Diving into the world of

Hacking
 The Journey of the Internet
• Internet history starts in the 1960. On Oct. 29, 1969, At 10:30 p.m.,
a student programmer at UCLA named Charley Kline sent the letter
“l” and the letter “o” electronically using packet switching protocol
more than 350 miles to a Stanford Research Institute computer in
Menlo Park, California.

• The letters stood for “login,” and the effort led to a system crash
immediately afterward. But a technological revolution had begun.

• The Message sent by ARPANET which is now called Internet.

ARPANET was funded by the U.S. military. (Advanced Research
Projects Agency Network)
 TCP/IP PROTOCOL
• The technology continued to grow in the 1970s after scientists Robert
Kahn and Vinton Gray Cerf developed Transmission Control Protocol and
Internet Protocol, or TCP/IP, a communications model in the year 1973,
that set standards for how data could be transmitted between multiple
networks

• In 1982, the PhoneNet system is established and is connected to

ARPANET and the first commercial network, Telenet.

• Jan. 1, 1983 is the date when ARPANET adopted to the TCP/IP protocol.
From there researchers began to assemble the “network of networks”
that became the modern Internet.

• Arpanet was renamed the Internet in 1984, when it linked 1,000 hosts
at university and corporate labs.
 Domain Name System
• Paul Mockapetris, Jon Postel and Craig Partridge create the Domain Name
system, which uses domain names to manage the increasing number of users
on the internet.

• In 1985, the first domain is registered: symbolics.com, a domain belonging

to a computer manufacturer.

• In 1989, the first Internet service providers, companies offering the public
direct access to the Internet for a monthly fee, were established in
Australia and the United States. In Brookline, Massachusetts, The World
became the first commercial ISP in the US. Its first customer was served in
November 1989.
 Online
• The online world then took on a more recognizable form in 1990, when
computer scientist Tim Berners-Lee invented the World Wide Web.

• 1995 is the year with fast grown internet because Microsoft launches
Windows 95; Amazon, Yahoo and eBay all launch; Internet Explorer
launches; and Java is created, allowing for animation on websites and
creating a new flurry of internet activity.

• Google is founded in 1998. In 1999, the music and video piracy controversy
intensifies with the launch of Napster.

• The first internet virus capable of copying and sending itself to a user’s
address book is discovered in 1999.
 Where from the internet comes
• The Internet comes to you across the bottom of the ocean

• The cables are installed by special boats called cable-layers

• Ninety-nine percent of international data is transmitted by wires at the

bottom of the ocean called submarine communications cables.These
cable networks are laid and maintained by various governments and
giant companies

• India is connected to the world at Mumbai, Cochin, Chennai and

Tuticorine. All of our international internet traffic goes through these
port cities. The place where the international cables connect to the
land is called landing stations.
 What is Hacking?

