Canada-India Track 1.5 Dialogue Paper No. 2 Partnering for Prosperity: India-Canada Collaboration to Curb Digital Black Markets Sameer Patil Canada-India Track 1.5 Dialogue Paper No. 2 Partnering for Prosperity: India-Canada Collaboration to Curb Digital Black Markets Sameer Patil CIGI Masthead Gateway House Masthead Executive Executive Board President Rohinton P. Medhora Director,Gateway House: Indian Council on Global Relations Neelam Deo Deputy Director, International Intellectual Property Law and Innovation Bassem Awad President, Human Resources, After-Market & Corporate Services & Member, Chief Financial Officer and Director of Operations Shelley Boettger Group Executive Board, Mahindra and Mahindra Ltd. Rajeev Dubey Director of the Global Economy Program Robert Fay President & CEO, The Indian Music Industry Blaise Fernandes Director of the International Law Research Program Oonagh Fitzgerald Executive Director, Morgan Stanley Investment Management Amay Hattangadi Director of the Global Security & Politics Program Fen Osler Hampson Non-Executive Director, Tata Sons Ishaat Hussain Director of Human Resources Laura Kacur Director,Gateway House: Indian Council on Global Relations Satish Kamat Deputy Director, International Environmental Law Silvia Maciunas Executive Director, Gateway House: Indian Council on Global Deputy Director, International Economic Law Hugo Perezcano Díaz Relations Manjeet Kripalani Director, Evaluation and Partnerships Erica Shaw Founding Partner,AZB & Partners Bahram Vakil Managing Director and General Counsel Aaron Shull Director of Communications and Digital Media Spencer Tripp Advisory Board Senior Advisor, Morgan Stanley Investment Management Luis Miranda Publications Chief Risk Officer, Mahindra and Mahindra Ltd. K.N. Vaidyanathan Publisher Carol Bonnett Managing Director and Head of Advisory, Capital Raising and Financing for India, BNP Paribas Suneet Weling Senior Publications Editor Jennifer Goyder Senior Publications Editor Nicole Langlois Publications Editor Susan Bubak Publications Editor Patricia Holmes Publications Editor Lynn Schellenberg Graphic Designer Melodie Wakefield For publications enquiries, please contact [email protected]. Communications For media enquiries, please contact [email protected]. @cigionline Copyright © 2019 by the Centre for International Governance Innovation and Gateway House. The opinions expressed in this publication are those of the author and do not necessarily reflect the views of the Centre for International Governance Innovation or its Board of Directors, or the Gateway House Executive or Advisory Board. This work is licensed under a Creative Commons Attribution — Non-commercial — No Derivatives License. To view this license, visit (www.creativecommons. org/licenses/by-nc-nd/3.0/). For re-use or distribution, please include this copyright notice. Printed in Canada on paper containing 100% post-consumer fibre and certified by the Forest Stewardship Council® and the Sustainable Forestry Initiative. Centre for International Governance Innovation and CIGI are registered trademarks. 67 Erb Street West Cecil Court, 3rd floor, Next to Regal Cinema, Waterloo, ON, Canada N2L 6C2 Colaba, Mumbai – 400 005, www.cigionline.org India Table of Contents vi About the Author vii About the Project vii Acronyms and Abbreviations 1 Executive Summary 1 Introduction 2 Digital Black Markets: The Internet’s Murky Alleys 5 Cracking Down on Digital Black Markets and Securing Cyberspace 6 Tackling Black Markets through India- Canada Digital Security Cooperation 8 Conclusion 9 Appendix 15 Works Cited 18 About CIGI 18 À propos du CIGI About the Author Sameer Patil is a fellow, National Security Studies and director of the Centre for International Security at Gateway House. His research focuses on cyber security, maritime security and counter-terrorism. Sameer previously served in the National Security Council Secretariat within the Indian Prime Minister’s Office, where he focused on counter-terrorism and regional security. He is also a dissertation advisor at the Indian Naval War College. vi Canada-India Track 1.5 Dialogue Paper No. 2 • Sameer Patil About the Project Acronyms and The Canada-India Track 1.5 Dialogue on Innovation, Abbreviations Growth and Prosperity is a three-year initiative between the Centre for International Governance ATT Arms Trade Treaty Innovation (CIGI) and Gateway House: Indian Council on Global Relations, to explore areas Europol European Union Agency for Law for closer cooperation. Experts, government Enforcement Cooperation officials and business leaders will convene FBI Federal Bureau of Investigation annually to promote bilateral economic growth and innovation in today’s digital economy. G20 Group of Twenty Canada and India maintain strong bilateral I2P Invisible Internet Project relations built on the foundation of shared values and healthy economic ties. Economic I4C Indian Cyber Crime exchanges between Canada and India are on Coordination Centre an upward trajectory, but there continue