GRAY_HAT_927

Ethical Hacking and the Legal System Cryptography Types of Cyber Attacks

     Cryptography is an indispensable tool for protecting information in computer systems.

  Types of Cryptography

  There are three types of cryptography techniques :

  Secret key Cryptography
  Public key cryptography
  Hash Functions

   Secret Key Cryptography

   This type of cryptography technique uses just a single key. The sender applies a key to encrypt a message while the receiver applies the same key to decrypt the message. Since only single key is used so we say that this is a symmetric encryption.The biggest problem with this technique is the distribution of key as this algorithm makes use of single key for encryption or decryption.

   Public Key Cryptography

   This type of cryptography technique involves two key crypto system in which a secure communication can take place between receiver and sender over insecure communication channel. Since a pair of keys is applied here so this technique is also known as asymmetric encryption.

   In this method, each party has a private key and a public key. The private is secret and is not revealed while the public key is shared with all those whom you want to communicate with. If Alice wants to send a message to bob, then Alice will encrypt it with Bob's public key and Bob can decrypt the message with its private key.

   This is what we use when we setup public key authentication in openssh to login from one server to another server in the backend without having to enter the password.

Hash Functions

   This technique does not involve any key. Rather it uses a fixed length hash value that is computed on the basis of the plain text message. Hash functions are used to check the integrity of the message to ensure that the message has not be altered,compromised or affected by virus.

Man has created codes to keep secrets and has broken codes to learn those secrets since the time of the Pharaohs. For 4,000 years, fierce battles have been waged between codemakers and codebreakers and the story of these battles is civilization's secret history, the hidden account of how wars were won and lost, diplomatic intrigues foiled, business secrets stolen, governments ruined, computers hacked. Codebreaking has shaped the course or human events to an extent beyond any easy reckoning.

Once a goverment monopoly, cryptology today touches everybody. It secures the Internet, keeps e-mails private, maintains the integrity of cash machine transactions, and scrambles TV signals on unpaid-for channels.



 

 

 

 

   The Enigma machine it was an electro-mechanic rotor machine used for encryption and decryption of secret messages, was invented by the German engineer Arthur Scherbius at the end of world war I. Early models were used commercially and later on adopted by military and govermment.

    To me it was the first true encrypting device invented. Breaking Enigma's code demand a special kind of talent. Using pure brute force it will still take a year to crack Enigma's code even with the fastest computer we have today.

   Though Enigma had some cryptographic weaknesses, in practice it was German procedural flaws, operator mistakes, laziness, failure to systematically introduce changes in encipherment procedures, and Allied capture of key tables and hardware that, during the war, enabled Allied cryptologists to succeed.

    In use, the Enigma required a list of daily key settings and auxiliary documents. The procedures for German Naval Enigma were more elaborate and more secure than those in other services. Navy codebooks were printed in red, water-soluble ink on pink paper so that they could easily be destroyed if they were endangered. The codebook to the right was taken from captured German submarine U-505.

    An Enigma machine's initial state, the cryptographic key, has several aspects:

    Wheel order (Walzenlage) - the choice of rotors and the order in which they are fitted.
Initial position of the rotors - chosen by the operator, different for each message.
Ring settings (Ringstellung) - the position of the alphabet ring relative to the rotor wiring.
Plug connections (Steckerverbindungen) - the connections of the plugs in the plugboard.
In very late versions, the wiring of the reconfigurable reflector.

    Note that although the ringstellung was a required part of the setup, they did not affect encryption because the rotors were positioned independently of the rings. The ring settings were only necessary to determine the initial rotor position based on the message setting that was transmitted at the beginning of a message, as described in the "Indicators" section, below. Once the receiver's rotors were set to the indicated positions, the ring settings no longer played any role.

    In modern cryptographic language, the ring settings did not actually contribute entropy to the key used for encrypting the message. Rather, the ring settings were part of a separate key (along with the rest of the setup such as wheel order and plug settings) used to encrypt an initialization vector for the message. The session key consisted of the complete setup except for the ring settings, plus the initial rotor positions chosen arbitrarily by the sender (the message setting). The important part of this session key was the rotor positions, not the ring positions. However, by encoding the rotor position into the ring position using the ring settings, additional variability was added to the encryption of the initialization vector.

