![NETWORKS
Networks provide the main transit for information, and because of
this, they are subject to scrutiny and attack. The basic model of
network communication can be visualized as in Figure 2.1.
Figure 2.1 Network topology.
The usual way to conceptualize a network in computing and
electronics engineering is through the Open Systems Interconnection
(OSI) model (see Figure 2.2) [1].](https://image.slidesharecdn.com/37173-250320175918-7fae7170/85/Advanced-Cybersecurity-Technologies-1st-Edition-Ralph-Moseley-33-320.jpg)
![MS Outlook, has data which resides at Layer 7 – the application
layer. When an email is written and send is pressed, the data works
its way down the OSI layers one by one and through the network.
The data first works through the presentation and session layers,
before entering the transport layer; here, the email will be sent by
SMTP. The data will move through the network layer into the data
link. The packets eventually reach the physical layer, where the hard
wiring will send the data across the networks to the recipient.
When the recipient is reached, the process occurs in reverse, that
is, it will work its way back up the OSI model before reaching the
application level again.
TCP/IP MODEL
One of the main differences between the two models is that the
application layer, presentation layer and session layer are not
distinguished separately in the TCP/IP model [2], which only has an
application layer above the transport layer.
Application layer
This is equivalent to application, presentation and session layers in
the OSI model, dealing with higher-level application-based
processes. The applications use the services of the underlying lower
layers. For example, the transport layer provides pipes between
processes. The partners involved in this communication are
characterized by the application architecture, such as peer-to-peer
networking or the client-server model. At this layer reside the
application protocols such as SMTP, FTP, SSH and HTTP, each of
which has its own designated port.
Transport layer
Transport and network layers in the OSI model are concerned with
host-to-host transport of data. The transport layer uses the local or
remote networks, separated by routers, to perform host-to-host](https://image.slidesharecdn.com/37173-250320175918-7fae7170/85/Advanced-Cybersecurity-Technologies-1st-Edition-Ralph-Moseley-36-320.jpg)
![Assigned Numbers Authority (IANA)[3]. Typically, core network
services such as the web use well-known port numbers. Operating
systems require special privileges for particular applications to bind
to specific ports, as they are critical for the operation of the network.
Ports that are between port numbers 1024 and 49151 are known as
registered ports; these are used by vendors for their own server
applications. These ports are not assigned or controlled but can be
registered to prevent duplication.
Ports in the range 49152 to 65535 are dynamic ports, that is, they
are used for temporary or private ports. Vendors can register their
application ports with ICANN, so other vendors can respect their
usage and choose other unused ports from the pool.
UDP AND TCP
The Transmission Control Protocol (TCP) can be considered one of
the main protocols involved in the Internet protocol suite within the
transport layer. In fact, the entire suite is often known as TCP/IP,
noting its origins in the original initial network implementation. TCP
has several important characteristics – it provides reliable, ordered
and error-checked delivery of bytes between applications running on
hosts in an IP network. This includes web, file transfer, email and
remote administration. Secure Sockets Layer (SSL) and the newer
Transport Layer Security (TLS) cryptographic protocols often run on
top of TCP. These provide communications security over the
computer network.
TCP is connection-oriented, where a communication session has a
permanent connection established before data is transferred.
Another example of the application which uses TCP due to its
persistent connection is Secure Shell (SSH). This is a means of
operating network services using a cryptographic network protocol
over an unsecure network. SSH uses TCP port 22 and was designed
as a replacement for telnet and it should be said that SSH is not an
implementation of telnet with cryptography provided by SSL as is
sometimes thought.](https://image.slidesharecdn.com/37173-250320175918-7fae7170/85/Advanced-Cybersecurity-Technologies-1st-Edition-Ralph-Moseley-40-320.jpg)
![User Datagram Protocol (UDP) [4] is another member of the
Internet protocol suite at the transport layer. This protocol allows
applications to send messages, referred to as datagrams, to other
members of the IP network. In this instance, prior communications
are not required to set up communication channels. UDP is a simple
connectionless model with a very minimalistic protocol approach.
UDP utilizes checksums for data integrity and port numbers, which
address different functions at the source and destination of the
datagram. It does not have handshaking communication and,
therefore, there can be exposure to issues of unreliability if present
in the underlying network; it offers no guarantee of delivery,
ordering or duplication. If such features as error correction are
required, TCP or Stream Control Transmission Protocol may be a
better choice.
UDP is suitable for applications where dropped packets are
preferable to waiting for packets delayed in retransmission, within
real-time systems, such as media streaming applications (as lost
frames are okay), local broadcast systems (where one machine
attempts to find another, for example) and some games which do
not need to receive every update communication. Other systems
that use UDP include DNS and Trivial File Transfer Protocol, as well
as some aircraft control systems.
A good way of understanding the difference is by a comparison of
two applications. For example, email would be good by TCP, as all
the content is received and so understandable, with no missing
information, whereas video streaming is fine by UDP, because if
some frames are missing, the content is still understandable.
WEB SPECIFICS
The web can be seen as a separate entity which relies on the
Internet as its infrastructure. Another way to put it is that the web is
a way of accessing information over the medium of the Internet. The
web uses HTTP and HTTPS protocols to allow applications to
exchange data. The web uses browsers to access documents which](https://image.slidesharecdn.com/37173-250320175918-7fae7170/85/Advanced-Cybersecurity-Technologies-1st-Edition-Ralph-Moseley-41-320.jpg)
![are linked to each other via hyperlinks. These web pages can contain
a range of multimedia and text.
Both TLS and its deprecated predecessor SSL are used in web
browsing, email, instant messaging and voice over IP (VoIP).
The web is based on a client-server architecture, revolving around
the browser on the client side, with its various capabilities for
communication, running scripts and rendering web pages. Web
browsers run on various devices from desktops, laptops, to
smartphones. The most popular browser has been, for some time,
Google Chrome. As of 2020, the general share of browsers is around
Chrome 62% and Safari 20%, with Firefox at 4%. Others include
Samsung, Opera, Edge and IE, only taking small percentages.
The central idea of the browser is that of hyperlinks – the ability
to move between linked resources. The ideas for such systems have
actually been in place since the mid-1960s, by people such as the
futurist Ted Nelson [5], followed by his ideas being explored by Neil
Larson’s commercial DoS Maxthink outline program, in which angle
bracket hypertext jumps between files that are created. Others
developed this idea of linked resources, which initially were only
pages through to the 1990s.
