CEH v12 – Module 01 • Introduction to Ethical Hacking • Comprehensive Study Notes
Elements of Information Security
Information security is a state of well-being for information assets, systems, and data, where the risk of loss due to activities like theft, tampering, or disruption is maintained at a low or tolerable level. Its primary goal is to protect against unauthorized access, use, disclosure, disruption, modification, or destruction of information. This foundational discipline ensures the resilience and trustworthiness of an organization's digital ecosystem.
Five core elements, commonly known as CIAAN, form the foundation of information security, each addressing a critical aspect of data protection:
• Confidentiality – This principle ensures that information is accessible only to authorized entities, individuals, or systems. It is paramount in preventing sensitive data from being disclosed to unauthorized parties. Controls to maintain confidentiality include data classification (categorizing data sensitivity levels, e.g., public, internal, confidential, restricted), encryption (transforming data into an unreadable format using cryptographic algorithms, such as AES for symmetric encryption or RSA for asymmetric encryption), access control lists (ACLs) and role-based access control (RBAC) to restrict resource access, and secure data disposal (ensuring data is irrecoverably destroyed from storage media through methods like degaussing or pulverization).
• Integrity – Guarantees the accuracy, completeness, and trustworthiness of information and its processing methods throughout its lifecycle. It ensures that data has not been modified or corrupted in an unauthorized or accidental manner. Controls involve checksums (mathematical calculations like CRC or hash values to verify data consistency during transmission or storage), hashing (one-way cryptographic functions like SHA-256 that produce unique, fixed-size digital fingerprints of data, used for file integrity verification), access control (restricting who can modify data and enforcing granular permissions), version control systems (tracking changes to documents and code), and digital signatures (cryptographically ensuring data has not been tampered with since it was signed).
• Availability – This ensures that authorized users can access and utilize information and systems when needed, without undue delay or disruption. It means that systems, networks, and applications are operational and functioning correctly, even under stress or attack. Controls include redundancy (duplicating critical system components, data, or network paths to provide failover capabilities, e.g., redundant power supplies, RAID configurations, or geographically dispersed data centers), anti-virus (AV) software (preventing malware infections that can impair system availability), anti-DDoS (Distributed Denial of Service) solutions (mitigating attacks that flood systems to make them unavailable through traffic scrubbing and rate limiting), disaster recovery planning (DRP), and regular system backups.
• Authenticity – Provides proof that data, users, and communications are genuine and have not been forged or impersonated. It verifies the identity of a user, the source of data, or the validity of a transaction. Controls include biometrics (unique physical characteristics like fingerprints, facial recognition, or iris scans for user authentication), digital certificates (electronic documents issued by a Certificate Authority that cryptographically bind a public key to an individual or entity, verifying identity in online transactions and enabling secure communication), and multi-factor authentication (MFA) (requiring multiple distinct verification methods from different categories, such as something you know (password), something you have (token), and something you are (biometric), to verify identity).
• Non-repudiation – Guarantees that the sender of a message or the author of an action cannot later deny having sent or performed it, and conversely, that the receiver cannot deny having received it. It provides undeniable proof of participation or origin. Controls often involve digital signatures (using public-key cryptography to create a unique cryptographic stamp on a document or message, linking it to the sender and ensuring integrity), and auditing logs (securely recording actions, transactions, and system events with timestamps and user identifiers to provide irrefutable proof for forensic analysis or legal purposes).
Motives, Goals, Formula & Attack Categories
The generic equation for understanding an attack is: . This formula highlights that a successful attack requires an attacker's reason (motive), a means or technique to execute it (method), and a weakness or flaw in the target system's defenses (vulnerability).
Typical motives for cyberattacks are diverse and include:
• Disrupting business continuity: Aiming to cause downtime, operational failures, or service interruptions to severely impact an organization's operations.
• Stealing/manipulating data: Gaining unauthorized access to sensitive information for exfiltration (theft) or altering data for malicious purposes, such as financial fraud or disinformation.
• Causing financial/reputation loss: Direct monetary theft, extortion (e.g., ransomware demanding payment), or damaging a brand's public image and trustworthiness, leading to loss of customer confidence.
• Ideology: Motivations rooted in political, social, or religious beliefs, often manifesting as hacktivism, where attacks are used to convey a message or protest.
• State objectives: Espionage (stealing classified information), sabotage (destroying critical infrastructure), or information warfare conducted by nation-states against adversaries.
• Ransom: Encrypting a victim's data or locking down their systems and demanding payment, typically in cryptocurrency, for the decryption key or release of control.
• Revenge: Retaliation against individuals or organizations due to perceived grievances, often by disgruntled employees or former associates.