   Enigma was designed to be secure even if the rotor wiring was known to an opponent, although in practice considerable effort protected the wiring configuration. If the wiring is secret, the total number of possible configurations has been calculated to be around 10114 (approximately 380 bits); with known wiring and other operational constraints, this is reduced to around 1023 (76 bits).[10] Users of Enigma were confident of its security because of the large number of possibilities; it was not then feasible for an adversary to even begin to try a brute force attack.

   Most of the key was kept constant for a set time period, typically a day. However, a different initial rotor position was used for each message, a concept similar to an initialisation vector in modern cryptography. The reason is that encrypting many messages with identical or near-identical settings (termed in cryptanalysis as being in depth), would enable an attack using a statistical UHL, and then the ciphertext. The receiver set up the start position according to the first trigram, WZA, and decoded the second trigram, UHL, to obtain the SXT message setting. Next, he used this SXT message setting as the start position to decrypt the message. This way, each ground setting was different and the new procedure avoided the security flaw of double encoded message settingsprocedure such as Friedman's Index of coincidence.[The starting position for the rotors was transmitted just before the ciphertext, usually after having been enciphered. The exact method used was termed the indicator procedure. Design weakness and operator sloppiness in these indicator procedures were two of the main weakness that made cracking Enigma possible.

   With the inner lid down, the Enigma was ready for use. The finger wheels of the rotors protruded through the lid, allowing the operator to set the rotors, and their current position, here RDKP, was visible to the operator through a set of windows.

   One of the earliest indicator procedures was used by Polish cryptanalysts to make the initial breaks into the Enigma. The procedure was for the operator to set up his machine in accordance with his settings list, which included a global initial position for the rotors (Grundstellung, meaning ground setting), say, AOH. The operator turned his rotors until AOH was visible through the rotor windows. At that point, the operator chose his own arbitrary starting position for that particular message. An operator might select EIN, and these became the message settings for that encryption session. The operator then typed EIN into the machine, twice, to allow for detection of transmission errors. The results were an encrypted indicator-the EIN typed twice might turn into XHTLOA, which would be transmitted along with the message. Finally, the operator then spun the rotors to his message settings, EIN in this example, and typed the plaintext of the message.

    At the receiving end, the operation was reversed. The operator set the machine to the initial settings and typed in the first six letters of the message (XHTLOA). In this example, EINEIN emerged on the lamps. After moving his rotors to EIN, the receiving operator then typed in the rest of the ciphertext, deciphering the message.

   The weakness in this indicator scheme came from two factors. First, use of a global ground setting-this was later changed so the operator selected his initial position to encrypt the indicator, and sent the initial position in the clear. The second problem was the repetition of the indicator, which was a serious security flaw. The message setting was encoded twice, resulting in a relation between first and fourth, second and fifth, and third and sixth character. This security problem enabled the Polish Cipher Bureau to break into the pre-war Enigma system as early as 1932. However, from 1940 on, the Germans changed procedure.

   During World War II, codebooks were only used each day to set up the rotors, their ring settings and the plugboard. For each message, the operator selected a random start position, let's say WZA, and a random message key, perhaps SXT. He moved the rotors to the WZA start position and encoded the message key SXT. Assume the result was UHL. He then set up the message key, SXT, as the start position and encrypted the message. Next, he transmitted the start position, WZA, the encoded message key,UHL, and then the ciphertext. The receiver set up the start position according to the first trigram, WZA, and decoded the second trigram, UHL, to obtain the SXT message setting. Next, he used this SXT message setting as the start position to decrypt the message. This way, each ground setting was different and the new procedure avoided the security flaw of double encoded message settings

 

 

   This procedure was used by Wehrmacht and Luftwaffe only. The Kriegsmarine procedures on sending messages with the Enigma were far more complex and elaborate. Prior to encryption the message was encoded using the Kurzsignalheft code book. The Kurzsignalheft contained tables to convert sentences into four-letter groups. A great many choices were included, for example, logistic matters such as refueling and rendezvous with supply ships, positions and grid lists, harbor names, countries, weapons, weather conditions, enemy positions and ships, date and time tables. Another codebook contained the Kenngruppen and Spruchschlüssel: the key identification and message key.
Additional details

   The Army Enigma machine used only the 26 alphabet characters. Signs were replaced with rare character combinations. A space was omitted or replaced with an X. The X was generally used as point or full-stop.

