DOCSLIB.ORG

SDSU Template, Version 11.1

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
SDSU Template, Version 11.1 STAYING CLEAN: CYBER HYGIENE & SOCIAL ENGINEERING WITHIN SCADA & INDUSTRIAL CONTROL SYSTEMS _______________ A Thesis Presented to the Faculty of San Diego State University _______________ In Partial Fulfillment of the Requirements for the Degree Master of Science in Homeland Security _______________ by Drew Kirk Facetti Summer 2018 iii Copyright © 2018 by Drew Kirk Facetti All Rights Reserved iv ABSTRACT OF THE THESIS Staying Clean: Cyber Hygiene & Social Engineering Within Scada & Industrial Control Systems by Drew Kirk Facetti Master of Science in Homeland Security San Diego State University, 2018 Critical infrastructure facilities allow the United States and other nations to run smoothly every day. Many critical infrastructure facilities that use Supervisory Control and Data Acquisition (SCADA) systems are susceptible to a cyber-attack. Among the plethora of facilities that use SCADA systems are: electric grids, nuclear power plants, water treatment facilities, transportation, etc. These Industrial Control Systems (ICS) then commonly feed into response and management systems mandated by the Department of Homeland Security for protecting United States assets and people and responding to natural and manmade events. Enhancing the US national SCADA/ICS protection is becoming more and more important as the interconnectivity of the national and the world is expanding with the Internet of Things (IoT) and Industrial Internet of Things (IIoT) with the known risks and threats continuing to rise. Creating and providing in-depth Cyber Security and Cyber Hygiene recommendations will allow privately owned Critical Infrastructure (CI) facilities using SCADA/ICS the tools to prevent cyber-attacks from occurring. Finding ways to further the Cybersecurity of SCADA and ICS systems will benefit the public and the owners of the systems, as more and more attacks continue to occur via the profoundly interconnected nature of today’s internet. New solutions are very promising such as enhancing major public- private partnerships like the FBI InfraGard and potentially new national bodies like the Department of Energy’s Office of Cybersecurity and Emergency Response or other specialized agencies. Private-sector and government professional organizations and conferences focused on SCADA and ICS are also leading the nation and world in being better prepared and learning from the attacks or mishaps that have impacted others. Turning security recommendations of SCADA/ICS provided by the National Institute of Standards and Technology (NIST) into requirements will better prepare the workers of CI facilities for cyber-attacks. Turning the recommendations into requirements will also strengthen the government contracts that are meant to perform security audits on the CI facilities. v TABLE OF CONTENTS PAGE ABSTRACT ............................................................................................................................. iv LIST OF FIGURES ................................................................................................................ vii CHAPTER 1 INTRODUCTION .........................................................................................................1 Problem Statement ...................................................................................................2 2 CYBER CRIME.............................................................................................................7 Cyberterrorism .........................................................................................................9 Cyber-Espionage ....................................................................................................15 Cyber war ...............................................................................................................18 3 ATTRIBUTION ...........................................................................................................20 4 CYBER WEAPONS ....................................................................................................22 Types of Attacks ....................................................................................................23 Malware ...........................................................................................................23 DDoS................................................................................................................23 Botnets .............................................................................................................24 Phishing and Spear-Phishing ...........................................................................24 Zero-Day Vulnerabilities .......................................................................................25 Ransomware .....................................................................................................26 5 NUCLEAR POWER PLANTS....................................................................................28 Electric Grid ...........................................................................................................29 Water Treatment Facilities .....................................................................................32 Fiber Optic Cables .................................................................................................33 6 NIST .............................................................................................................................36 Recommendations and Suggestions .......................................................................36 Requirements .........................................................................................................44 vi Relationships, Resources, and Collaborations .......................................................44 CESER .............................................................................................................44 Office of Intelligence and Counterintelligence ................................................45 InfraGard ..........................................................................................................46 USNORTHCOM..............................................................................................46 OSAC ...............................................................................................................48 Fusion Centers .................................................................................................48 ICSJWG ...........................................................................................................49 ISACs ...............................................................................................................49 7 FIBER OPTIC NETWORKS ......................................................................................51 Zero Days ...............................................................................................................52 Attribution ..............................................................................................................53 8 FINAL STATEMENT/CONCLUSION ......................................................................55 REFERENCES ........................................................................................................................56 APPENDIX SUPPLEMENTARY FIGURES ........................................................................................67 vii LIST OF FIGURES PAGE Figure 1. SCADA diagram.. ......................................................................................................2 Figure 2. Photograph depicting the US F-35, left, and the Chinese J-20, right. ......................16 Figure 3. Picture showing what computer screens looked like after the Sony Hack ...............21 Figure 4. Screenshot of a computer with the “WannaCry” Ransomware activated. The instructions within need to be followed or the encrypted files will be deleted.. ..........27 Figure 5. Map of the eight different power grids in the United States. ...................................31 Figure 6. Firewall diagram. ......................................................................................................38 Figure 7. Libelium smart world concept. .................................................................................43 Figure 8. Screenshot from Shodan.io which provides the user with information about a Verizon Wireless page for CI. ...................................................................................67 Figure 9. Screenshot showing the “http” which will allow anyone to connect to the login page for Verizon. ................................................................................................67 Figure 10. Screenshot of the login page to access crucial CI information. .............................68 1 CHAPTER 1 INTRODUCTION Cyberspace is ever growing and, there is no obvious indication that it will stop, so the vulnerability of our world to attacks using Cyberspace is also an ever-growing challenge. One such area of society around the world is critical infrastructure for having society function---attacks on our critical infrastructure (CI) through cyber-attacks has become a significant concern as once isolated systems are being added to the internet for ease of control and linkage to other CI systems, producing potentially cascading dangers from interconnectivity (Deibert, 2012). Everyday CI is used in the United States and around the world to manage parts of our life from providing water from water treatment facilities
Load more

Recommended publications
  • View Final Report (PDF)
    TABLE OF CONTENTS TABLE OF CONTENTS I EXECUTIVE SUMMARY III INTRODUCTION 1 GENESIS OF THE PROJECT 1 RESEARCH QUESTIONS 1 INDUSTRY SITUATION 2 METHODOLOGY 3 GENERAL COMMENTS ON INTERVIEWS 5 APT1 (CHINA) 6 SUMMARY 7 THE GROUP 7 TIMELINE 7 TYPOLOGY OF ATTACKS 9 DISCLOSURE EVENTS 9 APT10 (CHINA) 13 INTRODUCTION 14 THE GROUP 14 TIMELINE 15 TYPOLOGY OF ATTACKS 16 DISCLOSURE EVENTS 18 COBALT (CRIMINAL GROUP) 22 INTRODUCTION 23 THE GROUP 23 TIMELINE 25 TYPOLOGY OF ATTACKS 27 DISCLOSURE EVENTS 30 APT33 (IRAN) 33 INTRODUCTION 34 THE GROUP 34 TIMELINE 35 TYPOLOGY OF ATTACKS 37 DISCLOSURE EVENTS 38 APT34 (IRAN) 41 INTRODUCTION 42 THE GROUP 42 SIPA Capstone 2020 i The Impact of Information Disclosures on APT Operations TIMELINE 43 TYPOLOGY OF ATTACKS 44 DISCLOSURE EVENTS 48 APT38 (NORTH KOREA) 52 INTRODUCTION 53 THE GROUP 53 TIMELINE 55 TYPOLOGY OF ATTACKS 59 DISCLOSURE EVENTS 61 APT28 (RUSSIA) 65 INTRODUCTION 66 THE GROUP 66 TIMELINE 66 TYPOLOGY OF ATTACKS 69 DISCLOSURE EVENTS 71 APT29 (RUSSIA) 74 INTRODUCTION 75 THE GROUP 75 TIMELINE 76 TYPOLOGY OF ATTACKS 79 DISCLOSURE EVENTS 81 COMPARISON AND ANALYSIS 84 DIFFERENCES BETWEEN ACTOR RESPONSE 84 CONTRIBUTING FACTORS TO SIMILARITIES AND DIFFERENCES 86 MEASURING THE SUCCESS OF DISCLOSURES 90 IMPLICATIONS OF OUR RESEARCH 92 FOR PERSISTENT ENGAGEMENT AND FORWARD DEFENSE 92 FOR PRIVATE CYBERSECURITY VENDORS 96 FOR THE FINANCIAL SECTOR 96 ROOM FOR FURTHER RESEARCH 97 ACKNOWLEDGEMENTS 98 ABOUT THE TEAM 99 SIPA Capstone 2020 ii The Impact of Information Disclosures on APT Operations EXECUTIVE SUMMARY This project was completed to fulfill the including the scope of the disclosure and capstone requirement for Columbia Uni- the disclosing actor.
