Frederick Giasson’s Weblog

Many say that information is power. Then, why do you give power to your foes? Is that your wishes? There is the idea being this article: cut the information pipeline of to your enemy to prevent you greater harm.

Do not help your attackers gathering information about your network. The first step of an attack is the reconnaissance of the playground. It’s done by social engineering, physical site reconnaissance, internet search, network mapping and DNS reconnaissance. After they map their target by war dialling, network mapping (ICMP), port-scanning and vulnerability scanning.

If you cut their sources of information they’ll not easily be able to go through these first essential steps. The principle is the same as in personal self-defence, if you look self-confident, attentive and aware, most of your possible stalker will watch for another target; they don’t need to get in trouble with you; they need an easy pray; a pray that they can hunt easily. The same principle is present here; if the first steps of an attacker are hard to get troughs, most of the attackers will try to find another, more easily penetrable system. Sure that there are exception, if your attacker is searching challenge and not profit (money or peer acceptance), you’ll probably fit his prey pattern and get stock with him.

You need to always have in mind you goal. Your goal is to limit the information that attackers can gather from your organisation, his personal and your network. By remembering this goal, you’ll probably be able to find what your information leaks are and how to prevent them. There are some examples:

• Your attacker can bring much information by looking at your garbage containers.
o You can hire a specialised garbage collector that will destroy your garbage’s. (Just ensure that the company is trustable).

• Your attackers can bring information on your employees for further social engineering tricks.
o You can try to limit the information about your employees you put on the internet. (Example, by not putting your employees’ contact book.
o You can teach your employees to be aware of this situation; how attackers do this type of attack on them.

• Your attacker can map your network by ICMP querying.
o You can block the ICMP echoing of certain critical part of your network.

• Your attacker can do banner grabbing to try to know which program deliver a specific service (example sendmail for SMTP).
o You can choose a product where you can alter or delete the banner when a session is open (a banner is a signature sent by a software generally when a connection is attended).

• Your attacker can try to guess your firewall rules with a TCP ACK scan.
o You can also choose a firewall that store the stage of his connection to refuse the ACK response packet.

• Your attacker can use packet fragmentation options to do his scan to stealth the scan attempt toward the firewall and IDS (old ones)
o You can use a firewall or IDS that refragment packets before analysis.

These examples are obvious. However, the goal isn’t to do an exhaustive checklist of what to do, but to give you some example that will help you find information leaks about your company.

What’s important here is to always have the principle in mind. How to implement this principle in the everyday life of your enterprise is another question but you have some leads here.

Enjoy the principle, the lecture and feel free to add your stone to the foundation.

Google is an information gathering engine; everybody knows the fact (it’s the definition of a search engine, but Google is a bit more). In the past, US Army had sensitive document leaks on Google. Theoretically terrorists were able to use it and get access to those same documents. Do they do it? No demonstrations of this have been done for the moment. We can think that they did, but I never had any confirmation of this.

But yesterday terrorists used Google to find information on a hostage. They used it to confirm his identity. By confirming his real identity, they saved his live. It seems that we can use Google to destroy things (by gathering information about bomb making or critical infrastructure information) but also to save lives. Is that true? Possibly. It demonstrates the new power of internet as an ease information gathering system that can be used for anything, by anybody, all around the world.

There are some thoughts I had when I read this article:

“Trying to monitor the sea of traffic on all the chat channels would be like assigning a police officer to listen in on every conversation on the sidewalk — virtually impossible.”

Sure that it’s virtually impossible but the question is: Is this legal? It’s another question with many more sense.

“The $157,673 grant comes from the National Science Foundation’s Approaches to Combat Terrorism program. It was selected in coordination with the nation’s intelligence agencies.”

Is the program will only be used for terrorists? Let me doubt about this.

“Security officials know al-Qaida and other terrorist groups use the internet for everything from propaganda to offering tips on kidnapping. But it’s not clear if terrorists rely much on chat rooms for planning and coordination.”

Will they put a “carnivore” program on every chat server of every programs availed on the internet and private ones programmed by Joe in his basement? Or will they put a bot on every channel they know of? If so, how will they intercept private conversations? If so, what will stop terrorists to create their own protocols and programs (possibly encrypted) to communicate between them? It’s a non-sense

“Because they are focusing on public chat rooms, authorities are not violating constitutional rights to privacy when they keep an eye on the traffic, experts said. Law enforcement agents have trolled chat rooms for years in search of pedophiles, sometimes adopting profiles making it look like they are young teens.”

In this case it’s probably a better idea to do cyber-infiltration of some terrorist groups than filtering traffic.

Seriously, do they really think that terrorists are as silly as they wish? Two things, or they take their dreams for reality (what I doubt) or they put another thing on the shoulders of terrorists to get budgets. It’s sure that terrorists are a world wide problem, but what I see now is that they use them to try to resolve other problems by the side. What thinker of law enforcement agencies are thinking about? Probably not what you think…

Seriously, they can’t think of things like this to arm terrorist organizations, it’s impossible. Go Infiltrate them; return back in the playground; stop losing your time in the cyberspace to try to stop terrorists…