• The term “Hacking” in information security refers to exploiting

the vulnerabilities in a system, compromising the security to
gain unauthorized command and control over the system
resources. Purpose of hacking may include modification of
system resources, disruption of features and services to achieve
goals. It can also be used to steal information for any use like
sending it to competitors, regulatory bodies or publicizing the
sensitive information.
 Terminologies
• Attack
• An attempt to break into a system
• Backdoor
• A design fault, planned or accidental, that allows an attacker access to the
compromised system around any security mechanisms that are in place
• Exploit
• Code that is designed to take advantage of a vulnerability. An exploit is
designed to give an attacker the ability to execute additional malicious
programs on the compromised system or to provide unauthorized access to
affected data or application.
• Hardening
• The process of identifying and fixing vulnerabilities on a system.
• Patch
• A patch is a small update released by a software manufacturer to fix bugs or
vulnerabilities in an existing program
• Payload
• The actual application data a packet contains. It is part of the
t ransmitted data which is the fundamental purpose of the transmission. In
summary, payload refers to the actual intended message in a transmission.
• Vulnerability
• In cybersecurity, a flaw in a system or device that can leave it open to
unauthorized access and attack. It may also refer to any type of weakness
in a computer system itself, in a set of procedures, or in anything that
leaves information securit exposed to a threat.
• Pentesting
• An authorized, simulated attack exercise used to evaluate the security of
IT infrastructures.
• Zero-Day Attack and Vulnerability
• Zero-day is a flaw in software, hardware or firmware that is unknown
to the party or parties responsible for patching or otherwise fixing the
flaw
• Iphone Zero-day: https://thehackernews.com/2020/04/zero-day-
warning-its-possible-to-hack.html
• Doxing
• The Internet-based practice of researching and publicly broadcasting
private or identifying information (especially personally identifying
information) about an individual or organization
• Doxing of Donal Trump: http://micropaste.com/view/96b164d8
Types of hackers
• White Hat Hackers:
• White hat hackers are the one who authorized or certified hacker who work for
government or other organizations by performing penetration testing and
identifying loopholes in their security
• Marcus Hutchins: https://www.ncsc.gov.uk/blog-post/finding-kill-switch-stop-
spread-ransomware-0
• Black Hat Hackers:
• Black hat hackers are the one who gains the access to the system without
authorization, and they can destroy or steal sensitive information.
• Maksim yakubets: https://thehackernews.com/2019/12/dridex-russian-hackers-
wanted-by-fbi.html
• Gray Hat Hackers:
• Grey hat hackers are the one who stands in the middle of white hat hackers and
black hat hackers. They can use their skills for personal gain and also for the
professional gain
• Alexey: https://www.thesslstore.com/blog/mysterious-russian-grey-hat-
vigilante-patched-over-100000-routers/
• Blue Hat Hacker:
• In one word, this is the amateur. Usually, their techniques are deployed
out of ill motives such as revenge attacks.
• Cyber Anakin: https://www.vice.com/en_us/article/pgkp57/a-teen-
hacker-is-targeting-russian-sites-as-revenge-for-the-mh17-crash

• Red Hat Hacker:

• The objective of a red hat hacker is to find black hat hackers, intercept
and destroy their schemes.
• FBI: https://thehackernews.com/2015/11/fbi-tor-unmask.html

• Green Hat Hackers:

• This is the set of individuals who simply want to observe and learn about
the world of hacking. It comprises those who join learning communities to
watch videos and tutorials about hacking.
• State Sponsered Hackers:
• These are hackers who are employed by a country to attack the cybersphere of
another nation or international agency as a result of warfare or to
retrieve/steal information.
• web: https://www.zdnet.com/article/state-sponsored-hackers-are-now-using-
coronavirus-lures-to-infect-their-targets/
• Script Kiddies:
• Script Kiddies or skid are unskilled individual who uses scripts developed by
others to attack computer systems and networks and deface websites, such as a
web shell.
• web: https://siliconangle.com/2015/10/27/15-year-old-script-kiddie-arrested-
in-talktalk-hacking-investigation/
• Cyber Terrorists:
• Cyber terrorists are politically motivated attackers who break into computer
systems to stir up violence against non-combatant targets by subnational groups
or clandestine agents.
• Unit 8200: Kosher Cracking :https://www.ft.com/content/69f150da-25b8-11e5-
bd83-71cb60e8f08c
• Social Engineering Hackers:
• These are hackers who use psychological manipulation to make people to divulge private
contents or to perform certain actions. It is a more complex crime scheme.
• web: https://thehackernews.com/2013/04/social-engineering-skype-
support-team.html

• Elite Hackers:
• These are individuals who are considered the “cutting-edge geniuses”.
They are the real experts and the innovators in the field of hacking.
• web: https://knowyourmeme.com/memes/events/lulzsec-hacks

• Malicious insider/whistleblower:
• These are the types of computer hackers who leak sensitive information from within an
organization, especially data under the umbrella of government agencies.
• web: https://www.theguardian.com/us-news/ng-interactive/2019/sep/13/edward-
snowden-interview-whistleblowing-russia-ai-permanent-record
Phases of Hacking
 Phases of Hacking

• Information Gathering - Preparation phase when an attacker

seeks to gather information does not directly interact with the
system, and relies on social engineering and public info.

• Network Scanning - Identify specific vulnerabilities (in-depth

probing) Using Port scanners to detect listening ports (companies
should shut down ports that are not required)
• Gaining Access - Using vulnerabilities identified during
reconniassance [DoS, Logic/Time, Exploit reconfiguring/crashing
system]
 Phases of Hacking

• Maintaining Access - Keeping a low profile, keeping system as

a launch pad, backdooring the system etc.

