INTRODUCTION.

                  The DAIM ( Data Analysis and Management Instrumentation) is responsible for protecting and defending a target/system from all types of cyberattacks. These include attacks exploiting vulnerabilities in the operating system, web browser, etc., at the application/APP/API without comprehensive static and dynamic testing (without DevSecOps), through misconfiguration or inadequate default configurations, and through shrink wrap code using scripts with vulnerabilities or default code. DOP (Data Object Perception) attacks allow a cyberattacker/malware to perform arbitrary computations in program memory by chaining the execution of short sequences of instructions called "DOP gadgets." The DAIM proactively prevents the exploitation of memory errors, the concealment of information necessary for the cyberattack, and the hiding of horizontal/vertical privilege escalations, lateral movement, SQL injection, etc. The DAIM proactively protects critical data/metadata from potential manipulation. The DAIM blocks all attempts to collect any kind of useful information from "trash bins" . This includes "dumpster-diving" cyberattacks, for example, unused memory areas, outdated hardware (hard drives can be restored to provide all kinds of sensitive information; the solution is to encrypt or wipe it), access to internal phone directories (names and numbers of people, clients, etc., for cyberattacks and impersonation; many names are based on legal names), organizational charts (information about people with authority within an organization), calendars (showing which employees are out of town at a given time), agendas, system manuals, network diagrams, and other sources of technical information (this information is very useful to cyber attackers; it includes IP addresses of key assets, network topologies, operating systems, applications in use, versions, firewall locations, IDS/IPS, etc.), and policy manuals (which contain information from which the security of a system can be inferred). insecure (which is actually the organization, industry), etc. According to Stefan Gross Selbeck, Operations Manager at Boston Consulting Group “personal data is the oil of the 21st century.” DAIM , integrates the ISO 27701 sustainable privacy protection management system .     

DAIM PROTECTION-DEFENSE MANEUVERS AGAINST MALWARE CYBERATTACKS ON WEB BROWSERS.

The DAIM operates at a low level in multiple directions, blocking all types of malicious attempts to execute perverse operations on web browsers (such as malicious extensions/plugins, browser rootkits, MyWay Searchbar, Download.ject, etc.). The DAIM will neutralize all malicious attempts to install malware as a component of the web browser. Likewise, the DAIM will block all malicious attempts to exploit vulnerabilities in native browser components (such as the JS interpreter, rendering engine, XML parser, network modules, browser engine, user interface, etc., since exploiting these vulnerabilities can allow the execution of drive-by-download cyberattacks) and to download binaries into the operating system. The DAIM will neutralize all malicious attempts to read and write to the disk, control network sockets, steal stored data, alter the registry, modify any type of extension, or execute malicious operations in the same memory context (address space) as other legitimate extensions. The DAIM will block all malicious attempts to exploit other installed extensions by using JavaScript "wrapper" functions to change their functionality. Likewise, the DAIM will block all malicious attempts to launch malicious code (acting as a carrier for Trojans), preventing interaction with plugins (such as PDF or Flash). The DAIM will block all malicious attempts to hide rootkits in browser extensions by manipulating parameters in the install.rdf and using CSS to install malicious extensions with transparent style metrics. The DAIM will block all malicious attempts to delete entries in the Extension Manager so that malicious extensions cannot be listed. Furthermore, the DAIM will block all malicious attempts to "hook" objects in theSecurity Manager and will neutralize the creation of new objects such as "invisible tags." The DAIM will block all malicious attempts to corruptthe JavaScript heap , which plays a key role in the successful execution of malicious cyberattacks. The DAIM will block all malicious attempts to explicitly use asynchronous HTTP requests via AJAX with events associated with listener generated for communication with third-party servers. Likewise, the DAIM will neutralize all malicious attempts to use encrypted protocols to transfer data. The DAIM will block all malicious attempts to exploit vulnerabilities in the plug-in interface to cause infections ( plug-ins run as separate processes, operate outside the browser, and can act as parasites that use browser resources to spread infections). The DAIM will block all attempts by a malicious plug-in to use JavaScript from a web page (loaded in a sub-window) to perform various malicious functions. The DAIM will block all attempts to execute malicious scripts in the web browser (originating from plug-ins ) and exploit the DOM to perform XSS attacks to steal sensitive information, phishing, and social engineering cyberattacks. The DAIM will block all malicious attempts to use NPAPI (Netscape Plug-in Application Programming Interface) maliciously to craft platform-independent code and spread infections. The DAIM will block all malicious attempts to use ActiveX objects to execute arbitrary code that can manipulate web browser resources. The DAIM vulnerabilities plug-in interface (this is known as drive-by download cyberattacks, exploiting vulnerabilities in the Adobe Reader, Flash, and Silverlight plug-ins). The DAIM will block all malicious attempts to use JavaScript heap corruption, employing evasion techniques such as encryption, module splitters (like variables and arrays), multi-level compression, encoding, cross-referencing objects, etc. The DAIMwill block all malicious attempts to exploit the web browser interface and its vulnerabilities to use operating system user permissions. The DAIM will block all malicious attempts to use system-level APIs to cyberattack the browser or plug-in processes and thus control the browser's communication interface with the internet to manipulate traffic flow. The DAIM will block all malicious attempts to use IAT (Import Address Table) hooking, inline hooking, DLL hijacking using APIs, and hooking through the SSDT (System Service Descriptor Table) to control browser-related functions in the kernel. DAIM will block all types of malicious attempts to "hook" the web browser's communication channel, monitor traffic, inject malicious traffic into the browser, bypass operating system firewalls, generate fake website pages, capture POST requests, and all types of system-related activities, including controlling standard HTTP functions in operating system libraries used by browsers for all types of work.