Building on this hyperlink concept, the first browser was
developed by Tim Berners-Lee in 1990 and was called World Wide
Web, which was followed by the Line Mode Browser, which displayed
web pages on dumb terminals released in 1991. In 1993, Mosaic
was launched, which could be seem as the first true browser for
normal use by anybody. This had a graphical interface and led to the
Internet boom which occurred in the 1990s, leading to the rapid
expansion of the web. Members of the same team that developed
Mosaic went on to form their own company, Netscape, which
developed its own browser, named the Netscape Navigator in 1994,
which quickly became the more popular browser. In 1995, Microsoft
produced the Internet Explorer, leading to what has commonly
become known as the “browser war” with Netscape. However,
because Microsoft could bundle their software in the Windows
operating system, they gained a peak of 95% of browser uses by
2002.](https://image.slidesharecdn.com/37173-250320175918-7fae7170/85/Advanced-Cybersecurity-Technologies-1st-Edition-Ralph-Moseley-42-320.jpg)
Advanced Cybersecurity Technologies 1st Edition Ralph Moseley
- 1. Read Anytime Anywhere Easy Ebook Downloads at ebookmeta.com Advanced Cybersecurity Technologies 1st Edition Ralph Moseley https://ebookmeta.com/product/advanced-cybersecurity- technologies-1st-edition-ralph-moseley-2/ OR CLICK HERE DOWLOAD EBOOK Visit and Get More Ebook Downloads Instantly at https://ebookmeta.com
- 2. Recommended digital products (PDF, EPUB, MOBI) that you can download immediately if you are interested. Advanced Cybersecurity Technologies 1st Edition Ralph Moseley https://ebookmeta.com/product/advanced-cybersecurity-technologies-1st- edition-ralph-moseley-2/ ebookmeta.com Advanced Smart Computing Technologies in Cybersecurity and Forensics 1st Edition https://ebookmeta.com/product/advanced-smart-computing-technologies- in-cybersecurity-and-forensics-1st-edition/ ebookmeta.com Advanced Smart Computing Technologies in Cybersecurity and Forensics 1st Edition Keshav Kaushik (Editor) https://ebookmeta.com/product/advanced-smart-computing-technologies- in-cybersecurity-and-forensics-1st-edition-keshav-kaushik-editor/ ebookmeta.com Lazarus Rising 1st Edition Joseph Caldwell https://ebookmeta.com/product/lazarus-rising-1st-edition-joseph- caldwell/ ebookmeta.com
- 3. Histology A Text and Atlas With Correlated Cell and Molecular Biology Pawlina Md Faaa https://ebookmeta.com/product/histology-a-text-and-atlas-with- correlated-cell-and-molecular-biology-pawlina-md-faaa/ ebookmeta.com The University of Pennsylvania Today: Its Buildings, Departments, and Work Cornell M. Dowlin (Editor) https://ebookmeta.com/product/the-university-of-pennsylvania-today- its-buildings-departments-and-work-cornell-m-dowlin-editor/ ebookmeta.com First Bites A First in Series Collection Tropes to Love By Book 1 1st Edition Skye Alder https://ebookmeta.com/product/first-bites-a-first-in-series- collection-tropes-to-love-by-book-1-1st-edition-skye-alder/ ebookmeta.com Mathematical Physical Chemistry: Practical and Intuitive Methodology 3rd Edition Shu Hotta https://ebookmeta.com/product/mathematical-physical-chemistry- practical-and-intuitive-methodology-3rd-edition-shu-hotta/ ebookmeta.com Storyteller s Corner Carol Gatewood https://ebookmeta.com/product/storyteller-s-corner-carol-gatewood/ ebookmeta.com
- 4. On Freud s Formulations on the Two Principles of Mental Functioning The International Psychoanalytical Association Contemporary Freud Turning Points and Critical Issues Series 1st Edition Gabriela Legorreta https://ebookmeta.com/product/on-freud-s-formulations-on-the-two- principles-of-mental-functioning-the-international-psychoanalytical- association-contemporary-freud-turning-points-and-critical-issues- series-1st-edition-gabriela-le/ ebookmeta.com
- 9. First edition published 2022 by CRC Press 6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742 and by CRC Press 2 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN © 2022 Taylor & Francis Group, LLC CRC Press is an imprint of Taylor & Francis Group, LLC Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, access www.copyright.com or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. For works that are not available on CCC please contact mpkbookspermissions@tandf.co.uk Trademark notice: Product or corporate names may be trademarks or registered trademarks and are used only for identification and explanation without intent to infringe. Library of Congress Cataloging-in-Publication Data Names: Moseley, Ralph, author. Title: Advanced cybersecurity technologies / Dr. Ralph Moseley. Description: First edition. | Boca Raton : CRC Press, 2022. | Includes bibliographical references and index. Identifiers: LCCN 2021037788 | ISBN 9780367562274 (hbk) | ISBN 9780367562328 (pbk) | ISBN 9781003096894 (ebk) Subjects: LCSH: Computer security. | Computer networks--Security measures. | Cyberspace--Security measures.
- 10. Classification: LCC QA76.9.A25 M6735 2022 | DDC 005.8--dc23 LC record available at https://lccn.loc.gov/2021037788 ISBN: 9780367562274 (hbk) ISBN: 9780367562328 (pbk) ISBN: 9781003096894 (ebk) DOI: 10.1201/9781003096894 Typeset in Sabon by Deanta Global Publishing Services, Chennai, India
- 11. This book is dedicated to Professor Miltos Petridis, an inspiring academic and thoughtful Head of the Department of Computer Science at Middlesex University, along with all those others who passed away in the COVID-19 pandemic.
- 12. Contents Biography Abbreviations and Acronyms 1 Introduction 2 Web and network basics Networks Application layer Presentation layer Session layer Transport layer Network layer Data link layer Physical layer How the OSI model works TCP/IP model Application layer Transport layer Internet layer Link layer Protocols and ports
- 13. UDP and TCP Web specifics HTTP HTTP resources HTTP connections Conversations with a server UPnP Remote access protocols SSH Suggested projects and experiments Deploy Apache Deploy a Droplet or virtual server References 3 Cryptography Why we need cryptography Classical cryptography Substitution ciphers Frequency analysis Caesar cipher Vigenere cipher The one-time pad Modern algorithms Practical encryption engineering Encryption in Node.js Hashes Python cryptography
- 14. Steganography Terminology and basics Images Audio encryption Least significant bit (LSB) coding Phase encoding Spread spectrum Parity encoding Echo hiding DeepSound Using stenography practically Digital watermarking Suggested projects 4 Hacking overview Case histories – a context and background of hacks and hacker’s motivations Worms Viruses Deception File replication Trojan Botnets DDoS Motivations behind malware History Case history: Stuxnet
- 15. Case history: Michael Calce (Aka MafiaBoy) Case history: Jonathan James Case history: Gary McKinnon Case history: Lauri Love Huawei Techniques Spoofing email – the basis of phishing attack Bots and automated mechanisms References 5 Packet analysis and penetration testing Packet sniffing Wireshark Modifying Wireshark Analysis with Wireshark Analyzing malware – Trickbot Conclusion Suggested projects 6 Social engineering Phishing Spear phishing Vishing Smishing Pretexting Water holing Baiting
- 16. Quid Pro Quo Tailgating Scareware Other varieties Social engineering process Research Engagement The attack The conclusion Social engineering countermeasures Training Frameworks and protocols Categorizing information Protocols Tests Resistance to social engineering Waste handling General advice Software protection Intelligence and research used for social engineering Sources Search engines Google Alerts Google/Bing images Using web archives Social media
- 17. Specialized search engines Media – documents, photographs, video Telephone numbers and addresses Online tracing with IP addresses and presence Conclusions References 7 Cyber countermeasures Introduction Training Firewalls Linux Cloud Shields Malware detection Websites Antivirus Ransomware Keep backups! Conclusions Reference 8 Incident response and mitigation Example: Malware outbreak Remediation – clear and hold Misunderstanding threats Mistiming of response
- 18. Gauging the severity of an incident – triage Analysis Containment Terminate Failing to verify Recovery The notification process European Union – GDPR Ransomware Individual reporting Timing of breach notifications The notification Data privacy and protection in the United States Comparison of EU versus US privacy laws California Consumer Privacy Act Basic CIS controls Foundational CIS controls Organizational CIS controls Post-incident analysis and applying gained insights Ongoing preparedness Conclusions References 9 Digital forensics Introduction Low level
- 19. System level Application level Network level Storage level Tape Flash SSD USB memory devices Information retrieval Disk analysis Memory forensics Windows registry analysis Mobile forensics Network analysis Linux distributions Kali Linux Binwalk tool Bulk extractor tool HashDeep tool Magic rescue tool Scalpel tool Scrounge-NTFS tool Guymager tool Pdfid tool Pdf-parser tool Peepdf tool img_cat tool
- 20. ICAT tool Srch_strings tool Parrot BlackArch Linux BackBox Linux ForLEx Technique Preservation Collection Examination Analysis Analysis techniques Targeted searches Constructing timelines and events Utilizing log files Computer storage analysis Moving files Deleted file reconstruction Directory restoration Temporal analysis Time bounding Dynamic temporal analysis Conclusions References 10 Special topics: Countersurveillance in a cyber-intrusive world
- 21. Where is detection of an individual in the electronic domain possible? Strategies for avoidance Deletion Obfuscation Network Tor Identity Defeating profiling and identity capture False tells One name, many people Identifying device shuffling Obfuscation agents and automated stealth Suggested projects Resource scanner Hardware-based memory shredder References 11 Special topics: Securing the Internet of Things (IoT) Introduction The use of crypto-integrated circuits Comparison of crypto ICs Wi-Fi connection Cloud connectivity and dashboard Security by design in IoT devices
- 22. Network devices with possible network weaknesses Modems Routers Home appliances Cameras Environment sensors Automation Automotive Streaming devices Body sensors Arduino IoT Suggested projects IoT robot with encrypted communication channels Encrypted chat system (hardware based) References Index
- 23. Biography Dr. Ralph Moseley is a senior lecturer in computer science and cyber security at Middlesex University, London. He has acted as a consultant in the security of organizations and businesses, as well as an expert witness for the Metropolitan Police. His research areas include applying artificial intelligence techniques within cyber defense and brain–computer interface techniques to train mental states. As well as this, Ralph is a keen yoga and meditation teacher who can often be found creating virtual worlds online. eResources are available at www.routledge.com/9780367562328.
