Offensive Security Research Articles

Cyberwarfare: intelligence, defense, and offensive security

Cyberwarfare: intelligence, defense, and offensive security

Ethical hacking and penetration testing strengthening cybersecurity posture through offensive security measures

Ethical hacking and penetration testing strengthening cybersecurity posture through offensive security measures

Vulnerability Exploitation Risk Assessment Based on Offensive Security Approach

Security incidents targeting control systems and the industrial internet of things (IIoT) are on the rise as attackers gain a better understanding of the nature of these systems and their increasing connectivity to information technology (IT). Every year, the number of vulnerabilities associated with these incidents increases, making it impractical to apply timely patches for all of them. The current vulnerability assessments, which are the basis for vulnerability patching, have limitations in that they do not adequately reflect the risk of exploitation in the real world after discovery and do not consider operational technology (OT) and industrial control system (ICS) environments other than IT environments. This study proposes to evaluate exploit risk in real-world environments by considering OT/ICS environments and calculating three metrics, including exploit chain risk, exploit code availability, and exploit use probability based on cyber threat information, including IIoT vulnerability data, used in OT/ICS environments. In addition, we construct exploitation scenarios in a control system environment to prioritize vulnerabilities with a high risk of exploitation based on the three metrics. We show that by assessing the risk of attackers’ intentions and exploited technologies for attacks against IIoT devices in a control system environment, we can provide defenders with comprehensive attack risk information for proactive defense.

SOCIAL ENGINEERING IN MODERN MESSENGERS: APPLICATIONS FOR OFFENSIVE SECURITY

The work considers the problems of social engineering in modern messengers, and provides classification indicators for modern attacks. Attention is focused on the Telegram messenger, whose channel owners and visitors to these channels may suffer from the intervention of fraudsters who cannot always be identified in time. Fraudsters or malicious bots are exposed and removed as a result of certain user complaints, very often when the purpose of the malicious intervention has already been realized. This indicates the need to develop new proactive solutions. The purpose of this work is to enrich offensive security mechanisms for social messengers by using bots and artificial intelligence using specially created prompts. The novelty of the work. It is proposed to place a kind of honeypot analogues in the space of communication. The role of the decoy victim is given to a specially configured bot disguised as a user, capable of carrying out a conversation according to a given scenario. The bot’s algorithm has been developed. Methodology. Social engineering is seen as a proactive security tool aimed at identifying vulnerabilities that attackers can exploit, as well as a reverse defense by obtaining information from fraudsters that compromises them. Main results. The work successfully combined developed offensive security scenarios for real Ukrainian chats at the time of the research, with the capabilities of ChatGPT, which made it possible to implement a bot, with the ability to communicate according to the scenario specified by the security specialist. Testing of the bot and the corresponding application in the Telegram channel was carried out, with the consent of real users, which proved the workability of the solution. Conclusions. The modern level of artificial intelligence tools allows one to obtain valuable information about attackers in the information space, conduct automated security testing, and implement other offensive security scenarios. Channel administrators can use the solution as a channel subscribers filtering tool.

Who evaluates the evaluators? On automatic metrics for assessing AI-based offensive code generators

AI-based code generators are an emerging solution for automatically writing programs starting from descriptions in natural language, by using deep neural networks (Neural Machine Translation, NMT). In particular, code generators have been used for ethical hacking and offensive security testing by generating proof-of-concept attacks. Unfortunately, the evaluation of code generators still faces several issues. The current practice uses output similarity metrics, i.e., automatic metrics that compute the textual similarity of generated code with ground-truth references. However, it is not clear what metric to use, and which metric is most suitable for specific contexts. This work analyzes a large set of output similarity metrics on offensive code generators. We apply the metrics on two state-of-the-art NMT models using two datasets containing offensive assembly and Python code with their descriptions in the English language. We compare the estimates from the automatic metrics with human evaluation and provide practical insights into their strengths and limitations.

