Speaker 1: Welcome to your deep dive.
Speaker 2: Oh love that name.
Speaker 1: By the way, today we're going to be looking at
Speaker 1: Collie net Hunter awesome, with the help of a book
Speaker 1: called Security Testing with Collie net Hunter okay by Daniel W. Dieter.
Speaker 2: Loll so similar.
Speaker 1: So I'd be wondering, like what even I penetration testing, right,
Speaker 1: good question, and like, how can my phone be like
Speaker 1: a hacking tool?
Speaker 2: It's a little scary when you think about it.
Speaker 1: Yeah, it is a little bit unnerving for sure. Yeah, well,
Speaker 1: let's bring an expert speaker to help us break this down.
Speaker 2: Sounds good. Yeah, so penetration testing okay. It is kind
Speaker 2: of like a security audit, okay, but with a little
Speaker 2: more you know, excitement to it. Basically, ethical hackers use
Speaker 2: the same tools and techniques as you know, the bad
Speaker 2: guys to find those weaknesses and systems, but with permission.
Speaker 2: Of course, we got to keep it legal, of course,
Speaker 2: of course. Collie net Hunter essentially turns your smartphone into
Speaker 2: a portable hacking lab. Whoa, which makes it so versatile
Speaker 2: it's incredible.
Speaker 1: Okay, I'm with you so far. But wouldn't like a
Speaker 1: regular computer, right be more powerful? For like all that
Speaker 1: kind of stuff.
Speaker 2: That's a really good question.
Speaker 1: Why use a phone?
Speaker 2: That's what makes net hunters so unique. It's stealthy. Okay,
Speaker 2: you could just be walking around a building testing the
Speaker 2: Wi Fi. Right, you could plug into a computer with
Speaker 2: like a malicious USB. Oh wow, still do all the
Speaker 2: stuff you would do on a laptop, you know, traditional testing,
Speaker 2: but ye on your phone. Yeah. Plus everyone's always on
Speaker 2: their phones totally, so it's perfect. You blend right in. Yeah,
Speaker 2: nobody suspects the thing.
Speaker 1: That's awesome. Okay, so it's like the ultimate undercover hacking tool.
Speaker 2: You got it.
Speaker 1: That's so cool. Okay, so let's unpack us this a
Speaker 1: little bit. Yeah, what exactly is Collie Netthunter.
Speaker 2: Well, you can kind of think of it as like
Speaker 2: a mini super powerful hacking computer running right inside your endroid,
Speaker 2: phone or tablet. It's based on Kalie Linux gotcha, which
Speaker 2: is kind of the gold standard for cybersecurity pros. Yeah,
Speaker 2: but instead of being tied to your desk, net hunter
Speaker 2: lets you take all that power anywhere.
Speaker 1: So I'm kind of picturing like a bunch of complicated
Speaker 1: hacking tools crammed into my phone.
Speaker 2: You would think that, right, Yeah, it's actually got a
Speaker 2: very user friendly interface. Oh really, tons of penetration testing
Speaker 2: apps ready to go. Wow. Okay, but if you are
Speaker 2: a terminal person and you're comfortable with that, yeah, you
Speaker 2: also have direct access to all those classic Calie Linux
Speaker 2: tools as well.
Speaker 1: Oh that's so cool. So there's something for everyone exactly,
Speaker 1: And I understand there are also like some special Android
Speaker 1: based tools too.
Speaker 2: Yes, exactly. Net Hunter takes advantage of the Android environment
Speaker 2: to give you even more tools like ce sploit, which
Speaker 2: is great for network analysis, gotcha, and drive droid Okay.
Speaker 2: Drive droid can actually turn your phone into a bootable
Speaker 2: USB drive.
Speaker 1: Wait, hold on, cool, right, my phone can become a
Speaker 1: bootable USB drive. What would I even use that for?
Speaker 2: Well, that is where it gets super interesting. Imagine you
Speaker 2: need to access like a locked computer okay, yeah, maybe
Speaker 2: to recover data or troubleshoot something. With drive droid, you
Speaker 2: can boot that computer huh into a different operating system.
