1.4 Attackers and their Motivation

This video belongs to the openHPI course Cyberthreats by Malware. Do you want to see more?

1.4 Attackers and their Motivation

Time effort: approx. 22 minutes

An error occurred while loading the video player, or it takes a long time to initialize. You can try clearing your browser cache. Please try again later and contact the helpdesk if the problem persists.

Scroll to current position

00:00In our openHPI course on Cyber threats by Malware, we now
00:05have a look at the attackers and their motivation.
00:12I remind you the situation - we have the internet, we have so many
00:16networks that are inter-connected in the internet
00:20and which provides this virtual network, which offers so many
00:25services to the users, users are accessing
00:30these services in the internet by means of their tools, their laptops, their smartphone,
00:35their tablets and then we have attackers
00:38which are really
00:42using all possibilities to attack
00:45the internet, the internet services, the user
00:49to get access to their data, to misuse the services, to find the possibility
00:58to earn money in a criminal way.
01:02And what we want to do is to have a closer look on the different types of
01:07attackers in the internet.
01:09So let's start with the so called Insiders.
01:15These are company's own employees. They could attack or steal company's resources,
01:22for example confidential documents or servers, misusing
01:28their privilege in the company and this is often much easier
01:33for insider to do than for externals because we have to
01:40imagine that there is a world outside the company and outside
01:44the network and the services of the company and there are the bad guys
01:49and inside the service company's boundaries there are the good guys.
01:55And many of the security infrastructure is designed following this image.
02:03But of course this image is wrong. The
02:06attackers can also sit inside the company
02:10and they could have different motives, for example,
02:14simply curiosity or frustration about the
02:18work, revenge, greed, envy - there are many human
02:24motivations that an insider brings to have a look to some
02:30secret documents, to try to get access to servers and others.
02:35So insider attacks are particularly dangerous
02:41because they come from inside the company's network, from the intranet,
02:47and I already mentioned many
02:50security and protection tools, like for example firewalls are
02:54typically designed in a way that
02:57messages that come from the inside are not taken with the same
03:02care as messages that come from the outside.
03:07So the
03:10motives or behavior, it could be a naivety,
03:14it could be carelessness. This opens doors for social hacking
03:20that provides attackers a possibility to bring the people inside a company
03:27for example to do something they would not do alone, for example download
03:34some malware or others.
03:37And there is an increased risk by these types of attack
03:42because of the integration of home offices.
03:46The idea bring your own device, use your device as well in
03:50a private life, as well for the business,
03:55this inside and connected to the resources of corporate networks, this makes
04:03the situation much more difficult to protect the system and it makes it easier
04:11for the attackers to attack, to steal resources or misuse resources
04:17inside the company's network.
04:20So the noncompliance with internal security instructions
04:25that opens the door for attackers, so here it's really important for the companies
04:31to educate their people to formulate clear rules,
04:36that's called security policy,
04:39so that the people
04:42the insiders are not doing,
04:48by means of carelessness or with activity, attacks in the network.
04:54Another potential group of attackers in the internet
04:57are the so called Script Kiddies.
05:00These are attackers without deep cybersecurity knowledge
05:06who launch cyber attacks using hacker tools, looking in the
05:11internet for such hacker tools and play around with the hacker tools and try
05:15to apply them. For that reason often one speaks of the Script
05:20Kiddies, of school kids or students that also have time that are driven by
05:26which are driven by curiosity just for fun to do something,
05:31show off that one is able, to have an impact
05:36by means of such an attack.
05:39So indiscriminate and usually its done usually without direct
05:47criminal intent. Mostly young people,
05:51I already mentioned pupils, students starting to learn about cyber
05:55security, they are experimenting and looking around. And it is so easy
06:01to find hacking tools in the internet which can be used for such
06:10cyber attacks, which can easily be downloaded and then misused makes this type
06:15of attack also dangerous.
06:18In particular, such Denial- of-Service-Attacks, the DoS
