What does hacking actually LOOK like? For example, what interface is the hacker using, what’s their goal, and are they typing in a bunch of passwords like in the movies?
In: Technology
In general, you are trying to find access to a system. What you are doing changes based on what access you have and what you know about the system. It basically does not look any different from any other form of programming. Work in text editors and watching screens of log files / searching through them for details of how the program crashed this time.
Most hacking involves getting the computer to run a program that does what you want, and reports to somewhere you control.
You can trick someone who has access to run your program. This is phishing and commonly done by sending email messages that get a user to open the file you sent.
Attacking from a distance requires having an exploit to a program that is running and responding to a computer you do control. Some people do this without any real knowledge, referred to as “script kiddies” by just finding attack scripts and executing them with little to know knowledge how they work.
Making your own exploit involves either reverse engineering the changes to a system in published patches and figuring out how to do what the patch prevents, or a process called fuzzing.
Reverse engineering involves analyzing the files through methods including reverse compilers, which reverse the program into programming code that is easier to read ( easier being the key word. Any notes made by the programmer to help make sense of what the program is doing is lost, and the version you get is still closer to computer logic than human. ) Reading the patch notes to identify what it is supposed to change, and running programs that list all changes made to a computer as you apply the patch.
To fuzz a system, you build a copy of what you want to attack on a virtual computer and send it random messages. Eventually one of these messages will cause a problem with the system. You then use debugging tools to see where what happened. Most often, the computer just broke and needs to be restarted to reset, sometimes, very rarely, you can find the information sent in a specific part of the computer’s memory where running programs are stored. If you find a way to write into the execution stack, you append a program to the string that broke the system and fine-tune until the computer is doing exactly what you want.
The next step requires getting the program to be run on the computer you want to hack. If you have a network exploit, you can just send a request (similar to sending email or requesting a webpage to it).
Hacking a computer on-site is much simpler. The old adage is if you can get physical control of a system, there is no protection that can stop you, often referred to as an evil maid attack: you left your computer in the hotel room, and the maid does something to it while cleaning that gains access to anything on the system. Depending on how difficult the owner has made it, this can range from simply running one of the programs you would send in a phishig campaign on the computer if there was no password protection, all the way to opening the computer and installing a device that records whatever parts you want when the computer is running and sends the data back to somewhere for you.
Not so ELI5, but if you want to learn, there are several places that put up systems intentionally to be hacked. SANS runs a new event every year in December and they keep the system open so you can try even after the event is over. The ‘event’ includes talks from security researchers that detail the security flaws you can exploit in the systems to pass the challenges so you should be able to learn as you go.
https://holidayhackchallenge.com/2019/
They also publish participant’s notes on what they found after the event is closed so any parts that stumped someone can be searched and learned from.
Latest Answers