172

Confirmed cases? Yes, at least two. One is Strava, and the other is Polar. When Strava updated its global heat map, it showed some areas in supposed desert areas full of activity. Who would go jogging, at night, on the desert? What about US soldiers? An interactive map posted on the Internet that shows the whereabouts of people who use fitness devices ...


53

Yes, exploitation of location data in combat: FancyBear Tracking Ukrainian artillery units In short, Ukrainian artillery units used malware-infused app to compute shooting solutions for their D-30 122mm towed howitzer. It has been found that these units suffered suspiciously high losses. Quoting more from the Crowdstrike report (emphasis mine): From ...


27

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the internet also makes it possible to conceal the source of an attack, a well resourced attacker can even make it impossible for the defender to realise that an ...


13

I've stumbled across this article. It assumes that the Russian army in Ukraine uses equipment capable of detecting the location of cellphones — not even necessarily GPS-enabled smartphones, just anything that uses standard cell operators (quite often compromised). The Future Of Information Warfare Is Here — And The Russians Are Already Doing It (highlight ...


12

Yes. The Russian government appears to be using attacks to destabilise the Ukraine - for some years now. There's a well researched Wired article that has a lot of details: https://www.wired.com/story/russian-hackers-attack-ukraine/ Then there's also NotPetya (which, you may remember, got a little out of hand): https://www.wired.com/story/notpetya-...


11

A Russian soldier on duty posted pictures automatically tagged with GPS data that showed he was in Ukraine, back when Russia was denying having troops there. https://www.businessinsider.com/russian-soldier-ukraine-2014-7 Not directly involving combat, but definitely something his country would prefer to avoid.


5

Information security is data-centric, meaning about safeguarding data for the purpose of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. Information security is agnostic to the form the data takes (electronic, or paper). Cybersecurity is about safeguarding information systems ...


5

The main question you probably need to ask is who has the motivation to do such an attack. While in former times it was often enough to brag about the attacks you did and show what a capable hacker you are, cyber attacks are now predominantly seen as crime. This means that bragging about it might even be dangerous and there must be other motivations. Thus ...


4

While, as others have said, Mutually Assured Destruction is not something that could apply to Cyber Security, it is certainly true that tit-for-tat cyber aggression has been going on for quite a while and has been pretty nasty over the last few years between the main government supported hacking groups. Indeed, I believe that the USA did a deal with a large ...


3

The term "Cyber Warfare" is largely nonsense. There just isn't enough there to make a prolonged exchange of hostilities likely, not on the order of magnitude that you could call a "war". However, as we have seen already, there is quite a bit of critical infrastructure reachable (directly or indirectly) through the Internet. If an actual war would break out ...


3

I cannot quantify for you, but it can certainly be said that strategic cyber-warfare is increasingly feasible - with whole swathes of vital national infrastructure now completely dependent on digital integrity. It could be argued that the feasibility of strategic cyber-warfare is increasing with exponential. Especially so with the emergence of everyday ...


3

I have done this very thing before, the best method I found was to create a job to periodically pull the IP’s from the tor exit node list, this list can be used to test your rule set against. The list can be found here. These scripts can help with converting them into a CSV file to be pulled by your SIEM.


3

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any professionals interest to avoid vague terms which tend to produce misleading associations. The best way to market things is to use terms which people already know (so you ...


2

any actions that a reasonable practitioner should take now Generally speaking you should secure the systems you are responsible for so that they cannot be hacked. (but DoS would still be possible) How do those actions differ what should be done in the absence of this conflict? If you were in a government position, or had government client (military, etc....


2

Can these experts make these claims with 100% certainty? Why or why not? You can almost never prove anything 100%, but for all intents and purposes you can be quite certain. Can we know for sure the Shadow Brokers leak was legit? No, but we can conclude any other option would be highly impractical. But the American government is not providing that level ...


2

The two problems you are facing with NFC tags is either preventing a re-write of the tag by a malicious user, or the NFC tag being replaced by a malicious one in the advertisement. The first problem can be resolved by using read-only NFC tags. These cannot be reprogrammed and thus thwart any attempts to modify the NFC tag contents. The second issue is a ...


1

I'm assuming you meant the recent outbreak of 'Petya' that is also known as 'NotPetya', since it was based on the original 'Petya' but it is not 'Petya', hence the name 'NotPetya' NotPetya was spread through an infected software update process for a software company in Ukraine called MeDoc, which make accounting software. NotPetya's authors exploited MeDoc'...


1

Cyber ranges are mostly established for infra related imitation & simulations. Lot of cyber ranges count on network, host, system element creation in a virtual environment and then generate the volume and traffic patterns. Establishing cyber ranges for business logic security failures could be a extremely complicated exercise. Since the logical flows ...


1

Cyber ranges can be set up to simulate anything you want. Most commonly they are used to simulate vulnerabilities so people can learn to exploit them but it would be easy to setup a misconfigured application which allows for business-logic exploitation. There are some intentionally poorly written web apps that simulate shopping carts and also a fake bank ...


1

Create a reference set for IP addresses with a time to live that is a little more than an hour and call it like "Tor Exit Nodes". Using cron and wget download the list of tor exit nodes hourly. Possibly you need to tidy up the IP addresses so that you have 1 IP address per line. Load the file hourly into your reference set like so: /opt/qradar/bin/...


1

If you are feeding the traffic logs to your SIEM you can use that and compare with a list of tor nodes. (something like BRO IDS) But since any list of tor nodes is going to be changing/incomplete, you would probably want to look at detecting through other ways. This could be behavioral based, tor ssl certs identified on your network, or other host based ...


1

I would argue that the poster stating that MAD does not apply in cyberwarfare is inaccurate, in that systems are not nearly isolated enough from one another to prevent countries from attacking and destroying a significant portion of internet and other infrastructure. One of my best examples would be to point you to the massive cyberattack in 2007 on the ...


Only top voted, non community-wiki answers of a minimum length are eligible