06:24are dangerous. Here by means of a huge number of
06:31requests to services the service is brought in a situation
06:37that it's no more able to regularly
06:40respond to all these requests.
06:44These are not request for using the service, these are only a
06:49huge number of risk
06:51requests to
06:55attack the service, to make the service no more available for other uses
07:01and so to overload the situation.
07:05Another potential attacker on the internet are the hackers.
07:10Unfortunately the term hacker has different interpretations.
07:16Originally the term was used in recognition of particularly
07:20creative and talented individuals which were able to design such an attack.
07:28I mentioned, today the attackers, cybercriminals can get the attack
07:33tools easily from the internet. So this
07:36is no more proof that they are able to design this by himself.
07:42Later then hacker has got a negative connotation
07:48by the media to the indiscretion and damages by their cyber attacks.
07:54Sometimes they want to
07:57shed light to a certain point but
08:00in doing that they create a big damage. So typically now hacker
08:05is no more used in this originally positive meaning mostly.
08:13Mostly this term refers to people with in-depth technical
08:19knowledge and if we have a closer look, then today
08:25often hackers are categorized in different groups. We have he white hat
08:32hacker, we have the grey hat hacker, we have the black hat hacker, we have hacktivists.
08:39Let's have a closer look when we speak about white hat hackers.
08:44These are the good hackers. These are the ethical hackers.
08:50These are professional experts who look for security vulnerabilities in computer systems,
08:57in application, services, networks.
09:00So for example we develop a large SchulCloud system and we asked
09:06such ethical hackers to attack
09:11what we are designing to find out whether there are vulnerabilities
09:16before we make the system public. So this is the help such
09:22white-hat hackers are providing
09:25motives are good samaritan and increase cyber security awareness.
09:30So they perform security analysis
09:34of systems, they perform penetration tests
09:38to detect security gaps and report these gaps
09:44to the owner of the system so that the owner is able to
09:48to increase the security of the system.
09:53So the information of the authorized owner about the discovered security gaps,
09:59this is a characteristic of the work of the white-hat hacker
10:04to help to improve the security of that computer systems.
10:10And what they do with this is they help to prevent future attacks on the system
10:17by cyber criminals.
10:21If we look to the other side, these are the
10:24black-hat hackers. These are also called the
10:30evil hackers and cybercriminals.
10:34Mostly these are professional computer experts who hack the computer system
10:40with some criminal
10:44motivation, to do some criminal activity,
10:48for example to steal data, to manipulate the system, to
10:54install a backdoor to be able to
10:58get access to the system. So they do this for self interest, for example
11:04to get money by selling the
11:07stolen data and greed for profit.
11:11So motives here are typically the motives of criminals
11:16to easily earn money, to get power, blackmail, notoriety and others.
11:23So the exploits that are discovered
11:28from discovered security gaps,
11:31these are done to gain unauthorized
11:37access to the system. Here I
11:45better say unauthorized, I mean
11:48authorized was that when they find a way,
11:52for example to steal the data of authorized users
11:56or find ways to overcome this authorized station, then
12:02they get access to the system and can do their every work.
12:08The aim is to launch crimes such as data theft, identities theft,
12:14service destruction and others.
12:16For their own benefit,
12:20on behalf of others to gain money by means of the attack. In most cases
12:27the discovered security gaps are kept secret. So when they find a way
12:34how it's possible to
12:39attack a system and to break into a system,
12:42then typically they will not tell how they did it
12:46to prevent that this vulnerability is closed.
12:51So they share this knowledge with other black hat hackers, for example
12:57to get money they give this information in darknet, so to
13:03earn money and support other cybercriminals.
13:09The black hat hackers could sell stolen information.
13:14They could sell it to the public.
13:19Usually it's organized and done in the darknet.
13:23For example some information you can find here in this cited website.
13:30For example, when you want to buy an email account and you
13:34can do this for a few dollars, if you want to
13:40illegally get the driving licence information, you have to pay about twenty dollars,
13:46credit card details are available between eight