    [Show full text]
  • List of Targets of Arrested Computer Hackers 6 March 2012
    List of targets of arrested computer hackers 6 March 2012 The five computer hackers charged in New York Tribune and Los Angeles Times, using on Tuesday and a sixth who pleaded guilty are misappropriated login credentials. accused of involvement in some of the most notorious hacking incidents of the past 18 months. -- February 2011: A cyberattack on private computer security firm HBGary that involved the The following are some of the cyberattacks in theft of 60,000 emails from HBGary employees and which the two Britons, two Irishmen and two the HBGary chief executive, as well as defacing his Americans allegedly played a role as members of Twitter account. Anonymous, Lulz Security or associated groups: -- April-May 2011: A cyberattack on a Fox -- December 2010: Operation Payback. Distributed Broadcasting Company website that involved the denial of service (DDoS) attacks by members of theft of names, dates of birth, telephone numbers, Anonymous on the websites of MasterCard, email and residential addresses for more than PayPal and Visa in retaliation for their refusal to 70,000 potential contestants on the Fox television accept donations for WikiLeaks. In a DDoS attack, show the "X-Factor." a website is bombarded with traffic, slowing it down or knocking it offline completely. -- May 2011: A cyberattack on Sony Pictures Entertainment that revealed the passwords, email -- January 2011: Defacing a website of the Irish addresses, home addresses and dates of birth of political party Fine Gael after accessing computer 100,000 users of the www.sonypictures.com servers in Arizona used to maintain the website, website and a subsequent online attack against www.finegael2011.com.
    [Show full text]
  • Easier Said Than Done: Legal Reviews of Cyber Weapons
    Easier Said Than Done: Legal Reviews of Cyber Weapons Gary D. Brown* & Andrew O. Metcalf** INTRODUCTION On June 1, 2012, author and New York Times reporter David Sanger created a sensation within the cyber-law community. Just over a year previously, Vanity Fair, among other media outlets, reported that a malware package of unprec- edented complexity had effectively targeted the Iranian nuclear research pro- gram.1 The malware, which came to be known as Stuxnet, was also discovered on many computer systems outside Iran, but it did not appear to do any damage to these other systems. Just as the discussions spurred by the discovery of Stuxnet had begun to die down, the New York Times published an interview with Mr. Sanger to discuss his newest book, in which he alleged that the Stuxnet malware had been part of a U.S. planned and led covert cyber operation. The assertion that a nation state had used a “cyber attack” in support of its national objectives reinvigorated the attention of cyber-law commentators, both in and out of government. What makes Stuxnet interesting as a point of discussion is that the basic functioning of the software is easy to understand and easy to categorize. A piece of software was deliberately inserted into the target systems, and physical damage was the result. However, resulting physical damage is not characteristic of most cyber operations, and the legal analysis of Stuxnet is of limited utility when examining a broad range of cyber activities.2 A distinct lack of physical effects is much more characteristic of cyber operations, and the absence of physical effects has continued to complicate the legal analysis of cyber in the context of military operations.