- 24. Abbreviations and Acronyms 3DES Triple Data Encryption Standard AE Authenticated Encryption AES Advanced Encryption Standard ANSI American National Standards Institute APT Advanced Persistent Threat ASCII American Standard Code for Information Interchange AV Anti-virus CAPTCHA Completely Automated Public Turing Test to Tell Computers and Humans Apart CBC Cipher Block Chaining CBC-MAC Cipher Block Chaining Message Authentication Code CCA Chosen Ciphertext Attack CERT Computer Emergency Response Team CHAP Challenge Handshake Authentication Protocol CMS Content Management System CNC Cipher Block Chaining CND Computer Network Defense CPA Chosen Plaintext Attack CRC Cyclic Redundancy Check CSO Chief Security Officer CTR Counter CVE Common Vulnerabilities and Exposures DDoS Distributed Denial of Service DEM Data Encapsulation Mechanism
- 25. DES Data Encryption Standard D-H Diffie Hellman key exchange DNS Domain Name Server DoD Department of Defense DoS Denial of Service DSA Digital Signature Algorithm ECB Electronic Code Book ECC Elliptic Curve Cryptography FTP File Transfer Protocol HMAC Keyed-Hash Message Authentication Code HTTP Hypertext Transfer Protocol HTTPS Hypertext Transfer Protocol Secure IA Information Assurance IEEE Institute of Electrical and Electronics Engineers IETF Internet Engineering Task Force IMAP Internet Message Access Protocol ISO International Organization for Standardization JSON JavaScript Object Notation KEK Key Encryption Key KPK Key Production Key LFSR Linear Feedback Shift Register LSB Least Significant Bit MAC Message Authentication Code MD Message Digest MD5 Message Digest 5 MEK Message Encryption Key MITM Man in the Middle MSB Most Significant Bit NCSA National Cyber Security Alliance NIST National Institute of Standards and Technology
- 26. OSINT Open Source Intelligence OTP One Time Pad PGP Pretty Good Privacy PKC Public Key Cryptography PRF Pseudo Random Function PRG Pseudo Random Generator PRP Pseudo Random Permutation RAM Random Access Memory RFC Request for Comments RSA Rivest, Shamir, Adleman SHA Secure Hash Algorithm SHTTP Secure Hypertext Transfer Protocol SIEM Security Information and Event Management SKE Symmetric Key Encryption SSH Secure Shell SSL Secure Socket Layer SSO Single Sign On TCP/IP Transmission Control Protocol / Internet Protocol TDEA Triple Data Encryption Algorithm TKIP Temporal Key Integrity Protocol TLS Transport Layer Security uPNP Universal Plug and Play URI Uniform Resource Indicator URL Uniform Resource Locator USB Universal Serial Bus VPN Virtual Private Network WEP Wired Equivalent Privacy WPA Wi-Fi Protected Access WPA2 Wi-Fi Protected Access II WPS Wi-Fi Protected Setup
- 27. WWW World Wide Web XEX Xor-Encrypt-Xor XOR Exclusive OR ZKP Zero Knowledge Proof
- 28. Chapter 1 Introduction DOI: 10.1201/9781003096894-1 As network systems have become ever more complex, with increased speeds and capacities for storage expanded, the need for security to guard against intrusion or even accidental disclosure of private or sensitive information has increased. This growth in complexity of systems has been coupled with ever-more sophisticated attacks on systems. Threats have increased at various levels whether personal, commercial or military. Systems are under threat from individuals, special interest groups or even nation-states, with armies of hackers. At each of these levels there is a substantial capability which arises from weaknesses in networks or computer operating systems and the ability to develop tools which attempt automated entry or denial of use. This automation of attacks has seen the rise of script development that attempts known hacks, hijacks and probing for bugs in networked systems; the scripts themselves are easily available in the darker corners of the Internet. These require only the rudiments of knowledge to run if the attacker is motivated enough. At another level, there is the capability to build bots which have this knowledge and can roam freely, perhaps assessing systems, reporting back and even replicating themselves to wreak untold havoc on systems. Technical capability and the automation of threats can also be leveraged with social engineering techniques, or intelligence work, to target individuals or groups. Background research, revealing a target’s interests and basic personal details, can often create an opening for more social contact, which brings about the ability for a much deeper attack, perhaps to steal financial information or to apply extortion.
- 29. Artificial Intelligence (AI), which has many positive uses, also has the capability to both defend systems against attack and to be the perpetrator itself. It may be that AI systems will be matched against each other. Each of these instigators of attack can find many ways into systems through weaknesses in operating systems, firmware in devices, web browsers and emails. This book will look at how information can be made secure, by exploring methods of attack (and by revealing this, how they can be thwarted) as well as emerging technologies in the field. While technology is obviously key, a large component and often the weakest link in the chain is often the human component, so this too will be at the forefront of this investigation. Chapter 2 discusses the basics of network and web technology to set the context for the work that follows. This provides an outline of the topography, architecture and basic protocols used. Chapter 3 discusses the basis of information security with a thorough exploration of cryptography and its allied subjects, such as steganography and digital watermarking. To provide ultimate security of information and to ensure it is seen by only those for who it is intended, cryptography is outlined from the more classical beginnings, through to the advanced techniques that are utilized today. Emerging technologies in this area are also detailed. This chapter gives examples and code and explores which cryptography techniques are suitable for programming projects. Often, programmers simply choose from libraries an encryption module without knowing its level of security or its suitability for the task in hand. For example, there can be a lot of difference between encryption for a stream of live data to one which hides a file. Therefore, a guide is provided for some special cases of encryption and hiding of messages such as steganography, as well as an exploration of future possibilities and mechanisms for development of systems. Chapter 4 discusses the basics and background of hacking, outlining a brief general history, before moving into a detailed review of particular cases, then on to current practices, common
- 30. weaknesses and types of attack. Here a wide review of hacking is given – from networks, Internet-connected devices, embedded systems, through to PCs, laptops and mobile phones. The chapter discusses in detail the actual mechanisms used for an attack, referring to some of the systems mentioned in the overview chapter. Code is outlined to show how simple automated attacks occur and how more intelligent bots can be built, which replicate or recover from faults as they traverse the net, providing ever-more robust means to attack. Chapter 5 the discusses in detail the tools used, along with penetration testing. As detailed previously, one of the most important aspects of the challenge of security is social engineering – the vulnerability of a technological system via the human user. In Chapter 6, this is examined in detail, focusing on the psychology and ability of users to be manipulated into providing the necessary details for a more technical attack. It is shown here that prior to any engagement with the user, or their system, the primary work is one of intelligence research into the target by gaining insight through their social media, and interactions through the web or more covert means. After detailed information about the attack on targets, the book moves on to Chapter 7, discussing countermeasures, that is, what can be done to protect. Of course, knowing the techniques used gives a user knowledge to defend but there are useful tools that can be deployed, which enable some degree of protection. As well as tools, a user can be trained to avoid particular behavior or to avoid systems which are in some sense compromised. Coding techniques are shown for common problems, whether it be spambots or more contrived attacks on servers. It is often the case that a programmer or system developer is telephoned at some late hour to be told that their system is currently under attack – how to respond? Chapter 8 provides ways of dealing with such an event and maps out the protocols that should be followed, whether dealing with an ongoing assault or finding the result of one through to looking for possible evidence of covert surveillance or system manipulation from outside.
- 31. Once an attack has occurred and the scene or evidence secured, what should be checked? What is useful and again, what routines need to be followed to preserve and make use of logs and states of systems. Chapter 9 focuses on these issues. Following this are a couple of special topics chapters based on cyber countersurveillance and cyber-physical IoT security. These chapters look at the cutting edge and bleeding edge of the developments which build on the previous practical work in the book. Chapter 10 examines ways of decreasing an individual’s digital presence or utilizing techniques which can circumvent intrusion, or capturing of unnecessary data by unwanted organizations, businesses and suchlike. Chapter 11 looks closely at embedded systems and the latest developments and capabilities for deploying hardware securely, particularly with reference to cloud and networked devices. This book is written with a university course in cybersecurity in mind, though any trainee or interested individual will gain from it. The book is written in a progressive manner, building up knowledge of an area and providing an opportunity for practical exploration. This comes in the form of code or experimenting with the tools mentioned. Online resources are available, including code from the book, utilities and examples at https://simulacra.uk/act.zip
- 32. Chapter 2 Web and network basics DOI: 10.1201/9781003096894-2 The Internet and networks in computing have undoubtedly been around a lot longer than we think; as soon as information is created and held in an electronic system, it will have been the desire of those around to store it at multiple points. This distribution of the information is great for those whose access is desired but not so much a good idea in terms of security, if there are those who can, perhaps, casually access it. This demonstrates the need for appropriate security mechanisms. Electronic systems have particular physical attributes, architectures, topologies and protocols which can be under attack from an adversary or snooper. It is, therefore, important to have some idea of those qualities which exist in these systems first, before dwelling on particular techniques that hackers use or system developers utilize as defense. An electronic system that stores information does so by holding that information in devices saving state in a memory medium, which in the past has been magnetic, as in a tape, drums, disks and suchlike, as well as optical or solid state. These information stores are connected by networks and processed by CPUs. It should also be mentioned that as well as this storage and processing, there are methods of input, such as keyboard, mouse and voice, as well as output, which could be a screen or print out, for example. Security weaknesses in the past have been found at each of these mentioned points.