   Some signs were different in other parts of the armed forces. The Wehrmacht replaced a comma with ZZ and the question sign with FRAGE or FRAQ.

   The Kriegsmarine replaced the comma with Y and the question sign with UD. The combination CH, as in "Acht" (eight) or "Richtung" (direction), was replaced with Q (AQT, RIQTUNG). Two, three and four zeros were replaced with CENTA, MILLE and MYRIA.

   The Wehrmacht and the Luftwaffe transmitted messages in groups of five characters.

   The Kriegsmarine, using the four rotor Enigma, had four-character groups. Frequently used names or words were varied as much as possible. Words like Minensuchboot (minesweeper) could be written as MINENSUCHBOOT, MINBOOT, MMMBOOT or MMM354. To make cryptanalysis harder, messages were limited to 250 characters. Longer messages were divided into several parts, each using a different message key.

 



   "Find out where your enemy is. Get at him as soon as you can. Strike him as hard as you can, and keep moving on"
     
Ulisses S. Grant.


    SINCE TECH NOLOGY CAN BE USED BY THE GOOD AND BAD GUYS, THERE IS ALWAYS A FINE LINE THAT SEPARATES THE TWO.

    It has been proven over and over again that it is important to understand one's enemies, including their tactics, skills, tools, and motivations. Corporations and nations have enemies that are very dedicated and talented. We must work together to understand the enemies processes and procedures to ensure that we can properly thwart their destructive and malicious behavior.

   YOU CANNOT PROPERLY PROTECT YOURSELF FROM THREATS YOU DO NOT UNDERSTAND. THE GOAL IS TO IDENTIFY AND PREVENT DESTRUCTION AND MAYHEM, NOT CAUSE IT.

   The more you know about what your enemy is up to, the better idea you have as to what protection mechanisms you need to put into place to defend yourself.

   An interesting aspect of the hacker community is that it is changing. Over the last few years, their motivation has changed from just the thrill of figuring out how to exploit vulnerabilities to figuring out how to make revenue from their action and getting paid for their skills. Hackers who were out to have fun without any real target in mind, have been replaced by people who are serious about gaining financial benefits from their activities. Attacks are not only getting more specific, but also increasing in sophistication.

   Malware is still one of the main culprits that cost companies the most amount of money. An interesting thing about malware is that many people seem to put it in a different category from hacking and intrusion. The fact is malware has evolved to become one of the most sophisticated and automated forms of hacking. The attacker only has to put some upfront effort into developing the sofware, and then with no more effort required from the attacker, the malware can do its damage over and over again. The commands and logic within the malware are the same components that attackers used to have to carry out manually.

   Even if an attack or compromise is not totally successful for the attacker, this in no way mean that the company remains unharmed. Many times attacks and intrusions cause more of a nuisance and can negatively affect production and the normal department operations, which always correlates to costing the company more money in direct or indirect ways.

   Today, potentially millions of computers are infected with bots that are controlled by specific hackers. If a hacker has infected 10,000 systems, this is her botnet, and she can use it to carry out DDoS attacks or even lease these systems to others who do not want their activities linked to their true identities or systems. ( Botnets are commonly used to spread spam, phishing attacks) The hacker who owns and runs a botnet is referred to as a bot herder. Since more network administrators have configured their mail relays properly and blacklists have been employed to block mail relays that are open, spammers have had to change tactics.

   The Koobface, is one of the most efficient social enginnering-driven botnets to date. It spreads via social networking sites Myspace and Facebook with faked messages or comments from "friends". When a user clicks a provided link to view a video, the user is prompted to obtain a necessary software update, like a CODEC but the update is really malware that can take control of the computer.

    Some hackers also create and sell zero-day attacks. is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability. This means that the developers have had zero days to address and patch the vulnerability. Zero-day exploits (the software and/or strategies that use a security hole to carry out a successful (attack) are used or shared by attackers before the developer of the target software knows about the vulnerability. Whoever is running the particular software that contains that exploitable vulnerability is exposed with little or no protection. The code for these types of attacks are advertised on special websites and sold to others. hackers or organized crime rings.