IATF (Information Assurance Technical Framework) categorizes attacks into several classes, based on the nature of the interaction with the target system:
• Passive attacks – These involve monitoring or eavesdropping on communications and data transfers without altering them. The goal is to gather information discreetly. Examples include sniffing (capturing network traffic packets to analyze their content) and eavesdropping (listening to private conversations or intercepting data transmissions, such as unencrypted wireless communications).
• Active attacks – These involve modifying or disrupting system operations and data. They are detectable as they directly impact the target. Examples include Denial of Service (DoS) attacks (overwhelming a system's resources to make it unavailable to legitimate users), spoofing (impersonating a legitimate user, device, or system to gain unauthorized access or deceive), code execution (running arbitrary malicious code on a target system, often through vulnerabilities like buffer overflows), and SQL Injection (SQLi) (inserting malicious SQL code into input fields to manipulate backend databases).
• Close-in attacks – These attacks require physical proximity to the target to gain information or direct access. Examples include shoulder surfing (observing someone entering credentials or sensitive information by looking over their shoulder) and dumpster diving (sifting through discarded trash or waste to find sensitive documents, media, or other information).
• Insider attacks – Attacks perpetrated by individuals within the organization who have authorized access, often abusing their legitimate privileges. Examples include privileged misuse (an authorized user exceeding or abusing their legitimate access rights for malicious purposes) and device theft (stealing laptops, mobile devices, or storage media containing sensitive data).
• Distribution attacks – These involve tampering with hardware or software at various points during its development, manufacturing, or distribution within the supply chain. This could mean inserting malicious code into legitimate software updates, compromising hardware components before they reach the end-user, or distributing infected media.
Information Warfare
Information Warfare (InfoWar) refers to the use of information and communication technologies (ICT) to achieve competitive or military advantage over an adversary. It involves systematic strategies for controlling and manipulating information and information systems in a conflict or competition, encompassing both offensive and defensive measures.
Libicki's 7 categories of Information Warfare provide a comprehensive framework that outlines the diverse forms InfoWar can take:
Command-and-Control (C2) Warfare: Focuses on disrupting, degrading, or deceiving an adversary's ability to command and control their forces and operations, by targeting their C2 systems, communications, and decision-making processes.
Intelligence-based Warfare: Involves using information to gain a deeper understanding of the adversary's capabilities, intentions, and vulnerabilities, or conversely, to deny them crucial intelligence through deception or jamming.
Electronic Warfare: Exploiting the electromagnetic spectrum to deny, degrade, or deceive an adversary's electronic systems, signals, and communications. This includes jamming, spoofing, and electronic surveillance.
Psychological Warfare (PSYOPs): Influencing the emotions, motives, reasoning, and behavior of target audiences (e.g., enemy forces, civilian populations) through propaganda, disinformation, and perception management to achieve strategic objectives.
Hacker Warfare: Exploiting vulnerabilities in an adversary's IT systems, networks, and infrastructure for unauthorized access, disruption, data theft, or sabotage, often conducted by state-sponsored or affiliated groups.
Economic Warfare: Using information systems and cyber capabilities to impact an adversary's economic stability, disrupt financial markets, steal industrial secrets, or gain asymmetrical financial advantage.
Cyberwarfare: Actions by a nation-state to penetrate another nation's computers or networks for the purposes of causing significant damage or disruption to critical infrastructure, government functions, or military capabilities.
InfoWar can be categorized into two main stances based on objective:
• Defensive IW: Focuses on protecting one's own information systems, data, and capabilities from adversary attacks. This includes prevention (implementing robust security measures like firewalls, IDS/IPS, and secure configurations), deterrence (discouraging attacks through strong defenses and threat of retaliation), alerts (early warnings of potential threats or attacks), detection (identifying ongoing attacks and compromises through monitoring and analysis), and response (mitigating the impact of an attack, containing breaches, and recovering compromised systems and data).
• Offensive IW: Involves actively using cyber capabilities to attack an adversary's information systems and infrastructure to achieve strategic advantages. Tactics include system hacking (gaining unauthorized access to target systems), Man-in-the-Middle (MITM) attacks (intercepting and altering communications between two parties without their knowledge), malware deployment (using malicious software like viruses, worms, or ransomware to compromise systems), and web/server attacks (exploiting vulnerabilities in web applications, databases, or servers to gain control or steal data).
Hacking Methodologies & FrameworksCEH Hacking Methodology (CHM)
This systematic approach, taught in the Certified Ethical Hacker (CEH) certification, outlines the sequential steps an attacker (or ethical hacker conducting a penetration test) typically follows to compromise a system:
Footprinting: The initial, passive phase of gathering as much information as possible about the target organization and its systems without direct interaction. This can involve Open Source Intelligence (OSINT) techniques, utilizing public sources (e.g., corporate websites, social media, financial reports, Google Dorks), competitor websites, domain name lookups (e.g., WHOIS records), and DNS queries to collect IP ranges, domain names, network topology details, employee contact information, and operating system details.
