Attack Methodology

Integrated Attack Strategy

Integrated attack strategies involve combining hacking computer systems with attack vectors such as: espionage, blackmail, medical/health attacks, asymmetric “guerrilla-style” attacks, weapons of mass destruction, and conventional kinetic military attacks. The video below shows an example using a medical vector, and an unprotected printer, to compromise patient and identity records that can be used in future […]

Zero Day Vulnerabilities Have No Patch Yet

When computer system vulnerabilities are discovered, patches are issued that have been designed to close the hole of vulnerability. The patches take some time to construct and deploy and even longer to get the community to accept them and install them. This always leaves a gap of some time between the discovery and when the […]

How Real Hacking Works

Hacking computers is a mysterious and dangerous world that most of us don’t really understand. This video shows some hackers at DEFCON demonstrating their techniques on a reporter who volunteered to be hacked. The video shows some basic “social engineering” which may use technical knowledge and experience, but involves classic “confidence” manipulation to gain credentials […]

Password Strength Requirements

While the main premise of the article linked below is correct, it understates a key part of password cracking methodology. There are two primary means of cracking passwords: using word lists, and brute force. There are also many hybrid combinations, which is an important focus of the article. In brute force cracking, every element of […]

Shodan – Hackers Search Engine

Shodan is a hackers search engine that can help you find any device connected to the internet. Shodan: Search Engine for Hackers – [] Shodan has been getting a lot of publicity lately as a “scary” search engine that can be used to facilitate hacking. Annie explains how the site works, and talks with Shodan […]

Defending Against APT

Advanced Persistent Threat (APT) is a cyber attack threat that typically comes from a team of attackers with advanced penetration skills, deep resources, specific target profiles and they tend to be very persistent in their efforts. They often have tools that are capable of circumventing defenses. They use stealthy tactics and show good situational awareness […]

Cyber Threat Potential

Cyber attackers have a variety of motivations, but it is possible to categorize them and attempt to understand the different strategies they might use and how to defend against them. Here are some of the categories of motivations behind threats: Use data from your system Identity theft – mostly for financial fraud Business information – […]

New OPSEC Controls in 800-53 rev4

NIST SP 800-53 includes the catalog of security controls that form the core of the “security bible” that is required guidance for federal agencies. NIST periodically reviews the list of controls and updates them. They are currently in the process of taking public comments on the latest revision (rev4) before they go “final”. Included in […]

Operations Security = OPSEC

Operations Security or OPSEC is about identifying critical information that can be used against you by an opponent and minimizing access to that information. This is a sub process of risk assessment and follows the same basic process flow: Characterization and scope determination Assessment of threats Assessment of vulnerabilities Likelihood and impact analysis Determine risk […]

Cyber-Attack Psychology

We already know that cyber attackers have a methodology. They usually perform variations on the following theme: Reconnaissance Penetration Entrench Pivot Disrupt Counter Defense is mixed in throughout But it’s also useful to consider their psychology because it is often different from the thinking used by defenders. When this is true, defenders trying to study […]