In most computer attacks targeting ordinary people, hackers mainly use social engineering techniques, e.g. malicious emails*(phishing*) or fraudulent text messages*(smishing*).
However, certain individuals, due to the position or position they hold - politicians, CEOs, judges, military, prosecutors, and a long etc. - face greater risks, as attackers can invest large resources of money and time to achieve their goals.
The effort is worth it because of the succulent rewards offered by the valuable information his victims handle.
Although the following 5 phases are not always used in an attack, we will see below the usual stages that are usually carried out against different targets.
As we said in a previous post, to best defend ourselves against our enemy we must first know him, and knowing his Tactics, Techniques and Procedures**(TTP**) is part of the process.
In a future article, we will also look at some of the typical infrastructures and tools they use to carry out their attacks (clandestine servers in countries with lax legislation, proxies, pivoting their attacks from other previously infected computers, use of cryptocurrencies as payment/collection currency, etc.).
For the moment, let’s look at the typical phases of a hacker attack.
By the way, please know that I am not very comfortable always having to refer to the term hacker as a synonym for cybercriminal, cybercriminal, hacker, etc.
Although I will continue to use it, I reserve the right for another article to qualify the term hacker a little more, we’ll see…
Phase 1: Information gathering
When attackers select a target, the first thing they do is gather as much information about it as possible.
If this phase yields valuable data (names, emails, PR, etc.), multiple attack possibilities open up.
Footprinting
On footprinting involves collecting information from open sources*(Open Source Intelligence* or OSINT).
This includes: forums, social media, online newspapers or official records such as the Official State Gazette (BOE).
This is the only phase in which systems are not being illegally breached, since the information is obtained only what is available to the public.
If we want to know how much information about us is on the Internet, we can do a test with a simple search in a search engine like Google. By using quotation marks to encompass the full name (e.g., “Perico de los Palotes Perez”) or even further refining the search using logical operators*(AND*, OR, site:) we can get spectacular results. I learned this technique during my hacking studies and since then I use it to search for anything (e.g., “Nissan” AND “Navarra” OR “NP300” AND “Madrid” - red).
With the previous search I would be looking for: a Nissan car, model Navarra or NP300, only vehicles from Madrid, and any color except red.
This type of advanced search is known as Google hacking or Google dorks and, used well, can reveal data that a user would not expect to find easily.
In addition to Google, attackers use automated tools such as Maltego, Recon-ng, TheHarvester or Osintgram, and specialized websites such as osintframework.com or shodan.io.
When various tools and techniques are combined, an exhaustive profile of the victim can be generated, a practice known as doxing. There are even forums on the Dark Web where doxing services are offered for little money.
A practical example would be *email *guessing, which consists of guessing the victim’s email address from partial data. For example,some social networks such as Facebook, or at least until recently, displayed a hint of the email you were trying to guess from a target by simply trying to retrieve their password - an option that was always available.
You tried various combinations of email formation patterns and when the application stops telling you “the entered email does not exist”, you had found the potentially correct email.
This is particularly easy to guess with corporate emails. It would be enough to discover the way corporate emails are generated (first name + last name + company domain pattern) to deduce their emails and then launch phishing campaigns.
With a valid email, the attacker can launch spear phishing attacks, which are targeted and highly personalized messages that are often highly effective due to their credibility.
Let’s imagine the following situation: A user leaves a positive review on the Google account of a dental clinic.
A savvy attacker could impersonate the clinic to send you an email “thanking” you for the positive review and offering you a discount voucher.
The victim is likely to trust the email, as its content matches an action he himself has recently performed. If he is offered a download link to get the hypothetical discount voucher, he will surely click on it, making the attack a resounding success.
How to avoid these risks:
- Do not link your real name to accounts used to leave comments or reviews.
- Configure the privacy settings to be able to post reviews anonymously.
- Remember that every piece of information shared online can be exploited by cybercriminals.
Don’t forget that, if you’ve ever left reviews on platforms like Amazon, know that you are indirectly providing information about what you buy, what your purchasing power might be and even the genius you spend if you post comments with a little off-color language.
