CERIAS Tech Report 2015-11 Using Deception to Enhance Security: a Taxonomy, Model, and Novel Uses by Mohammed H
Total Page：16
File Type：pdf, Size：1020Kb
CERIAS Tech Report 2015-11 Using Deception to Enhance Security: A Taxonomy, Model, and Novel Uses by Mohammed H. Almeshekah Center for Education and Research Information Assurance and Security Purdue University, West Lafayette, IN 47907-2086 USING DECEPTION TO ENHANCE SECURITY: A TAXONOMY, MODEL, AND NOVEL USES A Dissertation Submitted to the Faculty of Purdue University by Mohammed H. Almeshekah In Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy August 2015 Purdue University West Lafayette, Indiana ii In dedication to my mother, Aljoharh, who has given up so much to make me into who I am; to my wife, Asma, who taught me the meaning of sacrifice; and to my sons, Abdullah and Feras, who provided me the extra motivation to finish my PhD. iii ACKNOWLEDGMENTS I would like to express my heartfelt thanks to my advisors, Prof. Eugene H. Spaf ford and Prof. Mikhal J. Atallah, for their time, guidance, and invaluable comments throughout the whole span of this dissertation work. I am honored to have the op portunity to learn from such renowned scientists and highly respected mentors. They taught me the skills that would guide me in my career for years to come. I am forever indebted to them and aspire to follow in their footsteps. I would also like to express my deepest appreciation to my committee members, Prof. Samuel Wagstaff and Prof. Matt Bishop, for their invaluable advice and help. Without their insights and hard questions, this dissertation would not have been possible. I am also extremely grateful for my beloved wife, Asma, for her continuous encour agement and unwavering support. She provided light when the rigors of intellectual pursuit were casting a shadow. I would not have finished this dissertation without her by my side. She has sacrificed beyond what I wished for and has done so with love. Also, I am grateful for my parents for their unwavering support and unforgettable endorsement, especially to my dearest mom. She is the pillar I stand by during hard times and I owe her my life for her constant love and encouragement. Special thanks are also due to Northrop Grumman and Saudi Arabian Cultural Mission for supporting me throughout my PhD. Finally, I take this opportunity to record my sincere thanks to all the faculty, staff, and friends at the Computer Sci ence Department and CERIAS; they provided me with one of the best academic environment during my PhD. iv TABLE OF CONTENTS Page LIST OF TABLES :::::::::::::::::::::::::::::::: viii LIST OF FIGURES ::::::::::::::::::::::::::::::: ix ABBREVIATIONS :::::::::::::::::::::::::::::::: xi ABSTRACT ::::::::::::::::::::::::::::::::::: xii 1 Introduction :::::::::::::::::::::::::::::::::: 1 1.1 Motivation and Overview :::::::::::::::::::::::: 1 1.1.1 Thesis Statement :::::::::::::::::::::::: 2 1.1.2 Dissertation Overview ::::::::::::::::::::: 3 1.2 Terminology ::::::::::::::::::::::::::::::: 4 1.3 Dissertation Organization and Contribution ::::::::::::: 5 2 A Taxonomy of Computer Systems’ Defenses :::::::::::::::: 8 2.1 The Four Categories of Protection Mechanisms :::::::::::: 10 2.1.1 