ENIGMA: An explainable digital twin security solution for cyber–physical systems

Digital Twins (DTs), being the virtual replicas of their physical counterparts, share valuable knowledge of the underlying physical processes and act as data acquisition and dissemination sources to Cyber–Physical System (CPS). Moreover, without obstructing the ongoing operations, DTs also provide an assessment platform for evaluating the operational behavior and security of the CPS. Therefore, they become a potential source of data breaches and a broad attack surface for attackers to launch covert attacks. To detect and mitigate security loopholes in DTs, one of the potential solutions is to leverage a gamification approach that can assess the security level of DTs while providing security analysts with a controlled and supportive virtual training environment. Artificial Intelligence/Machine Learning (AI/ML)-based approaches can complement the idea of security orchestration and automation in the gamification approach. However, AI/ML-based DTs security solutions are generally constrained by the lack of transparency of AI operations, which results in less confidence in the decisions made by the AI models. To address the explainable security challenges of DTs, this article proposes a gamification approach called sEcuriNg dIgital twins through GaMification Approach (ENIGMA). While leveraging DTs as an offensive security platform, ENIGMA provides gaming scenarios to assess DTs’ security and train security analysts. The game players within ENIGMA are humans (the attacker team) and AI agents (the defender team). Furthermore, ENIGMA is supported by an eXplainable AI (XAI)-based DT security assessment model that explains the decisions made based on the SHAP values by the AI model on attack vectors for the defender team, i.e., the AI agent. The SHAP values illustrate the contribution of different features towards predicting the outcome of attack vectors. This explanation can help security analysts to take security measures based on reasoned and trustworthy decisions. Finally, experimental validation has been carried out to demonstrate the viability of ENIGMA.

A quantum-based approach for offensive security against cyber attacks in electrical infrastructure

Deciding the correct offensive security strategy for safeguarding the electrical physical infrastructures of smart grids is a challenging task. The offensive security training against various cyber-attacks focuses on a multitude of electrical subsystems and measurement systems like the Load Frequency Control(LFC) system. Primarily, the principal challenge is to categorize and parameterize the various possible cyber-attacks on electrical infrastructures. This is done by specifying and selecting cyber-attacks considering various main and subsystem blocks of the power structural system within each area of major installations. In this research investigation, formal modeling of security strategy is proposed using Lambda calculus with both classical and quantum perspectives. Furthermore, using a Quantum Machine Learning (QML) technique, the procedure for correct vulnerability prediction, exploitation, and execution strategy is presented with an approximated likelihood of attack and its mode. The local and non-local interactions are introduced as quantum threats and entanglement threats similar to False Data Injection (FDI) methods to induce the attack and counter-attack events through quantum causality connections. Finally, the Quirk simulator is used to validate the proposed quantum design of offensive and defensive attack models considering scenarios of exogenous and scaling attacks on the LFC systems that support the feasibility of the present research work to address the issue of cyber-attacks on the power system networks.

Toward Effective Evaluation of Cyber Defense: Threat Based Adversary Emulation Approach

Attackers compromise organizations with increasingly sophisticated ways, such as Advanced Persistent Threat (APT) attackers. Usually, such attacks have the intention to exploit endpoints to gain access to critical data. For security controls and defense evaluation, organizations may employ offensive security activities. The most important one is penetration testing and red teaming, but such operations are usually resource exhaustive and extend over a longer period of time. Furthermore, traditional Venerability Assessment and Penetration Testing (VAPT) works effectively in the mitigation of known attacks but did not prove to be effective against stealthy attacks. VAPT considers the whole offsec as an acting problem but in reality, an attacker has to deal with uncertainty while conducting real-world attacks. In this paper, we are presenting an adversary emulation approach based on MITRE ATT&CK adversary emulation plan with consideration of planning as a major part of each attack phase. The approach utilizes stealthy attack vectors and paths to emulate adversary for defense evaluation. For effective defense evaluation, we picked more than 40 techniques from ATT&CK, deployed their mitigation on target machines, and then launched attacks against all those techniques. We show that attack paths and payloads generated using our approach are strong enough to evade security controls at endpoints. This approach provides a special environment for cyber defenders to think like adversary, and create new attack vectors and paths to evaluate organizational security preparedness. This process constructs a special environment to expand the attack landscape view and defense evaluation with minimal resources for the organization.

An automated approach to Web Offensive Security

Web Application Penetration testing is a popular approach that aims at discovering vulnerabilities by emulating real attacks. Experts often use a variety of publicly available attack tools, define attack methodologies and orchestrate them throughout the separate phases of testing. In doing so, they leverage personal experience and intuition, making any automation effort very challenging. In this paper, we propose the design and implementation of a framework for Web Penetration Testing that allows for the integration, as well as orchestration, of several types of attacks. We identify the generic tasks performed during a penetration test. Then, we provide a way to integrate attacks that implement such tasks in a component responsible for executing them. A further component holds the logic that decides which task to execute and aggregates the results of completed tasks. We also define the communication protocol between the two components to enable the orchestration of tasks across all phases of a testing campaign. As a concrete example of the application of the proposed framework, we show how it is possible to integrate several types of attacks, as well as embed an ad hoc defined behavioral model in order to discover cross-site scripting vulnerabilities.

