6 ms·

Bricking every intel cpu,Using a likely 0 day in JunOS and ASR routers to make them all inoperable for a few days,similar wipe outs of cloud provider infrastruc

Bricking every intel cpu,Using a likely 0 day in JunOS and ASR routers to make them all inoperable for a few days,similar wipe outs of cloud provider infrastructure come to mind. But if I was the well resourced attacker I would use multiple teams and target a diverse variety of important services and infrastructure and coordinate an phased long term(weeks) attack. I would not cripple the internet as a whole,especially social media. In battle,hiding your location and intent is crucial to victory. Social media would play a critical role in sowing confusion amidst the chaos. Isolate part of the country and spread a message that some internal political group (antifa or alt-right for example) launched a physical WMD attack,use access to fortune 500 company networks to send emails and other communication indicating internal collapse of the companies,one corp is going bankrupt,another has been lying about profits is under SEC investigation. Chaos after chaos. The goal of a "cyber 9/11" would not be to cripple the internet but (imho)rather to exploit it to acheive three independent goals: 1) Long term (multi?)National and Economical instability and possibly collapse. 2) Make the internet as it stands today a mortal threat to society. 3) As a precursor to a physical invasion. The kinetic attack would be only of the many rumors and reports being circulated. Any and all damage to your enemy's communications brings you one step closer to victory with minimal effort. More on goal #2: The goal of 9/11 was not to kill some americans. The goal was to destabilize the west by attacking important symbols of economic and political prosperity. It worked,economy was only momentarily destabilized but 17 years later america and the west are grappling to keep their democracies and basic freedoms. The goal of terrorism is to terrorize not to merely kill(which is why mass shooters are not labeled terrorists,their intent is murder not change through terror). A Cyber 9/11 would have similar goals where the intent is to change and cause long term weakening of the adversary. What makes the internet strong is not BGP,DNS and secure operating systems. It's the fact that people trust it for reliable and resilient communication and governments view it as a strength to their political and economical stability as opposed to a dangerous liability. The goal of terrorism is to change your beliefs so that fear resulting from the attack changes your policy and principles.

