Here are the specific ways the 2016 Republican National Convention (RNC) and Democratic National Convention (DNC) will be Cyber-Attacked

Major Attack Type: Denial of Service Attacks

Denial of Service (DoS) attacks have grown each and every year since 2010. Moreover, the lessons of what are the most successful attacks and the reduction of cost and skill needed to execute these attacks have both dramatically been reduced. Today, for $6 one can rent an Amazon Web Service-based “Booter” to attack any foe at a moment’s notice. In fact, one can enlist the support of hundreds or thousands of infected ‘bots’ including the Internet of Things (IoT) when theoretically almost anything internet-connected can be directed.

As we saw in previous campaigns against elections and political campaigns in the Philippines, Bulgaria, Ukraine, the Russian Federation, and nearly every free election throughout the world, these DoS attacks will be large and focused. In fact, today’s technology allows for supreme bursts and intense focus. I am reminded of the biggest solar power plant on earth that directs the sun’s energy through a massive array of mirrors. These reflect the sun’s energy to a focal point and the rise in heat manages to power an electric plant, which boils water to make electricity.

[You might also like: 2016 Summer Olympics: In the Crosshairs]

So, in the end, what will these volume attacks look like? Here’s a quick checklist of the techniques which will need to be defended from with volume-based attacks:

Mostly-Network Based Volume Attacks Along with Some Popular Tools to Generate

Category	Attack Type	Known Tools	Targeting
TCP Flood	Classic SYN Flood	Bonesi   Cythosia bot Dirtjumper Hping Metasploit Nmap Nping Pitbullbot Scapy T50	TCP/IP Stack,   Stateful devices
	3-Way-handshake Flood	Curl   Netcat Nmap Nping Nping Scapy Telnet Wget Zemra bot(port 80)
TCP Out-of-State Flood	FIN Flood	Hping   Nping Scapy T50
	RST Flood
	ACK Flood		Internet pipe   TCP/IP Stack Stateful devices
	PUSH Flood
UDP Flood	UDP Garbage Flood	Anonymousattackerpackage   Bonesi Cythosia bot Hping Loic Nping Pitbullbot Scapy T50
DNS	DNS Query Flood	Dig   Metasploit Nslookup Scapy	DNS Server
	DNS Recursive Flood	Dig   Nslookup Scapy
	DNS Reflective Flood	Nmap   Nping Scapy	DNS Servers   Internet pipe Stateful devices
	DNS Garbage Flood	Dig   Nslookup Scapy	Internet pipe   Stateful devices
Reflection Flood	NTP Reflection Flood	Nmap   Ntpdc Scapy	Pipe Saturation   Stateful devices
	SMURF attack	Scapy   Smurf.c
	CHARGEN Reflective Flood	Scapy
	SNMP Reflection Flood	Scapy   Snmpbulkwalk
Packet Anomaly	XMAS Tree	Hping   Nmap Scapy T50	TCP/IP stacks
Other	ICMP Flood	Bonesi   Darkness (aka optima) Hping Nping Scapy Rsmurf6 T50	Servers   Stateful devices Internet pipe
	IGMP Flood	Hping   T50	Servers   Stateful devices Internet pipe Routers
	SMTP Flood	Netcat   Scapy Telnet Wget	SMTP Servers
	IP fragmented Flood	Nmap   Pitbullbot Scapy	TCP/IP stacks

 

 

Application-Layer Cyber Attacks

However, these large volume attacks will not characterize all of the attacks which the RNC and DNC Convention will need to fend off. We know from other major world events such as the World Cup, the Olympics, and SuperBowl that the application-stack will be heinously attacked.

So, application-layer attacks can come in two broad forms - one is against the confidentiality and integrity of the application(s) servicing the convention itself such as the broadcast applications, the websites leveraged to carry and transmit what is being accomplished, and the myriad of IoT being leveraged to bring the convention to the masses. Also, each of these applications can also be DoS-attacked, however many of the techniques are varied from the network level illustrated above.

So, let’s take a look at just a few of the major application level attack techniques which can render an application vulnerable to loss of data, integrity or availability:

 

 

Within the Denial-of-Service category itself, application-level threats have a dizzying array of techniques which can render a service or application slow, unresponsive, erratic, or ultimately completely down.

