Cyber War – Game Over

22 Friday Jan 2010

Tags

“Are you kidding me! WTF Sarge! I mean, do you have any idea what you’re asking me to do? You might as well just ask me to kill my first born!” I/O was inconsolable, fairly incoherent and in a state of complete disbelief as he absorbed his Console Sergeant’s command to wipe the drives of all honeypots and pwned bots under the command of the Cyber Force. This was over 50,000 computers world wide. But it wasn’t the difficulty in carrying out the task. Computers are automated if nothing else. Apparently I/O had developed an emotional attachment to his bots.

“We’re withdrawing from this theater of conflict soldier. Report back when it’s complete.” The Console Sergeant turned and walked out of the war room.

Nearly everyone in the room was empathetic to I/O, except Tyler. “Let it go I/O. We have bigger concerns. Game over man. We all need an exit strategy.”

“What are you talking about?” I/O was coming to terms and seemed ready to talk logic. “Exit strategy for what?”

Tyler addressed the entire room, SecIntel along with the Ethical Hack team. “You heard the Console Sergeant. We’re shutting down operations. And we never existed. Most of us are within a year of returning to the private sector. What do we do for resumes? We can’t talk about it.” Tyler paused but everyone stared at him with blank faces. Clearly they must have understood his point but no one had a response yet. “So, we need an exit strategy. We need to latch on to opportunities where the employer has at least some implicit knowledge of our experience.”

Jane was the first to suggest a plan. “My older brother went to work for the NSA after he left the Rangers. And after two years there he had his pick of employers. NSA will know what we’re about.”

Tyler liked that idea. “Sounds pretty smart. We all need to think about this. This war might be over but it’s not like cyber warfare itself is going away. And we’re not going away – in terms of our skills. We need new homes. And those new homes are going to need a new army of bots, so you might want to be selective in how you carry out your command I/O.”

The End

Cyber War – We Have Met the Enemy, and it is Us

19 Tuesday Jan 2010

Posted by Ed Mahoney in cyber war

≈ Leave a comment

Tags

china, cyber war, hacking

Tyler planned to spend the day in bed – Jane’s bed – playing her video games. And he began the day like that but as his attention drifted to Jane’s concern about a possible inside attack, he logged into the Cyber Force’s VPN to research some ideas. He couldn’t authenticate initially and then he remembered the computing policy in effect that mapped everyone’s home ISP IP address to their user credentials. He ran into this issue when he was working from I/O’s house and recalled the network admin assigned him a temporary account without the restriction. He tried that user account and it still worked. Unbelievable!

Once on the network, Tyler did a telnet to a machine with some of his personal utilities. This way he could run the utilities from within the Cyber Force data center network rather than over the wide area. He booted up a wifi sniffer that searched the local area network for wireless access points. He scrolled down the list it generated until he found one that clearly did not conform to the data center’s SSID naming convention as it had the default name of Linksys. This suggested to him that perhaps the admin login was also default, and it was. No user ID and the password was admin. Brilliant.

Tyler then reviewed the DHCP log which contained the MAC addresses that had been assigned IP addresses. MAC addresses are 12 digit hexadecimal numbers in the format of MM:MM:MM:SS:SS:SS where the first 6 digits refer to the hardware manufacturer of the network adapter. Tyler knew the Air Force was in bed with Cisco and most of the MAC addresses looked to be them – but he double checked against a list of vendors and they were all Cisco. The Cyber Force were all on Apple computers and he didn’t see any of those vendor types, but then he spotted two MAC addresses that looked different. He checked and sure enough these were from a Chinese manufacturer. He cross checked against yet another list he had of known Chinese hackers and they matched that list in terms of the hardware vendor portion as well.

So now Tyler understood how the hackers got onto their network and were able to bypass network intrusion detection. They were very likely sitting in the parking lot jacked into the Air Force unsecured WiFi. Brilliant. Talk about shooting yourself in the foot! Tyler called his Console Sergeant and advised him to search the parking lot.