Are you a CEO or CFO?
Cybercrime is knocking, are you ready: Series 3.
ATTACK PLANNING: FOOTPRINTING & RECONNAISSANCE
A couple of weeks back, my wife took a long weekend vacation. Naturally, it was my turn to mind the children.
On Saturday afternoon, it occurred to me that the whole house had gone quiet. The living room was even quieter, as I darted through the corridor to open the door and check if I still had company in the house.
It was TV time. The channel was National Geographic. A pride of lions was on a hunt. The target? A herd of antelopes. All the kids’ eyes, glued to the screen, oblivious to the world around them. I quietly closed the door behind me and joined the youngsters.
The final attack was swift, coordinated and on target. Sadly, it was brutal. Chunks of flesh from the antelope were chewed while it was still alive, heart beating and legs kicking.
But the build-up phase of the final assault was rather slow and somewhat uninteresting. However, if you watched closely, you could see that real work was done before any energy was expended at all.
For most of the program, the lions were shown as just sitting there and somewhat sleepy. The antelopes that were being targeted too saw the lions, raised their necks and ears a little, and then went about their normal business of chewing grass. While some shook their little tails as they fed, others lay down, regurgitating and chewing.
From time to time, the lions would look up at the herd, stand and then lazily go back down, place their heads on the ground, yawn and lick their teeth.
Occasionally they’d get up stroll aimlessly around, and split the pride, then take opposite directions, disappearing behind tall grass and thickets. The antelopes would also raise their necks, bleat and grunt a little, walk around in different directions and finally get back to grazing business.
This went on for a while and the pride of lions just seemed to be sitting there and somehow, co-existing besides the herd of antelopes.
At last one camera focused across the field showed an explosion of a lion from its lazy looks, focusing both eyes towards the herd, dashing across the field. Within seconds, as the herd dispersed in different directions, another lion that had been taking cover pounced upon an antelope bringing it down by the neck and suffocating it to death while other members of the pride joined to claim their prize.
What do you think the lions were doing all along? In effect, they were footprinting, scanning and enumerating. They spent time discreetly figuring out the herd, gathering and piecing together different pieces of information. They observed how the herd was moving, the old, the young and the wounded.
The lions used non-intrusive methods to understand how the herd is organized. They narrowed down which antelope to attack. Which lion would chase? Which direction? Which lion would lie in wait and avoid detection?
Computer hackers do what is similar to what the lions did. Using both passive and active methods they are able to identify loopholes to exploit.
Hackers will footprint websites, emails, gather competitive intelligence and use social engineering to gather information about their target organization.
They will use search engines and use google hacking techniques. Many times, they will deploy technological tools like Maltego, Recon-ng, Recon-Dog and Netscan Tools Pro.
While still using our analogy of the pride of lions, we will look at Scanning in series 4.