to be unexplored areas for mutually beneficial Interpol International Criminal growth, especially in light of rapid developments Police Organization in technology that are changing every facet IP internet protocol of the economy and society in both countries. To address these challenges, the partnership IRC internet relay chat is helping to develop policy recommendations to promote innovation and navigate shared ISP internet service provider governance issues that are integral to the continued growth of Canada-India bilateral relations. NCCC National Cyber Coordination Centre The Canada-India Track 1.5 Dialogue on Innovation, OECD Organisation for Economic Growth and Prosperity strives to build closer Co-operation and Development ties between Canada and India and nurture P2P peer-to-peer the relationship to its full potential. Canada and India can be global leaders in innovation, PGP pretty good privacy and the Canada-India Track 1.5 Dialogue seeks opportunities to work jointly on multilateral PIPEDA Personal Information Protection issues and identify areas where improved and Electronic Documents Act cooperation could benefit both countries. RCMP Royal Canadian Mounted Police In addition to its focus on innovation, the partnership examines topics such TOR The Onion Router as collaboration on research and higher VPN virtual private network education, promotion of Canada-India trade and investment, energy cooperation and issues pertaining to global governance. Through this partnership, Canada and India can be intellectual partners and cooperate in the design of their global governance frameworks. Partnering for Prosperity: India-Canada Collaboration to Curb Digital Black Markets vii Executive Summary Introduction When Canadian Prime Minister Justin Trudeau In recent years, India and Canada have seen visited India in February 2018, the two countries unprecedented growth in ties across all sectors. agreed to extend their cooperation on security Their bilateral security cooperation, however, issues to cover cyberspace, with a specific focus has not kept pace with emerging cyber threats. on cybercrime. The two countries face multiple Ottawa and New Delhi are well-positioned to common cyber security challenges. Digital black advance their security cooperation to focus markets, where contraband and illegal services are on the growing problem. Annual security bought and sold, pose an emerging threat. Using dialogues and a counter-terrorism working advanced security features to remain anonymous, group already provide useful platforms for hackers, organized criminal networks and terrorist the countries’ respective national security groups use these sites, also known as the “dark establishments to share assessments of a range net marketplaces,” as force multiplier for their of security threats. The consensus to step up illicit activities. In the case of India and Canada, cyber cooperation with a focus on fighting these markets have abetted drug smuggling, cybercrimes in bilateral and multilateral forums, facilitated cybercrimes and contributed to terrorist achieved during Prime Minister Justin Trudeau’s activities. Despite frequent security crackdowns, India visit in early 2018, provides a foundation these marketplaces have proved to be resilient. for even closer collaboration (India 2018b). India and Canada have implemented multiple Although they are heterogeneous democracies steps domestically to address the growing threats. and their economies have achieved different levels Canada has participated in multiple crackdowns of digitalization, India and Canada face multiple against the digital black markets. India, however, common cyber-security challenges, including: lacks a comprehensive understanding of this illicit activity. Both countries have an opportunity to → cybercrime and data breaches; deepen their security cooperation by collaborating → critical infrastructure protection; to tackle these markets. They can work bilaterally to track the encryption technologies, encourage → cyber-enabled espionage; informal collaboration between their respective law enforcement agencies, work with private → securing election systems from sabotage; and stakeholders (such as cryptocurrency exchanges) and move to discredit these marketplaces. → misuse of cyberspace by terrorists At the multilateral level, the two countries and extremists. can contribute to international security and For India and Canada, an emerging concern cyberspace stability by building the capacity
Load more

Recommended publications
  • Download (589Kb)
