The Dark Space Project Dave McMahon Rafal Rohozinski Bell Canada Scientific Authority Rodney Howes DRDC Centre for Security Science The scientific or technical validity of this Contract Report is entirely the responsibility of the Contractor and the contents do not necessarily have the approval or endorsement of Defence R&D Canada. Defence R&D Canada – Centre for Security Science Contractor Report DRDC CSS CR 2013-007 July 2013 The Dark Space Project Dave McMahon Rafal Rohozinski Bell Canada Scientific Authority Rodney Howes DRDC Centre for Security Science The scientific or technical validity of this Contract Report is entirely the responsibility of the Contractor and the contents do not necessarily have the approval or endorsement of Defence R&D Canada. Defence R&D Canada – Centre for Security Science Contractor Report DRDC CSS CR 2013-007 July 2013 Scientific Authority Rodney Howes Rodney Howes eSecurity Portfolio Manager Approved by Original signed by Andrew Vallerand DRDC Centre for Security Science Director S&T Public Security Approved for release by Dr. Mark Williamson DRDC Centre for Security Science DRP Chair © Her Majesty the Queen in Right of Canada, as represented by the Minister of National Defence, 2013 © Sa Majesté la Reine (en droit du Canada), telle que représentée par le ministre de la Défense nationale, 2013 THE Dark Space Project 1 | Page Privacy and Ethics Statement The methodology used in this research was based on guidance and precedence provided by the Privacy Commissioner of Canada and Auditor General of Canada for conducting cyber security research from primary data sources. No personal information has been used in this project. The research was conducted on aggregate data only no personally identifiable information (PII) was collected. In addition, all research activities related to this project complied with applicable laws and regulations in Canada and the following policies and procedures: the Bell Canada Code of Business Conduct, Bell Canada Corporate Policies and Ethics, the Bell Competition Law Compliance Handbook, the Bell Code of Fair Information Practices and the Privacy Statement and Ethical Principles Regarding Cyber Security Research at the Citizen Lab, Munk School of Global Affairs, University of Toronto. All such documents are publicly available. Bell Canada research, including this project, was subject to an independent audit under Sarbanes– Oxley Act, regulatory oversight by the Canadian Radio-television and Telecommunications Commission (CRTC), and review by privacy organizations and law enforcement agencies. This report is derived exclusively from commercial and open sources. No public sector information was used or consulted. In the interests of academic independence, no government information or intellectual property was used in the study, nor has the Canadian government influenced the scientific findings of this report in any way. 2 | Page TABLE OF CONTENTS Contents PREFACE ......................................................................................................................................... 9 HISTORICAL CONTEXT ............................................................................................................... 9 THE GENESIS OF THE DARK SPACE PROJECT ......................................................................... 10 COURSE CORRECTION NECESSITATED BY COMPELLING EVENTS ......................................... 11 CHALLENGES, OBSERVATIONS AND BREAKTHROUGHS ....................................................... 12 CENTRAL THEMATIC EMPHASIS .............................................................................................. 12 THE DARK SPACE PROJECT - START ........................................................................................ 14 THE PHOENIX ‘CLEAN PIPES’ IS REBORN ................................................................................ 16 ABSTRACT ..................................................................................................................................... 17 EXECUTIVE SUMMARY ................................................................................................................. 18 THE PLAN ...................................................................................................................................... 23 INTRODUCTION ......................................................................................................................... 23 RESEARCH BACKGROUND ....................................................................................................... 24 METHODOLOGY AND APPROACH .......................................................................................... 26 ACTIVITIES AND FINDINGS ....................................................................................................... 27 TECHNICAL DEVELOPMENT - REFERENCE ARCHITECTURE © .............................................. 29 INDUSTRY BEST PRACTICE ...................................................................................................... 29 ALL SOURCE FUSION ............................................................................................................... 30 APPLIED EXPERIMENTATION .................................................................................................. 31 METHODOLOGY AND SOURCES: ............................................................................................. 32 INVESTIGATIVE RESULTS......................................................................................................... 33 3 | Page INITIAL RECOMMENDATIONS ................................................................................................ 33 THE PROBLEM.............................................................................................................................. 35 E-SPIONAGE, CYBER TERRORISM AND 5TH DIMENSION WARFARE IN 2011 ........................ 36 AGENTS OF CHAOS ...................................................................................................................37 ROBOT NETWORKS IN THE LITERATURE AND RECENT RESEARCH .................................... 38 LAST YEAR 2010 ........................................................................................................................ 43 CONDUCTANCE OF RISK .......................................................................................................... 43 ATTACK VECTORS AND INADEQUATE SAFEGUARDS ........................................................... 43 CYBER- INTELLIGENCE LED DECISION MAKING ..................................................................... 44 CURRENT SITUATION REPORT................................................................................................ 45 GLOBAL THREAT INTELLIGENCE ............................................................................................. 48 TRADITIONAL WAR-FIGHTING VS NETCENTRIC WARFARE ................................................. 49 HISTORICAL CONTEXT TO E-SPIONAGE AND CYBERWAR .................................................... 53 THE PROBLEM SET ................................................................................................................... 55 E-TELLIGENCE ........................................................................................................................... 56 THE BAD ACTORS ..................................................................................................................... 60 OPERATIONS AND INVESTIGATIONS ..................................................................................... 62 ROBOT SPYNETS ...................................................................................................................... 69 VICTIMIZATION ........................................................................................................................ 70 HOW TO APPROACH THE THREAT .......................................................................................... 71 SHUNS AND STUNS .................................................................................................................. 76 THE PROACTIVE GAME ............................................................................................................. 77 DNS INFRASTRUCTURE THREATS ........................................................................................... 79 EVIDENCE AND EXPERIMENTATION .......................................................................................... 82 4 | Page INVESTIGATIVE METHODOLOGY AND SYSTEMS .................................................................. 83 BACKGROUND - ANTIVIRUS RESEARCH ................................................................................. 83 BACKGROUND - SECURITY RESEARCH ................................................................................... 84 BACKGROUND - ANTIVIRUS RESEARCH VERSUS SECURITY RESEARCH ............................. 85 WHAT IS THREAT INTELLIGENCE? .......................................................................................... 86 DATA FUSION METHODOLOGIES FOR CYBER SECURITY ..................................................... 88 TRADITIONAL CYBER SECURITY METHODS AND TOOLS ..................................................... 89 DATA FUSION METHODS ......................................................................................................... 91 DATA FUSION IN CYBER SECURITY ......................................................................................... 91 DATA