FlipThem: Modeling Targeted Attacks with FlipIt for Multiple Resources

Abstract

The attack on RSA [12] in early 2011 represented a big surprise for the IT security industry. It showed that major security companies are attractive targets for stealthy attacks because of the important information they possess. The RSA attack induced an interesting discussion in the security industry and the research community alike. In particular, researchers at RSA modeled stealthy takeovers of a resource in their FlipIt game [13]. FlipIt is an attacker-defender game in which the players compete for the control of a resource, which can correspond to the practical case of updating and compromising a cryptographic key.In this paper, we present FlipThem, a generalization of the FlipIt game to multiple resources. In particular, we consider two control models: In the AND control model, the attacker needs to compromise all resources to gain access to the target system, whereas in the OR control model, the attacker only needs to control a single resource to reach her goal. First, we propose combinations of basic, single-resource FlipIt strategies and study the best choices for the defender and the attacker. Then, we extend these basic strategies with the Markov strategy class to represent more complex combinations of moves.Based on our FlipThem model, we can provide a few guidelines for the defenders. First, in the AND control model, we found that the defender should update her resources independently. On the other hand, the defender should generally update her resources synchronously in the OR control model. We also found that periodically updating resources is a good choice against a non-adaptive attacker in the FlipThem model, however, it suffers from the same weaknesses against an attacker with feedback as in the basic FlipIt model. Thus, the defender needs to carefully assess the potential information available to the attacker when choosing her strategy. In summary, our results enable a defender to plan her defense strategy against a range of attacker strategies.

Multi-rate Threshold FlipThem

“…So far we have extended the full threshold FlipThem game [17] by obtaining the equilibria of the benefit functions constructed from the proportion of time the attacker is in control of the whole system. In order to generalise this further, we return to our partial threshold case in which the attacker gains benefit from controlling only t < n resources.…”

“…A multi-resource example in which we retain one rate per player (as opposed to one rate per resource for each player) is given by the situation in [17] and [19]; each player chooses a rate at which to play all resources. Whilst this allows us to retain a twodimensional system when considering the multiple resource case, unfortunately obtaining explicit best response functions is extremely difficult.…”

“…Such techniques can either be used directly as in [4,30], or using secret sharing to actually compute some data as in Multi-Party Computation [2,8]. To capture this and other such situations, Laszka et al [17] introduce a FlipThem game in which there are multiple resources, each equipped with a button as in FlipIt, and the attacker obtains benefit only by gaining control of every resource in the game. This models the full threshold situation in distributed cryptographic solutions.…”

Threshold FlipThem: When the Winner Does Not Need to Take All

“…This was partially considered before in the paper [7], who introduced a variant of FlipIt called FlipThem in which the defender has control of multiple resources. Instead of flipping the state of a single resource from good to bad, the attacker is trying to flip the states of multiple resources.…”

“…Instead of flipping the state of a single resource from good to bad, the attacker is trying to flip the states of multiple resources. In [7] the authors examine the simplest situations in which an attacker "wins" if he has control of all resources, and a defender "wins" if she has control of at least one resource. Thus using the terminology of secret sharing schemes the paper [7] considers only the full threshold situation.…”