    This is an Open Access document downloaded from ORCA, Cardiff University's institutional repository: http://orca.cf.ac.uk/95227/ This is the author’s version of a work that was submitted to / accepted for publication. Citation for final published version: Décary-Hétu, David and Giommoni, Luca 2017. Do police crackdowns disrupt drug cryptomarkets? a longitudinal analysis of the effects of Operation Onymous. Crime, Law and Social Change 67 (1) , pp. 55-75. 10.1007/s10611-016-9644-4 file Publishers page: http://dx.doi.org/10.1007/s10611-016-9644-4 <http://dx.doi.org/10.1007/s10611- 016-9644-4> Please note: Changes made as a result of publishing processes such as copy-editing, formatting and page numbers may not be reflected in this version. For the definitive version of this publication, please refer to the published source. You are advised to consult the publisher’s version if you wish to cite this paper. This version is being made available in accordance with publisher policies. See http://orca.cf.ac.uk/policies.html for usage policies. Copyright and moral rights for publications made available in ORCA are retained by the copyright holders. 1 Do Police Crackdowns Disrupt Drug Cryptomarkets? A Longitudinal Analysis Of The Effects Of Operation Onymous In recent years, there has been a proliferation of online illicit markets where participants can purchase and sell a wide range of goods and services such as drugs, hacking services, and stolen financial information. Second- generation markets, known as cryptomarkets, provide a pseudo-anonymous platform from which to operate and have attracted the attention of researchers, regulators, and law enforcement.
    [Show full text]
  • Van De Laarschot and Rolf Van Wegberg, Delft University of Technology
    Risky Business? Investigating the Security Practices of Vendors on an Online Anonymous Market using Ground-Truth Data Jochem van de Laarschot and Rolf van Wegberg, Delft University of Technology https://www.usenix.org/conference/usenixsecurity21/presentation/van-de-laarschot This paper is included in the Proceedings of the 30th USENIX Security Symposium. August 11–13, 2021 978-1-939133-24-3 Open access to the Proceedings of the 30th USENIX Security Symposium is sponsored by USENIX. Risky Business? Investigating the Security Practices of Vendors on an Online Anonymous Market using Ground-Truth Data Jochem van de Laarschot Rolf van Wegberg Delft University of Technology Delft University of Technology Abstract However, there are numerous indications in earlier work that cybercriminals do not always achieve maximum security. Cybercriminal entrepreneurs on online anonymous markets Due to competing business incentives, criminals may turn rely on security mechanisms to thwart investigators in at- to insecure practices that ease transacting illegal products or tributing their illicit activities. Earlier work indicates that – services. Here, we witness an inevitable trade-off between despite the high-risk criminal context – cybercriminals may enhanced security and improved efficiency of operations [42]. turn to poor security practices due to competing business ‘Perfect security’ therefore, is not economically viable. Like incentives. This claim has not yet been supported through in the legitimate economy [54], security in the underground empirical, quantitative analysis on ground-truth data. In this economy comes at a cost [53]. This leads us to wonder how paper, we investigate the security practices on Hansa Mar- prevalent poor security practices (or: “insecure practices”) ket (2015-2017) and measure the prevalence of poor security among online anonymous market vendors actually are.
    [Show full text]
  • Pairing-Based Onion Routing with Improved Forward Secrecy ∗
    Pairing-Based Onion Routing with Improved Forward Secrecy ∗ Aniket Kate Greg M. Zaverucha Ian Goldberg David R. Cheriton School of Computer Science University of Waterloo Waterloo, ON, Canada N2L 3G1 {akate,gzaveruc,iang}@cs.uwaterloo.ca Abstract This paper presents new protocols for onion routing anonymity networks. We define a provably secure privacy-preserving key agreement scheme in an identity-based infrastructure setting, and use it to forge new onion routing circuit constructions. These constructions, based on a user’s selection, offer immediate or eventual forward secrecy at each node in a circuit and require significantly less computation and communication than the telescoping mechanism used by Tor. Further, the use of the identity-based infrastructure also leads to a reduction in the required amount of authenticated directory information. Therefore, our constructions provide practical ways to allow onion routing anonymity networks to scale gracefully. Keywords: onion routing, Tor, pairing-based cryptography, anonymous key agreement, forward secrecy 1 Introduction Over the years, a large number of anonymity networks have been proposed and some have been implemented. Common to many of them is onion routing [RSG98], a technique whereby a message is wrapped in multiple layers of encryption, forming an onion. As the message is delivered via a number of intermediate onion routers (ORs), or nodes, each node decrypts one of the layers, and forwards the message to the next node. This idea goes back to Chaum [Cha81] and has been used to build both low- and high-latency communication networks. A common realization of an onion routing system is to arrange a collection of nodes that will relay traffic for users of the system.
