All language subtitles for 1 - Introduction English

And we'll go back to another episode on How to Hack.

So today we'll be discussing about this cyber attack chain.

The reason why we have to understand about a cyber attack is because there are a lot of questions about

what goes on in the penetration testing, how our security assessment being carried out.

And the best way to actually describe that is to look at cyber attack chain.

So in this case, cyber protection is, of course, developed by Lockheed Martin, and it is to help

us understand and visualize the step by step process of how hackers actually go after specific individuals,

a particular enterprise that they have been hired to go after, or if they are state funded hackers,

state sponsored hackers, and they have a particular agency in mind and they are supposed to go after

them.

So there are so many tutorials and so many different kind of hacking videos available.

But the whole idea is doing what you have or you're doing a penetration testing.

It's important to follow this step by step process and it will really help you be able to control and

manage how far you're going into cyber attack chain and how far are you going to penetrate the testing.

So on the left side, we actually have the different phases and of course, we have seven phases.

So here we go, reconnaissance, which is about finding out information on publicly available websites.

And of course, we are weaponization is number two.

So this is about how we can create the payload, whether it is a fully undetectable payload, a microwave

cell.

It's about how we can weaponize it and delivery.

Are we going to use a USB?

Are we going to send a phishing email?

Are we going to send Seabass?

So again, those are the delivery mechanisms that we'll be using in terms of putting the weaponization

or the weaponized payload into the system.

And of course, we have our exploitation.

So exploitation is a way for us to actually attack into the system.

So we will execute you will execute the particular exploit that we have created in number two, which

is to weaponize of payload and number five installation.

So we'll install the malware into the system, into the mobile device or any assets that we have on

hand on.

And this is when we go into number six, where we have command and control.

So whenever you're looking at the tutorials, you're looking at that display framework as the command

and control center to manage and control many of these devices.

And of course, the final thing is on actions and objectives.

So this is what are we trying to accomplish?

Have we achieve our goal?

What was the goal?

Was it for personal data?

Was it for credit card information?

Was it for financial data?

Was it for state secrets?

So, again, all these are the things that we're looking at in terms of the cyber attack chain.

So, of course, we discussed the cyber security Kuching.

So it's really important what you're talking about, the chain of cyber attack chain, because many

enterprises or users can be victimized by many of these cyber breaches.

And over here we can see the different companies that have been compromised.

And again, it all follows the same steps.

So if you read up about the hacks that have happened, you'll recognize that many of these hacks that

have happened follow this specific step.

So if you manage to get a detailed report on it, you'll be able to see how the hackers actually attack.

And it is very similar to what you see in a cyber attack chain, all the cybersecurity cuchi.

So the first step is about reconnaissance, a reconnaissance is about finding publicly available information,

using who is using domain name servers, information, lookout on your servers, and be able to find

out what data they have using Net Kroloff using all these different kind of publicly available information,

including also on Google searching to find out usernames, passwords, more tanks of all the domains

going into dark web, finding accounts, data or passwords of this particular enterprise and getting

those data.

So, again, the characteristics of this, it could range from minutes all the way to weeks and months

trying to find out all this data.

And because a lot of users have social media accounts.

Again, those are good places to also start all that to find out more details about enterprise, about

individuals working in the enterprise.

So this is what we call passive reconnaissance.

We are trying to file all publicly available information, not directly interacting with the enterprise.

So do not on debt.

And of course, this is where we have the active reconnaissance, so active reconnaissance means we

are probing the system.

So whenever you'll look at and map that we have been using in a number of the tutorials, we are trying

to get details about the services of the systems and servers.

They're available in site, that particular enterprise.

So we are actually trying to prop directly into the system, looking at fingerprinting, reconnaissance.

We are working and we are pinging the system to find out more details and data.

So this are information that we can find out immediately from.

So again, active reconnaissance and passive reconnaissance are very different in terms of trying to

find out all these details.

So, of course, this is where we go into the weaponization stage, so the weaponization stage would

actually allow us to see what kind of payload we can create sort of first and most use is actually using

Emmis of venom, or you could actually use a different kind of tubes to create a payload so you could

write your own script or your own malicious software if you know C programming and so on, or you want

to put it up on the shell.

You want to get a reverse shell on it, you want to get a seashell on it.

So again, all these are available as part of weaponization.

And in terms of weaponization, we are also thinking about how can we make it fully undetectable so

that we'll use encoding matter to use different kind of Métis to mask the capability from detection

by antivirus systems.

And of course, ultimately this would bring us into the delivery stage.

So in the delivery phase, this is the part where we're thinking about how are we going to deliver the

payload into the user's machine?

So, again, over here we go to social engineer has seen a number of tutorials.