Scanning: The second phase, which involves active engagement with the target network to identify live systems, open ports, and services running on them. This involves network scanning (e.g., using Nmap to discover hosts and their states), vulnerability scanning (automated tools to identify known weaknesses on services and applications), and port scanning (identifying open ports that indicate running services).
Enumeration: This phase aims to extract more detailed and specific information about identified systems and services found during scanning. It focuses on gathering user accounts, network shares, applications, system configurations, and security policies. Techniques might involve NetBIOS enumeration (discovering computer names, user lists, and shares in Windows networks), SNMP enumeration (gathering network device information), and LDAP enumeration (querying directory services for user and group details).
Vulnerability Analysis: In this critical phase, the collected information is analyzed to identify security weaknesses and potential entry points in the enumerated systems and applications. This involves comparing identified services and software versions against known vulnerability databases (e.g., CVEs, Exploit-DB) and using automated vulnerability scanners (e.g., Nessus, OpenVAS) to find potential exploits.
System Hacking: This is the active phase where the attacker attempts to exploit identified vulnerabilities to gain unauthorized access to the target system. This typically involves several interdependent sub-phases:
Gaining Access: Exploiting a vulnerability (e.g., a buffer overflow, SQL injection, weak SSH credentials, or an unpatched web application flaw) to obtain an initial foothold or unauthorized access to the system.
Privilege Escalation: Once initial access is gained, the attacker attempts to escalate their privileges from a standard user account to a higher-level user (e.g., administrator, root, or system account) to gain more control over the compromised system and bypass security restrictions, often by exploiting local vulnerabilities or misconfigurations.
Maintaining Access: After gaining and escalating access, the attacker establishes persistence to ensure continued access to the compromised system, even after reboots or security patches. This often involves installing backdoors, rootkits, creating hidden user accounts, or modifying boot processes.
Clearing Logs: (Also known as covering tracks) The final step in system hacking involves erasing or modifying system logs, event logs, and forensic artifacts to remove traces of the attack, making detection and investigation more difficult and allowing the attacker to remain undetected.
Cyber Kill Chain (Lockheed Martin)
This framework describes the stages of a typical targeted cyberattack from the adversary's perspective, emphasizing that each phase presents opportunities for defense and mitigation. Disrupting any stage can prevent the attack's success, making it a valuable model for defensive strategies:
Reconnaissance: The attacker selects a target, conducts extensive research to gather information about the victim (e.g., public-facing assets, employee details, technologies used), and attempts to identify potential vulnerabilities or entry vectors.
Weaponization: The attacker creates a deliverable exploit by combining a specifically crafted exploit (e.g., for a software vulnerability like a buffer overflow) with a malicious payload (e.g., a backdoor, remote access Trojan, or data exfiltration tool) into a single, self-contained package (e.g., a malicious PDF, infected macro-enabled document, or executable).
Delivery: The weaponized payload is transmitted to the victim's environment. Common delivery vectors include email attachments (phishing), malicious websites (drive-by downloads), USB drives, compromised supply chain channels, or direct network access.
Exploitation: Upon delivery, the attacker's code exploits a specific vulnerability on the victim's system or application, leading to the successful execution of the payload. This might involve tricking the user into opening a malicious file or exploiting a web server flaw.
Installation: The payload successfully executes and installs a persistent backdoor, remote access Trojan (RAT), or other malicious software on the victim's system. This ensures the attacker can maintain continued access, even if the system is restarted.
Command and Control (C2): The compromised system establishes a communication channel (often referred to as a beacon) to the attacker's external command and control infrastructure. This two-way communication allows the attacker to remotely control the compromised system, issue commands, and receive data.
Actions on Objectives: With remote control established, the attacker achieves their ultimate goal for the intrusion. This final phase can involve a wide range of activities, such as data exfiltration (stealing sensitive information), destruction of data or systems, espionage, further exploitation within the network (lateral movement), or financial gain.
MITRE ATT&CK
The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) knowledge base is a globally accessible framework that provides a comprehensive list of adversary tactics and techniques observed in real-world cyberattacks. It serves as a foundational resource for developing specific threat models, understanding adversary behavior, and improving defensive capabilities in the private sector, government, and the cybersecurity community.
It is structured into several matrices based on the target environment:
PRE-ATT&CK focuses on adversary behavior during the reconnaissance, weaponization, and other pre-attack phases, before direct system compromise.
