Compromising the System

The previous chapter gave you an idea of the precursor of an attack. It discussed tools and techniques used to gather information about a target so that an attack can be planned and executed. It also touched on external and internal reconnaissance techniques. This chapter will discuss how actual attacks are conducted after information about the target is collected in the reconnaissance phase. Once the reconnaissance stage is over, the attackers will have useful information about a target, which will aid their attempts to compromise the system. When compromising the system, different hacking tools and techniques are used to breach into targeted systems. The objectives for doing this vary, as they may range from destroying critical systems to gaining access to sensitive files.

There are several ways that attackers can compromise a system. The current trend has been through the exploitation of vulnerabilities in systems. A lot of efforts are being made to...

Analyzing current trends

Over time, hackers have proven to cybersecurity experts that they can be persistent, more creative, and increasingly sophisticated with their attacks. They have learned how to adapt to changes in the IT landscape so that they can always be effective when they launch attacks. Even though there is no Moore’s law equivalent in the context of cyber attacks, it can be said that hacking techniques become more sophisticated each year.

Below, in the illustration, you will see an example of the anatomy of a cyber attack.

Figure 6.1: Anatomy of a cyber attack

In the last few years, there has been an observed trend in terms of the preferred attacks and modes of execution. These include extortion attacks, data manipulation attacks, IoT device attacks, backdoors, hacking everyday devices, hacking the cloud, phishing, exploiting a vulnerability in a system, and zero-day attacks. In this section, we will explain how these attacks and modes of execution...

Performing the steps to compromise a system

One of the main tasks of the Blue Team is to understand the cyber kill chain fully, and how it can be used against an organization’s infrastructure. The Red Team, on the other hand, can use simulation exercises to identify breaches, and the results of this exercise can help to enhance the overall security posture of the organization.

The core macro steps to be followed are:

1. Deploy the payloads
2. Compromise the operations system
3. Compromise the remote system
4. Compromise the web-based system

Note that these steps will vary according to the attacker’s mission, or the Red Team’s target exercise. The intent here is to give you a core plan that you can customize according to your organization’s needs.

Deploying payloads

Assuming that the entire public recon process was done to identify the target that you want to attack, you now need to build a payload that can exploit an...

Mobile phone (iOS/Android) attacks

Mobile phone usage by far exceeds any other computing device today. However, mobile phone users tend to be oblivious to the cyber threats that they face. Therefore, it is quite easy for an attacker to compromise a large number of mobile phones since it is unlikely that the users will have installed any effective security tools. There have been quite a number of mobile phone attacks in the recent past that have been reported on both Android and iOS devices. The following sections illustrate a few of these attacks.

Exodus

This spyware is said to have been the wake-up call for many mobile phone users on iOS devices. The spyware was initially effective against Android phones only, but soon enough, an iOS variant came up. It was a big concern for years in the Google Play Store since there were several malicious apps that had this malware. Security experts faulted the ineffectiveness of Google Play’s security filtering mechanism for new...

Summary

Armed with enough information from the reconnaissance phase, hackers will have an easier time finding the right attacks to use to compromise systems. This chapter has looked at several methods that hackers are utilizing to attack computing devices.

In many instances, vulnerabilities have been primarily targeted to allow hackers to breach into otherwise secured systems. Zero-day vulnerabilities have been particularly effective against many targets. These are vulnerabilities that have no existing patches thus making it significantly harder for any targeted system to be secured. There has been an alarming number of zero-day vulnerabilities discovered due to the efforts of security researchers, hackers, and state agencies to discover exploitable flaws in systems.

This chapter also looked at the WhatsApp vulnerability of May 2019, which allowed hackers to install spyware on devices using a simple voice call. All the hackers had to do was manipulate data packets to carry...

Further reading

• Exodus: New Android Spyware Made in Italy https://securitywithoutborders.org/blog/2019/03/29/exodus.html
• Fireeye blog post about CommandoVM https://www.fireeye.com/blog/threat-research/2019/03/commando-vm-windows-offensive-distribution.html
• IoT Threat Report by Sophus https://nakedsecurity.sophos.com/2018/11/23/mobile-and-iot-attacks-sophoslabs-2019-threat-report/
• Mitre Attack Framework https://attack.mitre.org/
• Cross-site Scripting (XSS) https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
• Google Project Zero iOS Zero Days in the wild https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html?m=1
• Hackers hit malware in CC Cleaner software https://www.theverge.com/2017/9/18/16325202/ccleaner-hack-malware-security

References

• S. Layak, Ransomware: The extortionists of the new millennium Internet, The Economic Times (Online), 2017. Available: https://search.proquest.com/docview/1900413817
• Wallenstrom. (Jul 05). Taking the bite out of the non-malware threat. Available: https://search.proquest.com/docview/1916016466
• N. Lomas. (Aug 19). Full Ashley Madison Hacked Data Apparently Dumped On Tor. Available: https://search.proquest.com/docview/1705297436
• S. Writer, QNB hackers behind data breach at Sharjah bank, Arabianbusiness.com, 2016. Available: https://search.proquest.com/docview/1787557261
• J. Stein, How a Chinese Spy Case Turned Into One Man’s Child Porn Nightmare, Newsweek, 2016. Available: https://search.proquest.com/docview/1793546676
• J. Melrose, Cyber security protection enters a new era, Control Eng., 2016. Available: https://search.proquest.com/docview/1777631974
• F. Y. Rashid, Listen up, FBI: Juniper code shows the problem with backdoors...