- 33. NETWORKS Networks provide the main transit for information, and because of this, they are subject to scrutiny and attack. The basic model of network communication can be visualized as in Figure 2.1. Figure 2.1 Network topology. The usual way to conceptualize a network in computing and electronics engineering is through the Open Systems Interconnection (OSI) model (see Figure 2.2) [1].
- 34. Figure 2.2 OSI model. This is characterized by several layers of abstraction. Application layer The function of this layer is high-level APIs, remote file sharing and resource sharing in general. Presentation layer This layer is concerned with the translation of data between a networking service and an application. This could be data compression, character encoding and encryption or decryption.
- 35. Session layer The functionality of the session layer is concerned with managing communication sessions, such as the continuous exchange of information in the form of back-and-forth transmission between nodes. Transport layer This layer deals with the reliable transmission of data segments between points on a network, including segmentation, acknowledgement and multiplexing. Network layer The network layer functionality includes the structuring and managing of multi-node networks, including addressing, routing and traffic control. Data link layer Here the reliable transmission of data frames between two nodes connected by a physical layer is the main concern. Physical layer Finally, the physical layer is focused on the transmission and reception of raw bit streams over a physical medium. Another model which is useful to compare with the above OSI here is the TCP/IP model. HOW THE OSI MODEL WORKS The layers work together to form a mechanism of communication between systems at various levels of abstraction. How this works in practice can be understood by an example of its use and envisaging the movement of packets within a network. An email client, such as
- 36. MS Outlook, has data which resides at Layer 7 – the application layer. When an email is written and send is pressed, the data works its way down the OSI layers one by one and through the network. The data first works through the presentation and session layers, before entering the transport layer; here, the email will be sent by SMTP. The data will move through the network layer into the data link. The packets eventually reach the physical layer, where the hard wiring will send the data across the networks to the recipient. When the recipient is reached, the process occurs in reverse, that is, it will work its way back up the OSI model before reaching the application level again. TCP/IP MODEL One of the main differences between the two models is that the application layer, presentation layer and session layer are not distinguished separately in the TCP/IP model [2], which only has an application layer above the transport layer. Application layer This is equivalent to application, presentation and session layers in the OSI model, dealing with higher-level application-based processes. The applications use the services of the underlying lower layers. For example, the transport layer provides pipes between processes. The partners involved in this communication are characterized by the application architecture, such as peer-to-peer networking or the client-server model. At this layer reside the application protocols such as SMTP, FTP, SSH and HTTP, each of which has its own designated port. Transport layer Transport and network layers in the OSI model are concerned with host-to-host transport of data. The transport layer uses the local or remote networks, separated by routers, to perform host-to-host
- 37. communication. It is this layer which sets up a channel of communication which is needed by the applications. The basic protocol at this level is UDP, which provides an unreliable connectionless datagram service. TCP provides flow control and the establishment of the connection, together with the reliable transmission of data. Internet layer The Internet layer is concerned with the exchange of datagrams across network boundaries, providing a uniform network interface that hides the underlying network connections’ topology or layout. It is, therefore, this layer which provides the actual capability to internet-work; in effect, it establishes and defines the Internet. It is this layer which defines the routing and addressing capabilities that are used in the TCP/IP protocols, the main one of which is the Internet Protocol, which define the IP addresses. In routing, its function is to transport datagrams to the next host. Link layer This is the data link layer in the OSI model, concerned with the network interface and specifically the local network link where hosts communicate without routers between them. Typically, these models allow conceptualization of the process of communication between source and destination. This leads us to the question of why these models are of interest to anyone studying cyber security. Understanding the layers gives a way of seeing information in transit and a way of looking at how weaknesses occur at various points. For example, an attack at layer 1, the physical aspect, is an attack on the cabling and infrastructure used to communicate. This kind of disruption could be as simple as cutting through a cable to disrupt signals. The OSI data link layer focuses on the methods for delivering data blocks, consisting of switches which utilize specific protocols, such as Spanning Tree Protocol (STP) and Dynamic Host
- 38. Configuration Protocol (DHCP). An attack at this layer may target the insecurity of protocols used, or even the routing devices themselves and their lack of any hardening. The switches themselves are concerned with LAN connectivity and any attack may be from within the organization. This layer can also be attacked by MAC flooding or ARP poisoning. To resolve these kinds of issues, network switches can be hardened and techniques such as ARP inspection can be utilized or, unused ports can be disabled, as well security on VLANs can be enforced. At level 3, the network layer IP protocols are in use and common attacks involve IP packet sniffing DoS attacks based on Ping floods and ICMP attacks. Unlike layer 2 attacks, which occur within the LAN, layer 3 attacks can be performed remotely via the Internet. To circumvent such attacks, routers can be hardened and packet filtering along with routing information can be added and controlled. The transport layer 4 utilizes TCP/IP and UDP as protocols, and the techniques used in the attack here focus on port scanning to identify vulnerable or open ports. The key to resolving these kinds of problems are effective firewalls, which lock down ports and seal off this kind of attack, thus mitigating risks of this nature occurring at this level. Beyond layer 4, the main form of attack is through applications which come about through poor coding, bugs and suchlike. There are many types of vulnerabilities which can be exploited through specific types of attack, such as SQL injection, where, for example, the software engineer has not correctly allowed for invalid input. Injected code into the SQL database could extract data. Here the main aim in mitigating such an issue is to ensure good software engineering practices are adhered to. PROTOCOLS AND PORTS Any communication between parties requires a set of rules which are understood between those involved. Someone speaking Chinese has a differing protocol set applied to their language than say, English. A mutually understood change of rules and symbols used is required to
- 39. allow for the exchange of meaningful information. Similarly, to communicate between computer systems, there need to be rules and interface points. The rules, or agreed means of communicating, are known as protocols, while the interface points, which are assigned protocols, are known as ports. A system, whether it be a full-blown PC or an embedded controller, will have many ports, each with an assigned protocol. While the list of ports is extensive, some of the more common ones are listed below: 20 File Transfer Protocol (FTP) Data Transfer 21 File Transfer Protocol (FTP) Command Control 22 Secure Shell (SSH) Secure Login 23 Telnet remote login service, unencrypted text messages 25 Simple Mail Transfer Protocol (SMTP) E-mail routing 53 Domain Name System (DNS) service 67, 68 Dynamic Host Configuration Protocol (DHCP) 80 Hypertext Transfer Protocol (HTTP) used in the World Wide Web 110 Post Office Protocol (POP3) 119 Network News Transfer Protocol (NNTP) 123 Network Time Protocol (NTP) 143 Internet Message Access Protocol (IMAP) Management of digital mail 161 Simple Network Management Protocol (SNMP) 194 Internet Relay Chat (IRC) 443 HTTP Secure (HTTPS) HTTP over TLS/SSL Port numbers are divided into three ranges: well-known ports (also named system ports), registered ports and dynamic or private ports. System ports range from 0 through 1023. The ranges and ports themselves are defined by convention, overseen by the Internet
- 40. Assigned Numbers Authority (IANA)[3]. Typically, core network services such as the web use well-known port numbers. Operating systems require special privileges for particular applications to bind to specific ports, as they are critical for the operation of the network. Ports that are between port numbers 1024 and 49151 are known as registered ports; these are used by vendors for their own server applications. These ports are not assigned or controlled but can be registered to prevent duplication. Ports in the range 49152 to 65535 are dynamic ports, that is, they are used for temporary or private ports. Vendors can register their application ports with ICANN, so other vendors can respect their usage and choose other unused ports from the pool. UDP AND TCP The Transmission Control Protocol (TCP) can be considered one of the main protocols involved in the Internet protocol suite within the transport layer. In fact, the entire suite is often known as TCP/IP, noting its origins in the original initial network implementation. TCP has several important characteristics – it provides reliable, ordered and error-checked delivery of bytes between applications running on hosts in an IP network. This includes web, file transfer, email and remote administration. Secure Sockets Layer (SSL) and the newer Transport Layer Security (TLS) cryptographic protocols often run on top of TCP. These provide communications security over the computer network. TCP is connection-oriented, where a communication session has a permanent connection established before data is transferred. Another example of the application which uses TCP due to its persistent connection is Secure Shell (SSH). This is a means of operating network services using a cryptographic network protocol over an unsecure network. SSH uses TCP port 22 and was designed as a replacement for telnet and it should be said that SSH is not an implementation of telnet with cryptography provided by SSL as is sometimes thought.