tyingq 8y ago
I accidentally stumbled on an interesting approach to sow discontent. There was a forum that was hotlinking a "words to images" script I had on one of my websites. They would post these images as their "text" instead of plain text. It was hammering my server, so I changed up the script to return random inflammatory and/or inappropriate images if the referer was this forum site. I was using the source IP as the rand() seed, so everyone on the forum had a different view of the images, but consistent in that it remained constant for any single user. The resulting chaos and infighting was pretty funny until they figured it out.
- TeMPOraL 8y ago
  > everyone on the forum had a different view of the images, but consistent Reminds me of the endless fun with [you] tag on phpBB forums. That particular tag's function was to be replaced during rendering of a forum post with the username of the user viewing it. AFAIR it was retained in tag form in quotes, too. You'd post something like, "I think [you] is dumb in believing $something", and watch the hilarity ensue.
- 0xcde4c3db 8y ago
  Some years ago, indie game developer Arthur "Mr. Podunkian" Lee released a short game via a thread on an indie game forum, to similar effect [1]. [1] https://forums.tigsource.com/index.php?topic=9284.0 https://forums.tigsource.com/index.php?topic=9284.0
  - w-ll 8y ago
    I'm confused to how this is to a similar effect? Are the images of the game, not the same as the actual game?
    - tyingq 8y ago
      You have to page through the discussion a bit. There's 11 pages. The game play is different depending on the machine it's being played on. Some folks get stuck on an unwinnable screen right away, some later, some play to the end, etc. Also, the screen/level names vary.
- CM30 8y ago
  This is what I consider/fear the next 'step' for 'fake news' and weaponised propaganda. Giving different audiences different content, and using those differences to turn them against each other. Picture this: You've got a story which is seemingly very controversial, and will rile up one side of the political spectrum. However, this story is only shown for say, 10-20% of your readers/viewers, and the rest get an innoculous story, or one that says the complete opposite. Now the ones affected by it will post it on social media sites and forums, saying that this is proof of how 'evil' the other side is. But the others there can't see the same story, and will think said users are trolling them. After seeing them keep posting comments about how some minority group is evil with links to innocent stories about kittens and puppies, said users get banned. This causes said users to think they're being targeted by the other side, and then every story they see on the site is designed to build off that. Make the forum/social media/news site owners out to be illuminati pawns or what not and their banning policies a way to stifle dissent. Voila, the site has now basically weaponised A/B testing, and created a localised echo chamber to gaslight its readers into more and more extreme mindsets. That's basically the nightmare scenario. Imagine an enemy state like Russia or China using it against the alt-right/antifa/whatever. Or activists using it to recruit followers. Worse still, imagine it with compromised browser extensions as well. Imagine if a foreign government managed to do this in a way that could let them edit the text on fact checking sites like Snopes or major media outlets like the BBC or CNN or what not. Now that could have some worrying consequences. Still, it wouldn't be impossible to fix/detect. Set up sites like Reddit/Hacker News to automatically archive pages linked to, and send users to the archive rather than the original unless they choose to click through. Avoid using any browser extensions at all, with hosts file blocking for things like ads rather than Adblock/uBlock/whatever. Ask others to double check what every page you see says to make sure it hasn't been compromised/doesn't show different things. Do that and you can at least minimise this style of dissent sowing.
walrus01 8y ago
> Bricking every intel cpu,Using a likely 0 day in JunOS and ASR routers to make them all inoperable for a few days,similar wipe outs of cloud provider infrastructure come to mind. The packet flow ASICs and fabric on an example router like an MX960 or an ASR9006 are quite separated from the control plane routing engine. Just passing packets with the "zero day" through the router wouldn't do it, somebody would have to compromise the engineering/admin interface to the routing engine(s). If you have the equivalent of root, configure or enable on a Cisco IOS-XR or modern JunOS system you could run a script to brick it anyways, by overwriting the boot OS image and then reloading the router. I personally would be much more worried about a "brick yourself" magic packet that is hidden, hardcoded into the ASICs of Huawei or ZTE routers sold into the networks of major carriers in NATO countries.
- badrabbit 8y ago
  I worked with those devices. Things like icmp responses and ttl expired packet make it to the control plane cpu iirc. I was thinking more of a worm that would gain access to everything via internet exchanges ,propagatig through bgp sessions and such. Also, didn't know those backdoors in zte/huawei were a thing. But they do tend to have hardcoded creds "for support".
  - walrus01 8y ago
    If you have a router that exposes its admin/control plane/routing engine interface to IX and BGP peer facing addresses, that's another fundamental network architecture problem to address before worrying about anything else. Management VRFs, ACLs, etc. There should be absolutely no way to get the routing engine/control OS to listen on any interface facing anything public...
    - badrabbit 8y ago
      Yeah,one provider does that to the net,exposing their network which includes their IX router which connects to your IX router which connects to the IX lan. Heck,a well resourced attacker can peer with you on the IX lan just so he can attack you.
deleted 8y ago
[deleted]

tyingq 8y ago

I accidentally stumbled on an interesting approach to sow discontent. There was a forum that was hotlinking a "words to images" script I had on one of my websites. They would post these images as their "text" instead of plain text. It was hammering my server, so I changed up the script to return random inflammatory and/or inappropriate images if the referer was this forum site. I was using the source IP as the rand() seed, so everyone on the forum had a different view of the images, but consistent in that it remained constant for any single user. The resulting chaos and infighting was pretty funny until they figured it out.

