Original subtitles

‫And we'll go back to another episode on How to Hack.

‫So today we'll be discussing about this cyber attack chain.

‫The reason why we have to understand about a cyber attack is because there are a lot of questions about

‫what goes on in the penetration testing, how our security assessment being carried out.

‫And the best way to actually describe that is to look at cyber attack chain.

‫So in this case, cyber protection is, of course, developed by Lockheed Martin, and it is to help

‫us understand and visualize the step by step process of how hackers actually go after specific individuals,

‫a particular enterprise that they have been hired to go after, or if they are state funded hackers,

‫state sponsored hackers, and they have a particular agency in mind and they are supposed to go after

‫them.

‫So there are so many tutorials and so many different kind of hacking videos available.

‫But the whole idea is doing what you have or you're doing a penetration testing.

‫It's important to follow this step by step process and it will really help you be able to control and

‫manage how far you're going into cyber attack chain and how far are you going to penetrate the testing.

‫So on the left side, we actually have the different phases and of course, we have seven phases.

‫So here we go, reconnaissance, which is about finding out information on publicly available websites.

‫And of course, we are weaponization is number two.

‫So this is about how we can create the payload, whether it is a fully undetectable payload, a microwave

‫cell.

‫It's about how we can weaponize it and delivery.

‫Are we going to use a USB?

‫Are we going to send a phishing email?

‫Are we going to send Seabass?

‫So again, those are the delivery mechanisms that we'll be using in terms of putting the weaponization

‫or the weaponized payload into the system.

‫And of course, we have our exploitation.

‫So exploitation is a way for us to actually attack into the system.

‫So we will execute you will execute the particular exploit that we have created in number two, which

‫is to weaponize of payload and number five installation.

‫So we'll install the malware into the system, into the mobile device or any assets that we have on

‫hand on.

‫And this is when we go into number six, where we have command and control.

‫So whenever you're looking at the tutorials, you're looking at that display framework as the command

‫and control center to manage and control many of these devices.

‫And of course, the final thing is on actions and objectives.

‫So this is what are we trying to accomplish?

‫Have we achieve our goal?

‫What was the goal?

‫Was it for personal data?

‫Was it for credit card information?

‫Was it for financial data?

‫Was it for state secrets?

‫So, again, all these are the things that we're looking at in terms of the cyber attack chain.

‫So, of course, we discussed the cyber security Kuching.

‫So it's really important what you're talking about, the chain of cyber attack chain, because many

‫enterprises or users can be victimized by many of these cyber breaches.

‫And over here we can see the different companies that have been compromised.

‫And again, it all follows the same steps.

‫So if you read up about the hacks that have happened, you'll recognize that many of these hacks that

‫have happened follow this specific step.

‫So if you manage to get a detailed report on it, you'll be able to see how the hackers actually attack.

‫And it is very similar to what you see in a cyber attack chain, all the cybersecurity cuchi.

‫So the first step is about reconnaissance, a reconnaissance is about finding publicly available information,

‫using who is using domain name servers, information, lookout on your servers, and be able to find

‫out what data they have using Net Kroloff using all these different kind of publicly available information,

‫including also on Google searching to find out usernames, passwords, more tanks of all the domains

‫going into dark web, finding accounts, data or passwords of this particular enterprise and getting

‫those data.

‫So, again, the characteristics of this, it could range from minutes all the way to weeks and months

‫trying to find out all this data.

‫And because a lot of users have social media accounts.

‫Again, those are good places to also start all that to find out more details about enterprise, about

‫individuals working in the enterprise.

‫So this is what we call passive reconnaissance.

‫We are trying to file all publicly available information, not directly interacting with the enterprise.

‫So do not on debt.

‫And of course, this is where we have the active reconnaissance, so active reconnaissance means we

‫are probing the system.

‫So whenever you'll look at and map that we have been using in a number of the tutorials, we are trying

‫to get details about the services of the systems and servers.

‫They're available in site, that particular enterprise.

‫So we are actually trying to prop directly into the system, looking at fingerprinting, reconnaissance.

‫We are working and we are pinging the system to find out more details and data.

‫So this are information that we can find out immediately from.

‫So again, active reconnaissance and passive reconnaissance are very different in terms of trying to

‫find out all these details.

‫So, of course, this is where we go into the weaponization stage, so the weaponization stage would

‫actually allow us to see what kind of payload we can create sort of first and most use is actually using

‫Emmis of venom, or you could actually use a different kind of tubes to create a payload so you could

‫write your own script or your own malicious software if you know C programming and so on, or you want

‫to put it up on the shell.

‫You want to get a reverse shell on it, you want to get a seashell on it.

‫So again, all these are available as part of weaponization.

‫And in terms of weaponization, we are also thinking about how can we make it fully undetectable so

‫that we'll use encoding matter to use different kind of Métis to mask the capability from detection

‫by antivirus systems.

‫And of course, ultimately this would bring us into the delivery stage.

‫So in the delivery phase, this is the part where we're thinking about how are we going to deliver the

‫payload into the user's machine?

‫So, again, over here we go to social engineer has seen a number of tutorials.