- 41. User Datagram Protocol (UDP) [4] is another member of the Internet protocol suite at the transport layer. This protocol allows applications to send messages, referred to as datagrams, to other members of the IP network. In this instance, prior communications are not required to set up communication channels. UDP is a simple connectionless model with a very minimalistic protocol approach. UDP utilizes checksums for data integrity and port numbers, which address different functions at the source and destination of the datagram. It does not have handshaking communication and, therefore, there can be exposure to issues of unreliability if present in the underlying network; it offers no guarantee of delivery, ordering or duplication. If such features as error correction are required, TCP or Stream Control Transmission Protocol may be a better choice. UDP is suitable for applications where dropped packets are preferable to waiting for packets delayed in retransmission, within real-time systems, such as media streaming applications (as lost frames are okay), local broadcast systems (where one machine attempts to find another, for example) and some games which do not need to receive every update communication. Other systems that use UDP include DNS and Trivial File Transfer Protocol, as well as some aircraft control systems. A good way of understanding the difference is by a comparison of two applications. For example, email would be good by TCP, as all the content is received and so understandable, with no missing information, whereas video streaming is fine by UDP, because if some frames are missing, the content is still understandable. WEB SPECIFICS The web can be seen as a separate entity which relies on the Internet as its infrastructure. Another way to put it is that the web is a way of accessing information over the medium of the Internet. The web uses HTTP and HTTPS protocols to allow applications to exchange data. The web uses browsers to access documents which
- 42. are linked to each other via hyperlinks. These web pages can contain a range of multimedia and text. Both TLS and its deprecated predecessor SSL are used in web browsing, email, instant messaging and voice over IP (VoIP). The web is based on a client-server architecture, revolving around the browser on the client side, with its various capabilities for communication, running scripts and rendering web pages. Web browsers run on various devices from desktops, laptops, to smartphones. The most popular browser has been, for some time, Google Chrome. As of 2020, the general share of browsers is around Chrome 62% and Safari 20%, with Firefox at 4%. Others include Samsung, Opera, Edge and IE, only taking small percentages. The central idea of the browser is that of hyperlinks – the ability to move between linked resources. The ideas for such systems have actually been in place since the mid-1960s, by people such as the futurist Ted Nelson [5], followed by his ideas being explored by Neil Larson’s commercial DoS Maxthink outline program, in which angle bracket hypertext jumps between files that are created. Others developed this idea of linked resources, which initially were only pages through to the 1990s. Building on this hyperlink concept, the first browser was developed by Tim Berners-Lee in 1990 and was called World Wide Web, which was followed by the Line Mode Browser, which displayed web pages on dumb terminals released in 1991. In 1993, Mosaic was launched, which could be seem as the first true browser for normal use by anybody. This had a graphical interface and led to the Internet boom which occurred in the 1990s, leading to the rapid expansion of the web. Members of the same team that developed Mosaic went on to form their own company, Netscape, which developed its own browser, named the Netscape Navigator in 1994, which quickly became the more popular browser. In 1995, Microsoft produced the Internet Explorer, leading to what has commonly become known as the “browser war” with Netscape. However, because Microsoft could bundle their software in the Windows operating system, they gained a peak of 95% of browser uses by 2002.
- 43. The Mozilla Foundation was formed in 1998, by Netscape. This created a new browser using the open-source software model, which finally evolved into Firefox, released by Mozilla in 2004, which went on to gain a 28% market share in 2011. Apple too developed their own browser, Safari, in 2003, which although dominant on their own platforms was not popular elsewhere. Google released its own browser, Chrome, in 2008, which overtook all others by 2012, remaining the most dominant since this time. Over time browsers have expanded their capabilities in terms of HTML, CSS and general multimedia, to enable more sophisticated websites and web applications. Another factor which led to this is the increase in connection speeds, which allowed for content which is data-intensive, such as video streaming and communications that were not possible in the web starting years with dial-up modem devices. The prominence of Google Chrome led to the development of the Chromebook, first released by several vendors, such as Acer, Samsung and Google themselves in 2011 – a laptop system which is driven by the Chrome browser at its core, controlling many of its features and capabilities. Chromebooks by 2018 made up 60% of computers purchased for schools. HTTP Hypertext Transfer Protocol (HTTP) is a protocol used by applications in the collaborative, hypermedia information system known as the web. The main idea being the ability to link documents and later resources simply by clicking the web page at specific points. HTTP has a long history of development since its early development back in 1989 by Tim Berners-Lee at CERN. HTTP/1.1 was first documented in 1997, with further developments in 2015, as HTTP/2 with HTTP semantics and then HTTP/3 in 2019 added to Cloudflare and Google Chrome. Each revision brought new improvements, for example, in HTTP/1.0, a separate connection to the same server was made for each request, whereas in HTTP/1.1, a single connection
- 44. can be used multiple times to download web page components such as images, stylesheets, scripts etc., which may take place when the page has actually been delivered. This obviously improved latency issues involving TCP connection establishment which creates significant overheads. Within the client-server computing model, HTTP functions as a request-response model, with the client typically running the browser and the server hosting a website. The client, via the browser, submits an HTTP request message to the server which then provides, in return, resources such as HTML and multimedia in response. The response message also contains metadata such as whether the request was successful and the information itself in its main body. HTTP utilizes intermediate network elements to allow better communication to take place between the clients and servers involved, for example, high-traffic websites can use web cache servers to deliver content to improve response time. Caches can also be used in the web browser to help reduce network traffic. Also, HTTP proxy servers can allow communication for clients acting as gateways where they do not have a globally routable address, acting as relays between external servers. HTTP is designed within the framework of the Internet protocol suite at the application layer. It is built upon the transport layer protocol specifically; TCP is used though HTTP can be adapted to use the unreliable UDP. An example of this is the adapted version HTTPU utilized by Universal Plug and Play (UPnP) for data transfer and also Simple Service Discovery Protocol (SSDP), primarily utilized for advertising services on a TCP/IP network and discovering them. HTTP RESOURCES One of the main aspects of the web is the ability to link pages and resources, this is done through Uniform Resource Locators (URLs) (see Figure 2.3) using the Uniform Resource Identifiers (URIs) schemes for http and https. For example:
- 45. Other documents randomly have different content
- 46. "We understand, Professor Kane." "Then you'll send someone up immediately with a key!" "Please don't get upset. The Staff has been busy, but now the Staff will soon be with you." The Staff.... "I just want a key, I want to get the hell out of here!" Kane yelled several times into the phone after the click, but no voice came back. He had grabbed up the table, the metal table at the head of the bed, and flung it into the wall before he realized what he was doing. The shadows moved toward him. Phil, Laura, Ben, Jenny, Lawrence, Lucille, all the others, nameless, what did it matter anyway, their names? They were smiling, holding out their arms to him. Compassionate, sympathy, they had it all. All they wanted to do was help him. He ran through them back toward the bathroom. It was still full of men from the downstairs john. "What time is it?" Kane yelled at someone with a paper towel pressed to his eyes. "'Bout three I'd say, what a night!" "Three—" Three o'clock in the morning, but the fact was Kane wasn't sure about the day. He backed out of the bathroom, slammed the door. "The Staff is ready, Prof," Phil said. "We're all with you, aren't we?" Laura giggled. The closet. Kane ran into the closet and slammed the door. There was something immediately cozy in the narrow black confines of the closet. Either closet walls weren't TV screens, or they had decided to let him sleep at last. Probably the former. Better convert closets to Television. In
- 47. case kiddies misbehave and get locked in the closet, they'll not be alone in there.... He curled up on the floor in the pitch blackness and almost immediately began to drift off into sleep. The narrow darkness tightened around him like a thick comforting blanket on a cold night.... Sometime later—he had no idea how much time had passed—a light was blinking at his lids. He opened them slowly and stared into a flickering yellow eye. A doorhinge creaked. Up there somewhere a voice said pleasantly: "Professor Kane, your Staff is here." "Staff?" he whispered, trying to see above the blinking light. "We're here." The TV walls were dead now, but that was hardly consoling. The overhead light was glaring with an intense whiteness. The three members of the Staff were busy, and Kane was being Tested. Kane had emerged from the closet determined to remain as rational as possible, to control his emotions, and find out what he could about his human rights as an individual. That was easy to find out and only required a few questions honestly and frankly answered. As a minority, Kane had no rights whatsoever. He had one big right, the right to think as the majority did. But that didn't count for much yet because Kane was ill, maladjusted and had anti-group feeling. The Staff was going to test him, find out what was wrong with Kane. And this of course implied that when they found out what was wrong, the difficulty would be taken care of.