    [Show full text]
  • An Evolving Threat the Deep Web
    8 An Evolving Threat The Deep Web Learning Objectives distribute 1. Explain the differences between the deep web and darknets.or 2. Understand how the darknets are accessed. 3. Discuss the hidden wiki and how it is useful to criminals. 4. Understand the anonymity offered by the deep web. 5. Discuss the legal issues associated withpost, use of the deep web and the darknets. The action aimed to stop the sale, distribution and promotion of illegal and harmful items, including weapons and drugs, which were being sold on online ‘dark’ marketplaces. Operation Onymous, coordinated by Europol’s Europeancopy, Cybercrime Centre (EC3), the FBI, the U.S. Immigration and Customs Enforcement (ICE), Homeland Security Investigations (HSI) and Eurojust, resulted in 17 arrests of vendors andnot administrators running these online marketplaces and more than 410 hidden services being taken down. In addition, bitcoins worth approximately USD 1 million, EUR 180,000 Do in cash, drugs, gold and silver were seized. —Europol, 20141 143 Copyright ©2018 by SAGE Publications, Inc. This work may not be reproduced or distributed in any form or by any means without express written permission of the publisher. 144 Cyberspace, Cybersecurity, and Cybercrime THINK ABOUT IT 8.1 Surface Web and Deep Web Google, Facebook, and any website you can What Would You Do? find via traditional search engines (Internet Explorer, Chrome, Firefox, etc.) are all located 1. The deep web offers users an anonym- on the surface web. It is likely that when you ity that the surface web cannot provide. use the Internet for research and/or social What would you do if you knew that purposes you are using the surface web.
    [Show full text]
  • Into the Reverie: Exploration of the Dream Market
    Into the Reverie: Exploration of the Dream Market Theo Carr1, Jun Zhuang2, Dwight Sablan3, Emma LaRue4, Yubao Wu5, Mohammad Al Hasan2, and George Mohler2 1Department of Mathematics, Northeastern University, Boston, MA 2Department of Computer & Information Science, Indiana University - Purdue University, Indianapolis, IN 3Department of Mathematics and Computer Science, University of Guam, Guam 4Department of Mathematics and Statistics, University of Arkansas at Little Rock, AK 5Department of Computer Science, Georgia State University, Atlanta, GA [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] Abstract—Since the emergence of the Silk Road market in Onymous" in 2014, a worldwide action taken by law enforce- the early 2010s, dark web ‘cryptomarkets’ have proliferated and ment and judicial agencies aimed to put a kibosh on these offered people an online platform to buy and sell illicit drugs, illicit behaviors [5]. Law enforcement interventions such as relying on cryptocurrencies such as Bitcoin for anonymous trans- actions. However, recent studies have highlighted the potential for Onymous, along with exit scams and hacks, have successfully de-anonymization of bitcoin transactions, bringing into question shut down numerous cryptomarkets, including AlphaBay, Silk the level of anonymity afforded by cryptomarkets. We examine a Road, Dream, and more recently, Wall Street [6]. Despite these set of over 100,000 product reviews from several cryptomarkets interruptions, new markets have continued to proliferate. The collected in 2018 and 2019 and conduct a comprehensive analysis authors of [7] note that there appears to be a consistent daily of the markets, including an examination of the distribution of drug sales and revenue among vendors, and a comparison demand of about $500,000 for illicit products on the dark web, of incidences of opioid sales to overdose deaths in a US city.