Speaker 2: Oh wow, directly from your phone. Okay, you could bypass
Speaker 2: security measures and get in.
Speaker 1: That's that's seriously cool and maybe a little bit scary.
Speaker 2: Yeah. Powerful stuff.
Speaker 1: But before we get too far ahead of ourselves, let's
Speaker 1: talk about like actually getting net Hunter on my phone.
Speaker 1: Is it as simple as just like downloading an app?
Speaker 2: You wish, right, I wish. No, it is. It's a
Speaker 2: little bit more involved than that, but it is totally
Speaker 2: doable if you follow the instructions.
Speaker 1: Okay.
Speaker 2: The key thing to remember your is you really should
Speaker 2: only install net Hunter on a dedicated device. You don't
Speaker 2: want to put this on your everyday phone, your personal phone, not.
Speaker 1: The one with all my photos banking apps. Okay, So
Speaker 1: what's involved in.
Speaker 2: So basically you'll need to root your device Okay, install
Speaker 2: some custom firmware. Okay, it sounds complicated, but the net
Speaker 2: hunter team has very detailed instructions on their GitHub page.
Speaker 2: Oh fantastic, follow those carefully and you'll be good.
Speaker 1: All right. So this is definitely for someone who's comfortable
Speaker 1: sinkering with their device.
Speaker 2: For sure.
Speaker 1: But once it's set up, what can I actually do
Speaker 1: OK with this net Hunter terminal, that's.
Speaker 2: A good question. That terminal is your gateway to the
Speaker 2: full power of Kelly Linux. Oh, that's where you run commands,
Speaker 2: you can install additional programs, really get your hands dirty.
Speaker 1: So that's like where the concept of comes in.
Speaker 2: You got it, That's exactly it.
Speaker 1: Crew that sounds. It sounds scary a little intimidating, but
Speaker 1: it's not.
Speaker 2: Basically, just a fancy way of saying. Net Hunter runs
Speaker 2: as a separate little operating system within Android.
Speaker 1: Okay.
Speaker 2: Think of it like you have a workshop in your house. Yeah,
Speaker 2: you can do your messy projects there. Yeah, and it
Speaker 2: doesn't affect the rest of your house.
Speaker 1: Okay. So it's like like a virtual machine.
Speaker 2: Yeah, you can think of it that way, but on
Speaker 2: my phone exactly, exactly. Okay, that's it's a contained environment
Speaker 2: where you can experiment and explore, gotcha, without messing up
Speaker 2: your phone's main operating system.
Speaker 1: Awesome. Okay, so speaking of exploring, Yeah, net Hunter comes
Speaker 1: preloaded with some pretty fascinating.
Speaker 2: Desktop apps it does.
Speaker 1: Have you ever heard of Showdan Showdan.
Speaker 2: Yeah, rings a beltings a bell? Yeah? Yeah.
Speaker 1: Isn't that the one that's.
Speaker 2: Like the Yeah.
Speaker 1: Yeah, it's like the Internet for the Internet of things,
Speaker 1: the hackers Google.
Speaker 2: The hacker's Google's yeah. Yeah. But instead of you know,
Speaker 2: indexing web pages, Showdan is indexing devices. Okay, anything connected
Speaker 2: to the Internet, like what we're talking, cameras, industrial control systems, servers, routers,
Speaker 2: you name it. Oh wow, if it's online Showdan probably
Speaker 2: knows about it.
Speaker 1: So potentially I could. I could use showden to find
Speaker 1: like all the webcams in particular city.
Speaker 2: You could. You could showdan can be incredibly powerful, Okay,
Speaker 2: but you got to use it responsibly ethically.
Speaker 1: Right of course.
Speaker 2: Understanding these tools, yeah, is the first step to actually
Speaker 2: defending against them.
Speaker 1: Absolutely. Knowledge is power.
Speaker 2: That's it. That's it.