- 48. The Staff was kind, considerate, almost excessively polite considering the circumstances. They were young efficient men with crewcuts, briefcases, and wearing tight conservative dark suits. Only slight differences in build distinguished them one from another, but this superficial outward difference only seemed to emphasize the Staff's basic unity, its Group Spirit, its Staff Consciousness. Every public institution, every business establishment, every school, club, hotel, factory, office building—in short, everywhere that people congregated in official Groups, there was a regular Staff on duty twenty-four hours a day. They were Integrators. Glorified personnel men. Electrodes were clamped on Kane's head and wrists. Something was strapped around his chest. Wires ran into a miniature Reacto. A stylus began to make jagged lines on a strip of moving tape. "We're getting a complete personality checkup," the Staff said. It was indeed complete. It was as complete as a personality checkup could be short of an actual dissection. Kane looked at countless ink-blots. He was shown a great many pictures and whether he answered verbally or not was of no concern of the Staff. Whatever his reactions were, they were all analyzed by the machines. Words weren't necessary. The Staff had a shortcut to personality checkups. From the mind right into the machine. The Staff only interpreted the results, or maybe they didn't even do that. It was more likely that machines did that too. Kane protested for a while, but he was too tired to protest very long. He asked them a great many questions, and they answered them willingly enough—up to a point. They were interested in his questions too. He was an interesting symptom, but actually he knew that they already had him pretty well tabbed. They answered his questions the way big-hearted adults answered inquisitive children.
- 49. "We must," the Staff said, "determine why you don't fit in." Kane talked about his work, his theories, his years of devotion to what he had always considered to be a contribution to society. They hardly seemed interested. What good was all that—astronomy and such—when a man was not happy with others? "What about this aversion to people?" the Staff said, in a kindly way. "This—well—clinically, this de-grouping syndrome. This antagonism to the group spirit." "You mean my reaction to Phil and his friends?" "Your friends. Your Group," The Staff said. "But I don't dislike those people," Kane insisted. "Certainly, I have no aversion to them! Hell, I don't even know them." "But they're people," the Staff said. "Part of the family of man." "I know that. But I was tired and wanted to sleep!" "You'll find the true group Spirit," the Staff said. "Let us ask you this, Professor Kane. If you really had no aversion to people generally, why would you object to them being with you? Why should the presence of people disturb your sleep? Wouldn't a healthy person enjoy sleeping with others merely because they were there? Doesn't one sleep best among friends, knowing he isn't alone, knowing even his sleep is shared—" There was a great deal more, but it all boiled down to the same thing. Kane was wrong. And he didn't have the right to be wrong. They, or rather it, the Staff, seemed to concentrate on the whole question of why Kane had ever volunteered for a job demanding
- 50. extreme isolation in the first place. The point was that apparently Kane had been anti-social, a Group Spirit deviant from the beginning. Kane tried to explain it, calmly at first, then more emotionally. Either way, he knew that whatever he said was only additional grist to their syndrome recording mill. Being alone in order to do certain kinds of work demanding isolation seemed to be beside the point. The point was that being on the Moon deprived a man of Groups. It was a kind of psychological suicide. Now that he was back home they would straighten him out. The question of returning to the Moon was ignored. To them, this was an absurdity. What did Kane want? Kane was in no position to know what he really wanted—yet. They were going to help him decide what he really wanted. But they already knew that. It only remained for Kane to agree with them. The majority was always right. He explained his values to them. They listened. He told them that as far as he was concerned the social setup was now deadly, a kind of self-garrisoned mental concentration camp in which free thought was impossible. A stagnate, in fact a regressive state of affairs. Proficiency in skills would go, science would die. A herd state. Individuality lost. Depersonalized. Tyranny of the Majority. Integration mania. Collective thinking. Mass media. Lilliput against Leviathan.... But Kane wasn't happy, that was the important thing wasn't it? Could a knowledge of how rapidly the Universe was expanding contribute to the happiness of a human being living on Madison Avenue in Manhattan? Obviously the answer to that was no. Kane was going to be happy. He wouldn't concern himself with the stars any more. He wouldn't practice a self-imposed barren isolation of himself any more. Kane was going to be happy. He was going to be one of the Group. Time went by. He was given sedatives. He slept at last. He awoke and was tested and went to sleep again, many times. He was fed too,
- 51. given injections with needles of energy and vitamins and proteins and glucose and carbohydrates, because he refused to eat any other way. Vaguely he remembered episodes of babbling under the influence of hypnotic drugs. He kept remembering the briefcase. In a dream the Group had it, throwing it around among them like a basketball. The clasp broke. The papers, thousands of papers spilled out and drifted away over New York and Kane was running through a maze looking up at them and then he was lost. Now he knew what had happened to the other Moon ships, and to the rest of the Captain's crew, where they had gone to and never come back from. Space was lonely and dark. Space was empty. Space was frightening. They had gone back to the closeness and warmth and security of their Group. How many were there left such as the Captain, and Kane—Kane for a while yet perhaps? How many were there? Could he escape? At some unrelated point on the Testing chart, the Staff closed up their briefcases, politely said good-bye, and left. The data would be run through more machines. Kane would be happy. All he had to do was wait. Kane awoke with a galvanic start and stared at the prison of his room. The walls began coming alive. Phil, Laura, Lucille, Herby, Clarence, Jenny, Ben, the happy happy Group, always there, always waiting,
- 52. always reliable, sharing everything, pleasure and pain. "How we feeling now, Prof," Phil yelled. He was stark naked. "You look so cuddly," Laura giggled, and for an instant there, Kane could almost feel her snuggling in beside him. Kane lay there in a dim superimposed puzzle of furniture, moving forms, corners of rooms jutting out of the wrong walls, bodies walking through beds and one another, and then a naked figure curving into the air, falling toward him in a graceful arc, down, getting larger and larger, plunging right for Kane's face. Kane rolled frantically. And then somewhere under him he heard a splash and there was the vague ripple of unreal water as Phil swam away across his cool blue pool. There—that was Laura, only in a boudoir, standing before a mirror wearing only a pair of very brief panties, and nothing else. Her reflection in the mirror smiled at Kane as she brushed her hair. "Morning, Prof honey. How we feeling this morning?" It was morning. Some morning on some day during some year. There was Lucille on this morning lying in a sunchair, her black hair shining in the sunlight somewhere. Probably in the Group house at Sunny Hill. In a while now, Kane knew, the Group would all go away together to their office, and they would do their work, concentrating on getting along together until they could return to Sunny Hill together. Lucille was reading a newspaper, and she glanced up at Kane. There was a pale line around her mouth and she pulled her eyes quickly away as though she didn't want to look at him. She wasn't like the others. She was different. Of course. It had to be a matter of degree. Nothing was black and white. There had to be differences of opinion, some degree of individuality—somehow. Somewhere. Perhaps Lucille — "Good morning, good morning to all of us!" Kane shouted suddenly.
- 53. "Did we have a good rest, Prof?" Phil was yelling from his pool. He seemed greatly pleased with Kane's enthusiastic social response. Not that Kane was really trying to fool anybody. He was pretty sure the Staff wouldn't be fooled. Somewhere the machines were scanning the data. Soon, the Staff would have a full analysis of Kane, what was wrong, and what would make it right. What he should have done, and what he should be. Jenny and Ben were making love on a couch. Kane tried to keep on watching them as though he suffered no embarrassment, but it was impossible. "I've a full schedule planned for today," Phil yelled up. "Soon we'll all be going to the Office. You'll be going with us soon too, Prof!" He would belong to the happy Group. Sharing everything. But maybe it wouldn't be this happy Group. Maybe the machines would decide that he belonged in some other Group. Whatever Group it was it would be happy. That was a fact. Could he escape? Could he, perhaps, get back to the La Guardia Pits, and the Captain of the Moonship? The windows still barred, paneled in metal. The door locked. If he managed to get out of this Single, say, and out of the Midtown Hotel, and into the street, then what? That didn't matter. If he could only get that far— Laura was standing there naked, close to Kane. "We're having our wedding at five," she whispered. "Who?" Kane said, startled. "Ben and Jenny. They're right for all of us together." From a number of rooms, people were watching Ben and Jenny being right for all of us together, but Kane couldn't look. "See us all," Laura shouted and dived through the floor. A spray of water spilled up and fell unfelt through Kane's flinching torso. Ben and Jenny ran away.
- 54. Kane was practically alone with Lucille. It was the first time in he had no idea now how long that he had been this much alone with any one other person. She glanced rather sadly at Kane above the paper she was reading. "You know how I feel, Lucie?" She nodded, almost imperceptibly. "How can you stand it, all the time this way?" he asked. "Some of us learn to be in it, with a part of us out of it. A kind of self- hypnosis, a retreat of some kind. Into fantasy, that's what it really is. But—but I don't think any of us can keep on doing it forever. We will all give way completely—sooner or later." "I've got to get out," Kane said. "Do you want to get out?" "It's impossible to get out." "I've got to try." "What's the use of trying if you know you can't get away? Where can anyone go?" "There must be people who break away," Kane said. "There have to be." "There's supposed to be an underground, some secret group of some kind that helps people get out." "Get out—where? Out of the country?" "It's pretty much like this everywhere. But there are supposed to be areas where it isn't. Islands somewhere. Hidden places right here in the country. Supposed to be places in the Kentucky Mountains, and in New Mexico, places like that." "The Moon," Kane said. "That's a place I know of. I've been there." Her eyes were bright for a moment. "I know. It must have been wonderful. Why on Earth did you ever leave?"