    [Show full text]
  • MEMO. Nº. 52/2017 – SCOM
    00100.096648/2017-00 MEMO. nº. 52/2017 – SCOM Brasília, 21 de junho de 2017 A Sua Excelência a Senhora SENADORA REGINA SOUSA Assunto: Ideia Legislativa nº. 76.334 Senhora Presidente, Nos termos do parágrafo único do art. 6º da Resolução do Senado Federal nº. 19 de 2015, encaminho a Vossa Excelência a Ideia Legislativa nº. 76.334, sob o título de “Criminalização Da Apologia Ao Comunismo”, que alcançou, no período de 09/06/2017 a 20/06/2017, apoiamento superior a 20.000 manifestações individuais, conforme a ficha informativa em anexo. Respeitosamente, Dirceu Vieira Machado Filho Diretor da Secretaria de Comissões Senado Federal – Praça dos Três Poderes – CEP 70.165-900 – Brasília DF ARQUIVO ASSINADO DIGITALMENTE. CÓDIGO DE VERIFICAÇÃO: CE7C06D2001B6231. CONSULTE EM http://www.senado.gov.br/sigadweb/v.aspx. 00100.096648/2017-00 ANEXO AO MEMORANDO Nº. 52/2017 – SCOM - FICHA INFORMATIVA E RELAÇÃO DE APOIADORES - Senado Federal – Praça dos Três Poderes – CEP 70.165-900 – Brasília DF ARQUIVO ASSINADO DIGITALMENTE. CÓDIGO DE VERIFICAÇÃO: CE7C06D2001B6231. CONSULTE EM http://www.senado.gov.br/sigadweb/v.aspx. 00100.096648/2017-00 Ideia Legislativa nº. 76.334 TÍTULO Criminalização Da Apologia Ao Comunismo DESCRIÇÃO Assim como a Lei já prevê o "Crime de Divulgação do Nazismo", a apologia ao COMUNISMO e seus símbolos tem que ser proibidos no Brasil, como já acontece cada vez mais em diversos países, pois essa ideologia genocida causou males muito piores à Humanidade, massacrando mais de 100 milhões de inocentes! (sic) MAIS DETALHES O art. 20 da Lei 7.716/89 estabeleceu o "Crime de Divulgação do Nazismo": "§1º - Fabricar, comercializar, distribuir ou veicular, símbolos, emblemas, ornamentos, distintivos ou propaganda que utilizem a cruz suástica ou gamada, para fins de divulgação do nazismo.
    [Show full text]
  • Mass Surveillance
    Mass Surveillance Mass Surveillance What are the risks for the citizens and the opportunities for the European Information Society? What are the possible mitigation strategies? Part 1 - Risks and opportunities raised by the current generation of network services and applications Study IP/G/STOA/FWC-2013-1/LOT 9/C5/SC1 January 2015 PE 527.409 STOA - Science and Technology Options Assessment The STOA project “Mass Surveillance Part 1 – Risks, Opportunities and Mitigation Strategies” was carried out by TECNALIA Research and Investigation in Spain. AUTHORS Arkaitz Gamino Garcia Concepción Cortes Velasco Eider Iturbe Zamalloa Erkuden Rios Velasco Iñaki Eguía Elejabarrieta Javier Herrera Lotero Jason Mansell (Linguistic Review) José Javier Larrañeta Ibañez Stefan Schuster (Editor) The authors acknowledge and would like to thank the following experts for their contributions to this report: Prof. Nigel Smart, University of Bristol; Matteo E. Bonfanti PhD, Research Fellow in International Law and Security, Scuola Superiore Sant’Anna Pisa; Prof. Fred Piper, University of London; Caspar Bowden, independent privacy researcher; Maria Pilar Torres Bruna, Head of Cybersecurity, Everis Aerospace, Defense and Security; Prof. Kenny Paterson, University of London; Agustín Martin and Luis Hernández Encinas, Tenured Scientists, Department of Information Processing and Cryptography (Cryptology and Information Security Group), CSIC; Alessandro Zanasi, Zanasi & Partners; Fernando Acero, Expert on Open Source Software; Luigi Coppolino,Università degli Studi di Napoli; Marcello Antonucci, EZNESS srl; Rachel Oldroyd, Managing Editor of The Bureau of Investigative Journalism; Peter Kruse, Founder of CSIS Security Group A/S; Ryan Gallagher, investigative Reporter of The Intercept; Capitán Alberto Redondo, Guardia Civil; Prof. Bart Preneel, KU Leuven; Raoul Chiesa, Security Brokers SCpA, CyberDefcon Ltd.; Prof.