Speaker 1: Okay. So shden gives us this amazing big picture of
Speaker 1: the connected world. What if we want to zero in
Speaker 1: on a specific device on a network and really get
Speaker 1: into the nitty gritty.
Speaker 2: That's where seesploit comes in. Okay, seesploit. It's all about
Speaker 2: network scanning and vulnerability analysis.
Speaker 1: So imagine being able to see every device on a
Speaker 1: network exactly what ports are open, what services are running.
Speaker 2: And even potential weaknesses.
Speaker 1: Hold on exploit you could. You're making this sound like
Speaker 1: I could like hack into things with this app.
Speaker 2: You could, Okay, but remember we're talking about ethical hacking here.
Speaker 1: Of course.
Speaker 2: Sea sploit is meant for testing and research, not for
Speaker 2: doing anything illegal.
Speaker 1: Ethical exploration is the name of the game exactly.
Speaker 2: Okay, So ceaseplol's like your magnifying glass. Okay, Yeah, you're
Speaker 2: looking at those individual devices. Okay, yeah, examining them.
Speaker 1: Closely seesploit are magnifying glass. What else can we do
Speaker 1: with this powerful pocket size we.
Speaker 2: Talked about show Dan that big picture, Yeah, sea sploit
Speaker 2: the close up. But there's another side to net Hunter.
Speaker 2: It's a little more hands on. Okay, let's talk about
Speaker 2: hide attacks.
Speaker 1: Hide attacks. Okay, now you've really piqued my interest. Tell
Speaker 1: me more.
Speaker 2: So. HID stands for Human Interface device, Okay, and it's
Speaker 2: how your computer recognizes things like your keyboard and your mouse.
Speaker 2: What's so cool about net hunter is it can actually
Speaker 2: emulate a keyboard. Whoa. It can send commands to a
Speaker 2: connected computer as if you were typing them.
Speaker 1: So you're telling me I could plug my phone into
Speaker 1: a computer and it would start typing things on its own. Yeah,
Speaker 1: that sounds like something straight out of I know it's
Speaker 1: a sci fi movie.
Speaker 2: It does sound like that, Okay, but it's not science fiction.
Speaker 2: It's net Hunter.
Speaker 1: That's awesome.
Speaker 2: It happens incredibly fast too. Wow, you can automate these
Speaker 2: entire attack sequences. Huh, with just a few taps on
Speaker 2: your phone.
Speaker 1: So the book gives this kind of chilling example is
Speaker 1: creating a new admin user on a Windows system using
Speaker 1: these HID commands. So hold on, let me get this straight. Yeah,
Speaker 1: I could plug my phone into a computer and create
Speaker 1: a new user with admin privileges without anyone even touching
Speaker 1: the keyboard.
Speaker 2: If the system is vulnerable and you have physical access, right.
Speaker 1: Right, Yeah, it's like classic example why physical security is
Speaker 1: just as important as digital security. Yet it okay, but
Speaker 1: hid attacks, yes, can go even further. Oh yeah, Okay,
Speaker 1: there's a technique using PowerShell by.
Speaker 2: PowerShell ye, which is like it's a scripting language built
Speaker 2: into Windows. Right, Okay, they can actually give you a
Speaker 2: remote shell.
Speaker 1: A remote shell, So we're talking about like actually taking
Speaker 1: control of the computer.
Speaker 2: From its distance. That's exactly what we're talking about. Oh wow,
Speaker 2: So the book describes this scenario, okay, where you've got
Speaker 2: a penetration tester, part of what's called a red team.
Speaker 2: They're physically present with their net hunter device. They plug
Speaker 2: it into a target system, execute the HID attack, force
Speaker 2: that Windows computer to connect back to their own Calai
Speaker 2: Linux machine, gotcha, creating that remote Okay, So they've essentially
Speaker 2: established so it's.
Speaker 1: Like establishing like a secret back door into the system
Speaker 1: all through a harmless looking phone.
Speaker 2: That's right.
Speaker 1: This is some next level spy stuff.