- 55. "I didn't know what it was like here. And—my wife died. I wanted and needed another wife. More than a wife really. Someone who could share that kind of a life with me, someone who would be interested in the work too." She turned quickly back to the paper. "You might be able to get out of the hotel," she said. "But you would be too conspicuous." "Because I would be traveling alone?" "Yes." "If you came with me, there would be two of us. We wouldn't be conspicuous that way." He saw the flush move up through her face. "Is that the only reason?" "You know it isn't." She knew it. They both knew it and had probably known it for a long time. They had a lot in common, a minority of two. And then he remembered. She wasn't really there in the Midtown with him. She was in Sunny Hill, wherever that was. They couldn't leave inconspicuously together because they weren't together now, and they couldn't get together without the Gang being together too. The rooms, furniture, sounds, everything began to fade. "Goodbye," Lucille said. "Get sick or something," Kane said quickly. "Don't go with the Group to work. Stay there, wherever you are! Stay there—" Faintly, her voice came to him out of a kind of melting mask of a face. "I'll try—" Kane was alone in the single room and the door opened. The smiling Staff came in and shut the door. The three of them stood there happily holding their briefcases.
- 56. "We're happy to report that we have completed your personality breakdown." The word was a bit premature, Kane thought. "What is it?" he asked. "Excellent," the Staff beamed. "You should never have been an astronomer. You took up that profession as a way of escaping from people. Actually, of course, you love people and hate your profession. "Have you determined what I should be if not an astronomer?" "Naturally, it's all in the breakdown." "What is it?" "Generally, you prefer physical work, not mental work. Mental work is a constant strain on your psychological balance. You have done it neurotically to reinforce your need to avoid people." "Physical work? What kind?" "Specifically, it seems that you are best suited for the profession of plumbing." "Plumbing?" Kane said. "Plumbing what?" "Plumbing, the art of pipe-fitting, the study of water mains, sewage lines, and so forth." "Plumbing." Kane said. "Of course, you react antagonistically to it now. But that will be changed." Kane had nothing against plumbers or plumbing. Once, as a kid, he remembered having a long interesting talk with a plumber who was unstopping the kitchen sink. He had fascinating tools, and at that time, Kane had said he would be a plumber when he grew up. But he had also wanted to be any number of other things when he grew up, including an astronomer. Now he had no desire whatsoever to be a plumber. Kane drew the metal bedside table up hard and the edge of it caught number one of the Staff under the chin. Kane attacked, violently. He
- 57. did it knowing that something more was at stake than his life—his identity. Number one fell down on his knees and whimpered. He wasn't hit hard. But he squatted there blubbering as though he had suffered some horrible shock. Numbers two and three gaped as though equally shocked without ever having been hit at all. That was Kane's initial advantage. The Staff seemed incapable of understanding that anyone would do what Kane was doing. Kane hit number two four times before number two covered up his face with his hands and started to cry. Kane ran him into the closet and locked the door. Number three swung his briefcase at Kane's head, fluttering his other hand wildly. Kane was heavier than he should have been because he was accustomed to the Moon. But he was desperate and that was some compensation. He had some experience, a very little, as a boxer in college, but that had been years ago. But as little experience as he had at this sort of thing, he was way ahead of number three. Number three kept swinging his briefcase, and Kane hit him on the chin and then in the stomach and then on the back of the neck. Number three lay unconscious on the floor. Kane stared at his bleeding knuckles a moment, then dragged Number one up onto his feet. "You're going to help me," Kane said. "We're getting a saucer and then we're going to Sunny Hill. You know where Sunny Hill is?" Number one ran his hand nervously through his dark brushcut. He had a boyish face that seemed deeply insulted by what Kane had done. Insulted and shocked as though he had been a good boy all his life and then someone had slapped his hand—for no reason at all. Kane doubled his fists. Number one winced and looked shocked again, and very frightened. A great deal more frightened than anyone
- 58. would be who was afraid only of physical injury. "Yes, that's part of a big Group Housing Project downtown." "Where can we get a saucer?" "The roof." "Unlock the door," Kane said. "And just pretend everything is happy and that we're relating beautifully to one another. Now listen—I'll kill you if you try anything else. I hope you believe it because I really will. What you fellows intend doing with me, as far as I'm concerned, is worse than murder." They stepped onto one of several saucers decorating the roof of the Midtown Hotel. The rotary blades in the ten foot platform whirred under them, and Kane felt the saucer rise up to a thousand feet, then dip downtown. The air was full of them and only some kind of sixth- sense seemed to keep them from jamming into one another. There was never less than two on a saucer. And Kane noticed that most of the saucers were flying in Groups like aimless geese. Kane jumped from the saucer and ran across the roof landing of the Sunny Hill project building. There were a number of them like huge blocks arranged in some incomprehensible plan. Kane glanced back to see number one leaping from the saucer and running in the opposite direction. Kane ran on toward the elevator. He knew he didn't have much time, but what bothered him was the authority he was running against. Public opinion was a general attitude, not a cop car, or a squad of officers with guns. Getting out of line, Kane figured, was usually its own punishment—isolation, loneliness, social ostracism. But what about the exception? The guy who fought conformity and the majority opinion. Who would they put on Kane? Or what? It would help to know what he was running from. What concrete force or power would try to stop him.
- 59. Then he saw her running toward him. Her face was flushed and the wind blew her dress tightly against her slim body as she stopped and looked at him. He took hold of her arm. "We've got to hurry," she said. "The Group knows I've run away. The Staff will be after me." Kane glanced at the elevator, then they ran back toward the saucer. "You'll have to pilot this thing," Kane said. "It's a little crowded up there for me." She started the motor and the saucer lifted abruptly. "The terminal at La Guardia?" she said. "No. The ship's at least two miles from the Terminal. We'll go directly to the ship." He hesitated. "The only thing is—it isn't due to blast out of here until the 25th." "That doesn't matter," she said. "Why doesn't it? We're flaunting the law. They're after us. They won't let us just hide away on that ship until the 25th." "They?" He stared at her. "You said yourself we had to hurry, because the Staff—" "But don't you see, there's no one to stop us now. The Staff at Sunny Hills could have, but here there isn't any Staff. There's none at the ship either, is there?" "No." "Well then, we'll just wait on the ship until—we go to the Moon." "But you were afraid, Lucie. You talked about undergrounds, and how it was impossible—" She touched his arm and then took hold of his hand. "You don't understand I guess. Maybe you never will."
- 60. "Understand what?" "What it is to try to get away, be alone, be by yourself, when you can't. When no matter what you do you're with the Group, night and day, even in your dreams. You knew it for a while, but imagine it for years, not days. There's no place to hide. Wherever you go the Group goes with you. That's why I said you couldn't get away—" "Then there isn't any law to prevent us from going to the Moon?" "Only the law of the majority, of Public Opinion," she said. "But you can't stay here and fight it, not for very long. Finally you have to give in to it. You become what they are or go mad. And there are Groups even for them." The saucer dropped down to the fog draped earth and they were walking toward the pits where the Moonship waited. It looked like such a wonderful world, he thought. Everyone happy, everyone smiling all the time. No wars. No externalized authority. The Manufacturers of consent. A quasi-totalitarian society in which means of communication had largely replaced force as the apparatus of compulsion. Communication, fear, insecurity. In his isolation and insecurity, man clung to his Group, to the majority, the accepted opinions. The majority did not need to force a man now. No need for police, or armies. They convinced him. The only way you could keep from being convinced was to get out. The hatch slid open. "Welcome aboard," the Captain said.