    [Show full text]
  • A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
    In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi.
    [Show full text]
  • Analysis of Human Factors in Cyber Security: a Case Study of Anonymous Attack on Hbgary
    Analysis of Human Factors in Cyber Security: A Case Study of Anonymous Attack on Hbgary Benjamin Aruwa Gyunka Directorate of Information and Communication Technology National Open University of Nigeria (NOUN) Abuja, Nigeria [email protected] Abikoye Oluwakemi Christiana Department of Computer Science University of Ilorin Ilorin, Nigeria [email protected] ABSTRACT awareness programmes for workforces and the Purpose: This paper critically analyses the implementations and maintenance of basic human factors or behaviours as major threats to security culture and policies as a panacea for cyber security. Focus is placed on the usual roles social engineering cyber attacks against played by both the attackers and defenders (the individuals and organizations. targets of the attacker) in cyber threats’ Originality: Lots of work has been done and pervasiveness and the potential impacts of such many still on-going in the field of social actions on critical security infrastructures. engineering attacks and human factors, but this Design/Methodology/Approach: To enable an study is the first to adopt an approach of a effective and practical analysis, the Anonymous practical case study to critically analyze the attack against HBGary Federal (A security firm effects of human factors on cyber security. in the United State of America) was taken as a Keywords: The Anonymous; HBGary Federal; case study to reveal the huge damaging impacts Uniform Resource Location (URL); Content of human errors and attitudes against the security Management System (CMS); SQL Injection; of organizations and individuals. Cross-site Scripting (XXS); Social Engineering; Findings: The findings revealed that the Cyber Security; Information Security powerful security firm was compromised and Paper Type: Research Paper overtaken through simple SQL injection techniques and a very crafty social engineering attack which succeeded because of sheer 1 Introduction personnel negligence and unwitting utterances.
    [Show full text]
  • Darpa Starts Sleuthing out Disloyal Troops
    UNCLASSIFIED (U) FBI Tampa Division CI Strategic Partnership Newsletter JANUARY 2012 (U) Administrative Note: This product reflects the views of the FBI- Tampa Division and has not been vetted by FBI Headquarters. (U) Handling notice: Although UNCLASSIFIED, this information is property of the FBI and may be distributed only to members of organizations receiving this bulletin, or to cleared defense contractors. Precautions should be taken to ensure this information is stored and/or destroyed in a manner that precludes unauthorized access. 10 JAN 2012 (U) The FBI Tampa Division Counterintelligence Strategic Partnership Newsletter provides a summary of previously reported US government press releases, publications, and news articles from wire services and news organizations relating to counterintelligence, cyber and terrorism threats. The information in this bulletin represents the views and opinions of the cited sources for each article, and the analyst comment is intended only to highlight items of interest to organizations in Florida. This bulletin is provided solely to inform our Domain partners of news items of interest, and does not represent FBI information. In the JANUARY 2012 Issue: Article Title Page NATIONAL SECURITY THREAT NEWS FROM GOVERNMENT AGENCIES: American Jihadist Terrorism: Combating a Complex Threat p. 2 Authorities Uncover Increasing Number of United States-Based Terror Plots p. 3 Chinese Counterfeit COTS Create Chaos For The DoD p. 4 DHS Releases Cyber Strategy Framework p. 6 COUNTERINTELLIGENCE/ECONOMIC ESPIONAGE THREAT ITEMS FROM THE PRESS: United States Homes In on China Spying p. 6 Opinion: China‟s Spies Are Catching Up p. 8 Canadian Politician‟s Chinese Crush Likely „Sexpionage,‟ Former Spies Say p.
