Speaker 1: Imagine a world where every email you send, every video
Speaker 1: you stream, all the smart devices in your home, even
Speaker 1: your car, they're all speaking this hidden language. It's this
Speaker 1: invisible web of connections making our digital lives work. But
Speaker 1: what if you could actually understand that language, the nuts
Speaker 1: and bolts of it, and crucially see where the weak
Speaker 1: spots are.
Speaker 2: That's a really powerful idea, because in today's world everything's connected.
Speaker 2: Understanding how networks actually function it's not just for the
Speaker 2: tech geeks or the security pros anymore, like a critical
Speaker 2: way to see what's happening in our digital lives, whether
Speaker 2: you're building things, securing them, or just trying to use
Speaker 2: the Internet safely exactly.
Speaker 1: And that's really our mission today on the deep Dive.
Speaker 1: We're going to dig into a foundational guide. It's called
Speaker 1: Network Basics for Hackers, written by Occupy the Web. Their website,
Speaker 1: hackers Arise is described as a white hat hacker training site,
Speaker 1: So the focus is on using these skills for good ethically.
Speaker 1: Our goal here is to pull out the most important bits,
Speaker 1: those nuggets of knowledge, to give you a shortcut to
Speaker 1: really getting how networks operate their flaws and you understand
Speaker 1: not just what's happening. But why it's important.
Speaker 2: And what's interesting about this source is how it defines
Speaker 2: white hat hacker. It's not just about finding flaws for companies.
Speaker 2: It talks about being a beacon and warrior for information
Speaker 2: freedom and human rights on the Internet.
Speaker 1: That's a strong statement.
Speaker 2: Yeah, and it even goes into detail about occupyth Web's
Speaker 2: documented activities in the Ukraine conflict, things like denial of
Speaker 2: service attacks against Russian government sites, finding oligarch yachts, hacking
Speaker 2: cameras for war crime evidence, even cyber attacks on Russian
Speaker 2: industrial systems, the schodaic stuff, and setting up a cybersecurity
Speaker 2: school in Kharkiev. Now, obviously we're just reporting this impartially
Speaker 2: as it's laid out in the source material.
Speaker 1: Right understood, Okay, so let's get into it. We're started
Speaker 1: with the absolute basics, the plumbing, like what is an
Speaker 1: IP address really, and we'll go all the way to
Speaker 1: well networks in cars, factories, even hacking radio signals. It's
Speaker 1: a deep dive into the hidden anatomy of our digital world.
Speaker 1: Let's start right at the beginning. IP addresses.
Speaker 2: Okay, Yeah, IP addresses they are absolutely fundamental. Think of
Speaker 2: it simply as the house address for every single digital device,
Speaker 2: your laptop, your phone, your smart fridge. Without that unique address,
Speaker 2: data just wouldn't know where to go. Communication breaks down.
Speaker 1: So if it's a house number, how's it structured? Most
Speaker 1: of us are still on IPv four, right, that's the
Speaker 1: thirty two bit one.
Speaker 2: That's the one. It's broken into four groups of eight bits.
Speaker 2: We call those octets. So you see things like one,
Speaker 2: ninety two point one, sixty eight point one, one zero
Speaker 2: one each number in there. Each octet can be anything
Speaker 2: from zero up to two fifty five. Okay, Now, historically
Speaker 2: these were grouped into classes ABC based on the first
Speaker 2: few numbers. Helped organize things early on. But the real issue,
Speaker 2: the big problem today is we've basically run out of
Speaker 2: IPv four addresses. Yeah, there are only about four point
Speaker 2: three billion unique addresses possible with that thirty two bit structure,
Speaker 2: and we've got what over seven point five billion people
Speaker 2: plus way more devices than that. The math just doesn't
Speaker 2: work anymore.
Speaker 1: So how do we cope. That's where things like private
Speaker 1: ips come.
Speaker 2: In, exactly. That's one of the clever workarounds. They set
Speaker 2: aside specific ranges of IP addresses just for internal use
Speaker 2: inside your local area network your land. These are the private.
Speaker 1: Ips like one ninety two point one six eight dot
Speaker 1: something or ten dots are the common ones.
Speaker 2: Yeah, one ninety two point one six eight dot x
Speaker 2: dot x, ten dot x dot is and also the
Speaker 2: one seventy two point one six dot x dot x range.
Speaker 2: Your home router probably signs these to all your devices, which.