13:51and twenty two dollars and medical records are up to a thousand dollars.
13:58These black hat hackers also provide services and tools for various
14:05illegal activities. For example, tools to hack Facebook accounts.
14:11You have to pay for an attack over three months here only twenty dollars.
14:19Or to change the rating on Google and Co or to access special user accounts.
14:30Such things are sold as a service typically in a darknet so that other
14:37cybercriminals can misuse this, access all this data for their work.
14:45And when we speak about grey hat hacker then it's an
14:50immediate group between the
14:53white hat hacker and the black hat hacker. Sometimes
14:59they do good work sometimes they do bad work.
15:03Also they are mostly professional computer experts who have both
15:08benign and malicious selfish goals.
15:12So the exploit found
15:16which are misusing a security gap in the computer systems, sometimes it is
15:23announced sometimes it is sold.
15:27So they possibly launch criminal activities for their own profit.
15:33The grey hat hackers publish found security gaps to
15:38increase security awareness. So this is some positive
15:43thing what they are doing
15:45and a special group of
15:49these grey hat hackers are so called hacktivists.
15:53Hacktivists is a created
15:57word from hacker and activist.
16:01So hacktivists are individuals or groups who hack computer systems for ideological reasons,
16:08for social, political, or religious reasons.
16:12So the motives are they want to raise awareness, for self ego,
16:18there are political goals they perform.
16:23So they launch attacks to computer systems to highlight some issues to the public.
16:31For example they believe with this activity to contribute to higher causes,
16:40they do not shy away from criminal activities for following their
16:48political or ideological thinking and they
16:53try to influence the media and the public opinion
16:58often with false reports or confusing ideological phrases.
17:04Some known groups here are the group Anonymous which is
17:10such a hacktivistic group.
17:13And then when we consider the
17:17motivation of the attackers in the internet, we have see common criminals.
17:21So criminals who use the internet for their activities.
17:26They do their traditional criminal work and use the internet to prepare this,
17:34to exchange information with the partners and they of course want to
17:41use the potential of the internet as a global marketplace for their criminal activities.
17:50So they use the internet for criminal activities, for example drugs and arms,
17:57trafficking, extortion, computer fraud and other things.
18:03For the authorities it becomes more difficult to enforce the
18:08law and investigate the criminal activities on the internet
18:13than in the physical world.
18:15So therefore the governments may be interested to install
18:20backdoors in cryptographic protected systems
18:24to get access to the information that are cryptographically protected, exchanged
18:30by such criminals and terrorists.
18:35And then the next group of attackers with some own motivations
18:41our secret services and our
18:45attackers that do espionage.
18:49The extensive possibilities of the internet of our high potential
18:54for spies, for secret services.
18:58So economic crime is to steal confidential information,
19:03development, information, spying out competitors
19:08in any area. For espionage, spying out on political
19:14interesting actors, spying out the
19:18communication of politicians
19:21and of other countries,
19:24spying out international political organization and others
19:30and of course performing politically or economically motivated cyberattacks
19:37on services or on computer systems.
19:41One example to mention here is Stuxnet.
19:45Stuxnet is a malware, or a group of malware
19:50attacking Windows networks and proprietary programmable systems
19:55of nuclear plants with the aim of destroying
20:00the Iranian uranium enrichment plants and this of course was
20:06organized by such attackers from the field of secret services and espionage
20:13and this is where we have a closer look in our excursus when we speak about
20:21advanced persistence threats.
20:24And then here also this is a notion,
20:28you should remember "zero day vulnerabilites".
20:34These are vulnerabilites not detected yet and not publicly known
20:39and these secret services and espionage, they have a lot of
20:45means and money in the back. They often use as such zero-knowledge vulnerabilities
20:52for their work.
20:54There are more motivations but this is to see that the attackers
21:00often have very different backgrounds and very different motivations for their
21:06cybercriminal activities and this is important to take into account
21:12when we think about how to protect our systems.

About this video

Errata:

20:45 zero-day vulnerabilities, not zero-knowledge