DAIM 'S CONTRIBUTIONS ON PRIVACY-CYBERSECURITY.

Privacy confidentiality is correlated with in everything: my data/metadata (do not reveal the information I have, generate, use, capture, store, etc.), my identity (do not reveal; if I have to provide it, generate and show as many identities as services I access or that request it, or treat my identity as a secret that I don't reveal, but when it must be revealed, I use ZK technology that allows me to prove I have it without revealing it. Do not reveal the mobile identifier (IMSI/IMEI), IP address, MAC address, etc.), my geolocation indoor/outdoor (do not reveal), my activities (do not revealhow I carry them out), my preferences (do not reveal), my health (do not reveal; data is usually stored in clouds, which are a focus of espionage), my trips, itineraries, purchases, leisure, restaurants, etc. (Do not disclose), communications via the Internet (do not disclose, use anonymity (of sender, receiver, and connectivity between senders and receivers), for example with proxies, prevent tracking with DAIM as "anti-tracking", prevent traceability, sniffing, use encryption, steganography, subliminal channels, etc., against fake friends on social media/instant networks do not disclose, use OT technology (transactional transfers) to avoid revealing what data I have taken from a server, etc. Privacy (in close collaborative connection with cybersecurity and its many derivatives: confidentiality, integrity, geolocation, traceability, availability, authentication, authorization, non-repudiation, identification, etc.) is a right of every entity to be able to determine the degree to which it wishes to interact with its environment (visible, invisible, transparent, virtual, etc.) and to what extent (explicitly) said entity wishes to share information about itself with others (without forgetting malicious hacks due to its data sharing with organizations where The entity has had to hand over PII (Personally Identifiable Information), bank account numbers, personal data, addresses, telephone numbers, email/IM, data about their health, what they buy, their travel itineraries, etc., which may even be stored in decentralized public and private clouds. PET (Privacy-Enhancing Technologies) protect data/metadata (in terms of confidentiality, integrity, and accessibility) duringprocessing/use, at rest, and in transit, and allow us to leverage data in a cybersecure and private manner (for example, the data/images and metadata provided by the Sentinel-2 satellite network in its public version are published without the metadata associated with soil type). SMPC ), OT Obvious Transfer ( multi-layered encryption fully homomorphic, etc., also protect the privacy of data/metadata. The main protection-defense objectives related to an entity (human and all their cyber devices such as smartphones, tablets, PCs, servers, etc.) are... IoT objects (and all their derivatives: IoMT, AIoT, IoCT/Internet-of-Children's-Things, IIoT, etc.)) that DAIM will protect are: 1-Privacy on devices. This depends on the privacy of communications and physical sensitive information that the device may leak if it is cyber-attacked (using subliminal side-channel access, offensive malware, social engineering, etc.), stolen ( DAIM will encrypt the entire device), etc.

2- Privacy during communications (including OTA, satellite, BLE, WiFi, 5G, LoRaWAN, 6G, etc.). This depends on the availability, confidentiality, integrity, reliability, etc., of the device. Some devices communicate only when necessary (in an encrypted-steganographic and authenticated manner, for example, during updates and patches) to prevent the potential disclosure of data privacy and its modification during these communications.