Framework for Malware Triggering Using Steganography

Teaching offensive security (ethical hacking) is becoming a required component of information security curricula to develop better cybersecurity practitioners. Many academics and industry professionals believe that a good knowledge of the attacks a system can face is required to protect a system. The early detection of an attack is critical to effectively defending a system. We can’t wait for threats to be discovered in the wild to begin planning our defenses. For our study, we designed and developed an offensive model that aims to remain concealed in an image until it reaches the target location. Our attack approach exploits image steganography, which involves embedding malicious code and a geolocation code into a digital image. This study aimed to discover new ways to attack computer systems and stimulate awareness of such attacks among browser developers, thus encouraging them to handle images with more care. In our experiments, both stego-image analysis and geolocation techniques are tested. Our experience has confirmed that converting indiscriminate attacks into targeted attacks is possible.

Can we generate shellcodes via natural language? An empirical study

Writing software exploits is an important practice for offensive security analysts to investigate and prevent attacks. In particular, shellcodes are especially time-consuming and a technical challenge, as they are written in assembly language. In this work, we address the task of automatically generating shellcodes, starting purely from descriptions in natural language, by proposing an approach based on Neural Machine Translation (NMT). We then present an empirical study using a novel dataset (Shellcode_IA32), which consists of 3200 assembly code snippets of real Linux/x86 shellcodes from public databases, annotated using natural language. Moreover, we propose novel metrics to evaluate the accuracy of NMT at generating shellcodes. The empirical analysis shows that NMT can generate assembly code snippets from the natural language with high accuracy and that in many cases can generate entire shellcodes with no errors.

Offensive Security: Cyber Threat Intelligence Enrichment With Counterintelligence and Counterattack

Cyber-attacks on financial institutions and corporations are on the rise, particularly during pandemics. These attacks are becoming more sophisticated. Reports of hacking activities against government and commercial sector organisations have garnered a lot of attention in the last several years. By design, the focus of Cyber Threat Intelligence (CTI) is exclusively defensive. This is because most of the CTI-derived analysis output is intended to prevent breaches or facilitate early detection. So, there is a need to have a new mechanism for unmasking the attacker. In this research, we demonstrate cyber threat intelligence enrichment with counterintelligence and counterattack combined with certain new methods to exploit the adversary’s vulnerability and fully control the attacker’s system. Attackers use a VPN to establish an anonymous connection. A VPN creates a secure “tunnelling” to the internet, with the VPN server acting as a middleman between the attacker and the web. This provides anonymity because the attacker’s IP address seems to be that of the VPN rather than his own, masking the IP address. So, hackers used this application to create persistence because it is automatically launched each time a computer is restarted. As a result, we are attempting to eliminate the persistence by removing it from the startup and registry. This research will help firms detect and identify an assault in its earliest phases, allowing them to respond accordingly. This project will develop new and innovative strategies to bypass VPNs and other security measures in order to obtain correct source information. Companies will be able to identify new methods by which their systems are penetrated and rapidly harden them. Using counterattack and counterintelligence, a proposed technique can bypass a VPN and get adversarial intel. The main goal of this research is to find the attacker’s footprints or tracks and find out why the attack was planned in the first place.

An Automated Approach to Web Offensive Security

An Automated Approach to Web Offensive Security

PocketCTF: A Fully Featured Approach for Hosting Portable Attack and Defense Cybersecurity Exercises

Capture the flag (CTF) challenges are broadly used for engaging trainees in the technical aspects of cybersecurity, maintaining hands-on lab exercises, and integrating gamification elements. However, deploying the appropriate digital environment for conducting cybersecurity exercises can be challenging and typically requires a lot of effort and system resources by educators. In this paper, we present PocketCTF, an extensible and fully independent CTF platform, open to educators to run realistic virtual labs to host cybersecurity exercises in their classrooms. PocketCTF is based on containerization technologies to minimize the deployment effort and to utilize less system resources. A proof-of-concept implementation demonstrates the feasibility of deploying CTF challenges that allows the trainees to engage not only in offensive security but also in defensive tasks that have to be conducted during cybersecurity incidents. When using PocketCTF, educators can deploy hands-on labs, spending less time on the deployment and without necessarily having the advanced technical background to deploy complex labs and scenarios.