Speaker 1: Brings up a good question. Then, if my phone is
Speaker 1: an internal private IP like one ninety two point one
Speaker 1: six eight point one point five, how does it talk
Speaker 1: to a website out on the public internet.
Speaker 2: Ah? Good question. That involves two key pieces of magic
Speaker 2: DHCP and net. First, DCP Dynamic Host Configuration protocol that's
Speaker 2: usually running on your router. It automatically hands out those
Speaker 2: private IP addresses to divice is joining your network. Often
Speaker 2: it's just a temporary lease, so your phone might get
Speaker 2: a slightly different private IP next time it connects.
Speaker 1: Got it and that.
Speaker 2: NAT is network address translation. Think of it as the
Speaker 2: translator or the receptionist for your entire network. It lets
Speaker 2: all those devices on your internal network, each with its
Speaker 2: own private IP. Yeah, share the single public IP address
Speaker 2: that your internet provider gives to your router.
Speaker 1: Ah. Good.
Speaker 2: So When your phone sends a request out, NAT swaps
Speaker 2: the private source IP for the router's public IP, keeps
Speaker 2: a record, and when the reply comes back, NAT knows
Speaker 2: exactly which internal device which private IP to send it
Speaker 2: back to, and.
Speaker 1: It all just happens automatically, feels seamless to.
Speaker 2: Me as the user, completely transparent. That's the beauty of it. Okay,
Speaker 2: so we have the house address the IP. What about
Speaker 2: the apartment number.
Speaker 1: That's whereports come in ports. Right, So the IP gets
Speaker 1: dated to the right computer, but the port tells it
Speaker 1: which specific program or service on that computer should receive it, exactly.
Speaker 2: Like web traffic usually goes to port eighty for standard
Speaker 2: HTTP or four to forty three for secure HTTPS. Email
Speaker 2: uses different ports, Games use different ports. It directs the
Speaker 2: traffic internally.
Speaker 1: And how many ports are there? I remember reading it's
Speaker 1: a lot.
Speaker 2: It is sixty five thousand, five hundred and thirty six
Speaker 2: possible ports for each IP address zero through six hundred
Speaker 2: and five to five thirty five. The first oneenty twenty
Speaker 2: four are often called the well known or common ports
Speaker 2: reserved for standard services, and from.
Speaker 1: A security angle, knowing which ports are open on a
Speaker 1: device is huge, right, that's what tools like map do
Speaker 1: absolutely critical.
Speaker 2: End MAP scans a target. IP probes these ports and
Speaker 2: tells you which ones are open, meaning a service is
Speaker 2: listening there. It's often the very first step in reconnaissance,
Speaker 2: for a security assessment or for an attacker. It maps
Speaker 2: out the potential entry points.
Speaker 1: Okay, so IP addresses for location ports for the specific service.
Speaker 1: What's the language they're actually speaking? That's TCPIP primarily.
Speaker 2: Yes, TCPIP is the dominant suite of protocols for Internet communication.
Speaker 2: TCP is Transmission Control protocol and IP is Internet protocol.
Speaker 1: And protocols are just agreed upon rules.
Speaker 2: For talking, pretty much like a language has grammar and vocabulary.
Speaker 2: For networks, these rules ensure devices understand each other. They're
Speaker 2: often defined in technical documents called RFC's Requests for Comments.
Speaker 1: So the IP part that handles the addressing and routing,
Speaker 1: making sure packets get from source AID to destination B correct.
Speaker 2: The ipheader within each data packet contains crucial info like
Speaker 2: the version is this IPv four or the newer IPv
Speaker 2: six and the source and destination IP addresses?
Speaker 1: Obviously, what about that TTL field I've heard about? Time
Speaker 1: to live?
Speaker 2: Ah? Yes, TTL. It's basically a counter that prevents packets
Speaker 2: from looping endlessly around the Internet. Each router that handles
Speaker 2: the packet decreases the TTL value. If it hits zero,
Speaker 2: the packet is discarded. Okay, but here's a neat trick.
Speaker 2: Different operating systems often start packets with different default TTL values,
Speaker 2: So just by looking at the TTL of incoming packets,
Speaker 2: you can sometimes make a pretty good I guess about
Speaker 2: the sender's OS, Windows, Linux, Mac OS. It's a passive
Speaker 2: fingerprinting technique.
Speaker 1: That's clever. Okay, So that's IP. What about the TCP
Speaker 1: part you said, Transmission Control Protocol Right.