So it's about website attacks.

We want to create website hoster, particular payload.

Do you want to create infectious media generator put into a USB drive executed moment of user plug it

into the computer.

Do you want to have a payload?

You want a mass mailer to all these options are here inside a social engineer toolkit and we'll be exploring

a lot more later on.

So this is about the transmission of the attack.

How do we get the payload, a weaponized payload into the user's computer?

So, again, another key point in terms of sending out a face in order to talk about is also what kind

of payload are you doing?

Because some of these delivery mechanisms can be very different.

So, one, you could be using a lot of phishing emails that could be blasted out to millions of users

or two.

It could be a very targeted, very specific format of the email that is sent to one person where we

just want that person to click onto it so that we can go after that particular entity.

And this is on the exploitation stage, so this is what happens once you're weaponized, you've delivered

the user clicks onto it and you get a revised shell immediately.

So this is the detonation of the attack.

So once the exploit happens, we are in we are into the system.

And this allow us to have control of their environment.

So, again, this is all about gaining access, bypassing security mechanisms.

So this is the detonation of the payload.

And of course, once you hit a destination, this is where we go into the installation.

So this is where we want persistance inside the system.

We want to have the ability to persist inside the mobile device, inside the server, inside a computer

device.

So, again, this is what we call a payload again on the screen.

So this is a Microsoft disable.

Once the user click on enable content immediately will get access and we'll install a pilot into the

system and we will actually create persistance so that we can be able to latch onto the computer system

no matter how much the update to it.

And of course, this is the command and control and command control, we have a number of options in

sight, the channel where we discuss about how we can actually control the system.

So the first one that is most use a lot of time is using a supply framework and as of flow, of course,

on empire power shell.

So Ampara directly to manage based on the power shell scripting.

So and not a great way for us to manage many, many of these computers and systems.

So this is what we call the bots.

So any of these computers that have been hacked into, we call them to barter, we controlling them.

And on the top you can see we got a bot herders.

So the bot herder actually allows you, which is you to control what the bots will do as a result of

them being hijacked into.

So, of course, the focus can be very different.

So if you're a state funded hacker, chances are you're going for sensitive data, confidential data,

top secret data, top secret data, meaning they have grave danger to a nation.

So you're going after those specific data.

And if you are a cyber criminal who was going after for financial gains, then you have a very different

set of data.

You could be looking for credit card information, username passwords, doohickeys set on a dark web.

So, again, the purpose, the action and the objective can be very different across many different

kind of threats, many different kinds of attacks.

So, of course, the question will be, if I'm a defender, I'm going on the blue team and I want to

protect against this cyber attack, what can we do?

So the whole idea goes back into the concept of defense, defense in depth.

So defense in depth means that we must always have a way of slowing down the attacker.

So if a state funded hacker or someone who is persistent in trying to get into enterprise, getting

a data, what we can do is to slow down the person as much as possible and keep changing to different

kind of security mechanisms or countermeasures that we have in place.

That will take a very long time for the hacker to go after you.

So if you're managing an enterprise, you may have thousands of computers and point servers and so on.

So what you do is you will actually make sure that you have antivirus systems, you have a security

monitoring platform, you have a web application, firewall database, firewall and many different of

these security mechanisms in place that will slow down your hacker.

So the hacker want to get in to you to USB and you realize that all of your end points have the USB

disable, then a hacker have to try something else in order to gain access into a system.

And this would take longer and longer for them to persist through in order to gain access into your

sensitive data.

So defense in depth is going to be a great way for you to actually stop many of these potential threats.

So, of course, there are some potential flaws with the whole idea of the cyber attack chain and of

course, thinking about a cyber Accutane is that the hacker has to go through every of this single phase.

But the reality is that that's not the case because the hacker could perhaps be able to get all your

usernames and passwords directly from publicly available information due to all the data breaches.

And from there on, they could immediately get access into many of your accounts and credentials.

So that could be a very quick way, because on point number two or seven steps must be successful for

a successful cyber attack to occur.

But that's not always the case, because once you got usernames, once you got passwords, you could

morph your attack into other ways or other objectives in order to gain other kind of sensitive data.

So, of course, on the finer point, the defender has seven opportunities to break the chain and minimize

data exfiltration.

So if you're playing blue team again, you recognize that you do have the advantage.

If we are trying to conceptualize playing defense in terms of trying to stop the hacker from gaining

full access or completing the full cyber attack chain.

So once again, I hope you learned something valuable in today's lecture.

So if you have any questions, feel free to comment below and I'll try my best to answer any of your

questions.

So we're going to, like, share subscribe the channel so that you can be kept abreast of the latest

cybersecurity Tiriel.

Thank you so much once again for watching.