‫So it's about website attacks.

‫We want to create website hoster, particular payload.

‫Do you want to create infectious media generator put into a USB drive executed moment of user plug it

‫into the computer.

‫Do you want to have a payload?

‫You want a mass mailer to all these options are here inside a social engineer toolkit and we'll be exploring

‫a lot more later on.

‫So this is about the transmission of the attack.

‫How do we get the payload, a weaponized payload into the user's computer?

‫So, again, another key point in terms of sending out a face in order to talk about is also what kind

‫of payload are you doing?

‫Because some of these delivery mechanisms can be very different.

‫So, one, you could be using a lot of phishing emails that could be blasted out to millions of users

‫or two.

‫It could be a very targeted, very specific format of the email that is sent to one person where we

‫just want that person to click onto it so that we can go after that particular entity.

‫And this is on the exploitation stage, so this is what happens once you're weaponized, you've delivered

‫the user clicks onto it and you get a revised shell immediately.

‫So this is the detonation of the attack.

‫So once the exploit happens, we are in we are into the system.

‫And this allow us to have control of their environment.

‫So, again, this is all about gaining access, bypassing security mechanisms.

‫So this is the detonation of the payload.

‫And of course, once you hit a destination, this is where we go into the installation.

‫So this is where we want persistance inside the system.

‫We want to have the ability to persist inside the mobile device, inside the server, inside a computer

‫device.

‫So, again, this is what we call a payload again on the screen.

‫So this is a Microsoft disable.

‫Once the user click on enable content immediately will get access and we'll install a pilot into the

‫system and we will actually create persistance so that we can be able to latch onto the computer system

‫no matter how much the update to it.

‫And of course, this is the command and control and command control, we have a number of options in

‫sight, the channel where we discuss about how we can actually control the system.

‫So the first one that is most use a lot of time is using a supply framework and as of flow, of course,

‫on empire power shell.

‫So Ampara directly to manage based on the power shell scripting.

‫So and not a great way for us to manage many, many of these computers and systems.

‫So this is what we call the bots.

‫So any of these computers that have been hacked into, we call them to barter, we controlling them.

‫And on the top you can see we got a bot herders.

‫So the bot herder actually allows you, which is you to control what the bots will do as a result of

‫them being hijacked into.

‫So, of course, the focus can be very different.

‫So if you're a state funded hacker, chances are you're going for sensitive data, confidential data,

‫top secret data, top secret data, meaning they have grave danger to a nation.

‫So you're going after those specific data.

‫And if you are a cyber criminal who was going after for financial gains, then you have a very different

‫set of data.

‫You could be looking for credit card information, username passwords, doohickeys set on a dark web.

‫So, again, the purpose, the action and the objective can be very different across many different

‫kind of threats, many different kinds of attacks.

‫So, of course, the question will be, if I'm a defender, I'm going on the blue team and I want to

‫protect against this cyber attack, what can we do?

‫So the whole idea goes back into the concept of defense, defense in depth.

‫So defense in depth means that we must always have a way of slowing down the attacker.

‫So if a state funded hacker or someone who is persistent in trying to get into enterprise, getting

‫a data, what we can do is to slow down the person as much as possible and keep changing to different

‫kind of security mechanisms or countermeasures that we have in place.

‫That will take a very long time for the hacker to go after you.

‫So if you're managing an enterprise, you may have thousands of computers and point servers and so on.

‫So what you do is you will actually make sure that you have antivirus systems, you have a security

‫monitoring platform, you have a web application, firewall database, firewall and many different of

‫these security mechanisms in place that will slow down your hacker.

‫So the hacker want to get in to you to USB and you realize that all of your end points have the USB

‫disable, then a hacker have to try something else in order to gain access into a system.

‫And this would take longer and longer for them to persist through in order to gain access into your

‫sensitive data.

‫So defense in depth is going to be a great way for you to actually stop many of these potential threats.

‫So, of course, there are some potential flaws with the whole idea of the cyber attack chain and of

‫course, thinking about a cyber Accutane is that the hacker has to go through every of this single phase.

‫But the reality is that that's not the case because the hacker could perhaps be able to get all your

‫usernames and passwords directly from publicly available information due to all the data breaches.

‫And from there on, they could immediately get access into many of your accounts and credentials.

‫So that could be a very quick way, because on point number two or seven steps must be successful for

‫a successful cyber attack to occur.

‫But that's not always the case, because once you got usernames, once you got passwords, you could

‫morph your attack into other ways or other objectives in order to gain other kind of sensitive data.

‫So, of course, on the finer point, the defender has seven opportunities to break the chain and minimize

‫data exfiltration.

‫So if you're playing blue team again, you recognize that you do have the advantage.

‫If we are trying to conceptualize playing defense in terms of trying to stop the hacker from gaining

‫full access or completing the full cyber attack chain.

‫So once again, I hope you learned something valuable in today's lecture.

‫So if you have any questions, feel free to comment below and I'll try my best to answer any of your

‫questions.

‫So we're going to, like, share subscribe the channel so that you can be kept abreast of the latest

‫cybersecurity Tiriel.

‫Thank you so much once again for watching.