    [Show full text]
  • A Framework for Identifying Host-Based Artifacts in Dark Web Investigations
    Dakota State University Beadle Scholar Masters Theses & Doctoral Dissertations Fall 11-2020 A Framework for Identifying Host-based Artifacts in Dark Web Investigations Arica Kulm Dakota State University Follow this and additional works at: https://scholar.dsu.edu/theses Part of the Databases and Information Systems Commons, Information Security Commons, and the Systems Architecture Commons Recommended Citation Kulm, Arica, "A Framework for Identifying Host-based Artifacts in Dark Web Investigations" (2020). Masters Theses & Doctoral Dissertations. 357. https://scholar.dsu.edu/theses/357 This Dissertation is brought to you for free and open access by Beadle Scholar. It has been accepted for inclusion in Masters Theses & Doctoral Dissertations by an authorized administrator of Beadle Scholar. For more information, please contact [email protected]. A FRAMEWORK FOR IDENTIFYING HOST-BASED ARTIFACTS IN DARK WEB INVESTIGATIONS A dissertation submitted to Dakota State University in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Cyber Defense November 2020 By Arica Kulm Dissertation Committee: Dr. Ashley Podhradsky Dr. Kevin Streff Dr. Omar El-Gayar Cynthia Hetherington Trevor Jones ii DISSERTATION APPROVAL FORM This dissertation is approved as a credible and independent investigation by a candidate for the Doctor of Philosophy in Cyber Defense degree and is acceptable for meeting the dissertation requirements for this degree. Acceptance of this dissertation does not imply that the conclusions reached by the candidate are necessarily the conclusions of the major department or university. Student Name: Arica Kulm Dissertation Title: A Framework for Identifying Host-based Artifacts in Dark Web Investigations Dissertation Chair: Date: 11/12/20 Committee member: Date: 11/12/2020 Committee member: Date: Committee member: Date: Committee member: Date: iii ACKNOWLEDGMENT First, I would like to thank Dr.
    [Show full text]
  • Are Cookie Banners Indeed Compliant with the Law? Cristiana Santos, Nataliia Bielova, Célestin Matte
    Are cookie banners indeed compliant with the law? Cristiana Santos, Nataliia Bielova, Célestin Matte To cite this version: Cristiana Santos, Nataliia Bielova, Célestin Matte. Are cookie banners indeed compliant with the law?: Deciphering EU legal requirements on consent and technical means to verify compli- ance of cookie banners. Technology and Regulation, Tilburg University, 2020, 2020, pp.91-135. 10.26116/TECHREG.2020.009. hal-02875447v2 HAL Id: hal-02875447 https://hal.inria.fr/hal-02875447v2 Submitted on 23 Sep 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners Cristiana Santos, Nataliia Bielova, Célestin Matte Inria, France [email protected] [email protected] [email protected] Abstract In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the ePrivacy Directive and the GDPR, defining 22 legal requirements. While some are provided by legal sources, others result from the domain expertise of computer scientists. We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.
    [Show full text]
  • Indicators of Compromise Associated with Onepercent Group Ransomware
    TLP: WHITE The following information is being provided by the FBI, with no guarantees or 23 AUG 2021 warranties, for potential use at the sole discretion of recipients in order to protect against cyber threats. This data is provided to help cyber security Alert Number professionals and system administrators guard against the persistent malicious CU-000149-MW actions of cyber actors. This FLASH was coordinated with DHS-CISA. WE NEED YOUR HELP! This FLASH has been released TLP: WHITE. Subject to standard copyright rules, If you find any of TLP: WHITE information may be distributed without restriction. these indicators on your networks, or have related Indicators of Compromise Associated with OnePercent information, please contact Group Ransomware www.fbi.gov/con Summary tact-us/field- offices The FBI has learned of a cyber-criminal group who self identifies as the *Note: By reporting “OnePercent Group” and who have used Cobalt Strike to perpetuate any related ransomware attacks against US companies since November 2020. OnePercent information to the Group actors compromise victims through a phishing email in which an FBI, you are assisting in sharing attachment is opened by the user. The attachment’s macros infect the system information that with the IcedID1 banking trojan. IcedID downloads additional software to include allows the FBI to track malicious Cobalt Strike. Cobalt Strike moves laterally in the network, primarily with actors and PowerShell remoting. coordinate with private industry OnePercent Group actors encrypt the data and exfiltrate it from the victims’ and the United systems. The actors contact the victims via telephone and email, threatening to States Government to prevent future release the stolen data through The Onion Router (TOR) network and clearnet, intrusions and unless a ransom is paid in virtual currency.
