Counterplanning DeceptionsTo Foil Cyber-Attack Plans

Paper by: Neil C. RowePresentation by: Michael E. Aiello

Agenda

• Introduction- Deceptive Tactics• Counterplanning• MECOUNTER• Building a ploy strategy• Questions

Introduction: Deceptive Tactics• Second line of defense behind standard

information security tactics. Proactive countermeasures.

1. Concealment2. Camouflage3. Ruses (use of enemy equipment + procedures)4. Demonstrations (of capabilities)5. Disinformation/Lies6. Displays - “techniques to make the enemy see

what isn’t there”7. Insight (“deceiving the opponent by outthinking)

Cyber Deceptive Tactics

1. Lies - powerful because users are accustomed to truth from computer systems

2. Displays - I.E. simulating virus infection while actually destroying the infection

3. Insight - combination of lies and displays integrated into an overall defensive strategy designed to cause the attacker the maximum amount of trouble

Obstructive Counterplanning• Definition: Planning to interfere with or frustrate

and existing plan• Tool needed to define computer intrusion

plans/goals.• MECOUNTER: A tool to define attack models

with mostly-declarative definitions of actions. Allows users to create model for

1. Anticipating what an enemy would do2. Defining disruption models3. Observe how the enemy responds to disruption

MECOUNTER example: “decompress action”

1. If the system does not want a file to be compressed, it should decompress it

2. Decompressing a file on a system requires that it is known to be there, it is compressed, it is known to be compressed, the actor is logged in to its system, and the actor is not currently running any other program there.

3. Normally when a file is decompressed, this deletes the fact of its compression and adds no new facts

4. 10% of the time decompression fails with the error message “Wrong Format”

5. Decompression requires a mean time of 5 seconds and has a Poisson distribution

Example Markov model for ten runs of a simplified model for rootkit and port-software installation on a computer system.

Counterplanning

• Develop “ploys” to keep the attacker connected to the machine for tracing/logging purposes.

• GOAL: Annoy attackers, keep them connected, but do not make them suspicious

• GOAL: Avoid annoying legitimate users.• A successful ploy meets both of these

goals

Probability equation for successful ploys

Building a ploy strategy

• Build a Markov model for an attack sequence

• Define probability variables for each state (the j’s)

• Use a greedy search to permutate all of the available ploys against each state.

• Define threshold for successful ploy and report results.

High impact ploy strategy for buffer overflow + root kit example

• Delete the connection at port 80• Delete the fact the buffer is overflowed• Add the fact there are problems in the file

system• Report the connection is terminated• Delete administrator status

Questions??