Computer Science: Hacking and Cyberattack Notes

Definition of Hacker: Individuals who use their technical knowledge to break into computer systems.
White Hat Hackers: * Known as "the good guys." * They hunt for bugs and attempt to close security holes in software. * Their goal is to make systems safer and more resilient. * They are often professionally hired by companies and governments to perform security evaluations.
Black Hat Hackers: * Malicious hackers with negative intentions. * They aim to steal, exploit, and sell computer vulnerabilities and data.
Hacker Motivations: * Amusement and Curiosity: Hacking for the sake of exploring how systems work. * Cybercriminals: Primarily motivated by monetary gain. * Hacktivists: Use technical skills to promote a social or political goal.
Stereotype vs. Reality: * The stereotypical image of a hacker as an unpopular kid in a dark room with pizza boxes is largely inaccurate. * Carrie Anne notes this description better suited John Green in college than actual high-level hackers.

Definition: The most common entry method is not technical hacking, but manipulating users into providing access. This involves tricking people into divulging confidential information or configuring systems to permit entry.
Phishing: * Users receive an email asking them to log into an account, such as a bank, on a website. * The email contains a link to an "evil clone" site that appears legitimate to the casual observer. * Entered usernames and passwords go directly to the hackers. * Statistics: Even with a success rate of only $\frac{1}{10}$ of $1\%$ , a campaign of $1,000,000$ phishing emails can result in $1,000$ compromised accounts.
Pretexting: * The attacker calls a company and confidently pretends to be from a specific department, such as IT. * Sophisticated Tactics: Attackers may call one number and ask to be transferred to a second so the incoming call appears to be internal to the company. * They use research (like finding key employees' names) to be more convincing. * Success Threshold: An attacker may need ten calls to find a victim, but only one successful call is needed to gain entry.
Dialogue Example (Pretexting): * Attacker: "Oh. Hey, it's Susan from IT. We’re having some network issues down here, can you go ahead and check a setting for me?"

Trojan Horses: * Malicious programs delivered via email that masquerade as harmless attachments, such as a photo or an invoice.
Malware Types: * General Malware: Software designed to steal data, such as banking credentials. * Ransomware: Software that encrypts the user's files and demands a ransom payment for the decryption key.
Brute Force Attacks: * Attempting every possible combination of a password until entry is gained. * Defenses: Modern systems implement incremental wait times after failed attempts or lock accounts entirely after several tries.
NAND Mirroring: * A technique used to bypass brute-force wait times by having physical access to the hardware. * Attaching wires to the device's memory chip to create a perfect copy of the contents. * Passwords can be tried until the wait period begins; at that point, the memory is "reflashed" with the original copy to reset the timer. * This was successfully demonstrated on an iPhone 5C, though newer devices have defenses against it.

Exploit Definition: Successfully utilizing a bug in a system to gain capabilities or unauthorized access.
Buffer Overflow: * Buffer: A block of memory reserved for storing data (e.g., video buffers for pixel data). * Mechanism: In a login prompt, text buffers might be specified for a fixed size, such as $10$ . * If a user enters a password longer than the specified buffer size (e.g., $>10$ characters), the extra characters overwrite adjacent data in the memory. * Outcomes: 1. System Crash: Important values are overwritten with "gobbledygook." 2. Privilege Escalation: A hacker can inject purposeful values into memory, such as setting an "is admin" variable to true.
Combating Buffer Overflows: * Bounds Checking: Testing the length of input before copying it into a buffer. Many modern languages do this automatically. * Memory Randomization: Randomizing the location of variables so hackers do not know which memory address to overwrite. * Canaries: Named after the birds used in mining to detect danger. These are unused spaces left after buffers; if their values change, the system knows an attacker is manipulating the memory.

Code Injection: Utilizing input fields to run commands on the server. Most common on websites with databases.
Structured Query Language (SQL/Sequel): A popular database API used to manage data structures called tables.
SQL Query Example: * Standard Query: SELECT password FROM users WHERE username = 'philbin'; (Note: SQL commands end with a semicolon ;).
Injection Mechanism: Sending a malicious username containing embedded commands. * Example Malicious Input: whatever'; drop table users; * This results in two commands: one that fails to find the password for 'whatever' and a second that executes drop table users, deleting the entire table of user data.
Advanced Injection: Can be used to add new administrator records or steal sensitive data like credit card or social security numbers.
Defenses: * Never trust outside input; programmers must examine it carefully. * Block special characters (semicolons or quotes) in forms. * Input Sanitization: Removing or modifying special characters before running database queries.

Zero Day Vulnerability: A new exploitable bug discovered that the software creators are not yet aware of.
Patches: Security updates released to fix bugs. Users must keep software updated to close vulnerabilities.
Worms: Programs that jump from computer to computer automatically by exploiting open bugs.
Botnets: A large number of compromised computers (zombies) controlled together. * Uses: Sending spam, mining bitcoins (using the victim's power and electricity), and launching DDoS attacks.
Distributed Denial of Service (DDoS): Using a botnet to flood a server with dummy messages to knock services offline, often for ransom or malice.

Economic Impact: Cyberattacks cost the global economy approximately half a trillion dollars ( $500,000,000,000$ ) annually.
Critical Infrastructure Risks: Governments are concerned about computer-driven infrastructure, including: * Power plants and the electrical grid. * Traffic lights. * Water treatment plants. * Oil refineries. * Air traffic control.
Cyberwarfare: Many experts predict the next major war will be fought in cyberspace. * Nations could be crippled economically and infrastructurally without a single physical bullet being fired. * The potential for loss of life remains very high, possibly exceeding conventional warfare.
Community Responsibility: Users should adopt good cybersecurity practices and not ignore software update notifications to secure the interconnected internet community.