Original subtitles

1

Hey, guys, welcome back to another episode on how to defend and to do with looking at how can we check

2

if a mobile device has already been hacked.

3

OK, so this is going to be a little more technical.

4

OK, so we need some form of command line interface, define up the processes as well as the network

5

elbaum connections that we're having from our mobile device all the way out onto the Internet or into

6

some hacking server that is in control of all mobile devices.

7

So the first thing we want to do is, of course, want to highlight over here, I have an Android device

8

running on the left side of the screen, as you can see.

9

And it can be the same for a physical Android device that you can do the same to.

10

OK, so you can go ahead and plug in your Android device into a computer system which already has Android

11

debark running.

12

So if you're not sure what is Android debark, which we have a video tutorial on that, so do check

13

it out on a channel.

14

So what are we going to do now is to actually go ahead and open up command problem?

15

OK, is it going to open it up?

16

And of course, I'm going to zoom in a little more so it's easier for you to see.

17

OK, so I'm going to put this as for in twenty eight, OK, so what we'll do now is to actually kick

18

start EDB.

19

So we will need a connection into the Android device or discus shell and we can issue some interesting

20

commands to find out what's going on on the device.

21

OK, on a background, on a background, I actually have a colonics machine running, so we'll look

22

at what's normal and what is abnormal.

23

What are some of the indicators that your phone has already been compromised?

24

So first of all, you can go in, enter Adibi devices and it will show us a list of Android devices

25

that are connected to your computer system.

26

OK, so you could do the same for any form of operating system.

27

So go ahead, enter AB Shell and this would bring us into the device itself.

28

So now we are currently controlling the device on the left side.

29

You can see.

30

So of course, one of those things that we can do is to issue some commands and one of those commands

31

is, of course, Nestande.

32

So instead help us find out what are some of the elbow connection or establish connections that we have

33

and a really important areas over here to really important areas over here.

34

So we have here what is normal.

35

OK, so we have an established connection, active Internet connections.

36

OK, so over here, this is what we're seeing.

37

All right.

38

And what I'm going to do next is over here.

39

I really have a malicious application installed into the device in the back door.

40

I'm going to start up display.

41

OK, so I'm going to go into terminal.

42

OK, so this is colonics.

43

I'm going down to MSF console to start up exploit and I'm going to open up.

44

OK, a reverse shell from the device all the way into decolonize system.

45

OK, so go ahead, enter.

46

So I'm going to set to table now.

47

OK, so I will, of course, enter DDR to find the IP address of two colleagues machine and set the

48

alehouse.

49

So, of course in this case, the IP address of our colleagues machine is one or two one six eight zero

50

one zero six.

51

Go ahead and hit enter and that enter show options to see all the listed options and go ahead and enter

52

exploit.

53

So basically what I'm doing here is to start up a hacking server that would then give us control of

54

the Android device.

55

So of course, once the Android device and the user has those applications running and the users clicked

56

onto the malicious application, is sometimes what the hackers would do is they will use a legitimate

57

application and beat this malicious software on top of it.

58

And this would give them a instantaneous access into the mobile device.

59

Giving them access to the geolocation dismisses everything.

60

OK, so over here, what we're seeing is that we have a L port of four four four for this running.

61

So it could be any other port numbers that hackers could be using to gain control of your device.

62

All right.

63

And if I go into command from now and if I enter, I enter up arrow.

64

So I Antonet start once more, then we just increase the font size.

65

So it's a little easier for you to see.

66

Two thirty six.

67

OK.

68

So what I would do next is, again, the same issuing the same come in Internet stat.

69

All right, and what we will see here, OK, if I scroll back up to the top again.

70

All right.

71

So unlike the earlier results that we got in.

72

All right.

73

So going back to the top, we can see a foreign address.

74

All right.

75

Of four four four four.

76

OK, so we see that there is a connection.

77

All right.

78

Coming in from the device.

79

OK, this is it.

80

Elbow connection to a foreign address.

81

And this is definitely something amiss.

82

OK, so the other things we can look at for not just a network connection, which could be showing all

83

the suspicious elbow connections.

84

OK, so why would a mobile device have such a connection outwards?

85

OK, so there's something to take note off.

86

All right.

87

As part of the investigation, whether a device has already been compromised.

88

The second thing that we could take a look at is in terms of looking at the list of users, looking

89

at the processes that are actually being run in the system so you can enter a top GOP enter on deck.

90

And this will show us all the different processes to actually running inside the Android device in our

91

case.

92

OK, we have Shell running.

93

All right.

94

And we have all these number of uses over here.

95

So we have root.

96

We have a system, we have zero.

97

We have all these different uses who are actually inside the environment right now.

98

And of course, we have no idea what you're doing.

99

Right.

100

So we're trying to investigate what's going on.

101

So, of course, I can go and enter a game talk and we can see all the different information.

102

I mean, as well as the users, the processes are running and so on, so forth.

103

So, of course, on the on our case over here, OK, what we're seeing is that there are certain processes

104

that shouldn't be there, just the processes that are suspicious.

105

And of course, in our case, if I go back to colonics, know if I had to shell.

106

All right, this means that the hacker is having a command line interface into the device.

107

All right.

108

And for example, if a hacker who am I to get the username over here so we can see the username as you

109

zero on a score, a one, two, three, four.

110

OK, so in our case, when we go back to command from looking at a top, we can see over here, OK,

111

we have a user, you zero, a one, three, four, and they have a shell.

112

So if you think about it now, if you think about it from a mobile device perspective, why would a

113

mobile device have a shell running?

114

Why would a mobile device have a terminal running at all?

115

OK, so this is another big indicator that your device could have already been compromised in a hacker

116

is interfacing at a shell level.

117

OK, so that can be another form of indicator of attack.

118

OK, next.

119

And the final sharing is, of course, in terms of looking at piece stands for processes they're running.

120

So you can enter this will list all the processes inside the systems again and a capital A and we can

121

see all of those different processes.

122

They're running into the system.

123

And of course, we're looking at it again for certain processes that shouldn't be there.

124

So, for example, over here, OK, we have the common ones like com dot android and we have here Kamden

125

deployed on state.

126

Let's split, of course, is a hacking framework that we use and we have done a lot of lectures and

127

tutorials on it.

128

So that is going to be one suspicious indicator of suspicious indicators are going to be shell or a

129

shell is also another suspicious indicator if it is being run as a process inside your mobile device.

130

OK, so this is some of the processes and indicators of attacks that we can look at or indicate compromise

131

that we can look at.

132

OK, so there are many, many other ways for us to further filtering future down into what exactly is

133

going on in the process, looking for what is considered normal and what is considered abnormal in those

134

situations, in those cases.

135

All right.

136

And this is how we were able to detect when there was a cyber attack inside our system.

137

OK, so with that, I hope you've learned something valuable in today's tutorial.

138

And if you like what you just watch, remember, like sharing, subscribe to the channel so that you

139

can be kept abreast of the latest cyber security.

140

Thank you so much once again for watching.