TeMPOraL 8y ago
> everyone on the forum had a different view of the images, but consistent Reminds me of the endless fun with [you] tag on phpBB forums. That particular tag's function was to be replaced during rendering of a forum post with the username of the user viewing it. AFAIR it was retained in tag form in quotes, too. You'd post something like, "I think [you] is dumb in believing $something", and watch the hilarity ensue.
0xcde4c3db 8y ago
Some years ago, indie game developer Arthur "Mr. Podunkian" Lee released a short game via a thread on an indie game forum, to similar effect [1]. [1] https://forums.tigsource.com/index.php?topic=9284.0 https://forums.tigsource.com/index.php?topic=9284.0
- w-ll 8y ago
  I'm confused to how this is to a similar effect? Are the images of the game, not the same as the actual game?
  - tyingq 8y ago
    You have to page through the discussion a bit. There's 11 pages. The game play is different depending on the machine it's being played on. Some folks get stuck on an unwinnable screen right away, some later, some play to the end, etc. Also, the screen/level names vary.
CM30 8y ago
This is what I consider/fear the next 'step' for 'fake news' and weaponised propaganda. Giving different audiences different content, and using those differences to turn them against each other. Picture this: You've got a story which is seemingly very controversial, and will rile up one side of the political spectrum. However, this story is only shown for say, 10-20% of your readers/viewers, and the rest get an innoculous story, or one that says the complete opposite. Now the ones affected by it will post it on social media sites and forums, saying that this is proof of how 'evil' the other side is. But the others there can't see the same story, and will think said users are trolling them. After seeing them keep posting comments about how some minority group is evil with links to innocent stories about kittens and puppies, said users get banned. This causes said users to think they're being targeted by the other side, and then every story they see on the site is designed to build off that. Make the forum/social media/news site owners out to be illuminati pawns or what not and their banning policies a way to stifle dissent. Voila, the site has now basically weaponised A/B testing, and created a localised echo chamber to gaslight its readers into more and more extreme mindsets. That's basically the nightmare scenario. Imagine an enemy state like Russia or China using it against the alt-right/antifa/whatever. Or activists using it to recruit followers. Worse still, imagine it with compromised browser extensions as well. Imagine if a foreign government managed to do this in a way that could let them edit the text on fact checking sites like Snopes or major media outlets like the BBC or CNN or what not. Now that could have some worrying consequences. Still, it wouldn't be impossible to fix/detect. Set up sites like Reddit/Hacker News to automatically archive pages linked to, and send users to the archive rather than the original unless they choose to click through. Avoid using any browser extensions at all, with hosts file blocking for things like ads rather than Adblock/uBlock/whatever. Ask others to double check what every page you see says to make sure it hasn't been compromised/doesn't show different things. Do that and you can at least minimise this style of dissent sowing.

walrus01 8y ago

> Bricking every intel cpu,Using a likely 0 day in JunOS and ASR routers to make them all inoperable for a few days,similar wipe outs of cloud provider infrastructure come to mind. The packet flow ASICs and fabric on an example router like an MX960 or an ASR9006 are quite separated from the control plane routing engine. Just passing packets with the "zero day" through the router wouldn't do it, somebody would have to compromise the engineering/admin interface to the routing engine(s). If you have the equivalent of root, configure or enable on a Cisco IOS-XR or modern JunOS system you could run a script to brick it anyways, by overwriting the boot OS image and then reloading the router. I personally would be much more worried about a "brick yourself" magic packet that is hidden, hardcoded into the ASICs of Huawei or ZTE routers sold into the networks of major carriers in NATO countries.

badrabbit 8y ago
I worked with those devices. Things like icmp responses and ttl expired packet make it to the control plane cpu iirc. I was thinking more of a worm that would gain access to everything via internet exchanges ,propagatig through bgp sessions and such. Also, didn't know those backdoors in zte/huawei were a thing. But they do tend to have hardcoded creds "for support".
- walrus01 8y ago
  If you have a router that exposes its admin/control plane/routing engine interface to IX and BGP peer facing addresses, that's another fundamental network architecture problem to address before worrying about anything else. Management VRFs, ACLs, etc. There should be absolutely no way to get the routing engine/control OS to listen on any interface facing anything public...
  - badrabbit 8y ago
    Yeah,one provider does that to the net,exposing their network which includes their IX router which connects to your IX router which connects to the IX lan. Heck,a well resourced attacker can peer with you on the IX lan just so he can attack you.

deleted 8y ago

[deleted]