Speaker 2: I know. It's so cooling. And the crazy thing is
Speaker 2: once that connection is established, Yeah, you can disconnect the
Speaker 2: net hunder phone, and they still have control.
Speaker 1: So they can just unplug and walk away and still.
Speaker 2: Have access access files, install malware. Oh my gosh, use
Speaker 2: that computer to attack other systems on the network.
Speaker 1: It's starting to feel like a scene from like a
Speaker 1: hacking movie. I know, surely there are safeguards. Of course,
Speaker 1: computers aren't just sitting ducks for this kind of attack.
Speaker 2: Of course, you've got things like user account controls, okay,
Speaker 2: intrusion detection systems. But yeah, their effectiveness really depends on
Speaker 2: how they're configured, and sometimes there's just sometimes they're not
Speaker 2: as strong as they should be. The you've always got
Speaker 2: attackers looking for ways to get in.
Speaker 1: So it's like this constant cat and mouse game between
Speaker 1: attackers and defenders.
Speaker 2: It's an arms race, an ongoing arms race, okay, yeah,
Speaker 2: trying to stay ahead.
Speaker 1: And that brings us to this.
Speaker 2: Is where it gets really interesting. Another fascinating tool it
Speaker 2: builds on these HID attacks okay, called duck hunter hid.
Speaker 1: Duck Hunter HID Okay.
Speaker 2: It's like having the power of Hawk Five's rubber Ducky.
Speaker 2: Rubber Ducky.
Speaker 1: That's an interesting name, right, what is that?
Speaker 2: So the rubber Ducky, it's a USB device, looks just
Speaker 2: like a regular flash drive. Okay, but it's actually a
Speaker 2: cleverly disguised hid attack tool. So it's not like it's
Speaker 2: not a toy. A toy, but it's very interesting. It
Speaker 2: can automatically inject keystrokes into a computer using scripts written
Speaker 2: in a language called duck Toolkit, a toolkit, and with
Speaker 2: Duck Hunter, you can run those same scripts right from
Speaker 2: your phone.
Speaker 1: So instead of carrying around.
Speaker 2: The story with separate like rubber Ducky device, I can
Speaker 2: just use my phone.
Speaker 1: You got it?
Speaker 2: Okay, that's even stealthier.
Speaker 1: It is that kind of very things can you do
Speaker 1: with The possibilities are pretty mind blowing.
Speaker 2: You can do things like send simple text strings okay,
Speaker 2: maybe a prank message or like a fake Aero pop up.
Speaker 2: But you can get way more advanced, like there's actually
Speaker 2: a script that can create a reverse shell connection. Oh
Speaker 2: wow on a Mac computer.
Speaker 1: Wait, so you're saying I could like potentially take control
Speaker 1: of a Mac.
Speaker 2: You could just by plugging. If it's vulnerable, then the
Speaker 2: security settings up properly configured, and.
Speaker 1: The books goes even better, goes even further. There's have
Speaker 1: you seen the show Mister Robot? Oh yeah, so this
Speaker 1: next example is inspired by mister Robot.
Speaker 2: Okay, very cool. It shows you how to use duck
Speaker 2: Hunter to actually steal passwords from a Windows system using
Speaker 2: something using a tool called mimic cats mimicts.
Speaker 1: Yeah, that doesn't sound good.
Speaker 2: No, it's not good if you're on the receiving end
Speaker 2: of this attack. So mimic cats is a very powerful tool.
Speaker 2: It can actually extract passwords from the Windows computer's memory.
Speaker 2: Oh wow. The book shows how to use duck Hunter.
Speaker 2: Run a script, execute mimicats. Yeah, grab those passwords and
Speaker 2: send them to a remote server.
Speaker 1: So it's basically like digitally pick pocketing a computer. That's
Speaker 1: both amazing and terrifying.
Speaker 2: So it shows you how vulnerable we are even when
Speaker 2: we think we're secure. We're not done yet. Oh no,
Speaker 2: ned Hunter has one more trick up its sleeve, the
Speaker 2: bad USB attack.