Enterprise (the most extensive part) focuses on adversary behaviors within enterprise networks, covering Windows, Linux, macOS, cloud, and network devices.
Mobile covers tactics and techniques applicable to iOS and Android platforms.
The 14 Enterprise tactics represent the high-level adversarial objectives or phases an adversary might pursue during an attack, providing a structured way to categorize techniques:
Reconnaissance: Gathering information about the target to plan future operations, without direct interaction.
Resource Development: Establishing resources (e.g., persona, infrastructure, capabilities) to support operations before they begin.
Initial Access: Gaining the first foothold or access to a system or network, often through external means.
Execution: Running malicious code, commands, or tools on a local or remote system.
Persistence: Maintaining access to a system across reboots, credential changes, or other interruptions.
Privilege Escalation: Gaining higher-level user or system permissions than initially obtained on a compromised system.
Defense Evasion: Techniques used to avoid detection by security controls (e.g., antivirus, firewalls, intrusion detection systems).
Credential Access: Stealing account names, passwords, or hashes that can be used to authenticate to systems or services.
Discovery: Gaining knowledge about the internal network, systems, and environment to inform subsequent actions.
Lateral Movement: Moving from one compromised system to other systems within the network to expand control.
Collection: Gathering data from the target environment that is relevant to the adversary's objectives (e.g., sensitive files, emails).
Command and Control (C2): Communicating with compromised systems from external networks to issue commands and receive data.
Exfiltration: Stealing data from the victim's network and transferring it to an external location controlled by the adversary.
Impact: Disrupting the availability or integrity of systems and data, which can include activities like ransomware deployment, data wiping, or sabotage.
Diamond Model of Intrusion Analysis
The Diamond Model is a framework for analyzing and articulating cyber intrusions, providing a concise and structured way to understand and communicate attack events. It simplifies complex attack events into a core set of four interconnected nodes (or features) that describe any intrusion event:
• Adversary: The attacker, threat actor, or group behind the intrusion. This includes their identity (if known), motivations, and level of sophistication.
• Capability: The tools, techniques, and methodologies (TTPs) used by the adversary to conduct the intrusion. This can range from custom malware and zero-day exploits to public tools and established attack frameworks.
• Infrastructure: The physical and logical resources used by the adversary to deliver its capability and maintain control. This includes command and control (C2) servers, botnets, IP addresses, domains, and anonymous networks (e.g., Tor).
• Victim: The target of the intrusion, encompassing its assets (e.g., systems, data), personnel (e.g., specific users, administrators), and personas (e.g., roles or functions within the organization).
Meta-features enrich the basic Diamond Model by adding context and details to each intrusion event. These include:
Timestamp: When the event occurred.
Phase: Which stage of the attack lifecycle (e.g., reconnaissance, exploitation, post-exploitation) the event belongs to.
Result: The outcome of the event (success, failure, partial success).
Direction: The flow of the event (e.g., inbound for delivery, outbound for C2 or exfiltration).
Methodology: The specific approach used (e.g., phishing, brute force, supply chain compromise).
Resource: What was needed to conduct the attack (e.g., a specific tool, a vulnerability, a credential).
The Extended Diamond Model further adds Socio-Political and Technology relations, recognizing the broader context of the attack and the technical environment in which it occurred. Socio-Political refers to the geopolitical, economic, or social factors influencing the attack, while Technology refers to the underlying technological context, including protocols, operating systems, and network configurations.
Tactics, Techniques & Procedures (TTPs)
Tactics refer to the high-level objectives or overall approach of an adversary (the why behind an attack). They describe the adversary's strategic goals during various phases of an intrusion, such as "gaining initial access" or "maintaining persistence."
Techniques describe how an adversary achieves their tactical objectives. These are more specific methods or actions employed by an attacker, for instance, "phishing" as a technique for "initial access," or "Process Injection" for "privilege escalation." Techniques are specific, observable actions and often map directly to entries in frameworks like MITRE ATT&CK.
Procedures are the granular, step-by-step implementations or specific sequences of techniques used by a particular threat actor or group (the specific how). Procedures are the concrete, specific ways an adversary utilizes tactics and techniques to accomplish their objectives. For example, a procedure might detail which specific phishing email template was used, the specific malware deployed, and the exact C2 communication method, including specific domains or IP addresses. They represent the distinctive ways different threat actors operate and are often derived from forensic analysis of past incidents.
TTPs are fundamental for threat intelligence, enabling organizations to understand adversarial behavior, develop effective defenses, and simulate attacks (e.g., red teaming) based on realistic threat actor profiles. By understanding an adversary's TTPs, defenders can anticipate future attacks and build more resilient security architectures.