    [Show full text]
  • Hacks, Leaks and Disruptions | Russian Cyber Strategies
    CHAILLOT PAPER Nº 148 — October 2018 Hacks, leaks and disruptions Russian cyber strategies EDITED BY Nicu Popescu and Stanislav Secrieru WITH CONTRIBUTIONS FROM Siim Alatalu, Irina Borogan, Elena Chernenko, Sven Herpig, Oscar Jonsson, Xymena Kurowska, Jarno Limnell, Patryk Pawlak, Piret Pernik, Thomas Reinhold, Anatoly Reshetnikov, Andrei Soldatov and Jean-Baptiste Jeangène Vilmer Chaillot Papers HACKS, LEAKS AND DISRUPTIONS RUSSIAN CYBER STRATEGIES Edited by Nicu Popescu and Stanislav Secrieru CHAILLOT PAPERS October 2018 148 Disclaimer The views expressed in this Chaillot Paper are solely those of the authors and do not necessarily reflect the views of the Institute or of the European Union. European Union Institute for Security Studies Paris Director: Gustav Lindstrom © EU Institute for Security Studies, 2018. Reproduction is authorised, provided prior permission is sought from the Institute and the source is acknowledged, save where otherwise stated. Contents Executive summary 5 Introduction: Russia’s cyber prowess – where, how and what for? 9 Nicu Popescu and Stanislav Secrieru Russia’s cyber posture Russia’s approach to cyber: the best defence is a good offence 15 1 Andrei Soldatov and Irina Borogan Russia’s trolling complex at home and abroad 25 2 Xymena Kurowska and Anatoly Reshetnikov Spotting the bear: credible attribution and Russian 3 operations in cyberspace 33 Sven Herpig and Thomas Reinhold Russia’s cyber diplomacy 43 4 Elena Chernenko Case studies of Russian cyberattacks The early days of cyberattacks: 5 the cases of Estonia,
    [Show full text]
  • Siber Güvenlik Ve Savunma STANDARTLAR Ve UYGULAMALAR
    Siber Güvenlik ve Savunma STANDARTLAR ve UYGULAMALAR Editör Prof. Dr. Şeref SAĞIROĞLU Yazarlar Prof. Dr. Şeref SAĞIROĞLU - Onur AKTAŞ A. Oğuzhan ALKAN - Bilgehan ARSLAN Dr. Öğr. Üyesi Atila BOSTAN - Dr. Öğr. Üyesi Eyüp Burak CEYHAN Dr. Öğr. Üyesi İsmail Fatih CEYHAN Dr. Öğr. Üyesi Onur ÇAKIRGÖZ Dr. Öğr. Üyesi Mehmet DEMİRCİ - Sedef DEMİRCİ Doç. Dr. Gülüstan DOĞAN Dr. Öğr. Üyesi Muharrem Tuncay GENÇOĞLU Doç. Dr. Ali Hakan IŞIK - Burak ÖZÇAKMAK Dr. Öğr. Üyesi A. Nurdan SARAN - Doç. Dr. Gökhan ŞENGÜL Seda YILMAZ - Özgür YÜREKTEN Ankara 2019 Siber Güvenlik ve Savunma: Standartlar ve Uygulamalar Editör Prof. Dr. Şeref SAĞIROĞLU Yazarlar Prof. Dr. Şeref SAĞIROĞLU Doç. Dr. Gökhan ŞENGÜL Doç. Dr. Ali Hakan IŞIK Doç. Dr. Gülüstan DOĞAN Dr. Öğr. Üyesi Atila BOSTAN Dr. Öğr. Üyesi Eyüp Burak CEYHAN Dr. Öğr. Üyesi İsmail Fatih CEYHAN Dr. Öğr. Üyesi Onur ÇAKIRGÖZ Dr. Öğr. Üyesi Mehmet DEMİRCİ Dr. Öğr. Üyesi Muharrem Tuncay GENÇOĞLU Dr. Öğr. Üyesi A. Nurdan SARAN Onur AKTAŞ A. Oğuzhan ALKAN Bilgehan ARSLAN Sedef DEMİRCİ Burak ÖZÇAKMAK Seda YILMAZ Özgür YÜREKTEN ISBN: 978-605-2233-42-9 1. Baskı Aralık, 2019 / Ankara 1500 Adet Yayınları Yayın No: 334 Web: grafikeryayin.com Kapak, Sayfa Tasarımı, Baskı ve Cilt Grafik-Ofset Matbaacılık Reklamcılık San. ve Tic. Ltd. Şti. 1. Cadde 1396. Sokak No: 6 06520 (Oğuzlar Mahallesi) Balgat-ANKARA Tel : 0 312. 284 16 39 Pbx - Faks : 0 312. 284 37 27 E-posta : [email protected] Web : grafiker.com.tr Bu kitap HAVELSAN'ın katkılarıyla basılmıştır. İÇİNDEKİLER EDİTÖRDEN ........................................................................................................................................................... 11 BİLGİ GÜVENLİĞİ DERNEĞİ'NDEN ............................................................................. 15 ÖN SÖZ ........................................................................................................................................................................... 19 1. BÖLÜM SİBER GÜVENLİK MATEMATİĞİ 1.1.
