# RedHerd: Offensive Cyberspace Operations as a Service
## 3 Materials and Methods  
This section presents an OCO simulation consisting of a fictitious attack which aims to fully compromise a target enterprise environment following the CKC phases [6]. Table 4 lists the hardware involved during the current experiment. The Infrastructure Server is the system on which the RedHerd framework has been deployed. It hosts the core components and orchestrates the assets required for the mission accomplishment. One of them is a C2 Server that essentially operates as the landing point for the malware implanted during the exploitation. It allows to manage the compromised machines, sending tasks and receiving results. The second asset is a specifically designed drone, which represents a mobile device used to reach remote locations and perform on-demand actions. The usage of a drone for this experimental phase has been mainly driven by anonymization purposes but it also demonstrates how easily RedHerd can be interfaced with non-conventional hardware. The drone is a quad-copter based on a Raspberry Pi 4 model B [26], equipped with a Navio2 Emlid flight controller. The Navio2 is an autopliot shield developed as a Linux version of Ardupilot board [27]. The quad-copter can be controlled via a 900 MHz telemetry/telecommand module and is able to perform autonomous flight missions thanks to an onboard GPS receiver. It can join the RedHerd framework via a 4G-dongle Internet connection and is provided with a Wi-Fi Alfa antenna to perform wireless attacks, as shown in Figure 8. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Infrastructure Server** & **C2 Server** & **Drone** \\ \hline
**Platform** & VPS & VPS & Raspberry Pi 4b \\ \hline
**Operating System** & Ubuntu 20.04 & Ubuntu 20.04 & Raspberry Pi OS \\ \hline
**Processor** & 4 vCore & 1 vCore & 4 core (ARM) \\ \hline
**Memory** & 8 GB & 2 GB & 4 GB \\ \hline
**Storage** & 160 GB (SSD) & 40 GB (SSD) & 32 GB (SD card) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Inventory of materials. Figure 8: Top-view of the drone asset. It is worth noting how the drone is completely based on Commercial Off-The-Shelf (COTS) products and has been assembled with a budget of almost 300 euros. Figure 9 provides a Herd-View capture showing the list of available assets, i.e., the drone and the C2 server. As the reader can observe, they have, respectively, acquired the IP addresses 10.11.0.6 and 10.11.0.10, which have been distributed after the devices joined the framework VPN. By employing the Herd-View, the operator has complete control over the available assets and can easily use them to fulfil the assigned tasks. The end goals of this simulation are the full access to the IT environment of the _Fake Corp_ imaginary enterprise and the acquisition of its sensitive data. In order to reduce the chances of cyber-attribution, i.e., the process of tracking, identifying and laying blame on the perpetrator of a cyberattack or other hacking activity, the operator can fly the drone as close as necessary to a third-party Wi-Fi Access Point (AP), gain access to it by obtaining and cracking the pre-shared key and then use a non-attributable Internet access to perform the subsequent mission steps. The Wi-Fi network WPA2 protection is easily exploitable [28] launching the RedHerd _Airgeddon_[29] module, which:  
1. Deauthenticates all clients connected to the target AP, i.e., performs a so called _deauthentication attack_;
2. Captures the 4-way authentication handshake for the AP;
3. Cracks the WPA2 pre-shared key using a dictionary. Once the operator has obtained this OPSEC compliant Internet access, he can start the preliminary phase of the engagement, i.e., the **reconnaissance**. Adversaries may execute active scans to gather detailed information about the attack surface exposed by the target or more simply perform passive information gathering without involve direct interaction with it.