Fingerprinting
Fingerprinting consists of more active actions to gather information, often through **port scans **(listening connections that your device opens to communicate).
It is true that this is more normal to see it against a company’s infrastructure, but it also occurs in places with public Wi-Fi, such as hotels, airports or cafeterias.
The most popular tool used by hackers for this is Nmap, which identifies which ports people have open (e.g. http Port-80), which services they have installed (e.g. email), operating systems they use (e.g. Windows), etc.
The main disadvantage for the attacker is that fingerprinting leaves traces. Security systems or network administrators can detect scans and block them.
However, if the scanning goes undetected with slower and more disguised techniques, the cybercriminal can obtain key data to plan the attack.
Recommendations:
- Always keep the operating system and applications up to date.
- Install only essential software to reduce potential gateways.
- Configure in a secure and restrictive manner (e.g., disable features such as remote desktop if not in use).
To make an analogy with the physical world, we could understand footprinting as the action of **observing **that a thief would perform from the street to check if he sees open lights, doors or windows, and fingerprinting would be when that same thief takes action by approaching the house to check if those doors and windows are not properly closed or fortified.
Phase 2: Vulnerability analysis
After collecting information, it is necessary to validate it, as sometimes false positives (apparent vulnerabilities that are not really exploitable) or data have been mixed with other people who were not the target.
The key to this phase is to determine which vulnerabilities are truly exploitable and prioritize the different attack vectors that could be exploited.
With all this information clear, the cybercriminal designs the plan for the next stage.
Phase 3: Operation
In the exploitation phase, the attacker uses the data obtained to penetrate the victim’s devices or simply deceive the victim with social engineering techniques such as phishing.
If in any of the previous phases the attacker had discovered that your home router or one of your surveillance cameras is misconfigured or with outdated software, the hacker could exploit one of its known vulnerabilities.
The attacker would use what is known as a exploit (software tailored against a specific vulnerability), which are usually published in specialized public forums or in open-access databases such as Common Vulnerabilities and Exposures (CVE).
Once they access a single device within the network, pivoting from one device to another is a piece of cake, in order to compromise more computers connected to the same network.
Phase 4: Post-exploitation
When the cybercriminal has gained full access, it is when he/she executes one of the planned actions. Such as:
- Exfiltrate or delete information.
- Recording audio or video without permission.
- Encrypt the hard disk and ask for ransom (ransomware).
- Install a keylogger to capture passwords and card data.
In order to achieve this, the initial exploit usually includes a payload (malicious code that acts inside the device).
Often this code is obfuscated or encrypted so that it cannot even be detected by antivirus software. Hence, it is often said that an antivirus does not detect more than 25% or so of existing malware. The good news is that this 25% represents the vast majority of malware spread around the world.
Hackers usually like to maintain the access they have worked so hard to gain in the previous phases, so they often installbackdoors the first time they gain access or create new administrative users so that they can log in again whenever they feel like it without arousing suspicion.
Certain types of malware that hackers tend to leave installed on their victims’ devices usually communicate directly with a kind of Command and Control Center (C&C), which is the infrastructure used by the attacker to perform malicious actions such as turning on the camera, reviewing files or recording everything that is typed.
Phase 5: Deletion of traces
At the conclusion of the attack, the attacker usually removes all evidence so that he cannot be traced.
This includes:
- Delete logs and events from routers, security cameras, computers and phones they have passed through.
- Use advanced techniques to modify or overwrite critical logs.
In some false flag attacks, cybercriminals may leave deliberate clues to frame third parties or even target them to brag about their exploit.
However, they usually seek to keep their identity hidden and evade any computer forensic analysis audits.
In short, in our fight against cybercriminals and in our quest to keep ourselves safe, we find it essential to understand how hackers think and act.
As Sun Tzu said in The Art of War:
“If you know neither the enemy nor yourself, you will lose every battle. If you know yourself, but do not know the enemy, for every battle won you will lose another. If you know the enemy and know yourself, do not fear the outcome of a hundred battles.” Sun Tzu
Subscribe! to continue learning about anti-hacker techniques, protect yourself and don’t underestimate the power of prevention.