Speaker 1: Bad us B Yeah.
Speaker 2: It does, doesn't It speaks for itself.
Speaker 1: What's so bad?
Speaker 2: So it all comes down to how Windows interacts with
Speaker 2: USB devices. There's this protocol called RNDIS stands for Remote
Speaker 2: Network Driver Interface Specification. It basically allows Windows yeah, to
Speaker 2: treat a USB device like a network adapter.
Speaker 1: Okay, I'm so far, so good, I'm following so far. Yeah,
Speaker 1: all right, So the bad USB attack takes advantage of
Speaker 1: this protocol.
Speaker 2: Okay.
Speaker 1: It redirects all the network traffic from the Windows computer
Speaker 1: Okay through the net hunter phone.
Speaker 2: Okay, so picture this.
Speaker 1: You plug your phone into a computer and suddenly all
Speaker 1: that Internet traffic that would normally go through the router
Speaker 1: is now going through your phone.
Speaker 2: So I become the man in the middle, able to
Speaker 2: see everything the computer is sending and receiving exactly. Talk
Speaker 2: about eavesdropping. Yeah, you are in a powerful position. Wow.
Speaker 2: You can use tools like URL snarf okayeep dump to
Speaker 2: capture and analyze all that activity.
Speaker 1: See what to see it.
Speaker 2: You can see what websites they're visiting, what files they're downloading.
Speaker 2: Maybe even snag some sensitive information, yeah, like passwords if
Speaker 2: you're not using secure connections. Oh wow, it's pretty scary stuff.
Speaker 1: This is a lot to process.
Speaker 2: It is. We've covered We've covered a lot, haven't we show?
Speaker 2: Then se sploy.
Speaker 1: Sea sploy drive, droy h Ide Attacks.
Speaker 2: Duck Hunter, duck huntert bad USB. It's right, my head
Speaker 2: is spinning.
Speaker 1: That's a lot to take it.
Speaker 2: And I'm guessing this is just the tip.
Speaker 1: This is really just the tip of the ice when
Speaker 1: it comes to net it.
Speaker 2: Comes to net Hunter's capabilities, there's a whole world of
Speaker 2: tools and techniques, yeah, that we haven't even touched on yet.
Speaker 1: It's mind blowing to think that something is as commonplace
Speaker 1: as a phone can be used for such advanced penetration testing.
Speaker 2: It is amazing what you can do with a smartphone
Speaker 2: these days.
Speaker 1: This deep dive has been a real eye open I'm glad.
Speaker 2: I'm glad you're enjoying it. So HID stands for Human
Speaker 2: interface device, Okay, and it's basically how your computer recognizes
Speaker 2: things like keyboards and mice.
Speaker 1: Okay, yeah.
Speaker 2: But the fascinating thing is net hunter can actually emulate
Speaker 2: a keyboard.
Speaker 1: What Yeah, So it can like send command.
Speaker 2: It sends commands to a connected computer as if you
Speaker 2: were typing them.
Speaker 1: So you're telling me, I could plug my phone into
Speaker 1: a computer and it would start typing things.
Speaker 2: It would, it would. That's the power of net Hunter.
Speaker 2: Oh wow, and it happens so fast. Really, you can
Speaker 2: automate entire attack sequences. Wow, just with a few taps
Speaker 2: on your phone.
Speaker 1: So the book gives this chilling example.
Speaker 2: It is a pretty chilling example of.
Speaker 1: Creating a new admin user on a Windows system using
Speaker 1: these HID commands.
Speaker 2: That's right, so imagine this.
Speaker 1: Hold on, let me get this straight. Yeah, yeah, I
Speaker 1: could plug my phone into a computer and create a
Speaker 1: new user with full admin privileges without.
Speaker 2: Anyone, without anyone touching the keyboard, even.
Speaker 1: Touching the keyboard.
Speaker 2: Wow.
Speaker 1: If the system's vulnerable and you have physical.
Speaker 2: Access, right right, you can do it. Okay.
Speaker 1: It's a classic.
