Friday, November 29, 2019

PKI Server Infrastructure on IOS and IOS-XE

=================
PKI Server Infrastructure on IOS and IOS-XE
=================

------------------------
::Confirmed working OK::

Version 15.2(4)M1
Version 15.5(2)T
Also works ok on C180x and C1861
15.1(4)M12a
------------------------

-- tested first on the version below >> not supporting CA server command

::Not Working::
 
Cisco IOS XE Software, Version 03.12.03.S - Standard Support Release
Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S3, RELEASE SOFTWARE (fc2)
------------------------

-- on CSR1000v the minimum version where PKI Server is supported
minimum IOS XE version supported:

3.16 (Denali)
------------------------

Thursday, November 28, 2019

Communication

Local forces armed with new technologies, including mobile devices that tap into cellphone data in real time, dozens of local and state police agencies are capturing information about thousands of cellphone users at a time, whether they are targets of an investigation or not, according to public records obtained by USA TODAY and Gannett newspapers and TV stations.

The records, from more than 125 police agencies in 33 states, reveal:

About one in four law-enforcement agencies have used a tactic known as a "tower dump," which gives police data about the identity, activity and location of any phone that connects to the targeted cellphone towers over a set span of time, usually an hour or two. A typical dump covers multiple towers, and wireless providers, and can net information from thousands of phones. 

-----------------------------------------------------------------------------------------------------

The release pointed out that in 2012 alone AT&T and T-Mobile documented over 600,000 requests for customer information made by local, state and federal law enforcement.

The nation’s major cellphone carriers made the numbers available in response to an inquiry from Sen. Edward Markey (D-Mass.).

Verizon, in its response to Sen. Markey’s request, said that police requests for customers’ call records have approximately doubled over the last five years. The ACLU notes that often no warrant is required to compel cellphone carriers to turn over their customers’ information to police.

Christopher Calabrese, legislative counsel at the ACLU’s Washington Legislative Office said in a statement that there is no doubt that law enforcement sees mobile devices as the go-to source for information, likely in part because of the lack of privacy protections afforded by the law.

"Our mobile devices quite literally store our most intimate thoughts as well as the details of our personal lives," Calabrese wrote. "The idea that police can obtain such a rich treasure trove of data about any one of us without appropriate judicial oversight should send shivers down our spines."

The ACLU also notes that the carrier responses to Sen. Markey’s office also show that law enforcement conducts real-time surveillance of targets' web browsing habits.

According to AT&T’s letter, the company allows law enforcement to do real time web browsing surveillance. Police are also requesting "tower dumps," whereby cellphone companies give law enforcement the records of all cellphone users who have connected to a particular cellphone tower in a given time range.

The news comes as even more details surface about the NSA's extensive digital surveillance programs. Just last week, the Washington Post published a report that showed the NSA records and stores global cell phone location data.

In a letter to U.S. President Barack Obama, major tech companies in the United States are asking for a reform of government data collection practices.
"The balance in many countries has tipped too far in favor of the state and away from the rights of the individual — rights that are enshrined in our Constitution," the letter said. "This undermines the freedoms we all cherish. It's time for a change."  


Software Defined Networking | SD-WAN with Fortinet

Why SD-WAN?

Traditionally, network sensitive applications were typically handled through the use of Multi-Protocol Label Switching (MPLS) networks. These are dedicated links provided by a telecommunications company that had well defined Service Level Agreements (SLAs) by the provider to ensure the business that the network would meet a certain threshold when it comes to network characteristics such as latency and jitter. These types of circuits are known to be very expensive but were used by businesses because there were really no better ways to guarantee network performance.
To get an understanding of why there is a huge shift to adopt SD-WAN, let’s identify some of the issues that plague this legacy paradigm:

Multi-Protocol Switching Label (MPLS) WAN links are expensive
Doing a quick search in Google, I discovered a PDF that lists costs for Verizon MPLS ports. According to this document, a 30 Mbps bandwidth port will cost the business $656.24 per month! Compare this with commodity business class Internet (Verizon Fios) that supports 150 Mbps bandwidth for $79.99 per month! Looking at the difference in price, can theoretically get 8 Fios circuits for the price of one MPLS circuit.