The following is a list of specific attack techniques which have been witnessed at major world events over the past two years:

 

Category	Attack Type	Known Tools	Targeting
HTTP	GET /	#Refref   Athena Bonesi Curl Cythosia bot Darkness (aka optima) Dirtjumper Dos-pro Hoic Hulk Hydra Itsoknoproblembro Loic Mobile loic Netcat Pitbullbot Scapy Siege Wget Xerxes	Web server   Stateful devices
	HTTP Request Flood
	Search Engine Flood	Curl   Metasploit Scapy Siege Wget	Web server   SQL Server
	Large file Download flood	Curl   Scapy Siege Wget	Web server   Internet pipe
	HTTP Garbage Flood	Curl   Loic Scapy Siege Wget Zemra bot	Internet pipe   TCP/IP Stack Stateful devices
	POST Flood	Athena   Curl Scapy Siege Wget
	Slow HTTP Post	Athena   Httpbog Metasploit R.u.d.y. Scapy Slowhttptest	Web servers   TCP/IP Stack Stateful devices
	Incomplete HTTP Request	Assassindos   Curl Netcat Pyloris Scapy Slowloris Telnet Wget	Apache Web Servers
	Head/PUT/Delete Flood	Curl   Netcat Scapy Telnet Wget	Web Servers
	Apache Killer	Apache killer	Apache web servers
HTTPS	SSL Renegotiation	Thc-ssl-dos	Web servers   SSL Terminators
	SSL Request Flood	Dirtjumper   Itsoknoproblembro	Web servers
	Heartbleed	Check-ssl-heartbleed.pl   Crowdstrike Hb-test.py Metasploit Nessus Nmap
TCP attacks	TCP Window Size	Nping   Scapy Sockstress T50	TCP Stack
	Connection Flood
	Small window stress
	Req fin pause stress
	Activate reno pressure stress

 

 

Who will be attacked? In a nutshell, Sponsors, Broadcasters/Service Providers, Law-Enforcement, Contractors and Show Organizers

It is one thing to suggest that the technical attacks will be largely in the form illustrated above and either rented via Booter-services or conducted manually through some the popular tools listed above.

However, it’s another item to know who to protect. Attached below are some thoughts on who needs to button-down the hatches:

- Sponsors: Yes, all advertisers and individuals who have paid money or otherwise promoted the show should consider themselves forewarned. We know that from the Olympics and World Cup that show-advertisers – including those who simply advertise during the commercial breaks - will be considered viable targets. Also, groups who have thrown their support behind the convention, such as the National Rifle Association and others, should strengthen their defenses.
- Broadcasters / Service Providers: This is a very broad category and will include news outlets, managed IT service providers, domain name resolution (DNS) services, telecommunication providers and others who enable the transits of the messages
- Contractors: These are widespread and numerous and include everything from the internet Domain Name (DNS) Resolution Services, to transportation, to the HVAC services which are contracted (after all, the HVAC contractor is how the massive Target data breach first occurred)
- Law Enforcement: We know from numerous Group Anonymous attacks throughout the world that the local, state and federal police are not immune to cyber-attacks including personal data leaks and exposures of individual officers. They can also organize a fairly large protest with ease.
- Show Organizers: Perhaps the most obvious, but somehow appears to be among some of the least intellectually protected – this includes all of the individual candidates themselves, the various Republican Party groups from local, state and federal and all Political Action Committees.

 

The Convention is a big Wi-Fi station - - This Infrastructure is Subject to Physical Cyber-Attacks!

If you recall, the Super Bowl this past year was held at Levi’s Stadium in the San Jose/San Francisco Greater region. Levi’s Stadium is one of the most technologically advanced stadiums ever built and will be similar to what will need to be accomplished at the RNC and DNC to accomplish the goals of the convention. For example, The RNC will be held at the Quicken Loans Arena in Cleveland. This stadium features 461 antennas, 235 DAS and 230 Wi-Fi access points, that provide access to those attending events inside the stadium. The DAS system is built be Verizon Wireless and provides 4G LTE speeds. The DNC will be held at the Wells Fargo Center in Philadelphia. This stadium features 3501 Wi-Fi access point and 700 Bluetooth beacons. The system is powered by Cisco’s latest generation, Cisco connected stadium solution, that provides users with a 1Gbps connection.

When Levi’s Stadium hosted Super Bowl 50, it brought a new approach to the overall game experience by offering fans network connectivity via Wi-Fi, Bluetooth, and a number of other digital services. We see this also occurring at the conventions and, like the stadiums, the more connected stadiums become, the more risks they create. Such a concentration of mobile users could entice hackers looking to steal data from high-profile celebrities, politicians, and others at the game. It could allow someone to commandeer the stadium’s TV screens. It could allow a hacker to enslave thousands of unsuspecting mobile users with no more than a pocket’s worth of technology.

 

Summary

We now know through numerous external analysis and documented evidence that the political sector is vulnerable to cyber attacks. How long will it be before the terror strikes will evolve in the political arena, like they did around the world, to the cyber front? Should you have responsibility for any aspect of these areas, please don’t be a bystander and be proactive about on-boarding controls and bringing security to our democratic process. Given the threat landscape evolution and importance of newsroom fidelity and political candidate sanctity, this is an area where, unfortunately, the government’s ability to assist is not yet fully realized and can’t be relied upon. There is no real equivalent to the Secret Service in the digital realm, whose role would be equivalent to the Physical Secret Service in numerous ways.

As cyber attacks against political leaders, institutions, and others grow, the national conventions need to develop their own private “Digital Secret Service” which would stand guard against the hacktivists and others increasingly attacking the fidelity and trustworthiness of our democratic governments.