    [Show full text]
  • CSCI-UA.9480 Introduction to Computer Security
    CSCI-UA.9480 Introduction to Computer Security Session 2.3 Designing Secure Network Systems Prof. Nadim Kobeissi Goals of today’s class. A look into some secure network systems: ● WireGuard: a modern VPN. ● A critical look at ProtonMail, a secure email service. WireGuard is an example of a well-designed secure network application. ProtonMail is an example of a badly designed network application. CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi 2 WireGuard Following slides are by Jason A. 2.3a Donenfeld, author of WireGuard. CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi 3 What is WireGuard? ▪ Layer 3 secure network tunnel for IPv4 and IPv6. ▪ Opinionated. Only layer 3! ▪ Designed for the Linux kernel ▪ Slower cross platform implementations also. ▪ UDP-based. Punches through firewalls. ▪ Modern conservative cryptographic principles. ▪ Emphasis on simplicity and auditability. ▪ Authentication model similar to SSH’s authenticated_keys. ▪ Replacement for OpenVPN and IPsec. ▪ Grew out of a stealth rootkit project. ▪ Techniques desired for stealth are equally as useful for tunnel defensive measures. Security Design Principle 1: Easily Auditable OpenVPN Linux XFRM StrongSwan SoftEther WireGuard 116,730 LoC 119,363 LoC 405,894 LoC 329,853 LoC 3,771 LoC Plus OpenSSL! Plus StrongSwan! Plus XFRM! Less is more. Security Design Principle 1: Easily Auditable WireGuard 3,771 LoC IPsec SoftEther OpenVPN (XFRM+StrongSwan) 329,853 LoC 119,363 419,792 LoC LoC Security Design Principle 2: Simplicity of Interface ▪ WireGuard presents a normal network interface: # ip link add wg0 type wireguard # ip address add 192.168.3.2/24 dev wg0 # ip route add default via wg0 # ifconfig wg0 … # iptables –A INPUT -i wg0 … /etc/hosts.{allow,deny}, bind(), … ▪ Everything that ordinarily builds on top of network interfaces – like eth0 or wlan0 – can build on top of wg0.
    [Show full text]
  • Optical Onion Routing
    Optical Onion Routing Anna Engelmann and Admela Jukan Technische Universitat¨ Carolo-Wilhelmina zu Braunschweig, Germany Email: fa.engelmann, [email protected] Abstract—As more and more data is transmitted in the depend on number and dependability of volunteer systems, configurable optical layer, – whereby all optical switches forward the privacy features in optical network need to be approached packets without electronic layers involved, we envision privacy as differently: for instance, it is a telecom operator that should the intrinsic property of future optical networks. In this paper, we be able offer a private optical communication service as a propose Optical Onion Routing (OOR) routing and forwarding value added feature. For instance, for some client networks techniques, inspired by the onion routing in the Internet layer, - an optical network can grant anonymous access to third-party the best known realization of anonymous communication today, – but designed with specific features innate to optical networks. servers in the cloud, whereby the traffic contents and the origin We propose to design the optical anonymization network system of requests can remain secret for both the attacker as well as with a new optical anonymization node architecture, including the cloud provider. In designing an anonymous optical network the optical components and their electronic counterparts to akin to Tor, however, several obstacles need to be overcome, realize layered encryption. We propose modification to the secret since the main features need to be primarily implemented in key generation using Linear Feedback Shift Register (LFSR), – photonics, i.e., without intervention of electronics, such as able to utilize different primitive irreducible polynomials, and encryption, traffic routing, and session key distribution.
    [Show full text]