Intelligent Failover Requirements
The increased usage of latency/jitter sensitive applications (such as video conferencing and VoIP) that are less tolerant to sub-optimal network conditions, require a solution that is able to monitor the network beyond the standard link up/down and probe (ping) response. Also, networks need sub-second network convergence when a link does fail or show conditions that are not conducive to support the requirements for a network application.

MPLS WAN links are slower to provision than commodity circuits
A quick search in Google shows that on average, MPLS provisioning can take upwards to 60 days, and that is in the US. In other countries, it could take upwards to 120 days depending on the infrastructure and capabilities of the provider in those environments. However, many commodity circuits can be provisioned within a week and in some cases, the same day the circuit is ordered (i.e. dealing with wireless providers). This greatly shortens the amount of time needed to make an office operational with connectivity back to headquarters or the cloud.

Better control (security/path selection) over different traffic types
Traditional path control relies on using normal network based path control based on the network address where the destination network resides. In more intelligent platforms, the layer four (port) information of the protocol could be leveraged as well.
     However, in cloud connected environments where multiple applications may be hosted in the same network address space on the same port (think web applications), this does not allow granular control with routing. SD-WAN solutions address this by using deep packet inspection to identify the application of the packet and use that criteria to define policy to route the traffic.
In addition to that, SD-WAN solutions have capabilities to help control Quality of Service (QoS) by giving order and precedence to certain traffic in case of link congestion.

SD-WAN Requirements

In order to take advantage of SD-WAN capabilities, there are a certain level of requirements that must be met by the environment SD-WAN will be deployed in.

SD-WAN Requires Multiple Circuits for Connectivity
SD-WAN overcomes the lack of SLA by commodity circuits by spreading the risk over multiple circuits at the same time. The thought process is that a virtual circuit bundle comprised of multiple circuits will meet a defined SLA within in a certain time period, given that one or more circuits will meet the SLA requirements of the network applications utilizing that virtual circuit bundle.

SD-WAN Requires an Overlay Network
One of the consequences with leveraging many disparate internet circuits is that there is no control over the paths those circuits take to get to a common network. To accommodate for this, most SD-WAN solutions require an overlay network to route packets over to ensure a common topology for routing between networks. Creating this overlay network gives the SD-WAN administrator more control to provide a predictable path (built on top of the underlay network) for routing packets between two locations. This overlay network is commonly built with some type of tunneling/encapsulating protocol such as IPSec.

Secure SD-WAN with Fortinet

SD-WAN solutions typically provide a standard feature set comprised of:
  • Network measurement (through active or passive probing)
  • Intelligent path control to route traffic based on network characteristics like latency, jitter and packet loss
  • Forward Error Correction (FEC) for adding reliability to data transmission
  • Application awareness via Deep Packet Inspection (DPI) of network streams
  • Low (Zero) Touch Deployment and orchestration of SD-WAN solutions.
The FortiGate’s main differentiation when it comes to SD-WAN is that it is one of the few providers that has a “secure” SD-WAN solution. FortiGates is classified as a Next Generation Firewall (NGFW) with an embedded SD-WAN solution. This provides a distinctive advantage with this platform to allow you to implement enterprise class network security with intelligent path control built-in to the platform. Below are some highlights to capabilities specific to the FortiGate.

Source Based SD-WAN

The FortiGate does not need an overlay controller to provide the intelligent path control within its SD-WAN configuration. All decisions regarding the SD-WAN is made from the source of the traffic thus allowing the SD-WAN to be decentralized and not necessarily requiring a complete vendor lock-in to utilize the SD-WAN feature.

This is specifically useful when performing load balancing of WAN connections from disparate ISPs. These load balancing methods can support a variety of methods to distribute load across multiple WAN circuits.

