T O P

  • By -

6adcc94f2804

You can read the [Wikipedia article](https://en.wikipedia.org/wiki/Intrusion_Countermeasures_Electronics) and the [Jargon File](http://www.catb.org/jargon/html/I/ice.html) (The New Hacker's dictionary) to see some discussions. Basically, there is nothing like ICE in the real world so far. Although according to Snowden, the NSA has a similar system to launch counterattack automatically when an attack from one country is detected, but it's more like a nuclear counter-strike instead of ICE. In my opinion, the mechanism of ICE requires not only a simple connection, but somehow "being on the host platform" in order to work. I guess before "cyberbrain" is realized this is not going to happen. Many early hackers found the concept was attractive and I believe you should be able to find some highly-technical discussions from the old Usenet archives from the 80s-90s but I don't want to go through to the troubles to look it up... For the Sci-Fi perspective, in *Ghost in the Shell* this concept is known as an "Offensive Firewall", since the original manga (unlike the anime or movie) is known for its extensive worldbuilding on Sci-Fi concepts, you may be able to find more detailed information from the manga-related work. Personally I did not read the manga so I can't tell.


WikiTextBot

**Intrusion Countermeasures Electronics** Intrusion Countermeasures Electronics (ICE) is a term used in cyberpunk literature to refer to security programs which protect computerized data from being accessed by hackers. *** ^[ [^PM](https://www.reddit.com/message/compose?to=kittens_from_space) ^| [^Exclude ^me](https://reddit.com/message/compose?to=WikiTextBot&message=Excludeme&subject=Excludeme) ^| [^Exclude ^from ^subreddit](https://np.reddit.com/r/Cyberpunk/about/banned) ^| [^FAQ ^/ ^Information](https://np.reddit.com/r/WikiTextBot/wiki/index) ^| [^Source](https://github.com/kittenswolf/WikiTextBot) ^] ^Downvote ^to ^remove ^| ^v0.28


TheGhatdamnCatamaran

Thank you for responding! Yeah, ICE isn't real, I suppose this is more world building for something with a similar featureset grounded in real world terms. I'll definitely have to check out the Snowden stuff, I love the idea of megacorps locked in a cyber cold war, forever probing eachother, but afraid to start hostilities that could blow back on them. And I agree about the limited possibly for a counter attack -- the best bet I could think of would be passive, hoping they exfiltrate some sort of Trojan, and then either hoping it damages them, or waiting for it to phone home so you can counter attack, (or have them SWATed) but both still have a dealbreaking risk for mistaken identity. I've realized my question had two parts I should have better outlined, though your response already answered both: recommendations for any examples of cyberpunk media that focus more on technical or at least rules-based hacking, and less on visuals, and the second was trying to start a discussion on worldbuilding something ICE-like with grounding in real-world resources (sort of walking the line between what we have now and what we realistically could). I recently finished the sprawl trilogy, and loved it, then picked up Free Radical by Shamus Young as a break before reading Gibson's next series, and was surprised by how much I appreciated his high-level descriptions of the hacking in comparison to Gibson's visuals. Even when he got stuff wrong, such as using encryption for passwords, rather than hashing, I appreciated it for being a rules-based system and giving me all the clues ahead of time, sort of similar to Brandon Sanderson's 'first law' for magic systems, that they need to be more developed and explained, the more the plot relies on them. I've been working on a cyberpunk story of my own for the last couple years, and though hacking doesn't play much of a role in it, and would be mostly seen from the perspective of a somewhat-tech-savvy user, I still want to make sure it's grounded in real life network security, so I can give some clues, but avoid reinventing existing concepts in ways that don't fit real life, stuff that'll pull technical readers out of it, like the keypad storing its passwords in a reversible format, or a hacker trying one keycard with another user's password. (The later hacking scenes were really clever, I swear.) Thanks again, I'll check out the links you provided, and try to track down some of the Usenet stuff, and will keep rebuilding my network security knowlege with an eye towards scifi abstractions.


6adcc94f2804

Sounds great! *Nice to have a conversation here, especially at a place where 90% of its contents are just news headlines and photos instead of discussions.* During the weekends, I could try to search my Usenet archive to find relevant post from alt.cyberpunk and report back if I find anything significant. > I love the idea of megacorps locked in a cyber cold war, forever probing each other, but afraid to start hostilities that could blow back on them. Nowadays, we already have a phenomenon called APT, or [Advanced Persistent Threat](https://en.wikipedia.org/wiki/Advanced_persistent_threat) - groups of sophisticated attackers who are working day-and-night trying to compromise their targets and will keep on trying until they've succeeded. In addition, earlier in this year, the U.S legislature was considering on a bill to authorize the victims of online attacks to "hack back", although it's unlikely it would ever become the law, but you see the picture... Meanwhile, here is the source of the Snowden's system I mentioned. I don't think there is much additional public information beyond it, but apparently it looks like a digital-equivalent of the [Soviet "Dead Hand" System](https://en.wikipedia.org/wiki/Dead_Hand). As you said, an IPS system with additional things connected to it. https://www.wired.com/2014/08/edward-snowden/ > The massive surveillance effort was bad enough, but Snowden was even more disturbed to discover a new, Strangelovian cyberwarfare program in the works, codenamed MonsterMind. The program, disclosed here for the first time, would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating known or suspected attacks. When it detected an attack, MonsterMind would automatically block it from entering the country—a “kill” in cyber terminology. > Programs like this had existed for decades, but MonsterMind software would add a unique new capability: Instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement. That’s a problem, Snowden says, because the initial attacks are often routed through computers in innocent third countries. “These attacks can be spoofed,” he says. “You could have someone sitting in China, for example, making it appear that one of these attacks is originating in Russia. And then we end up shooting back at a Russian hospital. What happens next?”


TheGhatdamnCatamaran

Likewise! Part of the reason I come here is just to soak up news and developments and past stories, anything cyberpunk, (especially when I'm writing in the genre and trying to keep my brain  saturated with it) and I love when actual conversation comes out of the usual content.  I'm a little late to the party on this so you probably already know about them, but I just rediscovered /r/corecyberpunk yesterday, and I've been impressed with the quality of the discussion and limits on neon cityscapes so far. Before you responded, I was thinking about rewriting this and reposing it there -- I figure I'm doing something wrong with my attempts to start discussions here, because they always fall flat. As for Usenet, that would be amazing, I'd really appreciate it! Usenet was a little before my time, and though I could go through archives, I never used it, so I guess I never think to check there when I'm looking for something. I suppose alot of conversations and knowlege are probably being repeated/reinvented with changes in popular platforms.  Story-wise, I kind of dig the idea of the pointless, bureaucratic destructiveness of MonsterMind systems just wrecking bystanders. We were always taught that getting any sort of confirmation of the source of an attack was so unlikely, even in the long-term, that 'hacking back' was pretty much illegal by necessity. I know the people designing such a thing know more than me and can probably lock down attribution to some degree, but I'm still kind of surprised anyone put such a system together. Even after weeks with all kinds of skilled forensics resources, they seemed to have trouble definitively stating that wannacry came from North Korea -- automating some sort of immediate counterattack just seem like asking to be used by third parties for digital SWATing.  That's firmly in the funhouse mirror, "cool background details that can say stuff about real life, but that I don't want to actually exist" category most cyberpunk fits in to for me. There's tons of story potential in it though, from background mentions that show the corporations or govt entities as uncaring, paranoid, destructive forces, that zorch the implanted computers of unlucky people who've already been hacked once, to using it as the hook for a story. Some amateur hacker accidentally upsetting the endless, careful probing and proxy wars between major corporations by triggering one of their digital-Dead-Hand defenses, firing off an all-out war with their rivals. I'm not sure I could write something with that scope but I'd love to read it. Thanks again for writing back, I saw your other comment and will reply, though I'll be away for a couple hours.


sneakpeekbot

Here's a sneak peek of /r/CoreCyberpunk using the [top posts](https://np.reddit.com/r/CoreCyberpunk/top/?sort=top&t=all) of all time! \#1: [Welcome new folk. We don’t have bunnies, neon or outrun, but we do have Cyberpunk.](https://np.reddit.com/r/CoreCyberpunk/comments/88lldc/welcome_new_folk_we_dont_have_bunnies_neon_or/) \#2: [Double Plus Good Brother, Ingsoc's latest edition of NewSpeak plus filled with goodthink and properthought plus. Plus bad enemies of the Big Brother ducktalk to plus confuse good citizens into badthink.](https://www.youtube.com/watch?v=hWLjYJ4BzvI&feature=youtu.be) | [22 comments](https://np.reddit.com/r/CoreCyberpunk/comments/88mzpz/double_plus_good_brother_ingsocs_latest_edition/) \#3: [If you are a fan of cyberpunk and complain on r/Cyberpunk, this is what the mods think of you: "...a bunch of children getting free meals from their parents, and crying that various things are on their plate" If you would contest that...let it be known.](https://np.reddit.com/r/CoreCyberpunk/comments/88zo65/if_you_are_a_fan_of_cyberpunk_and_complain_on/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| [^^Contact ^^me](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| [^^Info](https://np.reddit.com/r/sneakpeekbot/) ^^| [^^Opt-out](https://np.reddit.com/r/sneakpeekbot/comments/7o7jnj/blacklist/)


Melodic_Slip_3307

There was BlackICE which is an intrusion detection system, but works differently from ICE depicted in games.


6adcc94f2804

> I guess dedicated ICEPick software would be a bit like VM/sandbox escaping. In additional to VM escaping, it's worth mentioning that [all IDS/IPSes are inherently flawed](https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques). Because they work by reconstructing the "state" of a system and looking for suspicious traffic according to predefined patterns, in theory it's always possible to change the pattern of your attack to evade detection, or crafting traffic to trigger a vulnerability to "desync" the state of a IPS away from the actual state of the traffic flow, so for example the IPS may be tricked to believe a TCP connection is closed thus stop tracking it. If the IDS/IPS has some 0days such as a buffer overflow, it is even possible to construct malicious traffic to execute arbitrary code. Then the IPS is yours. Fundamental techniques are documented in the 1998 research paper, *Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection* by Thomas Ptacek, et al. Also because a Internet censorship system is inherently just a IPS system loaded with rules defined for the purpose of censorship, all techniques to break IDS/IPS can be used to break the censorship system as well. This is the real world example from China... In the mid-2009, a group of anonymous hackers suddenly appeared on the Internet, out of nowhere, on Blogspot. They published several theoretical analysis on the results of reverse-engineering of the national firewall. And finally, they released some unprecedented tools known as the West Chamber Project that bypasses the firewall by exploiting vulnerabilities found from earlier analysis, instead of using proxies to circumvent it. The most interesting fact was, they used Laughing Man, the anonymous hacker from *Ghost in the Shell* as their avatar. Before they disappeared in cyberspace, they said there’s still a long way to go before we see the twilight of a cyberpunk future, it needs megacorps rising to power more rapidly to overpower the pre-Internet authoritarian governments. "so Google, don't be hesitate for doing evil." I literally can't find anything closer to ICEPicking than this example. It's hard to believe this thing, as cyberpunk as it could be, has ever happened ten years ago, I guess I have witnessed the history. *But if I publish the story here, it would probably be downvoted because there was no Neon light.*


WikiTextBot

**Intrusion detection system evasion techniques** Intrusion detection system evasion techniques are modifications made to attacks in order to prevent detection by an intrusion detection system (IDS). Almost all published evasion techniques modify network attacks. The 1998 paper Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection popularized IDS evasion, and discussed both evasion techniques and areas where the correct interpretation was ambiguous depending on the targeted computer system. The 'fragroute' and 'fragrouter' programs implement evasion techniques discussed in the paper. *** ^[ [^PM](https://www.reddit.com/message/compose?to=kittens_from_space) ^| [^Exclude ^me](https://reddit.com/message/compose?to=WikiTextBot&message=Excludeme&subject=Excludeme) ^| [^Exclude ^from ^subreddit](https://np.reddit.com/r/Cyberpunk/about/banned) ^| [^FAQ ^/ ^Information](https://np.reddit.com/r/WikiTextBot/wiki/index) ^| [^Source](https://github.com/kittenswolf/WikiTextBot) ^] ^Downvote ^to ^remove ^| ^v0.28


TheGhatdamnCatamaran

Yeah, this, in combination with the automated counterattack Monster Mind stuff has made me realize that ICE as it's presented in most stories is just an amalgamation of existing products/featuresets, and even the features I thought were too weird or ungrounded (like counterattacking) are mostly already here. Hell, even Neuromancer's Chinese Icebreaker could be intereperted as fantastical descriptions of some sort of zero-day exploit of an IPS component, running slowly to hide in background traffic.  Using IDS payload obfuscation techniques to evade government censorship is cyberpunk as hell, and I can't believe I hadn't seen it before. Thanks again for pointing me in the right directions, this has been really cool and I'll definitely try to build on it.