OODA Loops in Cyberspace: How Cyber Awareness Training Helps Threat Actors

OODA Loops in Cyberspace: How Cyber Awareness Training Helps Threat Actors

Robert Zager and John Zager

Cybersecurity’s human adversarial engagement is often lost in discussions of cybersecurity. We discuss how defenders’ focus on technology unintentionally creates vulnerabilities which can be exploited by threat actors. In particular, we discuss how the convergence of cyber awareness training and defensive technologies is exploited by threat actors with devastating consequences.

URL Abuse

Attackers want their attacks to look as realistic as possible and they therefore create websites and URLs that look like sites their targeted victims would expect to receive email from or visit.

-- Brad Smith, Microsoft President[[1]]

On August 8, 2018, Microsoft announced that its Digital Crime Unit (DCU) had obtained a United States District Court order transferring control of six internet domains from Strontium, a presumptive affiliate of the Russian government, to Microsoft.[[2]] The seized domains were associated with foreign efforts to subvert U.S. democracy. The transferred domains were:

• my-iri.org
• hudsonorg-my-sharepoint.com
• senate.group
• adfs-senate.services
• adfs-senate.email
• office365-onedrive.com

Each of these six domains was designed to mimic a legitimate organization that would be of interest to the specific targets. The first domain appeared to be associated with the International Republican Institute, a think tank affiliated with six Republican U.S. Senators. The second was designed to mimic the Hudson Institute, another prominent think tank. The third, fourth and fifth were obviously intended to mimic the U.S. Senate. The last was designed to mimic Microsoft’s popular Office 365 service. This is the sixth time in two years that Microsoft has gone to court to seize malicious websites, bring the total seized to eighty-four.

While seizing eighty-four malicious domains is laudable, a review of the six listed domains reveals how easy it is for threat actors to create deceptive domains that must be discovered and then decommissioned. In the six domains, the threat actors used five different Top Level Domains (TLDs), namely, “.org”, “.com”, “.group”, “.services”, and “.email’. These are just five of the over 1,500 TLDs that are currently available.[[3]] The large, and growing, number of TLDs and their respective registrars create a vast universe of possible URLs for threat actors to exploit.

It must be noted that DMARC, the email defensive technology mandated by DHS BOD 18-01, is ineffective against attacks which use these URL abuse techniques.[[4]] This is because the protections afforded by DMARC only protect the real domain, not domains created and controlled by threat actors. In fact, threat actors can use DMARC to increase the perceived legitimacy of attack domains.

SSL Abuse

Bad Money Drive Outs Good.

-- Gresham’s Law

Gresham’s Law is the economic principle that when two forms of a commodity money with the same face value are in circulation, the more valuable commodity will gradually disappear from circulation, being replaced by the less valuable commodity.[[5]] We currently see a similar dynamic playing-out in cyberspace. SSL digital certificates are issued by entities called Certificate Authorities (CAs).[[6]] SSL certificates are used to manage HTTPS, the secure browsing protocol for the World Wide Web. While there are many aspects of HTTPS, the one that is relevant to this discussion is the modification of the user’s browser interface based on HTTPS state. In general, when the browser session is secured using HTTPS, the user will receive two visual indicators of HTTPS security. The first indicator is that the text address will display https instead of http. The second indicator is a padlock. Figure 1 illustrates how HTTPS is displayed on the website of the IRS in the Chrome and Edge browsers.[[7]]

                                           Chrome                                                                          Edge

Figure 1. IRS Website Illustrating HTTPS.

The Chrome browser informs that user that this is “Secure.” What does “Secure” mean in the context of HTTPS? It means that the connection between the user’s computer and the website being displayed is encrypted. Encrypting the connection makes it very difficult for third parties to eavesdrop on the traffic over the connection. This is a vitally important security feature. For example, encryption allows the user to transmit banking credentials and conduct banking business online without fear that banking credentials or financial data will be stolen by eavesdroppers. However, securing the connection to the website from eavesdropping is only part of the system. The system is composed of three elements, i.e., the user, the connection and the website. What does an SSL certificate tell the user about the website? The answer to this question is dependent upon two subtleties of the SSL certificate. The first subtlety is the CA that issued the SSL certificate. The second subtlety is the class of the SSL certificate. The three classes of SSL certificate, in increasing order of veracity, are: i) DV, domain validation; ii) OV, organization validation; and iii) EV, extended validation.

The issuing CA and the class of the SSL certificate are of paramount importance. Just as a silver dime is worth more than a cupro-nickel dime, an EV Certificate issued by DigiCert is worth more than a DV certificate issued by Let’s Encrypt. In order to obtain an EV certificate from DigiCert, the website operator must pay an annual fee starting at $234.00[[8]], provide substantial legal documentation and complete a technically complex installation process.[[9]] On the other hand, obtaining a DV certificate from Let’s Encrypt is free, requires no documentation and does not require manual installation.[[10]] The intermediate OV certificate, which is not free and requires some documentation[[11]], receives the same visual indictors as the lowest tier DV certificate in browsing environments. Despite the substantial differences between the CAs and classes of SSL certificates, the vast majority of users are unaware of these differences – the different certificates have the same face value. This means that the HTTPS indicators on websites actually provide users with little guidance in determining if the website at the other end of the secure HTTPS connection is a trusted bank or a threat actor. The unfettered availability of free SSL certificates has, unsurprisingly, proven to be very beneficial to threat actors as they are able to display HTTPS indicators on malicious websites, making high trust websites indistinguishable from malicious ones.[[12]]

Cyber Security Awareness Abuse

… cybersecurity is fundamentally about an adversarial engagement. Humans must defend machines that are attacked by other humans using machines.

 -- Dr. Fredrick Chang, Former NSA Director of Research[[13]]

Colonel John Boyd, USAF (Deceased), developed the Observe/Orient/Decide/Act Loop (“OODA loop”) as a military decision-making analytical framework. The OODA loop has since been widely adopted outside of the military.[[14]] At that heart of this framework is the principle that the target’s decisions can be influenced by manipulating the information that the target uses to assess the situation.[[15]] Boyd observed that the success of this manipulation process is dependent upon anticipating the target’s thought processes. In the case of spearphishing, a sophisticated threat actor will anticipate that the target has received cyber security awareness training. Threat actors know that cyber security awareness training always emphasizes the importance of inspecting email addresses and looking for HTTPS indicators. Thus, in creating an attack the threat actor will assume:

1. The targeted individual will inspect the domain name displayed in the email address and may even inspect the URLs in the links. This is why, as Brad Smith observed, the threat actor will adopt a domain name that is deceptively similar to a domain name that the target would expect to see. As was the case in an attack on Russian banks, the deceptive domain name does not need to have any relation to the real domain name. In that case, the threat actors used the domain fincert.net to mimic FinCERT, the Russian bank regulator; FinCERT’s actual domain name is cbr.ru.[[16]] It has always been easy to dream up deceptive domain names and the ever-expanding list of TLD's facilitates threat actors in the creation of deceptive domain names.
2. The targeted individual will look for the HTTPS indicators on the destination website and in links. Thus, the threat actor will use SSL on the malicious website. Free SSLs make it easy for threat actors to use HTTPS indicators on malicious sites.

In the OODA loops of cyberspace, training becomes a vulnerability that is manipulated by threat actors because, knowing what the target is looking for, the threat actor will manipulate this information to deceive the target. This is the problem of psychological manipulation that the ODNI called out in the ODNI's Cyber Threat Framework.[[17]] Abusive domain names paired with abusive SSL certificates is a one-two punch that is facilitated, not frustrated, by technology and training.

Cyber security awareness training is an essential, but insufficient, response to malicious abuse of the user interface. The tables can be turned on the threat actor by providing the user with additional information which satisfies two conditions. First, the additional information must augment existing cyber security awareness training. Second, the additional information must be beyond the reach of threat actors.[[18]] It is possible to leverage intelligence and existing email technologies to create an email interface which satisfies these conditions, enabling users to quickly and easily unmask attempts to mimic trusted email senders. We discussed such a system in Improving Cybersecurity Through Human Systems Integration.[[19]]

The views expressed herein are the views of the authors and do not reflect the views of Iconix, Inc., or Walmart Inc. or its subsidiaries.

End Notes