Figure. – Screenshot of load balance algorithms supported by FortiGate SD-WAN

Enterprise Security Features

The FortiGate’s pedigree of being a NGFW gives it a distinct capability of supporting common enterprise grade security features. These features consist of the following:
  • Anti-Virus
  • Intrusion Prevention
  • Content Filtering
  • Application Control
  • Cloud-Application Inspection
  • User Identity via Single-Sign On
  • DNS Inspection
  • Web Application Firewall


Dedicated Hardware for Overlay Network

The FortiGate has purpose built hardware that is used to accelerate throughput associated with IPSec VPN (commonly used for the overlay network). This allows for high throughput application with minimal delay (latency) with network applications that are sensitive to the sub-optimal conditions. Due to this, lower end FortiGates can be leveraged in remote locations providing a cost effective solution to enable highly capable solutions.

Figure. – Picture of SoC4 ASIC
This initial post serves are an overview of SD-WAN as well as a means to annotate the capabilities associated with the Fortinet SD-WAN solution. Subsequent posts will detail the configurations associated with this solution as well as provide demonstrations of the solution in action.

Thursday, September 5, 2019

Special Activities Center (SAC)

SAC/SOG has several missions. One of these missions is the recruiting, training, and leading of indigenous forces in combat operations.[24] SAC/SOG and its successors have been used when it was considered desirable to have plausible deniability about U.S. support (this is called a covert operation or "covert action").[15] Unlike other special missions units, SAC/SOG operatives combine special operations and clandestine intelligence capabilities in one individual.[11] These individuals can operate in any environment (sea, air or ground) with limited to no support.[9]

The CIA's formal position for these individuals is "Paramilitary Operations Officers" and "Specialized Skills Officers." Paramilitary Operations Officers most likely attend the Clandestine Service Trainee (CST) program, which trains them as clandestine intelligence operatives and an internal paramilitary training course. The primary strengths of SAC/SOG Paramilitary Officers are operational agility, adaptability, and deniability.  


They often operate in small teams, typically made up of two to eight operatives (with some operations being carried out by a single officer), all usually with extensive military tactical experience and a set of specialized skills that does not exist in any other unit.[11] As fully trained intelligence case officers, Paramilitary Operations Officers possess all the clandestine skills to collect human intelligence – and most importantly – to recruit assets from among the indigenous troops receiving their training. These officers often operate in remote locations behind enemy lines to carry out direct action (including raids and sabotage), counter-intelligence, guerrilla/unconventional warfare, counter-terrorism, and hostage rescue missions, in addition to being able to conduct espionage via HUMINT assets. 

Paramilitary Operations Officers are trained to operate in a multitude of environments. Because these officers are taken from the most highly trained units in the U.S. military and then provided with extensive additional training to become CIA clandestine intelligence officers, many U.S. security experts assess them as the most elite of the U.S. special missions units.[32]

Required to become a clandestine intelligence officer, Paramilitary Operations Officers are trained to a high level of proficiency in the use and tactical employment of an unusually wide degree of modern weaponry, explosive devices and firearms (foreign and domestic), hand to hand combat, high performance/tactical driving (on and off road), apprehension avoidance (including picking handcuffs and escaping from confinement), improvised explosive devices, cyber warfare, covert channels, HAHO/HALO parachuting, combat and commercial SCUBA and closed circuit diving, proficiency in foreign languages, surreptitious entry operations (picking or otherwise bypassing locks), vehicle hot-wiring, Survival, Evasion, Resistance and Escape (SERE), extreme survival and wilderness training, combat EMS medical training, tactical communications, and tracking.  

An agent provocateur is a person who commits or who acts to entice another person to commit an illegal or rash act or falsely implicate them in partaking in an illegal act, so as to ruin the reputation or entice legal action against the target or a group they belong to.   