    [Show full text]
  • Ethical Hacking
    Ethical Hacking Alana Maurushat University of Ottawa Press ETHICAL HACKING ETHICAL HACKING Alana Maurushat University of Ottawa Press 2019 The University of Ottawa Press (UOP) is proud to be the oldest of the francophone university presses in Canada and the only bilingual university publisher in North America. Since 1936, UOP has been “enriching intellectual and cultural discourse” by producing peer-reviewed and award-winning books in the humanities and social sciences, in French or in English. Library and Archives Canada Cataloguing in Publication Title: Ethical hacking / Alana Maurushat. Names: Maurushat, Alana, author. Description: Includes bibliographical references. Identifiers: Canadiana (print) 20190087447 | Canadiana (ebook) 2019008748X | ISBN 9780776627915 (softcover) | ISBN 9780776627922 (PDF) | ISBN 9780776627939 (EPUB) | ISBN 9780776627946 (Kindle) Subjects: LCSH: Hacking—Moral and ethical aspects—Case studies. | LCGFT: Case studies. Classification: LCC HV6773 .M38 2019 | DDC 364.16/8—dc23 Legal Deposit: First Quarter 2019 Library and Archives Canada © Alana Maurushat, 2019, under Creative Commons License Attribution— NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) https://creativecommons.org/licenses/by-nc-sa/4.0/ Printed and bound in Canada by Gauvin Press Copy editing Robbie McCaw Proofreading Robert Ferguson Typesetting CS Cover design Édiscript enr. and Elizabeth Schwaiger Cover image Fragmented Memory by Phillip David Stearns, n.d., Personal Data, Software, Jacquard Woven Cotton. Image © Phillip David Stearns, reproduced with kind permission from the artist. The University of Ottawa Press gratefully acknowledges the support extended to its publishing list by Canadian Heritage through the Canada Book Fund, by the Canada Council for the Arts, by the Ontario Arts Council, by the Federation for the Humanities and Social Sciences through the Awards to Scholarly Publications Program, and by the University of Ottawa.
    [Show full text]
  • The Management and Insurance of Cyber
    CONTENTS LIST OF FIGURES .................................................................................................................................... 5 LIST OF TABLES ...................................................................................................................................... 5 ANNEXURES ........................................................................................................................................... 5 DEFINTIONS ........................................................................................................................................... 6 ABSTRACT ............................................................................................................................................ 16 1. Introduction ............................................................................................................................. 17 2. Emerging cyber exposures ....................................................................................................... 19 2.1 Cyber-crime ..................................................................................................................... 20 2.1.1 Business Disruption and Misuse .................................................................................. 20 2.1.2 Online scams ................................................................................................................ 23 2.1.3 Theft and Fraud ..........................................................................................................