Speaker 2: Example, it is. It really highlights it does why physical
Speaker 2: security is just as important for sure as digital You
Speaker 2: got it. Okay, but hide attacks? Yes, can go even further.
Speaker 2: Oh yeah, okay, there's a technique using PowerShell.
Speaker 1: PowerShell, which is like it's.
Speaker 2: A scripting language built into Windows. Yep. They can actually
Speaker 2: give you a remote shell, a.
Speaker 1: Remote shell, So we're talking about actually taking control of
Speaker 1: the computer from a distance, from a distance.
Speaker 2: That's right. Pretty powerful stuff.
Speaker 1: That's incredible.
Speaker 2: So the book actually describes a scenario where you've got
Speaker 2: a penetration tester, part of what's called a red team.
Speaker 2: They're physically present, okay with their net hunter device okay,
Speaker 2: plug it into the target system, execute the HID attack,
Speaker 2: force that Windows computer to connect back to their own
Speaker 2: Kylie Linux machine, creating that remote shell. Okay, so they've
Speaker 2: essentially established.
Speaker 1: It's like establishing like a secret backdoor into the system.
Speaker 1: That's it, all through a harmless looking phone.
Speaker 2: That's right.
Speaker 1: This is some next level Spice stuff.
Speaker 2: It really is. It's very cool.
Speaker 1: That's amazing.
Speaker 2: And the crazy thing is once that connection is established,
Speaker 2: you can disconnect the net hunter phone.
Speaker 1: Wait, so they can unplug it and walk away, and
Speaker 1: walk away and still have access, still have.
Speaker 2: Full access, oh my god, access files, install malware, use
Speaker 2: that computer to attack other systems on the network.
Speaker 1: This is starting to feel like, yeah, scene.
Speaker 2: From I know, it's very cinematic.
Speaker 1: Like a hacking movie.
Speaker 2: Right, Yeah, it's pretty wild.
Speaker 1: Surely there are safeguards in place, right.
Speaker 2: Of course, there are.
Speaker 1: Computers aren't just sitting ducks for this kind of attack.
Speaker 2: Of Course, you've got things like user account controls, intrusion
Speaker 2: detection systems, but their effectiveness really depends on how they're configured.
Speaker 1: And sometimes they're just and.
Speaker 2: Sometimes they're just not as strong as they should be,
Speaker 2: not as strong unfortunately as they should be.
Speaker 1: Determined attackers, they're always looking for a way in, right,
Speaker 1: they'll find those cracks.
Speaker 2: So it's a constant yeah, cat and mouse, it is.
Speaker 1: It is between attackers and defenders.
Speaker 2: A defender constantly trying to outsmart each other.
Speaker 1: An ongoing arms race.
Speaker 2: It is. It's an arms race for sure. And that
Speaker 2: brings us to another fascinating tool that builds on these
Speaker 2: HID attacks called duck Hunter HID.
Speaker 1: Duck Hunter HID.
Speaker 2: It's basically like bring in the power of Hawk Five's
Speaker 2: rubber Ducky.
Speaker 1: Rubber Ducky. Yeah, that's an interesting name.
Speaker 2: It is a catchy name.
Speaker 1: What is that?
Speaker 2: So the rubber Ducky Okay? The USB device looks just
Speaker 2: like a regular flash drive, but it's actually a cleverly
Speaker 2: disguised HID attack tool.
Speaker 1: WHOA. So it's not like it's not.
Speaker 2: A toy a toy, no, but it is very interesting.
Speaker 2: It can automatically inject keystrokes into a computer using scripts
Speaker 2: written in a language called duck Toolkit. Duck Toolkit okay,
Speaker 2: and with duck Hunter you can run those same scripts directly.
Speaker 1: From your phone, So instead of carrying around this exactly separate,
Speaker 1: rubber ducky device, Yeah, I can just use my phone.
Speaker 1: Got Okay, that's even stealthier.
Speaker 2: It is much more stealthy kind of things. So many things.
