Sunday, August 23, 2015

Methods in Hacking: No System is Safe

In the movie, Who am I - No System is Safe, Benjamin Engel, a young, friendless, German computer whiz, was invited to join a subversive hacker group that wants to be noticed on the world's stage and became a most wanted man.


Who Am I movie poster

The movie is interestingly an action-packed tutorials on the various methods of hacking into the systems whether software or hardware.

Here are some of the methods in hacking to which were demonstrated in the movie:

0 Day Exploit
According to Wikipedia, zero-day (also known as zero-hour or 0-day) vulnerability is an undisclosed and uncorrected computer application vulnerability that could be exploited to adversely affect the computer programs, data, additional computers or a network.[1] It is known as a "zero-day" because once a flaw becomes known, the programmer or developer has zero days to fix it.

Zero-day exploits are attempted before or on the day notice of the vulnerability is released to the public; sometimes before the author is aware or has developed and made available corrected code.

Zero-day attacks are a severe threat and they occur because a vulnerability window exists between the time a threat is released and the time security vendors release patches.


Phishing
Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims "Email Address" and "Password" is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials.

Keylogging
Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim's computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.
source: Top 10 Facebook profile hacking techniques!

But there's more. Benjamin and his team used to try to hack a nemesis identity.

Using a Trojan?
As per Wiki : "A Trojan horse, or Trojan, in computing is generally a non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm" and in the Benjamin is trying to identify the ip address and location of MRX, another hacker.

In most part of the story, they used Social Engineering as a tactic to get necessary information and/or convince the victim to do what the hacker wishes him/her to do.

"But the greatest of all is - Social Engineering!"
How a hacker proved that with social engineering technique he can get a free burger!

This was what said for how many times in the movie because they said "hacking is like magic".

Social Engineering always play a vital role to any hacking-related activity.
Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations today encounter.
TechTarget


Lets take a look at one of the reviews for this movie:


'Who am I' is a fast paced thriller, incessant, written and directed by the German director Baran Bo Odar talking about the increasingly present virtual world and the tasks of the hackers, who apparently are the new superheroes of the digital age , replacing the classic Superman, Batman or Spiderman. Young and capable of anything when faced with a computer.
agolpeeventos blogspot (translated)
And by the way, this movie is available in mediafire.

Philippines' Bureau of Customs Dozed by Hackers

A group of hackers performed DDOS (Distributed Denial of Service) attacks on the Bureau of Customs in secret operation they named as #OpCustoms which started as early as yesterday and this morning. Hackers continuously attacked the Bureau of Customs website with multiple pings and packets which either downed the site for a brief period or it made it slow for access to users.

A screenshot of the website when trying to access from the google.com website

The DDOSers from the Anonymous groups who called themselves ~Pinoy LulzSec, ~Elite Cyber Security and ~MCA and PHU DDOS Squad said that they downed the site "For the OFW's around the world"

They are in sympathy with the recent policy being enforced by the Bureau Of Customs wherein all "Balikbayan Boxes" sent by OFWs from around the world will be subject to intense inspection to opening of the said packages.

A lot Overseas Filipino Workers (OFWs) from around the world reacted strongly to this and the hackers sympathized with the OFWs.

Their message?


Greetings!
We Are DDOSERS Came From Different Groups.
We unite for this #OPCustoms for the #OFW`s
THIS IS AN OPEN MESSAGE TO Bureau of Customs Specially to Commissioner Alberto Lina.
Why are you focusing your "ire" on the Overseas Filipino Workers and their hard-earned boxes? While smuggled goods and fake rice from China and thrash coming from Canada were brought in to our country without you knowing?
You said that they are the "new heroes" of our poor country and yet it is they whom you put stricter measures; not the bigtime smugglers nor the Chinese illegal traders?
Our country will not further to progress if you are attacking small fishes instead of the big ones. Graft and corruption will always hamper our grwoth.
To Commissioner Alberto Lina and President Aquino, is this what you call "Tuwid na daan" (straight path to progress)??
WE ARE WATCHING.
~Elite Cyber Security
~Pinoy Lulzsec
~#MCA AND #PHU DDOS SQUAD.
 

As of this time, the Bureau of Customs website is either inaccessible or it is slow in loading.