The expression "discrediting tactics" in politics refers to personal attacks against a public figure intended to discourage people from believing in the figure or supporting their cause  


Character assassination

Character assassination (CA)
is a deliberate and sustained effort to damage the reputation or credibility of an individual[1]

     The term could also be selectively applied to social groups and institutions. Agents of character assassinations employ a mix of open and covert methods to achieve their goals, such as raising false accusations, planting and fostering rumors, and manipulating information.
     Character assassination happens through character attacks. These can take many forms, such as spoken insults, speeches, pamphlets, campaign ads, cartoons, and internet memes. As a result of character attacks, individuals may be rejected by their professional community or members of their social or cultural environment. The process of CA may resemble an annihilation of human life as the damage sustained can last a lifetime. For some historical figures, that damage endures for centuries.
     CA may involve exaggeration, misleading half-truths, or manipulation of facts to present an untrue picture of the targeted person. It is a form of defamation and can be a form of ad hominem argument.
     The phrase "character assassination" became popular from around 1930.[2]
     This concept, as a subject of scholarly study, was originally introduced by Davis (1950)[3] in his collection of essays revealing the dangers of political smear campaigns. Six decades later Icks and Shiraev (2014)[4] rejuvenated the term and revived academic interest by addressing and comparing a variety of historical character assassination events.

     Character attacks are by definition intentional:
they are launched to damage an individual's reputation in the eyes of others.
     If a person's reputation is damaged accidentally, for instance through a thoughtless remark, that does not constitute a character attack. Since character attacks are concerned with reputation, they are also by definition of a public nature. Insulting someone in private does not lead to character assassination.
      Each character attack invariably involves five aspects or pillars: the attacker, the target, the medium or media, the audience and the context. This last category can refer to the political system in which the attacks occur, the cultural environment, the level of technology, or any other factors that shape and determine character attacks.
     Many character attacks take place in the political sphere, for instance in election campaigns.      However, prominent figures from other spheres can also become the targets of character attacks, such as religious leaders, scientists, athletes and movie stars.
     Moreover, character assassination appears to be a near-universal, cross-cultural phenomenon that can be found in many, if not most, countries and historical periods.

believe that the attacker's motivation is often based on the intent to destroy the target psychologically or reduce his/her public support and/or chances to succeed in a political competition. For example, during elections, attacks are often used to sway undecided voters, create uncertainty with tentative voters, or prevent defections of supporters.

Fundamentally, an attack on one's image, reputation, or brand is dependent on relevant audiences’ perceptions. For instance, studies in the field of motivated reasoning show that consumers are highly selective of what they deem is “believable” information, preferring to accept what is most congruent with existing attitudes, expectations, or actions, such as a candidate's voting record. The “hybrid” processing model suggests that voters structure their candidate impressions or respond to candidate CA using two types of information: updated or ad-hoc. Anxiety, or an emotional state of uncertainty and tension, can influence consumer's attitudinal shifts. 

CA should also be addressed in relation to image studies. When organizations and leaders find themselves in crises, they are particularly vulnerable to attack via scrutiny and criticism that challenge their legitimacy or social responsibility. Their reputation is then judged in the court of public opinion, which focuses on a mix of publicly positioned principles, including ethics, social and political values, or cultural or religious beliefs. Acceptance or rejection of a candidate requires the candidate to be compatible with existing image components.

The theory suggests that the level of reputation threat is determined by whether the public believes the organization caused the crisis, the organization's crisis history, and the organization's prior relational reputation with the public (such as voters, stakeholders, etc.) 

Instantaneous or drive-by character attacks often occur. Such quick character attacks are usually opportunistic. On the other hand, the slow pace of character-poisoning is based on long-term hopes. Since the 1960s, the famous Russian author and dissident Alexander Solzhenitsyn was accused of being a Jew, a traitor, a Nazi collaborator, a prison snitch, and a paid foreign intelligence agent.[6]

 character assassination
is an intentional attempt, usually by a narcissist and/or his or her codependents, to influence the portrayal or reputation of someone in such a way as to cause others to develop an extremely negative or unappealing perception of him or her.
It typically involves deliberate exaggeration or manipulation of facts, the spreading of rumours and deliberate misinformation to present an untrue picture of the targeted person, and unwarranted and excessive criticism.[7]
   
     Fearmongering or scaremongering is the spreading of frightening and exaggerated rumors of an impending danger or the habit or tactic of purposely and needlessly arousing public fear about an issue.