3- Privacy during storage. To protect the privacy of data stored on devices (personal address book, client list, etc.), encryption, steganography, fragmentation, and other security measures must be applied. The amount of data that needs to be stored on the devices (whether there is sufficient space) must be considered, and regulations must be followed to provide user protection after the end of the device's life (such as irreversible encryption or very low-level "wiper" erasure of data if the device is stolen, lost, or no longer in use). Remember that when we take a photo with a mobile phone, that photo stores metadata (date and time it was taken, location, device used, etc.). This metadata must be protected and access to it blocked.

4-Privacy during processing. This depends on the device, the integrity, confidentiality, etc. of the communications. Data should not be disclosed or retained by third parties without the explicit consent of the entity that owns the data (person, device, object (IoT, IoCT, IoMT, IIoT, AIoT, etc.).

5-Entity identity privacy. The identity of any entity/device should only be revealed by authorized entities (human, device, etc.) with the explicit consent of the entity, and even better, use ZK technology that should not transmit the identity as a secret.

6-Privacy of the entity's location/geolocation (outdoor-indoor). The relevant geographic position (outdoors via satellite such as GPS, Galileo, Glonass, BeiDou, GNSS, etc., latitude, longitude, altitude, time, etc., as well as IP addresses, MAC addresses, etc., use of drones, outdoor video cameras, etc., or indoors using iBeacon/Bluetooth, webcams, RFID/NFC implants, etc.) of the entity (human, device, application, etc.) should only be discovered without the explicit consent of the entity to authorized entities, preferably using ZT/ZK technology.

                  The DAIM is responsible for blocking all types of malicious attempts to carry out harmful actions generated by all kinds of offensive cyberattacks (many of them including insidious malware). Some cyberattacks against privacy are:

Cyber-espionage/surveillance/exfiltration/monitoring. Using cracking techniques and malicious software (spyware such as Pegasus, keyloggers, creepware, etc.) allows cyber-attackers to spy on and obtain secret information from entities (individuals, organizations, industries, government, etc.) through their devices (endpoints: mobiles, tablets, PCs, etc.) on all their platforms (iOS, Android, Windows, Linux, Symbian, etc.).

Secret eavesdropping (of data, audio, video, keystrokes, etc.). Allows listening to conversations between different parties and viewing, with webcams, scenes between entities and cyber-attackers.

Tracking. When an entity/user moves, they can be tracked using the Unique Identification Numbers (UIDs) of devices such as IMSI, MAC, IP, URL, etc. Tracking the location of entities/users (e.g., GPS, Galileo, GLONASS, BeiDou, etc.) facilitates their identification in situations where they wish to remain anonymous. 

Data mining. It allows cyber attackers to discover information that is not anticipated in certain databases.

Password-based cyberattacksare attempts by cyber attackers to duplicate a valid user password. These attempts can take various forms: dictionary attacks, which involve trying every possible word in a dictionary; brute-force attacks, which use cracking tools to try every possible combination of letters, numbers, and special characters until valid passwords are discovered; keyloggers, which capture keystrokes; hard-coded passwords written in the source code; weak, simple, and easily guessed passwords; passwords written on paper or sticky notes; passwords shared among employees; passwords transferred unencrypted to the cloud; passwords stored in vulnerable password manager software; passwords using weak hashes; and so on.

Cyberattacks based on cloud usage (multi-tenant environments with virtual machines, containers/Docker). In scenarios such as "microservices" where applications are fragmented into small, self-contained components that can be deployed and scaled individually. In multi-cloud scenarios where software components are deployed in containers, it is possible to move them from servers to virtualized environments and public cloud environments. In automation scenarios, containers are controlled by APIs and enable automation and Continuous Integration/Continuous Deployment pipelines. Experience indicates that leaving information in the cloud, especially if it is public and not well encrypted, is unwise.

Cyberattacks based on leaks between virtual machines and containers. Information leaks are possible between virtual machines and between containers/dockers belonging to different users.

Destructive cyberattacks. Examples of destructive cyberattacks include terrorism, revenge cyberattacks, geopolitical attacks, cyberattacks on moving vehicles, etc. They exploit cyberspace to create destruction of life and property.

Cyberattacks on OT environments such as SCADA/PLCs. SCADA (Supervisory Control and Data Acquisition) is just as susceptible to exploitable vulnerabilities as the TCP/IP protocol stack. Systems can be cyberattacked in various ways: using denial-of-service attacks, blackouts of energy systems (electricity, gas, etc.), taking control of systems (using malware) and carrying out modifications, sabotage, espionage, etc.

