Counterplanning Deceptions To Foil Cyber-Attack Plans Paper by: Neil C. Rowe Presentation by: Michael E. Aiello

Agenda Introduction- Deceptive Tactics Counterplanning MECOUNTER Building a ploy strategy Questions

Introduction: Deceptive Tactics Second line of defense behind standard information security tactics. Proactive countermeasures. 1.Concealment 2.Camouflage 3.Ruses (use of enemy equipment + procedures) 4.Demonstrations (of capabilities) 5.Disinformation/Lies 6.Displays - “techniques to make the enemy see what isn’t there” 7.Insight (“deceiving the opponent by outthinking)

Cyber Deceptive Tactics 1.Lies - powerful because users are accustomed to truth from computer systems 2.Displays - I.E. simulating virus infection while actually destroying the infection 3.Insight - combination of lies and displays integrated into an overall defensive strategy designed to cause the attacker the maximum amount of trouble

Obstructive Counterplanning Definition: Planning to interfere with or frustrate and existing plan Tool needed to define computer intrusion plans/goals. MECOUNTER: A tool to define attack models with mostly-declarative definitions of actions. Allows users to create model for 1.Anticipating what an enemy would do 2.Defining disruption models 3.Observe how the enemy responds to disruption

MECOUNTER example: “decompress action” 1.If the system does not want a file to be compressed, it should decompress it 2.Decompressing a file on a system requires that it is known to be there, it is compressed, it is known to be compressed, the actor is logged in to its system, and the actor is not currently running any other program there. 3.Normally when a file is decompressed, this deletes the fact of its compression and adds no new facts 4.10% of the time decompression fails with the error message “Wrong Format” 5.Decompression requires a mean time of 5 seconds and has a Poisson distribution

Example Markov model for ten runs of a simplified model for rootkit and port-software installation on a computer system.

Counterplanning Develop “ploys” to keep the attacker connected to the machine for tracing/logging purposes. GOAL: Annoy attackers, keep them connected, but do not make them suspicious GOAL: Avoid annoying legitimate users. A successful ploy meets both of these goals

Probability equation for successful ploys

Building a ploy strategy Build a Markov model for an attack sequence Define probability variables for each state (the j’s) Use a greedy search to permutate all of the available ploys against each state. Define threshold for successful ploy and report results.

High impact ploy strategy for buffer overflow + root kit example Delete the connection at port 80 Delete the fact the buffer is overflowed Add the fact there are problems in the file system Report the connection is terminated Delete administrator status

Questions??