Denial and Isolation :::::::::::::::::::::: 12 2.1.2 Degradation and Obfuscation ::::::::::::::::: 13 2.1.3 Negative Information and Deception ::::::::::::: 13 2.1.4 Attribution and Counter-Operations ::::::::::::: 16 2.2 Fitting the Pieces Together – Cyber Kill-Chain Model :::::::: 17 2.2.1 The Role of Deception ::::::::::::::::::::: 17 2.3 Chapter Summary ::::::::::::::::::::::::::: 19 3 Deception ::::::::::::::::::::::::::::::::::: 21 3.1 General Definition of Deception :::::::::::::::::::: 21 3.2 Deception and the Truth – A Taxonomy ::::::::::::::: 22 3.2.1 Simulation and Dissimulation – Bell and Whaley :::::: 22 3.2.2 Linguistic Case Theory ::::::::::::::::::::: 24 3.3 Deception Maxims ::::::::::::::::::::::::::: 25 3.3.1 Truth/Reality :::::::::::::::::::::::::: 25 3.3.2 Deceit :::::::::::::::::::::::::::::: 26 3.3.3 Denial, Misdirection and Confusion :::::::::::::: 26 3.4 Deception and Biases :::::::::::::::::::::::::: 26 3.4.1 Personal Biases ::::::::::::::::::::::::: 28 3.4.2 Cultural Biases ::::::::::::::::::::::::: 28 3.4.3 Organizational Biases :::::::::::::::::::::: 30 v Page 3.4.4 Cognitive Biases :::::::::::::::::::::::: 30 3.5 The Use of Deception in War, Military and Conflicts :::::::: 31 3.6 General Use of Deception in Computing ::::::::::::::: 32 3.6.1 In Human-to-Human Digital Interaction ::::::::::: 32 3.6.2 In Human Computer Interaction (HCI) :::::::::::: 32 3.6.3 In Robotics and Human Robot Interaction (HRI) :::::: 34 3.6.4 In Computer-to-Computer Interaction :::::::::::: 35 3.7 The Use of Deception to Enhance Security :::::::::::::: 36 3.7.1 Honeypots :::::::::::::::::::::::::::: 37 3.7.2 Honey–* Tools ::::::::::::::::::::::::: 39 3.7.3 Incorporating Deception into Other Security Defenses :::: 40 3.8 Deception Operations and Tactics ::::::::::::::::::: 43 3.9 Chapter Summary ::::::::::::::::::::::::::: 44 4 A Framework for Using Deception to Enhance Security :::::::::: 45 4.1 Definition :::::::::::::::::::::::::::::::: 46 4.2 Limitations of Isolated Use of Deception ::::::::::::::: 46 4.3 The Role of Deception ::::::::::::::::::::::::: 47 4.3.1 Advantages of Using Deception in Computer Defenses :::: 48 4.4 Related Work of Modeling the Use of Deception in Security ::::: 50 4.5 A Framework for Integrating Deception-Based Defenses ::::::: 51 4.5.1 Planning Deception ::::::::::::::::::::::: 52 4.5.2 Implementing and Integrating Deception ::::::::::: 62 4.5.3 Monitoring and Evaluating the Use of Deception ::::::: 62 4.6 Deception and Related Concepts ::::::::::::::::::: 63 4.6.1 Kerckhoff’s Principle and Deception :::::::::::::: 63 4.6.2 Deception and Hacking Back :::::::::::::::::: 65 4.6.3 Deception and Consistency ::::::::::::::::::: 65 4.6.4 Deception and Abstraction ::::::::::::::::::: 66 4.7 Applying the Framework :::::::::::::::::::::::: 66 4.7.1 To Previous Uses of Deception ::::::::::::::::: 66 4.7.2 To the Work in This Dissertation – A Case Study :::::: 70 4.8 Chapter Summary ::::::::::::::::::::::::::: 73 5 Deceptive Covert Channel :::::::::::::::::::::::::: 74 5.1 Background ::::::::::::::::::::::::::::::: 75 5.1.1 Authentication Schemes :::::::::::::::::::: 75 5.1.2 Use of Smartphones ::::::::::::::::::::::: 77 5.1.3 Use of Deception and Covert Channels :::::::::::: 77 5.2 Creating a Deceptive Covert Channel ::::::::::::::::: 78 5.2.1 Threat Model :::::::::::::::::::::::::: 79 5.2.2 Scheme’s Setup ::::::::::::::::::::::::: 80 5.2.3 Logging In :::::::::::::::::::::::::::: 81 vi Page 5.2.4 Creating Deceit and Covert Communication ::::::::: 85 5.3 Enhancements :::::::::::::::::::::::::::::: 86 5.4 Security Analysis :::::::::::::::::::::::::::: 87 5.5 Comparison with Other Schemes ::::::::::::::::::: 89 5.6 Chapter Summary ::::::::::::::::::::::::::: 92 6 Deceptive Passwords — ErsatzPasswords :::::::::::::::::: 93 6.1 Background ::::::::::::::::::::::::::::::: 94 6.1.1 Passwords :::::::::::::::::::::::::::: 94 6.1.2 Password-Related Threats ::::::::::::::::::: 94 6.1.3 Injecting Deceit ::::::::::::::::::::::::: 96 6.2 Technical Specification ::::::::::::::::::::::::: 97 6.2.1 Background ::::::::::::::::::::::::::: 97 6.2.2 One-time Initialization ::::::::::::::::::::: 99 6.2.3 Login ::::::::::::::::::::::::::::::: 101 6.2.4 Password Administration :::::::::::::::::::: 102 6.3 ErsatzPasswords – The Use of Deception ::::::::::::::: 104 6.3.1 ErsatzPasswords Generation :::::::::::::::::: 105 6.3.2 ErsatzPasswords Properties :::::::::::::::::: 108 6.4 Implementation and Analysis ::::::::::::::::::::: 111 6.4.1 Implementation Details ::::::::::::::::::::: 111 6.4.2 Analysis ::::::::::::::::::::::::::::: 112 6.5 Chapter Summary ::::::::::::::::::::::::::: 118 7 Deceptiver — A Centralized Deceptive Server ::::::::::::::: 120 7.1 Background ::::::::::::::::::::::::::::::: 121 7.2 Overview ::::::::::::::::::::::::::::::::: 122 7.3 Deceptiver Design :::::::::::::::::::::::::::: 123 7.3.1 Deceptive Responses :::::::::::::::::::::: 124 7.3.2 Centralized Deception ::::::::::::::::::::: 130 7.4 Implementation and Deployment ::::::::::::::::::: 130 7.4.1 Apache Server Hook :::::::::::::::::::::: 131 7.5 Security Discussion ::::::::::::::::::::::::::: 132 7.6 Performance Analysis :::::::::::::::::::::::::: 134 7.7 Chapter Summary ::::::::::::::::::::::::::: 136 8 Conclusions :::::::::::::::::::::::::::::::::: 137 8.1 Summary :::::::::::::::::::::::::::::::: 137 8.2 Future Work ::::::::::::::::::::::::::::::: 138 LIST OF REFERENCES :::::::::::::::::::::::::::: 141 A Deceptiver Implementation :::::::::::::::::::::::::: 153 A.1 Deceptiver Command Line Inputs ::::::::::::::::::: 153 vii VITA ::::::::::::::::::::::::::::::::::::::: 155 viii LIST OF TABLES Table Page 2.1 Mapping Security Mechanisms to the Kill-Chain Model ::::::::: 18 4.1 Using the Deception Framework to Secure Web Applications :::::: 72 5.1 Schemes Comparison :::::::::::::::::::::::::::: 90 6.1 Number of Instructions for Creating a New User Under the new pam unix Module ::::::::::::::::::::::::::::::::::: 115 7.1 Comparing the Performance of Apache With ModSecurity and Deceptiver 134 ix LIST OF FIGURES Figure Page 1.1 Computer Systems Components Where Deception is Applied in the Dis sertation ::::::::::::::::::::::::::::::::::: 3 1.2 Using Deception to Enhance Security – Dissertation Overview ::::: 4 2.1 Taxonomy of Information Protection Mechanisms :::::::::::: 9 2.2 Plotting the Taxonomy Over Multiple Scales ::::::::::::::: 11 3.1 Deception and Perception ::::::::::::::::::::::::: 22 3.2 Deception