    [Show full text]
  • Belling the BEAR
    2016/12/21 Russia Hacks Bellingcat MH17 Investigation | ThreatConnect SEPTEMBER 28, 2016 Belling the BEAR IN BLOG, FEATURED ARTICLE, RESEARCH BY THREATCONNECT RESEARCH TEAM ThreatConnect reviews activity targeting Bellingcat, a key contributor in the MH17 investigation. Read the full series of ThreatConnect posts following the DNC Breach: “Rebooting Watergate: Tapping into the Democratic National Committee [https://www.threatconnect.com/tapping-into-democratic-national-committee/] ”, “Shiny Object? Guccifer 2.0 and the DNC Breach [https://www.threatconnect.com/guccifer-2-0-dnc-breach/] “, “What’s in a Name Server? [https://www.threatconnect.com/whats-in-a-name-server/] “, “Guccifer 2.0: the Man, the Myth, the Legend? [https://www.threatconnect.com/reassesing-guccifer-2-0-recent-claims/] “, “Guccifer 2.0: All Roads Lead to Russia [https://www.threatconnect.com/guccifer-2-all-roads-lead-russia/] “, “FANCY BEAR Has an (IT) Itch that They Can’t Scratch [https://www.threatconnect.com/fancy-bear-it-itch-they-cant-scratch/] “, “Does a BEAR Leak in the Woods? [https://www.threatconnect.com/blog/does-a-bear-leak-in-the-woods/] “, and “Russian Cyber Operations on Steroids [https://www.threatconnect.com/blog/fancy-bear-anti-doping-agency-phishing/] “. [UPDATE] October 7th 2016 [/russia-hacks-bellingcat-mh17-investigation#update] Introduction Since posting about the DNC hack [https://threatconnect.com/blog/tapping-into-democratic-national-committee/] , each time we published a blog post on a BEAR-based topic we thought it was going to be our last. But like the Death Star’s gravitational pull, the story keeps drawing us back in as new information comes to light.
    [Show full text]
  • D6.2 Altcoins – Alternatives to Bitcoin and Their Increasing Presence In
    Ref. Ares(2018)1599225 - 22/03/2018 RAMSES Internet Forensic platform for tracking the money flow of financially-motivated malware H2020 - 700326 D6.2 Altcoins: Alternatives to Bitcoin and their increasing presence in Malware-related Cybercrime Lead Authors: Darren Hurley-Smith (UNIKENT), Julio Hernandez-Castro (UNIKENT) With contributions from: Edward Cartwright (UNIKENT), Anna Stepanova (UNIKENT) Reviewers: Luis Javier Garcia Villalba (UCM) Deliverable nature: Report (R) Dissemination level: Public (PU) (Confidentiality) Contractual delivery date: 31/08/2017 Actual delivery date: 31/08/2017 Version: 1.0 Total number of pages: 36 Keywords: Cryptocurrency, altcoin, malware, darknet market, privacy Abstract Bitcoin is a relatively well-known cryptocurrency, a digital token representing value. It uses a blockchain, a distributed ledger formed of blocks which represent a network of computers agreeing that transactions have occurred, to provide a ledger of sorts. This technology is not unique to Bitcoin, many so-called ‘altcoins’ now exist. These alternative coins provide their own services, be it as a store of value with improved transactions (lower fees, higher speed), or additional privacy. Malware and Dark Net Market (DNM) operators have used Bitcoin to facilitate pseudo-anonymous extraction of value from their victims and customers. However, several high-profile arrests have been made using Bitcoin transaction graphing methods, proving that the emphasis is on the pseudo part of pseudo-anonymity. Altcoins specialising in masking the users’ identity – Monero, ZCash, and Dash – are therefore of interest as the next potential coins of choice for criminals. Ethereum, being the second largest crypto-currencies and imminently implementing its own privacy features, is also of interest.
    [Show full text]