Chapter 17 — Cryptography concepts | Bachelor's Threat intelligence and OSINT

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Hashes"]
  N2["17.2 Encryption"]
  N3["17.3 Signatures and certificates"]
  N4["17.4 Certificate transparency"]
  N5["17.5 Protecting intelligence"]
  N6["17.6 Fuzzy and partial matching"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Hashes"]
  N2["17.2 Encryption"]
  N3["17.3 Signatures and certificates"]
  N4["17.4 Certificate transparency"]
  N5["17.5 Protecting intelligence"]
  N6["17.6 Fuzzy and partial matching"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Hashes]
    |
    v
[17.2 Encryption]
    |
    v
[17.3 Signatures and certificates]
    |
    v
[17.4 Certificate transparency]
    |
    v
[17.5 Protecting intelligence]
    |
    v
[17.6 Fuzzy and partial matching]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) explain hashing, encryption and signatures at concept level; (2) understand what a file hash proves; (3) relate certificates to phishing infrastructure; (4) handle encrypted intelligence channels.

17.1 Hashes

A cryptographic hash such as SHA-256 maps a file to a fixed-length fingerprint. Identical files give identical hashes; changing one byte changes the hash completely. That makes hashes precise indicators — and fragile ones, because adversaries can alter files trivially. Bianco's Pyramid of Pain places hashes at the bottom: easy for defenders, trivial for attackers to change.

Amara uses hashes for exact matches in endpoint searches but does not rely on them alone. When a report lists hashes, she also looks for the behaviour and techniques described, which last longer.

17.2 Encryption

Encryption protects confidentiality. Ransomware abuses it (T1486). TLS protects web traffic, including adversaries' command traffic. Encryption therefore shapes what defenders can see.

Amara notes that HCHT's proxy sees only server names for encrypted traffic, as decided by the privacy and legal staff. This means domain indicators are useful, but indicators based on full URLs often cannot be checked. Ransomware intelligence goes to backup protection, since encryption by attackers cannot be undone without the key. Each limitation is recorded so readers understand what a clean search result means.

17.3 Signatures and certificates

Digital signatures show who signed data and that it was not altered. Certificates bind a domain name to a key. Free, automated certificates mean phishing sites routinely show a padlock; the padlock proves encryption, not legitimacy.

Amara explains this in staff awareness material: the padlock means the connection is private, not that the site belongs to HCHT. Signed software from trusted suppliers is still checked, because a stolen signing key can make malicious code look legitimate. Sector reports of such thefts are passed to the endpoint team.

17.4 Certificate transparency

Publicly trusted certificates are recorded in public logs. Searching them for names resembling HCHT's domains can reveal lookalike sites early — an ethical, passive OSINT method.

Amara tries occasional manual searches for names close to HCHT's domains and its hospitals' names; turning them into a regular process later becomes her capstone. New matches are checked by viewing public records only; live sites are not visited from HCHT laptops. Confirmed lookalikes are reported to the email team for blocking and, where appropriate, to the registrar for takedown, with the evidence recorded. Results are kept in the team's records.

17.5 Protecting intelligence

HSSC distributes TLP:AMBER material through an encrypted portal. Downloading it to personal devices or forwarding by ordinary email breaks the sharing agreement.

Amara reads AMBER material only on HCHT devices and stores any extracts in the team's restricted folder. When an AMBER item needs to reach another HCHT team, she sends a summary through the internal ticketing system, which is allowed under the agreement, rather than forwarding the original. The rules are explained in her onboarding notes. Breaches are reported to HSSC.

17.6 Fuzzy and partial matching

Because one changed byte defeats an exact hash, some tools compute similarity hashes that score how alike two files are. They help group variants but produce scores, not proof; a high similarity between two benign installers is common. Treat them as leads for human review.

Amara uses similarity scores only to choose which files to compare by hand. A high score leads to a closer look at both files, their sources and what they do; it is never enough on its own to label a file malicious or to add it to a blocklist. Amara records the score and the outcome of the review together.

Worked example

A staff member asks whether a site is safe "because it has a padlock". Amara explains the padlock means the connection is encrypted, not that the site is genuine. She then checks certificate-transparency records and finds the lookalike domain got its certificate two days ago — consistent with new phishing infrastructure.

Synthetic case. The site is invented.

Errors and limits

Hash matches identify exact files only. New certificates are common for legitimate sites too.

Exercises

EX049 — Hash fragility. Why are hashes low on the Pyramid of Pain?
Show marking criteria
Rubric: 3 = trivially changed by adversary; precise but brittle; 2 = partial; 1 = hard to change; 0 = none.
EX050 — Padlock myth. What does a browser padlock prove?
Show marking criteria
Rubric: 3 = encrypted connection to holder of certificate for that name; not legitimacy; 2 = encryption; 1 = safe site; 0 = none.
EX051 — Passive check. Name a passive OSINT source for spotting lookalike domains early.
Show marking criteria
Rubric: 3 = certificate-transparency logs, with reason; 2 = name; 1 = visiting sites; 0 = none.

Synthesis

Understand what cryptographic artefacts prove, use certificate transparency passively and protect restricted intelligence in transit.

Continue studying — chapter 17 of 40

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →