Introduction to ethical hacking.
In this nugget we'll be talking about an introduction to ethical
hacking which is the first module in the exam objectives, and
we're going to take a look first of all at juwost the kind of
the security landscape right now, some recent hacks that have
taken place, so we can kind of go ahead an idea for the scope
of the threat that could be out there. We'll also take a look
at some of the laws that exists that are against hacking. Now,
especially black hat hackers are not usually concerned about
not breaking too many laws, however you do need to be aware of
those laws as a certified ethical hacker. You also need to be
aware of many terms. We're going to have several different terms
that we're going to go over throughout this series, but I want
to start off with some terms that will probably be important
as we get started, so we have a good frame of reference. And
we'll talk about the various types of hackers, as well. For example,
they all may wear different colored hats. You'll see what I'm
talking about when we get to that part. And then we'll talk
about insider threats. This might be your best friend, this might
be your spouse, this could be the janitor, it could be lots of
different kinds of people. And we'll take a look at what that
really means.
Now, in our last nugget I talked about an introduction to the
certified ethical hackers series that I'm teaching, in other
words all the topics that I'm going to cover, and so forth. Here
in this topic we're addressing the actual first exam objective
known as module one, introduction to ethical hacking. And you
can probably download and print off of the EC Council's website
all of the exam objectives for yourself. Now, I want to point
out that we don't always identify and specifically detail each
bullet point on those exam objectives, and the reason for that
is because many of them are duplicated or repeated in various
ways throughout the whole series, as well as the fact that I
want to focus on things that are important to you as a potential
certified ethical hacker, both in practical reasons as well as
things that might be more important to someone who might be an
exam candidate.
And that having been said, I want to identify some of the issues
relating to the first topic there under the exam objectives,
which says understand the issues plaguing the information security
world. Now, at the time of this recording it's late in 2011,
and this has been a very bad year for hacks. I mean, there's
been a lot of high profile, sometimes very embarrassing hacks
that have taken place. And it's largely because not that they're
new, it's because the hacking groups that are doing them, which
is these two groups here I'll get to in a moment, they're really
publicizing a lot of the hacks that they're doing, they're kind
of bragging about it and making a point with some of these hacks. Now,
some of the recent hacks also I want to point out come from a
news story at 60 Minutes. Now, this is, I guess it's CBS's 60
Minutes network. I always used to make fun of my parents for
watching 60 Minutes because I said that was only for old folks,
and now it turns out here I am watching 60 Minutes. It's actually
pretty good, it's one of the best episodes I've ever seen in
terms of identifying the vulnerability and the devastating effects
that some of these security hacks can have on at least the nation
of the United States, and I'm assuming it really goes worldwide,
as well. You can back that up and kind of jot down that URL if
you want to. The actual URL is very, very long, so I just use
tinyurl here to kind of abbreviate it. And go ahead and take
a look at that, that should kind of be required viewing for anybody
that wants to be a hacker or anyone that's in the security world.
Now, I'm going to kind of summarize some of those things as well
as some of my own knowledge from different hacks that have taken
place. For example, in the country of Brazil in 2000 I think
it was 2005, and also 2007,
they had their power grid taken offline at various states, a
couple of times, and this devastated the locals who were dependent
upon that power for both the economy and business, as well as
just general productivity. You could imagine what happens when
the power goes out. Not a whole awful lot you can do. Very disruptive.
Nobody knows who did it, nobody knows why they did it. Could
just have been a vandal. But gee, that was a very devastating
case of vandalism in that case. Among other things, I know in
Brazil it can be very hot. Here in Phoenix today it's supposed
to be 115 degrees. We've had the world's we've had the record
heatwave in Arizona for the month of August. I think it's been
13 straight days where it was over 110.
Well, you can imagine in Brazil, Arizona, anywhere, when the
air conditioners shut off because there's no electricity, wow. Also,
how did this actually happen? Well, they kind of were guessing
at this, but they think that employees in the power plant somewhere
there in Brazil opened up a spam e-mail or a phishing or a spear
phishing e-mail where an employee clicked a link or something
like that, that downloaded malicious code into the plant, and
they were able to the hackers were able to gain access from that
point. Now, this is kind of scary, but it's also scary in the
U.S., as well. Because some people strongly suspect that there's
already back doors into power plants in the United States right
now, and the only reason why power grids haven't gone off is
because whoever the hackers are have not decided to actually
flip that switch quite yet. But there's a suspicion that we are
already vulnerable, already been compromised, just nothing has
happened quite yet. There's also been kind of a proof of concept,
because I saw a video of this, as well, if somebody figured out
a way to hack into some of the machinery, the programming and
machinery and stuff and generators and the like, and they are
able to shut off the cooling system and cause that machine to
overheat and literally rip itself apart. And again, this is something
that could possibly happen just at the flip of a switch, if a
hacker decided to do it. And in another incident that occurred,
this is known as kind of our 2007
electronic Pearl Harbor. What happened here is a foreign power,
we don't know who, but everyone always blames the Chinese, but
who knows if it was them. Anyway, they were able to infiltrate
with pretty much full admin access the Department of Defense,
the Department of State. Department of Commerce, Department of
Energy. And they think probably NASA. And over a long period
of time, download terabytes of information undetected for a long
period of time. Similarly, another foreign nation, we don't know
who, could have been the same one, also was able to break into
CENT I spelled that wrong, didn't I. CENTCOM.
This is the military arm that really much runs the wars overseas.
And so they were able to stay inside CENTCOM for several days,
hovering there again with full access, and they could see all
the commands that were going on, they could see everything that
was taking place. Now, here's what they think took place with
CENTCOM, by the way. They think that somebody, a visitor perhaps,
or somebody like that, was able to get into the building and
access a public area. It could have been a cafeteria, a break
room, the front lobby or something like that. And they were able
to drop one of these on a table somewhere, okay? You know what
that is? Except for my horrible artwork, you could probably make
a guess at it. Let me try it again. This is a USB stick. There
we go, that's a little bit better. And this USB stick is kind
of a common way right now, because people just drop those somewhere
with malicious code on it, and then somebody who is curious will
pick it up and plug it into their work computer, and say hey,
I wonder what's on this thing. Maybe some music I can put on
my iPod. Maybe some interesting pictures, you know, or something
like this. So they will plug those UBS sticks in, transmit the
malicious code to their computer, and really only takes one computer
to be compromised to be able to eventually elevate privilege
to gain access to maybe an entire system. They think that's what
happened there with CENTCOM. By the way, now these things are
completely banned at CENTCOM. You cannot have one of these in
your possession, at all. Another thing that took place, Sandia
National Labs, I'll put Sandia on here. This is actually a national
lab that's not far from where I graduated from high school, up
in Northern California. But they work with a lot of nuclear secrets,
a lot of weapons systems, things like this. And in the past they've
made their computer chips for all of their devices overseas.
But some of them started coming back with back door code, malicious
code, included in the chips.
So they stopped allowing them to be made overseas, now they created
their own manufacturing plant to create their own microchips,
to hopefully prevent malicious code from being planted on them.
And then a couple more kind of hacks that have taken place, there
were about 130 banks through a common ATM system that they shared,
that got hacked. And the hackers were able to derive people's
magnetic strip information from their debit cards, for example,
and also the PINs. Now, you know of course then that that means
that they have everything they need. This means that they can
create their own white plastic. White plastic being just a blank
credit card that they put their own magnetic strip on, and then
they can of course use the ATM. In a period of 24 hours, there
were $10 million stolen
because of this particular hack right there. Another one took
place, I'll just make this the last one, I think, for these examples.
The State of Virginia had their patient prescription database
records stolen, and then they deleted the original records and
encrypted the copy that they stole. Then they held the State
of Virginia hostage, and they sent them a message saying that
they could get a decrypted copy of their own database back if
they would pay $10 million. So I don't know, maybe it was the
same hacker, they seem to fixate on $10 million. Maybe they're
actually looking for $20 million, and if you add the two together
then that meets their goal, I don't know. Anyway, the State
of Virginia will not actually publicly comment on whether or
not they paid that ransom. Which usually means that they paid
it. So that doesn't look so good. Now, a lot of the motive for
these is going to be national security or foreign nations trying
to gain intelligence on us, like some of these up in here. This
one could just be a prank, but although a very costly prank.
This is obviously going to be greed. A lot of organized crime
syndicates right now, they don't have I'm sure they still have
these guys, too, they still have the thugs with, you know, baseball
bats and guns and whatnot, I guess. But a lot of them now are
actually hiring brainiacs that are very, very good hackers. And
they're actually on the payroll as a hacker, and they very often
will operate in other countries where either extradition is possible,
if not if not very difficult.
Or where it's very difficult to track them down. So it's actually
a profession now. Not just some 13-year-old in grandma's basement
trying to figure out how to learn to be a hacker. This is all
pretty serious stuff. And there's a couple of groups there,
as well, you'll see I've listed them there. LulzSec and Anonymous,
there are some other ones, but these are two that have been the
most high profile here in 2011.
And these are both just hackers groups of highly skilled hackers.
What's LulzSec, by the way? That's just kind of a play on the
word laughing out loud, you know, the expression laughing out
loud. And then sec is security. So laughing out loud at your
security, just a form of that. And they've been responsible for
a lot of different kinds of hacks. One of the first ones they
did is they hacked Fox News. Some of the stuff that they do is
kind of political. They made disagree with the political stance
that somebody takes, and so that they will then, you know, hack
your website to make a point. They hacked PBS, and then they
posted a fake story saying that Tupac Shakur is still actually
alive in New Zealand. Which obviously they got wrong, everyone
knows that's actually Elvis. Anyway they also hacked Sony, and
that's where the PlayStation 3 had some problems, oh, I think
back a few months ago here at the time of this recording. Cost
Sony quite a bit of money. And also, by the way, they say that
they got into that database and compromised the user accounts
of about a million user accounts. And they say they did that
by using SQL injection, which is something we'll take a look
at in this series. Also, Sony claims that it was only 37,500
accounts, not a million. But it depends on who you believe. Anyway,
there's also this group here called Anonymous, which is also
kind of what we try to be as hackers, we try to stay anonymous
and not get caught. The irony of this is that they're not so
anonymous as they might think they are, because the FBI has cracked
down on several of them and made several arrests and seized computers
and stuff like this. Although it is also conceivable that they've
actually got the wrong people. Because one of the things that
hackers are very good at is to shift the blame to somebody else,
or to cover their tracks and make it look as if it was actually
somebody else that was doing the hacking. One of the things that
Anonymous has done is that they hacked Paypal, because Paypal
refused to accept donation money for the organization of Wikileaks,
and so as a result, they didn't like that, so Anonymous hacked
Paypal as revenge. Also another thing that's taken place is there's
real hot button issues politically here in my state of Arizona
right now, and Anonymous did not like some of the policies that
have been going on. So as a political statement, what they decided
to do was to hack the Department of Public Safety, which is actually
our highway patrol here in the state. And it was very easy to
do, apparently, because a lot of our employees at the DPS use
very simple passwords. Like 1, 2, 3, 4, 5. Yeah. Literally. That's
a password. So it's kind of our own fault, because they didn't
implement good security measures on the passwords. Anyway, those
are some of the hacks that LulzSec and Anonymous have done in
the past year. Oh, and in fact LulzSec even hacked into a pornographic
website and downloaded all the e-mail addresses and associated
passwords of their membership, and I think they posted all that
online. Can you imagine the embarrassment of seeing your own
e-mail address show up in that list? Thankfully, my e-mail address
was not on the list for that particular porn website. Anyway,
there's also cyberterrorism, which is something we have to look
out for as well. A good example of this is there's a South Pole
research station with 57 scientists and support personnel down
there, and during a time of year when airplanes could not fly
into or out of that research station to deliver supplies or personnel,
someone was able to hack the systems down there. And I think
it was the life support systems. And the threat was that they
could shut all of that off and potentially kill all the people
down there. So that's a pretty serious threat that could go on.
They did get it resolved, but that's obviously a very scary situation
that could pop up. Now, if a situation does come up, what should
you do. You know, someone hacks your web server, someone hacks
your active directory server, something like this, what should
you do. Well, companies should have an information security policy
now, the specifics of that are not part of the certified ethical
hacker exam, but you should be aware of what this is. This is
kind of like the big thick manual of, you know, "break glass
in case of emergency" type of a manual. Similar to what airline
pilots take with them when they go on airplanes, they have a
big thick manual that says in case of emergency, do this. You
know, in case of an engine fire, do this. In case of a blown
tire, do this. In case I don't know, a cracked windshield, take
these steps. And they're supposed to always follow the same exact
steps religiously for maximum insurance of safety. Can you imagine
all the kinds of things that are in that book, but probably like,
you know, in case they stop serving food in coach well, I guess
they already did that. Or in case they start, I don't know, charging
for baggage. Oh, good heavens, we do have an emergency on our
hands. Anyway, companies should follow for IT information security
policies. This is a similar kind of a book to what the airlines
use, and this would say if the web server gets hacked, these
are the steps you take. And it could be unplugging the router,
or disconnecting the network cable from your web server, or something
like that. Regardless, if you ever come into a situation of where
maybe you're being examined on what you should do in case of
a specific emergency, there may be several answers, like disconnect
the web server. Turn off the power. I don't know, disconnect
the router, or something like this. The answer is always, though,
consult your own information security policy, and follow whatever
steps that gives you. That's the official answer that you should
know about. Now, also I'm going to be brief here, but here is
also some laws that you should know about. Again, if you were
ever examined to find out what you know about these kinds of
things, you don't need to know the specific details, I mean,
there's thousands of pages in all of these different laws, if
you actually read through them all. Certainly you don't want
to do that. But just be aware of the titles of these. For example,
in the United Kingdom they have the Computer Misuse Act of 1990,
which is their anti-hacking law that they enable. All the rest
of these relate to the United States, such as the Can-Spam Act,
I think we're probably familiar with that one, that prevents
spammers from sending you things either unsolicited, and/or if
they do send it unsolicited you should be able to opt out of
it. Unfortunately, most spam that comes your way is not really
directly traceable back to a specific company. Because there's
a lot of different ways that you can, you know, fake the route
that the e-mail came from, and so forth. But anyway, at least
the law is there. There's also the 18 USC 1030, that's the number
that you need to probably remember there, it's called the fraud
and related activity in connection with computers. Again, just
pretty much an anti-hacking item. And then it's kind of also
expanded also with the 1029 Fraud in Access Devices, which could
include things such as some kind of a smartcard reader or some
kind of a device, say, oh, what do they have those point of sale
devices of various things that you could potentially hack into
scanning the wrong price on a 3,000 television, you trick it
into scanning, you know, $100. Something like that. Also even
smartphones can potentially fall into this category.
Anyway, once again, you don't need to know all of the laws associated
with all these, but you should know the names of these particular
laws. All right now, we also need to cover various hacking terms.
These are going to be in no particular order, they're just words
that you need to know. Oh, my goodness, what in the world was
that. Sorry, folks, I see the weirdest things from my office
sometime. I just looked out the window, I have kind of an eyebrow
window that goes above my door, and I see my son heaving a couch
up the stairs. I guess he thinks dad is too busy to help him.
And I'm going to have to say yes, I am too busy to help him,
because I'm recording this series, okay? Anyway, what is hacking?
This is going to be our first term that we're going to address.
This is something where you force a system to function in a manner
other than what the designer intended. What would be a good example
of that. You've heard of a Pringles can, right? You've seen those
in the grocery store. What's the purpose of that Pringles can?
Yes. It holds those delicious little potato chips in a neatly
stacked arrangement. However,
if you hack that Pringles can, you can make it into a super-powered
wifi antenna. That's one of the things that hackers have done
in years past, is they've turned it into that so that they can
do better war driving. Which means that they'll go around different
areas maybe of their city or neighborhood or something, and they
will use that modified Pringles can to pickup wifi signals that
would be a stronger receiver than a normal wifi
network card. So that's what that could be done, that's part
of what hacking is. Now, what's a hacker? Well, if you kind of
make the connection, a hacker is the one that does the hacking.
But in terms of the official definition from the EC Council,
they would say that it's a person that enjoys modifying how a
system functions. I really think that's a poor definition. In
one respect, maybe it's my English major background coming out
in me here, but whenever you define something, you shouldn't
put a subjective term into it like that. The word "enjoys" kind
of throws me off there a little, but that's the official definition.
Again, a person that enjoys modifying how a system functions. Also,
let's take a look at these things. And again, we're in no particular
order, there's a lot of terms we just need to understand, so
I'm just kind of throwing them out here. One of those other
terms you'll need to know is something called a black bock black
box test.
Oh, my goodness, I see something strange out of my window and
I can't talk straight all of a sudden. Anyway, black box test.
And this simply means that you don't have any prior knowledge
of the system or the network, whatever it is, that you're trying
to penetrate. So it's a totally strange company, you don't work
for the company, you don't know the employees directly, you don't
have key card access, you don't have a phone number there. Anything
like that, it's just totally a black box, kind of explains itself
in that respect. There's also a white box test. This would be
where you're kind of kind of somebody that has total knowledge,
really, of the systems being tested, like, you know, an internal
employee for maybe a major credit card company. And maybe quarterly
you will put together your hacking tools and put your hacking
hat on and you'll say, I wonder where we have security weaknesses,
and they'll start doing network sweeps and doing vulnerability
tests and various things like this. There would also be a gray
box test. And what gray box test and by the way, this is also
sometimes known as an internal test, or a an opaque test. This
is where you have partial knowledge. And this is normally where
you're going to examine something as if you were just a generic
internal user, like just a clerical employee, for example. From
inside of a company. You can get into the building no problem,
and you can do some things, but you probably don't have full
administrative access on anything. And this is not necessarily
a CEH exam issue, but there's also blue box tests. What is that.
Well, that's just kind of the official or actually, the unofficial
term for internal testers at Microsoft. They do blue box testing.
I think that has to do with the fact that there's a lot of blue
in the logos for Microsoft.
Other hacking terms that we can identify here would be a vulnerability.
Now, this is where someone has analyzed maybe a program or an
operating system like Windows, and many times they will kind
of reverse engineer the source code. Now, there's millions of
lines of code in Microsoft Windows, for example. And so it's
very difficult to always find a good vulnerability in there,
because there's just a high quantity of code to comb through.
But maybe they found some kind of a vulnerability that could
be a weakness. They don't know that it is, necessarily, but it
looks as if it could be a problem. Now, a lot of times a security
expert or security organization will report that potential vulnerability
to Microsoft and they may then release a patch for it. Some vulnerabilities
have been out there for awhile, and Microsoft has not released
any vulnerability fixes for them. But if it's an exploit, this
means that yes, we already found a vulnerability, and we wrote
some kind of code or created something that actually does the
exploit, or that actually proves that we can take advantage of
this vulnerability to do something like steal data or take ownership
of a machine, or something like this. This is also known as a
proof of concept. Now, this can actually be lucrative. I was
just talking a few weeks ago to an associate of mine who is a
certified ethical hacker and a pen tester. And he came up with
an exploit that he was able to figure out how to hack into a
certain I don't think I should even say what it is, but he figured
out how to hack into a certain operating system, and a security
company paid him 100 grand. Yeah. $100,000
for his the vulnerability discovery and the exploit that he was
able to come up with. And so it kind of seems like it's extremely
lucrative, and it can be, and it might not be. Because he's also
got 20 years of experience, and when you average $100,000 over
20 years, that's really not all that lucrative, if you look at
it in that respect. Although it's a pretty good payday, regardless.
There's also something called 0day, and this is kind of the phonetic
of it. 0day, is how you pronounce it. Or we sometimes say zero
day. The literal spelling here, this is actually a zero, this
first item here is a zero, day. This means was that this was
the first day, or the zero day, that it actually came out. The
vulnerability, or the exploit, or whatever it was. This is what
my friend actually sold was an 0day, and that's kind of the combination
of the exploit plus the vulnerability.
This is what a lot of times hackers really strive after, especially
a higher level hacker, is very capable of programming and scripting
and things like this, and coming up with their own exploits.
And if they come and if they come up with 0day, those are some
serious bragging rights. Some hackers will only come up with
maybe one or two 0days in their entire lives. This is kind of
bowling 300, or getting a hole in one in golf. Other hackers
are just kind of brainiacs that come up maybe with dozens of
different 0day. Also there's vulnerability scans. This is going
to be using certain prepackaged tools out there, you can buy
these commercially, some of them are thousands of dollars. And
you just install them on a computer in your organization, and
you turn it loose, and it scans your network, it scans all the
destination hosts, and it sees which ones have not been patched,
which ones are vulnerable to certain kinds of exploits and so
forth. The big thing with vulnerability scans is number one,
it takes very little skill I'll put that out here to the side
little skill if you're only doing vulnerability little skin?
I don't know why I put that up there. Whoo. I don't know what
I've got on the brain today. Anyway, little skill to be able
to run a vulnerability scan.
Boy, I've really got to watch my spelling. Anyway, little skill
is involved. Also, again, it could cost thousands of dollars
for the actual software itself. Sometimes
a so-called penetration tester will actually come into an organization,
and they're not actually doing the things that a certified ethical
hacker does, they just run a fancy tool that also very often
have reports that it can spit out with its own charts and graphs
and things like this, to show you how weak the security is in
an organization, and it kind of helps sell that person. But they
actually may not have that much skill involved at all. And in
addition to that, you get a lot of false positives. I knew there
was something else I wanted to put up there. False positives,
I'll put a plus sign out there, okay, false positive. And the
reason why is that they're just looking for potential vulnerabilities.
They might not be actual vulnerabilties.
Now, I'm not down on vulnerability scans entirely. It depends
on how much time you have to analyze an organization, if you're
doing a pen test, and they're only giving you a few days, gee,
you might have to hit the vulnerability scan right out of the
gate just because you don't have much time to work with. But
it's much better if you can do a penetration test. That means
that you're going to do a lot of the things we're going to be
talking about throughout this whole course, and scanning the
network, and trying to be stealthy. When you're going to be stealthy
and patient, generally speaking, you have to have more time to
do that job. So it's kind of an inverse relationship that goes
on there sometimes.
Now, the penetration test itself will very often involve the
five steps of a hack that we'll talk about on a different whiteboard. Now,
let's take a look here also at the various types of hackers.
We have a black hat hacker. In fact, I made a video just to demonstrate
this to you, okay? Here's a black hat hacker. I'm just kidding,
that's me. I got this blinky hat from Cisco Live. On the last
night of Cisco Live in Las Vegas, we went to a really nice resort
and they had a concert for us there, and everything, Train was
playing as well as OK Go. It was a pretty fun time, at least
for a bunch of geeks, anyway. And they handed out those black
blinky hats, it's kind of a I've got to play it again, just because
it was so entertaining to watch the first time. So yeah, there
you go. Anyway, they handed out those blinking black hats. Now,
I'm sure that any legit black hat hacker out there would be quite
embarrassed to see someone being represented that way, so that's
not literally what they are, but anyway, the meaning here is
that they would have more of an unethical purpose. A good example
of that is one of the first hackers, Kevin Mitnick, who really
got started somewhere in the late 70s and early 80s, and he was
able to break into systems like Motorola, AT&T, Sun Micro. He
was stealing their source code. What's another one. Digital Equipment
Corporation, where he actually first worked and started getting
the idea to do some of this stuff, where he copied their software,
and so forth. Anyway, one of the things that he did was he also
hacked into the FBI's telephone system, and taunted the two agents
that were pursuing him. Now, I've kind of learned that it's a
good idea not to make the FBI mad. Don't ask me how I know about
that, but it's not a good idea. And what happened here is they
started with the two agents, and when they started getting mad,
they hired nine total agents to go after Kevin Mitnick. And at
that point it became relentless. And Kevin was eventually having
to change hotels very two hours, just to avoid detection. And
eventually they just wore him down, and he gave himself up because
he just couldn't take it anymore. Eventually he went to prison,
and then he's since been released.
They're also known as crackers, or just malicious hackers. There's
also a white hat hacker, and really, they're pretty much the
same as a black hat, in terms of the methodology and the way
they go about doing their jobs, it's just that the motive is
different. Here we have unethical, okay?
And or maybe you could consider that a more of a moral instead.
And here you have ethical. Or at least authorized. Because a
white hat hacker usually has permission to penetration test a
system. Might be a hired contractor that's been hired from the
outside to take a look at the security of a system, or maybe
it's an internal tester that's an employee of a company that
every now and then tests the security of their systems. There's
also what's known as an ethical hacker, and that hopefully is
what you're going to be is an ethical hacker. Also a penetration
tester. These kind of are all along the same vein, just depends
on what you want to call it, depending on context. And then there's
a gray hat hacker, and this is someone who is a white hat hacker
by day, and a black hat hacker by night. And this is very often
something that's by design, so that the white hat hacker, if
that's what you are by day, you have to keep track of what the
black hats are doing at night, and sometimes you have to duplicate
some of the methods that they use. Then you get into that little
kind of a gray area where I really shouldn't be doing this, but
after all, it's for research purposes. Also something called
a phreak. This is a person that's a phone freak, okay, so that's
kind of how they put the words together, there. Hackers are kind
of known for either misspelling things, or I guess they would
probably call it alternate spellings. As an English major it
kind of drives me nuts sometimes, but that's just part of the
part of the culture that we're part of. Anyway a phreak just
kind of hacks into phone systems. That's really kind of what
Kevin Mitnick was early in his career, because he would hack
into telco systems And then there's also a red team. Now, these
are very often used for penetration testers. I'll put pentest
up here. That's kind of a misspelling in and of itself, but anyway,
a pentest red team will involve several different people with
differing strengths. For example, it will involve probably several
programmers, okay, and they may have differing levels of expertise.
They might know C++, or Java or, you know, PERL, Python, different
kinds of levels of expertise there. You might have someone else
that's really good with web apps and languages. You might have
someone else that's good with SQL databases,
okay, so you'll have those sorts of things. You'll also have
someone that's pretty good with Unix and/or Linux.
Linux is kind of the preferred platform for hacking. One reason
why is because it's free, not that hackers can't get Windows
products for free, anyway, but it also has a great deal of flexibility
and power involved in it. There's also someone that's probably
going to have good expertise in cryptography, or cryptonalysis,
I'll put crypt right there for that. And then again, I'll just
put this separately, I kind of mentioned it a little bit earlier,
but a database expert. A lot of times you'll be able to abstract
information from a company through their database. So if you
can figure out a good way to hack it, that might be in there.
There also might be just a red team I'll put red team leader.
This is very also very often also I can't seem to write, here,
my pen is skipping around. The reporter. Someone will be there
to summarize everything that's taking place, put it all in writing,
including nice colorful graphics and screenshots and all that
sort of thing. This is actually what's being sold. As a penetration
tester. Because you'll hand that to executives and you're going
to sell them on that. You may need to also be a good public speaker.
They need to be pretty well convinced that they spend tens of
thousands of dollars for good reason. You don't want to just
hand them, you know, the summary of your notes on a dinner napkin
or something like that, it's going to have to look really good.
And the red team leader may not be a stone-cold expert in all
these other areas, but they're knowledgeable enough to kind of
get the idea of what's going on in each one of these areas, even
if they couldn't maybe author, you know, some of these sophisticated
hacks that some of these guys might have done.
Now, in addition to all of this, probably all members of this
team are going to have expert levels of Windows ability, they
need to understand Windows, because that's very often what they're
hacking into. Also, they're going to have pretty solid foundation
in network knowledge. They'll know, you know, the OSI model pretty
well. Just because that's where a lot of the hacks will take
place at different levels of that. They'll know routing, they'll
know switching, they'll know firewalls. Different vendors of
firewalls. They'll know intrusion index systems, and the like. Then
again, you'll have someone that's going to write the reports
and everything, and that again will very often be the red team
leader. Then I'm going to finish up here with insider threats.
And I'll try to be fairly quick with this. I do want to point
out that insiders are not on the certified ethical hacker exam
objectives, in any of the modules. You can do a word search for
it and you won't find it anywhere. However, take it on my authority
that you'd probably need to know what these are, okay? That having
been said, these will be insider threats such as employees or
whatever that could also be a threat to your corporation. So
for example, a pure insider would be somebody that has authorized
physical access. They have a key card, or they have a secure
ID token. Maybe they have, you know, they know the keypad to
the door, that sort of thing. They also will probably have network
logon, maybe they have a workstation that they sit down at and
log in at every day, or maybe they've been given a laptop. Or
even nowadays, even a smart phone, a company's smartphone may
also be a gateway for an insider threat. There is also the possibility
of an elevated pure insider, which is pretty much the same thing,
except that they have elevated privilege, because maybe they're
some kind of an administrator. Could be a help desk personnel,
could be database administrators, active directory administrators,
you get the idea, anybody that's a higher level
of privilege. So we also have, you know, these categories of
people that will be probably pure insiders. More than likely
it's going to be an employee, but it could also be some kind
of a contractor. I know here in Arizona, in Phoenix where I live,
there's some credit card companies that are based out of here,
or they have big office buildings here. And I know some of the
people that work in the IT department, even. And they get full
access as if they were an employee, they show up for work, 40,
50, 60 hours every week, just like everybody else does that's
an employee, but they're actually contractors, okay. So it may
be at that level, as well. Just depends on the level of access
your contractors have. Now, what's the motive for a pure insider
to be a threat to your company? Could be greed. I remember an
old Richard Pryor movie, I think this was maybe from the late
70s or early 80s, and Richard Pryor is an older comedian from
way back when, and he was in this employee and he figured out
that when the company did its accounting, that it would do certain
rounding. And every now and then there would be a.05 cents,
you know, that would not really get recorded on the books, because
of the way they did their rounding. So he found out all of these
fractional pennies floating around out there that never really
got accounted for, he figured a way to tap into the system and
suck all those fractions of pennies out and deposit them into
his own bank account. And so it added up to lots and lots of
dollars. And then foolishly he showed up the next week in a Ferrari
in the company parking lot, and everybody is wondering where
did he get all this money. So anyway, it could be greed. You
figured out a way to milk the system you figured out a way to
send your expense reports through the computer system without
it ever going to your supervisor and getting and now you can
get an automatic approval without supervisor rubber stamps.
Or maybe they figured out some other way to, you know, milk money
out of the company. Or it could just be a disgruntled employee,
and they've worked there for 20 years, and they were just getting
ready to get put up for a promotion and the kid that just got
out of college got the promotion instead. Well now, this person
is very upset and angry. Or maybe they got some kind of an advance
notice that they're about to get canned after, again, especially
these people that worked for a long time, that worked for the
company for 20 years, and they found out they're about to get
laid off. Well, that's a very disgruntled employee. They might
do something before they get out the door to hurt the company.
In fact, it's not part of the ethical hacker exam objectives
and all of that, but a lot of the training that goes on there
in terms of managing IT departments specifies that if you do
have to lay off or fire anybody, especially in the IT department,
you notify them of their firing immediately, and escort them
out of the building so they don't have a chance to touch any
computers. Very often their account has been disabled as they
walk into the meeting, where they're getting laid off or whatever. Sounds
a little bit heartless, but on the other hand, you have to protect
the company, and you don't want them to get mad and disgruntled
and do some damage. In other insider threats that you might have
there's someone called an insider associate. This person has
limited authorized physical access. And although that's kind
of literally the way we're supposed to identify that, as limited
access, sometimes they have full access. I mean, you think about
the physical access of a building, some parts of that building
are extremely sensitive. Highly sensitive. The server room, or
maybe the CEO's office, things like this, where even normal employees
don't go in there. Well, who can go in there? It's got to get
cleaned sometime. Some kind of janitorial crew probably is going
to get in there. Somebody who fixes the phones is probably going
to get in there. So these are people that do have some level
of access, although it varies, the level of physical access they
have. If they can get in the building at all, there's nothing
that says that maybe they're supposed to only vacuum and janitorially
clean the general office areas and not the CEO's office. But
if he's in the building, who's to say that he's not going to
pick that lock, or figure out a way into that office. So that's
really kind of a fuzzy line there. But also there's usually not
any direct network logon. Your janitorial staff, the maintenance
crew, other jobs like that will generally not have a network
logon, because they don't often use PCs there. They're very often
ignored and overlooked, and so it's easy to miss these folks.
Although there's more attention given to them now than there
used to be, probably because because of things like this. Remember
that old movie that Charlie Sheen was in, Wall Street? Yeah.
Well, this was an old movie that he was in where he got insider
information in a competitor's corporation, or something like
that, I can't really remember the whole story, but he got a job
as a janitor in that other corporation, and as a result of that
he was able to get access and to dig through trash, which we
call dumpster diving, and
look for papers, and stuff like that. So could be potentially
spies. So you can you could look at exposed papers. You might
be able to walk by logged-on systems. Somebody left for the day,
but you're there as the janitor, you can walk by the system and
see, oh, hey, this person did not lock their computer. And if
they haven't locked their computer and you have access to it,
you can pretty much do whatever you want to. You could put a
key logger on it, which I'll talk more about a little bit later
on, especially a hardware key logger. Very difficult to identify,
and it can really severely compromise the security of a system.
Secure areas, again, such as the server room, the CEO's office,
places like that, are still going to need services. Somebody
has to clean up there eventually, and they will still be able
to get in. So it's maintenance folks, people that, you know,
repair the phones, janitorial staff, guards, folks of this nature.
Now, another kind of an insider threat you might see would be
the insider affiliate. Don't confuse that with the insider associate
that we looked at on the last whiteboard. This person is someone
that has a connection to the employee, but they're not an employee
themselves. Something like that. They might be a client, maybe
you bring in a client in through the office, so that they can
see how you do your operations and things like this. Now, the
client might not actually be a client. They might be a prospective
client. You know what that's often known as? A social engineering
hacker. Someone who pretends to be a prospective client that
wants to buy your product, and that actually is spying on your
building and looking at seeing how you do what you do, so that
they can get some kind of an inside scoop on things. Or maybe
while you're not looking they're plant some kind of a keyboard
logger, something like that. And we'll talk more about keyboard
loggers later on, but that could be done through software or
hardware. The hardware kind that you just plug into the end of
the UBS cable on, let's say, a keyboard, and then you plug it
into the computer. Visually speaking they're very difficult to
detect, but they can log every keystroke that takes place, and
you can get things like passwords. There's you know, maybe it's
a spouse, or a girlfriend, or maybe you have both, I don't know,
hopefully only one. Maybe you have a boyfriend, best friend forever,
who knows what if they are, but there's somebody that's somehow
associated with you. And you might just want to bring them on
a tour of where you work, so that they can see how everything
you know, operates. And see why you're working 60 hours a week.
Now, these people might not always be malicious. They might just
be there and they're just waiting, you know, your spouses, they're
just waiting for you to finish out the last 10 minutes of your
day, and they're kind of sitting at somebody else's desk while
you're finishing up your paperwork, and they happen to notice
something on the screen where the on the desk where they're seated,
and that employee has already left, but they did not log out.
So they see something confidential on the computer screen. That's
actually a security threat. Even though that person is not a
hacker, it's still a security issue. They might see papers on
the desk, you know, you get the idea there. This one you've
also got to be careful of, just a friend. Especially a recently-made
friend. There are hackers out there who are pretty good social
engineers. Now, a lot of hackers that I have met, and that I
have seen, are not actually all that social. But some of them
are pretty good, and they're really more like con men or actors
or something like that, and they will just kind of charm their
way into your life, suddenly you're good friends, you've known
this person for a couple of weeks, now they want to see where
you work and you bring them in and guess what, they may have
been social engineering you the entire time. So just kind of,
you know, look out for that kind of thing, because it does happen. Also,
they're usually going to have visitors access, they may have
a visitors badge, or they come they may have to sign a log book
when they come in, especially in larger organizations. Smaller
ones they might be able to just walk through the front door.
They will usually have a loaned badge or they might have a loaned
PIN, and you don't want this to happen. Because when it's a loan
badge, what do I mean by that? That means that let's say a husband
has you know, he's gone out and he's left the building, and forgot
to pick up something that was on his desk. So he doesn't want
to go all the way back to work, so he sends his spouse out, okay?
And he says, honey, I'm really tired, would you please go back
and get these papers off my desk for me. Here's my badge, and
to get in the door you'll need my PIN. So she goes back and she
you know, gets into the building. Well, that's not really authorized
access. Shouldn't happen that way. Or it could be a best friend
forever, you know the most recently recently-made friend that
you give these things to. You don't want that to happen. Or it
could be a borrowed company laptop. Maybe you're sitting at home
with your boyfriend or your girlfriend, and, you know, it's your
laptop, your company laptop, and they say hey, can I get on the
internet real quick, I want to just look at my Facebook status,
I want to update my Facebook status. Hopefully they're not trying
to say that they're single now or available. Anyway, so they
get on there, and while they're on there they realize, oh, hey,
this person has a VPN logon into their company.
Now it could be a VPN connection that you've already established
because you were checking your e-mail or you were looking at
files over a protected virtual private network to your company.
However, this person, just out of curiosity, might start browsing
through those resources. Well, those are things that they shouldn't
be able to see, okay. So this can be a bit of a thorny issue
as well, sometimes. You could also put somebody, maybe a friend
or a loved one, in legal trouble if they actually access something
that they're really not supposed to, especially in some government
organizations. Doesn't matter if it was accidentally or on purpose,
if they're accessing some things, it might be illegal for them
to do that, and you could put them in quite a bit of trouble,
there. And again, like I said before, it might actually be a
social engineering thing, especially a BFF, something like that,
fake client, so forth. In this nugget we talked about the introduction
to ethical hacking, which is the first exam objective. We talked
about recent hacks that have taken place from such groups as
LulzSec and anonymous and some of the different kinds of things
that can take place, in terms of national security, corporate
espionage, banks getting hacked, all those sorts of things. And
obviously, very, very serious, and a good reason why we need
to be good ethical hackers, so that we can kind of track what
they're doing, and be able to penetration test. Also we talked
about various laws, one from the United Kingdom as well as others
from the United States, that make it illegal for someone to hack
into systems. We looked at various terms, as well. There's a
lot of terms that you need to know as we go on throughout the
rest of this series, so I wanted to address that early on in
this series. We took a look at the types of hackers, as well.
Remember there's black hat hackers, gray hat, white hat, different
types of folks like that. There's script kitties, and so forth.
And then we finally finished up with insider threats, and these
again are going to be people that could be a client, an employee,
they could be a best friend, lots of different kinds of folks
that may have some kind of an access inside of the company. Well,
I hope this has been informative for you, and I'd like to thank
you for viewing.