Speaker 2: The possibilities are really amazing. Yeah. You can send simple
Speaker 2: text strings, maybe a prank message or like a fake
Speaker 2: error pop up. You can also get a lot more advanced,
Speaker 2: like there's actually a script that can create a reverse
Speaker 2: shell connection on a Mac computer.
Speaker 1: Wait, so you're saying I could potentially take control of
Speaker 1: it just by plugging in my phone and running a script.
Speaker 2: If the Mac is vulnerable and the security settings aren't
Speaker 2: properly configured, you can absolutely do it. Okay, it's amazing, right.
Speaker 1: And the book goes even further. Well, yeah, there's this U.
Speaker 2: You're familiar with the TV series Mister Robot.
Speaker 1: Mister Robot, you have seen it.
Speaker 2: Okay, so this next example is actually inspired by mister Robot.
Speaker 1: Okay, very cool.
Speaker 2: It shows you how to use duck Hunter to actually
Speaker 2: steal passwords WHOA from a Windows systems using something called
Speaker 2: using a tool called mimicats.
Speaker 1: Mimicat mimicits Okay, Yeah, that doesn't sound good.
Speaker 2: It's not good if you're on the receiving end of this,
Speaker 2: that's for sure.
Speaker 1: That is so.
Speaker 2: Mimicats is a very powerful tool.
Speaker 1: Okay.
Speaker 2: It can extract passwords from a Windows computer's memory.
Speaker 1: Whoa, right out of the memory.
Speaker 2: That's right, while it's running.
Speaker 1: Oh wow.
Speaker 2: The book shows you how to use duck Hunter yeah,
Speaker 2: to run a script right, execute mimicats okay, grab those passwords,
Speaker 2: oh my god, and send them to a remote server.
Speaker 1: So it's like digitally pickpocketing. That's it.
Speaker 2: That's It's crazy, isn't it Both amazing and terrifying. It is.
Speaker 1: It's a good reminder of how vulnerable we are, even
Speaker 1: when we think our systems are secure.
Speaker 2: Yeah.
Speaker 1: Absolutely, and we're not even done yet.
Speaker 2: Oh no.
Speaker 1: Net Hunter has one more trick up its sleeve. Okay,
Speaker 1: the bad USB attack bad USB. Yeah, okay, the name
Speaker 1: kind of.
Speaker 2: It does for itself, speaks for itself. What's so bad?
Speaker 2: So it all comes down to how Windows interacts with
Speaker 2: USB devices.
Speaker 1: Okay.
Speaker 2: There's this protocol called r NDIS okay, stands for Remote
Speaker 2: Network Driver Interface Specification.
Speaker 1: Okay.
Speaker 2: Essentially, it allows Windows to treat a USB device like
Speaker 2: a network adapter. Okay, you're following so far.
Speaker 1: I'm following.
Speaker 2: Yeah, all right. So the bad USB attack takes advantage
Speaker 2: of this protocol. Okay, it redirects all the network traffic
Speaker 2: from a Windows computer through the net hunter phone. Okay,
Speaker 2: so picture this. You plug your phone into a computer. Yeah,
Speaker 2: and suddenly all that Internet traving that would normally go
Speaker 2: through the router is now flowing through your phone.
Speaker 1: So I become like the man in them.
Speaker 2: You become man in the middle. That's right.
Speaker 1: We're able to see.
Speaker 2: You've got everything the computer is sending and receiving. Talk
Speaker 2: about eavesdropping.
Speaker 1: You are in a powerful position.
Speaker 2: Wow.
Speaker 1: You can use tools like you are all snarf and
Speaker 1: TCP dump to capture and analyze all that activity.
Speaker 2: You can see what websites they're visiting, what files they're downloading.
Speaker 2: You can even snag sensitive information like passwords if they're
Speaker 2: not using secure connections. Oh wow, this is that scary stuff.
Speaker 2: A lot to process it is.
Speaker 1: It is covered showed in.
Speaker 2: We've covered so much. Splice drive, droid drive, droid h idea.
Speaker 1: Tack each idea, tax.