Cybercrimes/cyber offenses. Cyberbullying/cyber harassment, cyberattacks on reputation using disinformation (deepfake and synthetic media) and doxware (stealing sensitive data and blackmailing victims to prevent its publication), geopolitical destabilization between nations and companies, espionage on diplomatic servers, etc. The internet and smart devices are used to exploit users and data for financial gain, as in the case of intellectual property theft, identity theft/kidnapping, trademark theft, fraud, etc.

Man-in-the-middle (MITM) cyberattacksinvolve inserting oneself between two communicating entities to: steal identity, impersonate entities, change data, denial of service, espionage, degrade the quality of service, etc. 

FINAL CONSIDERATIONS.

The IRS (Internal Revenue Service), a US government agency, announced in February 2022 that it would no longer use biometric facial recognition technology ("video selfies") for user authentication with the government due to privacy concerns. DAIMprotects against cyberattacks attacks, spoofing which attempt to impersonate someone to commit illegal acts; sharing , which attempt to access assets (data, servers, etc.) through sharing relationships; DoS/DDoS , which attempt to degrade or disrupt access to a service; tampering attacks, middle which attempt to steal data, redirect payments, etc. Vulnerabilities deficiencies , flaws, and shortcomings (deep design and code level errors), weaknesses, unconfirmed trust, inaccuracies, and bugs (implementation errors in source code, use of insecure functions) in everything (software, firmware, hardware, people, organization, protocols, configurations, architecture, implementation, management, planning, etc.) that exploits (the code that exploits them) of to infect or cyberattack. The phases of an exploit are: reconnaissance (identification (target, gateways, etc.) and construction (payload, connectivity)), gateway (phishing, vulnerabilities (buffer overflow, use-and-later free, etc.)), execution (entry (input control) and exploit payload (root shell, malware installation, etc.)), and C&C/C2 (data copying and traffic monitoring). An impact vector is a compromised path of communication links through which a cyber attacker exploits vulnerabilities in services, platforms, or devices. This can affect the devices/targets (e.g., vehicles, IoT objects, mobile devices, servers, etc.), the physical environment (environment, living/artificial beings, infrastructure, etc.), and the virtual/cyber environment associated with cyberspace (e.g., with apps, AI, virtual reality, etc.). Gartner predicts that 60% of organizations/companies will phase out VPNs in favor of Zero Trust (ZT) by 2023. According to the OSCINR (Open Source Cybersecurity Intelligence Network and Resource), 60% of all medical devices (IoMT, appliances, etc.) lack patches/updates.

REFERENCES. 

- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2020.

- Areitio, J. “Duality of advanced intelligent malware (offensive and defensive), points of action and transparent expansion operation”. Conectrónica Magazine. No. 245. October 2021.

- Areitio, J. “Elements and approaches for the design and synthesis of advanced defensive intelligent malware”. Conectrónica Magazine. No. 246. November 2021.

- Areitio, J. “Development of advanced defensive intelligent malware. Neutralization of offensive malware actions”. Conectrónica Magazine. No. 247. February 2022.

- Areitio, J. “Automatic actions of advanced defensive intelligent malware”. Conectrónica Magazine. No. 248. March 2022.

- Areitio, J. “Exploration of the dynamics of the blocking operation used by the DAIM/MIAD”. Electronic Journal. No. 249. April 2022.

- Areitio, J. “Low-level defense and protection maneuvers and operations orchestrated by the DAIM/MIAD against offensive cyberattacks”. Conectrónica Magazine. No. 250. May 2022.

- Karbab, EB, Debbabi, M. Derhab, A. and Mouheb, D. “Android Malware Detection using Machine Learning: Data Driven Fingerprinting and Threat Intelligence”. Springer. 2021.

- Ligh, ML “The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory.” Wiley. 2014. 

- Matrosov, A., Rodionov, E. and Bratus, S. “Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats”. Not Starch Press. 2019.

- Bilge, L., Cavallaro, L., Pellegrino, G. and Neves, N. “Detection of Intrusions and Malware, and Vulnerability Assessment”. 18th International Conference, DIMVA 2021. Springer. 2021.  

- Astra, JD “Malware”. Shadow Alley Press. 2021. 

- Monnappa, KA “Learning Malware Analysis: Explore the Concepts, Tools, and Techniques to Analyze and Investigate Windows Malware.” Packt Publishing. 2018.  

- DiMaggio, J. “The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime.” Not Starch Press. 2021.

- Ryan. M. “Ransomware Revolution: The Rise of a Prodigious Cyber ​​Threat.” Springer. 2021. 

- Liska, A. “Ransomware: Understand. Prevent. Recover.” ActualTech Media. 2021.    

Author: Prof. Dr. Javier Areitio Bertolín - Director of the Networks and Systems Research Group