A survey of offensive security research on PLCs

Industrial Control Systems (ICSs) are widely deployed in critical infrastructures, such as electric power, water filtration and distribution. Programmable Logic Controllers (PLCs) work as the core components of an ICS. The offensive security technology of PLCs has attracted the popular interests of both attackers and researchers. In this paper, we firstly abstract a 4-layers model of PLC’s implementation, and then summarize and classify attacks against PLCs into 5 types. Further, we point out the features and trends of the related attack studies, which is helpful to promote the research in the ICS security community and provide vital suggestions for defenders.

Offensive Security: Towards Proactive Threat Hunting via Adversary Emulation

Attackers increasingly seek to compromise organizations and their critical data with advanced stealthy methods, often utilising legitimate tools. In the main, organisations employ reactive approaches for cyber security, focused on rectifying immediate incidents and preventing repeat attacks, through protections such as vulnerability assessment and penetration testing (VAPT) security information and event management (SIEM), firewalls, anti-spam/anti-malware solutions and system patches. Such system have weaknesses in addressing modern modern stealthy attacks. Proactive approaches, have been seen as part of the solution to this problem. However, approaches such as VAPT have limited scope and only works with threats that have already been discovered. Promising methods such as threat hunting are gaining momentum, enabling organisations to identify and rapidly respond to any potential attacks, though they have been criticised for their significant cost. In this paper, we present a novel hybrid model for uncovering tactics, techniques, and procedures (TTPs) through offensive security, specifically threat hunting via adversary emulation. The proposed technique is based on a novel approach of inducing adversary emulation (mapping each respective phase) model inside the threat hunting approach. The experimental results show that the proposed approach uses threat hunting via adversary emulation and has countervailing effects on hunting advance level threats. Moreover, the threat detection ability of the proposed approach utilizes minimum resources. The proposed approach can be used to develop the offensive security-aware environment for organizations to uncover advanced attack mechanisms and test their ability for attack detection.

Offensive Security of Keyboard Data Using Machine Learning for Password Authentication in IoT

In this paper, to increase the attack success rate, we analyzed the distribution of all collected keyboard data based on the distance of time and keyboard scancode data, which presents the crucial data from the previous study. To achieve this, we derived time-distance based features that have higher attack success rates than in previous studies. The proposed attack method defines 6 features, and evaluates the performance based on 18 datasets. For performance evaluation, the accuracy, precision, recall, F1-score, and AUC of Datasets (1 to 3) were compared, and two experiments showed improved overall performance by at least 10.6 % and up to 16.1 % compared to previous studies in terms of the performance evaluation for each feature, comparison of variations in maximum performance, comparison of variations in performance of each feature, and comparison of variations in overall performance. Moreover, the best accuracy, which represents the probability of password exposure, was 96.7 %, which suggests that our proposed attack method has a higher accuracy than the previous study (96.2 %). In conclusion, we demonstrated that password authentication is neutralized by stealing the user password more effectively. For future research, we will focus on improving the attack success rate with respect to accuracy and overall performance numbers, using not only machine learning, but also deep learning.

Improved Practical Vulnerability Analysis of Mouse Data According to Offensive Security based on Machine Learning in Image-Based User Authentication.

The objective of this study was to verify the feasibility of mouse data exposure by deriving features to improve the accuracy of a mouse data attack technique using machine learning models. To improve the accuracy, the feature appearing between the mouse coordinates input from the user was analyzed, which is defined as a feature for machine learning models to derive a method of improving the accuracy. As a result, we found a feature where the distance between the coordinates is concentrated in a specific range. We verified that the mouse data is apt to being stolen more accurately when the distance is used as a feature. An accuracy of over 99% was achieved, which means that the proposed method almost completely classifies the mouse data input from the user and the mouse data generated by the defender.

The Concept of Formless Defence

Quoting Sun Tzu might be a cliché, but there is truth in clichés, writes Ben Banks MBCS, cyber security consultant at Additive Security. Sun Tzu’s idea represents a clear manifesto for offensive security, but there is also a defensive aspect to unpack – the power of formlessness.

Updating the Wassenaar debate once again: Surveillance, intrusion software, and ambiguity

ABSTRACTThis paper analyzes a recent debate on regulating cyber weapons through multilateral export controls. The background relates to the amending of the international Wassenaar Arrangement with offensive cyber security technologies known as intrusion software. Implicitly, such software is related to previously unregulated software vulnerabilities and exploits, which also make the ongoing debate particularly relevant. By placing the debate into a historical context, the paper reveals interesting historical parallels, elaborates the political background, and underlines many ambiguity problems related to rigorous definitions for cyber weapons. Many difficult problems remaining for framing offensive security tools with multilateral export controls are also pointed out.