course evaluation room for attestations: 03.05.051 iLab Threat - PowerPoint PPT Presentation

course evaluation room for attestations: 03.05.051

iLab Threat modelling, surveillance, operational security Benjamin Hof hof@in.tum.de Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München Closing event – 15ss

You may not be interested in surveillance, but surveillance is interested in you CC-BY-SA 3.0 Andreas Preuß

IEEE Spectrum 2007: The Athens Affair.

IEEE Spectrum 2007: The Athens Affair.

View on security 1. communication 2. software stacks 3. physical security

Outline Classification of actors Threat actors Attack systems Examples Systematic defence

submarinecablemap.com

Eve lifewinning.com/submarine-cable-taps

Mallory

Burglar

Jack Bauer

Outline Classification of actors Threat actors Attack systems Examples Systematic defence

High end ◮ Five eyes ◮ Israel ◮ China ◮ Russia ◮ France

Commercial variants

arms dealers

Mercenaries law suits, high profile business deals

attacker resources ./ money ./ target value

Scale

Outline Classification of actors Threat actors Attack systems Examples Systematic defence

RAMPART-A Typical Operation USA Country X Processing Center E D B C Partner Analysts NSA Network SECRET//COMINT NETWORK Access Point A International Cable TOP SECRET//COMINT//NOFORN

◮ full traffic storage ◮ search engines ◮ financial transactions ◮ mobile systems

~ - ~; - e n - t i f - i ~ - ~ m -._ ~ L ~ -~ L ~W~ " O!" · gma f .c o:n :~._-.~ - ~ : ~h~me skypeM~ sk.ypeM~l:.*.en ~ gmo l . com P.v~s or sep~rate.:1 ~d ) TOP SECRET//$1 //REL U SA , AUS, CAN, GBR, NZL ' • (TS//51//REL) Change the query to search for the last 3 Months and click SUBMIT .. St lector Prollle sear ch Seied:or P l' oflle S<iec tor Ploflle [· - - - -:o>gnal.ccm<goo;je>) Mttlcatlon: v 20111110 [3 OD:OO :OO End D.t o: v 'bd>y Selectors Yeste«Jay c .. ,.,.,. <oi) Add @ Remove 1h l< - 7 1h i :>Mon th L google Parcrreters L Mt Nonlh [J Parilmetefs l 0ay El ._.-~- P ar<meters 2 t»ys googlo [J ParM'let«s 3 ~ 5.,.,. skyp e MaJ'blcM E P¥.snet us . Oays 1 t:l skype r.,.lbken 140ays google Pararwet. : ers J M>tth o 3r...w Ad d: I Ercer ~ rrore- seleclot! by (OO!mst and ht enter Qui et 6Monlhs A ut hority Filtus l v~-~ I > - . .. .. . . t· · •n• ·• •• .- .. - . - ll SPIEGEL ONLINE

Outline Classification of actors Threat actors Attack systems Examples Systematic defence

“I hunt sys admins” ◮ router ◮ look for successful logins ◮ admin ◮ personal webmail/facebook ◮ quantum

GCHQ attack on Belgian ISP Belgacom

German satcom provider Stellar

Attacks on standards ◮ Dual_EC_DRBG ◮ IETF

BSI report on German steel mill

Outline Classification of actors Threat actors Attack systems Examples Systematic defence

Operational security ◮ get a strategy ◮ unlinkability, compartmentalization ◮ paranoia doesn’t work retroactively

Endpoint security requires control.

Debian reproducible builds

QubesOS

Applications ◮ OTR ◮ Textsecure, Redphone, Signal ◮ Tor

Hide metadata

Development ◮ LANGSEC ◮ OWASP ◮ ENISA

Operations ◮ diceware ◮ don’t store plaintext ◮ logging ◮ defence in depth

Attack surface Endpoints ◮ browsers, drivers, . . . ◮ AMT/IPMI tracking devices with audio functionality ◮ SS7 ◮ data trail ◮ baseband processor ◮ additional batteries

Believe nothing. Research everything.