      Snakes in Suits: When Psychopaths Go to Work describe a five phase model of how a typical workplace psychopath climbs to and maintains power. In phase four (confrontation), the psychopath will use techniques of character assassination to maintain their agenda.

     Smears often consist of ad hominem attacks in the form of unverifiable rumors and distortions, half-truths, or even outright lies; smear campaigns are often propagated by gossip magazines and websites. Even when the facts behind smears and campaigns have been demonstrated to lack proper foundation, the tactic is often effective because the target's reputation remains tarnished regardless of the truth. Smears are also effective in diverting attention away from the matter in question. The target of the smear has to address the additional issue of correcting the false information, rather than being able to focus on their response to the original issue. 

     CA is also a form of negative campaigning. Opposition research is the practice of collecting information on someone that can be used to discredit them. A smear campaign is the use of falsehoods or distortions. Scandalmongering can be used to associate a person with a negative event in a false or exaggerated way.
     Smears often consist of ad hominem attacks in the form of unverifiable rumors and distortions, half-truths, or even outright lies; smear campaigns are often propagated by gossip magazines and websites. Even when the facts behind smears and campaigns have been demonstrated to lack proper foundation, the tactic is often effective because the target's reputation remains tarnished regardless of the truth. Smears are also effective in diverting attention away from the matter in question. The target of the smear has to address the additional issue of correcting the false information, rather than being able to focus on their response to the original issue.
      Common negative campaign techniques include painting an opponent as soft on criminals, dishonest, corrupt, or a danger to the nation. One tactic is attacking the other side for running a negative campaign. Negative campaigning, also known more colloquially as "mudslinging", is trying to win an advantage by referring to negative aspects of an opponent or of a policy rather than emphasizing one's own positive attributes or preferred policies.

Wednesday, August 28, 2019

Information Operations and Counterterrorism

There is an increasing awareness that TTOs and other asymmetric enemies seek to exploit Western vulnerabilities to cyberbased information operations.

The Mindsets of High-Technology Terrorists: Future Implications from a Historical Analog

An examination of the thoughts and actions of nineteenth century dynamite terrorists, as an historical analog that may provide insights into the psychological and political attributes of possible future nuclear terrorists.

 The main task of PSYOPS has been political and military deceptions in order to influence important individuals and populations, and to disrupt normal processes and functions, as well as to destabilize perceptions and belief systems among the civilian population and the military forces

Principles of the modern Russian INFOOPS/PSYOPS

 Facilitate the degradation of the adversaries’ defense capability, undermining the readiness and capabilities of the adversaries’ forces, weakening the trust of military and civilian leadership, destabilize the armed forces personnel and its moral, and enhance malfunctions in the rear echelons of the armed forces. 

2) Organize controlled chaos and crises by discrediting the political leadership, undermining state authorities and functions, and finally initiate disorder, panic and armed struggle among population. 

3) Concealment of own purpose of conflict and war to weaken critical elements of own population and create a perception of threat and danger directed to Russia.

----------------------------

Smuggling network creating look-alikes

 15 and 16 July 2019, 
the Hellenic Police, supported by Europol, dismantled an organised criminal group (OCG) smuggling migrants from Turkey to Greece 

Using commercial flights in regional airports for the transportation of migrants from Greece to Western Europe. The network was providing the migrants with genuine documents which resembled the holder (look-alike method), and/or forged documents.

OCG was even using a specific hair salon in Athens to enhance the resemblance of the migrants to the legal owner of the travel documents.

Among the seizures made are identities cards from various EU countries, equipment for document forgery, cash and various electronic devices.

 

PSYOPS - False Narratives And Deception

Psychological operations are spreading information to a population or a target group to influence their emotions, their motivation, their way of thinking and, finally; how they act. 

Psychological operations are spreading information to a population or a target group to influence their emotions, their motivation, their way of thinking and, finally; how they act.  

In psychological operations disinformation and deceit is routine. 
Psychological warfare is ancient as warfare itself.  
-------------------------------