• Clearing Tracks - Hiding malicious acts while continuing to

have access, avoiding suspicion
 Impact of Hacking
• Financial Losses. Every year, reports of hacked businesses
reveal staggering financial losses as a result. ...

• Loss of Information. Hacking often results in a loss of data due

to files being deleted or changed. ...

• Decreased Privacy. When hackers gain access to your

computer, they can see everything. ...

• Damaged Reputation.
 Case Study
• WannaCry
• The WannaCry ransomware attack was a May 2017 worldwide
cyberattack by the WannaCry ransomware cryptoworm, targeting only
the Microsoft Windows operating systems.
• The initial infection was likely through an exposed vulnerable SMB
port, rather than email phishing as initially assumed. However, email
phishing was the main method of spreading the WannaCry
ransomware.
• The WannaCry ransomware attack had exploited a vulnerability in
Windows OS called EternalBlue.
• Impact
• This attack impacted a number of businesses, institutions and
hospitals all over the world.
• Businesses like Nissan and Renault had to pause their activities after
some of their computers were affected.
• In hospitals, computer systems used for various purposes were
affected, like MRI scanners and computers.
• Many critics said that this attack could have been prevented if people
took steps, to solve the flaws on which the attacks were based,
earlier.
• Some even blame the governments for their inability to secure
vulnerabilities.
• Estimates state that around 200,000 to 300,000 computer
systems were affected in this attack in approximately 150
countries.
 Social engineering Attack
• Social engineering is the term used for a broad range of
malicious activities accomplished through human interactions.
It uses psychological manipulation to trick users into making
security mistakes or giving away sensitive information
• E.g. : Phishing , Vishing, Smishing

• Phishing:
• Convincing looking website which ask for credentials and the
credentials entered are harvested by hackers. ie, Fake Links
• Vishing:
• Using telephone calling to perform social engineering attacks is called
vishing.. Victims recieve calls from spammers and make the victims
believe they are genuine Professionals providing you jobs in exchange
of amount
• Smshing:
• Sending sms to victims to lure them to click on the link provided. Ex:
The message consists of your number being selected for a lucky draw

• Web: https://openphish.com/
 Future in Cyber Security
• Nowadays, everyone is connected; connected with each other
via the internet. With the rapid growth of the internet, it is
highly recommended to protect your personal data at all times
because anyone can misuse it for their own cause. With all
that said, the scope and demand of cybersecurity is increasing
day by day.
Some of the Certifications in Cyber Security
• CEH – Certified Ethical Hacker : Provided by EC-Council

• ECSA – EC-Council Certified Security Analyst : Provided by EC-

Council

• LPT – Licensed Penetration Tester : Provided by EC-Council

• OSCP : Offensive Security Certified Professional : Provided by

Offensive Security
 Virtualization (Virtual Box)
• Virtualization is the creation of a virtual – rather than actual –
version of something, such as an operating system (OS), a
server, a storage device or network resources. Virtualization
uses software that simulates hardware functionality in order
to create a virtual system.

• web: https://www.virtualbox.org/
 General Awareness
• Password Management
• Passwords are the key to our treasure so protecting the key is very
important in the digital world. A secure password will look like:

• Minimum 12 Characters
• Contains Alphabets and Numbers
• Contains Special Characters
• Spaces
• Lengthy
• Different Password for different accounts
 GOAL Based Password Management
• Convert your goal into your password.
• Eg :
• Quit_$moking 4Ever
• Iw@nt2becomead0ctor
 Introduction to bug bounty
• A bug bounty program is a deal offered by many websites,
organizations and software developers by which individuals
can receive recognition and compensation for reporting bugs,
especially those pertaining to security exploits and
vulnerabilities.
• Popular Platforms ;
• Bugcrowd : https://www.bugcrowd.com/
• HackerOne : https://www.hackerone.com/
• Intigriti : https://www.intigriti.com/
 LIVE CYBER THREAT MAP
• ThreatCloud from CheckPoint is a cyber attack map offering
a sophisticated way to detect all the malicious attacks all
over the world.

• Web: https://threatmap.checkpoint.com/