- 61. *** END OF THE PROJECT GUTENBERG EBOOK THE HAPPY HERD *** Updated editions will replace the previous one—the old editions will be renamed. Creating the works from print editions not protected by U.S. copyright law means that no one owns a United States copyright in these works, so the Foundation (and you!) can copy and distribute it in the United States without permission and without paying copyright royalties. Special rules, set forth in the General Terms of Use part of this license, apply to copying and distributing Project Gutenberg™ electronic works to protect the PROJECT GUTENBERG™ concept and trademark. Project Gutenberg is a registered trademark, and may not be used if you charge for an eBook, except by following the terms of the trademark license, including paying royalties for use of the Project Gutenberg trademark. If you do not charge anything for copies of this eBook, complying with the trademark license is very easy. You may use this eBook for nearly any purpose such as creation of derivative works, reports, performances and research. Project Gutenberg eBooks may be modified and printed and given away—you may do practically ANYTHING in the United States with eBooks not protected by U.S. copyright law. Redistribution is subject to the trademark license, especially commercial redistribution. START: FULL LICENSE
- 62. THE FULL PROJECT GUTENBERG LICENSE
- 63. PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK To protect the Project Gutenberg™ mission of promoting the free distribution of electronic works, by using or distributing this work (or any other work associated in any way with the phrase “Project Gutenberg”), you agree to comply with all the terms of the Full Project Gutenberg™ License available with this file or online at www.gutenberg.org/license. Section 1. General Terms of Use and Redistributing Project Gutenberg™ electronic works 1.A. By reading or using any part of this Project Gutenberg™ electronic work, you indicate that you have read, understand, agree to and accept all the terms of this license and intellectual property (trademark/copyright) agreement. If you do not agree to abide by all the terms of this agreement, you must cease using and return or destroy all copies of Project Gutenberg™ electronic works in your possession. If you paid a fee for obtaining a copy of or access to a Project Gutenberg™ electronic work and you do not agree to be bound by the terms of this agreement, you may obtain a refund from the person or entity to whom you paid the fee as set forth in paragraph 1.E.8. 1.B. “Project Gutenberg” is a registered trademark. It may only be used on or associated in any way with an electronic work by people who agree to be bound by the terms of this agreement. There are a few things that you can do with most Project Gutenberg™ electronic works even without complying with the full terms of this agreement. See paragraph 1.C below. There are a lot of things you can do with Project Gutenberg™ electronic works if you follow the terms of this agreement and help preserve free future access to Project Gutenberg™ electronic works. See paragraph 1.E below.
- 64. 1.C. The Project Gutenberg Literary Archive Foundation (“the Foundation” or PGLAF), owns a compilation copyright in the collection of Project Gutenberg™ electronic works. Nearly all the individual works in the collection are in the public domain in the United States. If an individual work is unprotected by copyright law in the United States and you are located in the United States, we do not claim a right to prevent you from copying, distributing, performing, displaying or creating derivative works based on the work as long as all references to Project Gutenberg are removed. Of course, we hope that you will support the Project Gutenberg™ mission of promoting free access to electronic works by freely sharing Project Gutenberg™ works in compliance with the terms of this agreement for keeping the Project Gutenberg™ name associated with the work. You can easily comply with the terms of this agreement by keeping this work in the same format with its attached full Project Gutenberg™ License when you share it without charge with others. 1.D. The copyright laws of the place where you are located also govern what you can do with this work. Copyright laws in most countries are in a constant state of change. If you are outside the United States, check the laws of your country in addition to the terms of this agreement before downloading, copying, displaying, performing, distributing or creating derivative works based on this work or any other Project Gutenberg™ work. The Foundation makes no representations concerning the copyright status of any work in any country other than the United States. 1.E. Unless you have removed all references to Project Gutenberg: 1.E.1. The following sentence, with active links to, or other immediate access to, the full Project Gutenberg™ License must appear prominently whenever any copy of a Project Gutenberg™ work (any work on which the phrase “Project
- 65. Gutenberg” appears, or with which the phrase “Project Gutenberg” is associated) is accessed, displayed, performed, viewed, copied or distributed: This eBook is for the use of anyone anywhere in the United States and most other parts of the world at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at www.gutenberg.org. If you are not located in the United States, you will have to check the laws of the country where you are located before using this eBook. 1.E.2. If an individual Project Gutenberg™ electronic work is derived from texts not protected by U.S. copyright law (does not contain a notice indicating that it is posted with permission of the copyright holder), the work can be copied and distributed to anyone in the United States without paying any fees or charges. If you are redistributing or providing access to a work with the phrase “Project Gutenberg” associated with or appearing on the work, you must comply either with the requirements of paragraphs 1.E.1 through 1.E.7 or obtain permission for the use of the work and the Project Gutenberg™ trademark as set forth in paragraphs 1.E.8 or 1.E.9. 1.E.3. If an individual Project Gutenberg™ electronic work is posted with the permission of the copyright holder, your use and distribution must comply with both paragraphs 1.E.1 through 1.E.7 and any additional terms imposed by the copyright holder. Additional terms will be linked to the Project Gutenberg™ License for all works posted with the permission of the copyright holder found at the beginning of this work. 1.E.4. Do not unlink or detach or remove the full Project Gutenberg™ License terms from this work, or any files
- 66. containing a part of this work or any other work associated with Project Gutenberg™. 1.E.5. Do not copy, display, perform, distribute or redistribute this electronic work, or any part of this electronic work, without prominently displaying the sentence set forth in paragraph 1.E.1 with active links or immediate access to the full terms of the Project Gutenberg™ License. 1.E.6. You may convert to and distribute this work in any binary, compressed, marked up, nonproprietary or proprietary form, including any word processing or hypertext form. However, if you provide access to or distribute copies of a Project Gutenberg™ work in a format other than “Plain Vanilla ASCII” or other format used in the official version posted on the official Project Gutenberg™ website (www.gutenberg.org), you must, at no additional cost, fee or expense to the user, provide a copy, a means of exporting a copy, or a means of obtaining a copy upon request, of the work in its original “Plain Vanilla ASCII” or other form. Any alternate format must include the full Project Gutenberg™ License as specified in paragraph 1.E.1. 1.E.7. Do not charge a fee for access to, viewing, displaying, performing, copying or distributing any Project Gutenberg™ works unless you comply with paragraph 1.E.8 or 1.E.9. 1.E.8. You may charge a reasonable fee for copies of or providing access to or distributing Project Gutenberg™ electronic works provided that: • You pay a royalty fee of 20% of the gross profits you derive from the use of Project Gutenberg™ works calculated using the method you already use to calculate your applicable taxes. The fee is owed to the owner of the Project Gutenberg™ trademark, but he has agreed to donate royalties under this paragraph to the Project Gutenberg Literary Archive Foundation. Royalty
- 67. payments must be paid within 60 days following each date on which you prepare (or are legally required to prepare) your periodic tax returns. Royalty payments should be clearly marked as such and sent to the Project Gutenberg Literary Archive Foundation at the address specified in Section 4, “Information about donations to the Project Gutenberg Literary Archive Foundation.” • You provide a full refund of any money paid by a user who notifies you in writing (or by e-mail) within 30 days of receipt that s/he does not agree to the terms of the full Project Gutenberg™ License. You must require such a user to return or destroy all copies of the works possessed in a physical medium and discontinue all use of and all access to other copies of Project Gutenberg™ works. • You provide, in accordance with paragraph 1.F.3, a full refund of any money paid for a work or a replacement copy, if a defect in the electronic work is discovered and reported to you within 90 days of receipt of the work. • You comply with all other terms of this agreement for free distribution of Project Gutenberg™ works. 1.E.9. If you wish to charge a fee or distribute a Project Gutenberg™ electronic work or group of works on different terms than are set forth in this agreement, you must obtain permission in writing from the Project Gutenberg Literary Archive Foundation, the manager of the Project Gutenberg™ trademark. Contact the Foundation as set forth in Section 3 below. 1.F. 1.F.1. Project Gutenberg volunteers and employees expend considerable effort to identify, do copyright research on, transcribe and proofread works not protected by U.S. copyright
- 68. law in creating the Project Gutenberg™ collection. Despite these efforts, Project Gutenberg™ electronic works, and the medium on which they may be stored, may contain “Defects,” such as, but not limited to, incomplete, inaccurate or corrupt data, transcription errors, a copyright or other intellectual property infringement, a defective or damaged disk or other medium, a computer virus, or computer codes that damage or cannot be read by your equipment. 1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except for the “Right of Replacement or Refund” described in paragraph 1.F.3, the Project Gutenberg Literary Archive Foundation, the owner of the Project Gutenberg™ trademark, and any other party distributing a Project Gutenberg™ electronic work under this agreement, disclaim all liability to you for damages, costs and expenses, including legal fees. YOU AGREE THAT YOU HAVE NO REMEDIES FOR NEGLIGENCE, STRICT LIABILITY, BREACH OF WARRANTY OR BREACH OF CONTRACT EXCEPT THOSE PROVIDED IN PARAGRAPH 1.F.3. YOU AGREE THAT THE FOUNDATION, THE TRADEMARK OWNER, AND ANY DISTRIBUTOR UNDER THIS AGREEMENT WILL NOT BE LIABLE TO YOU FOR ACTUAL, DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE OR INCIDENTAL DAMAGES EVEN IF YOU GIVE NOTICE OF THE POSSIBILITY OF SUCH DAMAGE. 1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you discover a defect in this electronic work within 90 days of receiving it, you can receive a refund of the money (if any) you paid for it by sending a written explanation to the person you received the work from. If you received the work on a physical medium, you must return the medium with your written explanation. The person or entity that provided you with the defective work may elect to provide a replacement copy in lieu of a refund. If you received the work electronically, the person or entity providing it to you may choose to give you a second opportunity to receive the work electronically in lieu of a refund.