A detailed look at the phases of a computer hack attack - part 2 of 2  

by Lucas Donato

The second of a two part of a series of articles that looks at how criminal profi ling can support digital forensic investigations, this article takes a detailed look at all phases of a computer intrusion, from the choice of victim through to the removal of traces after the obtainment of “root”, by joining a technical and a psychological approach in an unprecedented way by Lucas Donato

In the first fascinating article, we introduced the topic of the phases of a computer hacking attack by presenting the first three

phases of our model:

• The process to choose a target

• Footprinting

• Fingerprinting

In this article Lucacs discusses the remaining phases of “vulnerability identification and exploration”, “privilege escalation”, “actions with the target and access maintenance”, whilst finishing with a look at “trace removal”.

As identified in the first article of the series, the vulnerability identifi cation phase is one of the most critical phases in a hacking attack. After all, if a burglar wants to penetrate a house with success, he needs to identify with a certain level of precision those entrance points that offer more chance of success and under what conditions. In the same way, if a killer wants to approach his victim with a greater chance of success, he will need to know the victim’s habits and in which situations the victim is more exposed.

To support the process of identifying vulnerabilities in the digital world, a large number of tools exist, and the success rate of an intruder will be directly infl uenced by the arsenal of tools he has access too (e.g. public tools, commercial tools, group restrict tools), his ability to use the tools and by the amount of information that he has (or will obtain) regarding his victim.

In the previous article we looked at how to distinguish vulnerability identification tools and how to analyze the way the tool can be used. We also look at whether this phase was mandatory or not and investigated the challenge between automated and manual testing. To follow this we have identified other characteristics of this phase that are useful in our investigation, before moving to look at the subsequent phases:

1. Build a timeline of suspect probes regardless of their sources; attackers often use different origins to test or to collect information about the target. Websites such as the “Shodan Computer Search Engine” are rich sources of information to would be hackers. [Shodan].

2. When did the probes used, start to appear? Is it possible that the attacker was acting from home or from his office during business hours? Make a note of differences between time zones (this information can help in reveal the country of origin of the attack).

3. For local users, is someone trying to list installed software, existing accounts or using vulnerability scanners on the server? 

4. Try to identify if the kind of probes used reveals a previous knowledge of the target (e.g., probing specific services and unusual ports). If yes, how could the attacker obtain this kind of knowledge?

5. Is it possible to assess how much emphasis the attacker is placing on probing his target and for how long? This can reveal his determination.

Read the rest of Lucas Donato's final article on Criminal Profiling in Issue 7 of DFM - out now - login or subscribe today!