Speaker 2: Duck hunter, bad USB, bad USB. That's right.
Speaker 1: My head is spinning.
Speaker 2: It's a lot to take in, and.
Speaker 1: I'm guessing this is just the tip.
Speaker 2: It really is just the tip of the ice iceberg
Speaker 2: when it comes to net Hunter.
Speaker 1: When it comes to net Hunter's capability.
Speaker 2: There's so much more we haven't even touched on.
Speaker 1: It's mind blowing to think that something as commonplace as
Speaker 1: a phone it can be used for such advanced It
Speaker 1: really is penetration testing.
Speaker 2: It's incredible what you can do with a smartphone these days.
Speaker 1: This deep dive has been a real eye opener.
Speaker 2: I'm glad to hear that.
Speaker 1: So we've seen how net Hunter can be used to
Speaker 1: simulate these real world attacks. Yeah, and expose you know, vulnerabilities, right,
Speaker 1: but what does it.
Speaker 2: All mean for That's the big question, right, Yeah.
Speaker 1: For like someone like me who's not like a cybersecurity expert,
Speaker 1: you know, but.
Speaker 2: Really shows you that security is multifaceted. Okay, we tend
Speaker 2: to focus on you know, strong passwords, yeah, keeping our
Speaker 2: software updated, right, the basics. Yeah, but net Hunter shows us, Yeah,
Speaker 2: the physical security, understanding those hack factors. That's just as important.
Speaker 1: Easy to forget that, Yeah, it is that someone could
Speaker 1: get access to our data just by having physical access
Speaker 1: to our devices. It's a good reminder to be it
Speaker 1: is careful about who we let touch our computers and phones.
Speaker 2: Absolutely, and it's not just about protecting ourselves, right, think
Speaker 2: about businesses, organizations. Manhunter really shows us the importance of
Speaker 2: penetration testing. You got to find those weaknesses before the
Speaker 2: bad guys do.
Speaker 1: Be proactive, exactly, be proactive. So it's a reminder that
Speaker 1: it is even in our increasingly like digital world, physical access,
Speaker 1: physical access is huge, can be a major security risk.
Speaker 1: It's a big way, and it makes you realize he
Speaker 1: does that seemingly harmless devices like our smartphones can be incredibly.
Speaker 2: Powerful, powerful tools.
Speaker 1: Ye in the wrong hand, that's right.
Speaker 2: Yea, And we've really only scratched the surface of what's
Speaker 2: possible that Hunter. Yeah, this has given you a little
Speaker 2: taste of mobile pen testing. Yeah, but there's a whole
Speaker 2: universe out there.
Speaker 1: Right waiting to be explored.
Speaker 2: Exactly.
Speaker 1: I am definitely feeling inspired to that's great, learn more.
Speaker 1: This has been an incredible journey.
Speaker 2: I'm glad you enjoyed it.
Speaker 1: Yeah, I feel like I've gained a whole new perspective
Speaker 1: good on cybersecurity.
Speaker 2: Knowledge is power and understanding these tools the tactics used. Yeah,
Speaker 2: that's the first step to building stronger defenses.
Speaker 1: So to wrap things up, what's like the one, what's
Speaker 1: the key takeaway? Key takeaway? You hope our listeners right,
Speaker 1: they realize walk away with today.
Speaker 2: Security is an ongoing process. It's not a destination. There's
Speaker 2: always something new to learn, new threats to consider, ways
Speaker 2: to improve our defenses.
Speaker 1: So stay curious, stay in form and curious, stay in form,
Speaker 1: head of the game. That's it, well said, Thank you
Speaker 1: and for our listeners. If this deep dive has sparked
Speaker 1: your interest in cyber security, don't stop.
Speaker 2: Here, keep going.
Speaker 1: There are so many resources available online, everything from my
Speaker 1: line beginner friendly guides to like books, courses, advanced training courses, aloring,
Speaker 1: keep learning.
Speaker 2: Keep learning, and stay safe out there.
Speaker 1: Stay safe,