Speaker 2: TCP sits on top of IP and adds reliability. It's
Speaker 2: header has fields like source port and destination port. Connecting
Speaker 2: back to our port discussion makes sense. But crucially, it
Speaker 2: adds sequence numbers and acknowledgment numbers. These ensure that all
Speaker 2: the packets arrive and that they get reassembled in the
Speaker 2: correct order at the destination. If the center doesn't get
Speaker 2: an acknowledgment ack back for a packet it's sent, it
Speaker 2: knows to resend it.
Speaker 1: So that's why TCP is called connection oriented and reliable
Speaker 1: because of that back and forth checking.
Speaker 2: Precisely, it establishes a formal connection before sending data and
Speaker 2: ensures everything gets there intact.
Speaker 1: And what are those TCP flags? Things like s yn
Speaker 1: ack fim ah.
Speaker 2: The flags. They're like little single bit signals within the
Speaker 2: TCP header that manage the state of the connection. S
Speaker 2: yn synchronized starts a connection, ack acknowledged, confirms seat of data,
Speaker 2: fin finish signals the end of the data transmission.
Speaker 1: Okay.
Speaker 2: There are others to like RST reset to abruptly kill
Speaker 2: a connection, or PSH push and urg urgent. Understanding these
Speaker 2: flags is key for analyzing traffic, and attackers can manipulate
Speaker 2: them for scanning like an s yn scan or even
Speaker 2: trying to bypass firewalls.
Speaker 1: And this all starts with the famous three way handshake.
Speaker 2: Every single TCP connection. Yes, it's fundamental.
Speaker 1: How does that work again?
Speaker 2: Simple client sends a s yn packet I want to connect.
Speaker 2: Server replies with a s y n ack. Okay, acknowledge
Speaker 2: your request, and I also want to sink. Client sends
Speaker 2: a final ack, got it connection established? Only then can
Speaker 2: the actual data start flowing. S yn s yn ack
Speaker 2: three steps, got.
Speaker 1: It s y n s y n ack ack.
Speaker 2: So TCP is reliable, but has that set up overhead?
Speaker 2: What's the alternative?
Speaker 1: UDP? UDP user data GRAM protocols the polar opposite in
Speaker 1: some ways. It's connectionless, meaning meaning it doesn't do the handshake.
Speaker 1: It just sends packets datagrams out toward the destination. No
Speaker 1: sequence numbers, no acknowledgements, no guarantee they'll arrive or in
Speaker 1: what order.
Speaker 2: So why use it?
Speaker 1: Sounds risky Because it's fast and efficient, low overhead. It's
Speaker 1: perfect for things where losing a tiny bit of data
Speaker 1: isn't the end of the world and speed matters more.
Speaker 1: Think streaming video or music ah.
Speaker 2: Right, a droped frame is barely noticeable exactly, or online gaming. Also,
Speaker 2: some really important network services use UDP, like DNS for
Speaker 2: looking up domain names, SNMP for network management, and NTP
Speaker 2: for time synchronization. They handle reliability at the application layer
Speaker 2: if needed.
Speaker 1: Okay, that makes sense. Protocols covered. What about the physical
Speaker 1: layout how the devices are actually connected.
Speaker 2: Network topology right toology how the network is physically or
Speaker 2: logically arranged. There are a few classic types. The simplest
Speaker 2: is maybe the bus topology like.
Speaker 1: An old school ethernet cable everyone plugs into.
Speaker 2: Pretty much all devices share a single communication line. It's
Speaker 2: cheap and easy to set up, but prone to collisions
Speaker 2: if multiple devices talk at once, and if the main
Speaker 2: cable breaks, the whole segment goes down.
Speaker 1: Not ideal. What's more common now for.
Speaker 2: Local area networks definitely the start apology. Every device connects
Speaker 2: directly to a central point, usually a switch these days,
Speaker 2: historically a hub.
Speaker 1: That seems way better for resilience.
Speaker 2: It is, if one device is cable fails, it only
Speaker 2: affects that one device. The rest of the network keeps working.
Speaker 2: It's the standard for most office and home networks.
Speaker 1: Okay, any other's worth knowing.
Speaker 2: Well, there's the ring topology. Devices are connected in a circle.
Speaker 2: Data packets travel around the ring until they reach their destination. Simple,
Speaker 2: can be efficient, but like the bus, a single break
Speaker 2: in the ring can be catastrophic. Used in some older
Speaker 2: network types like token ring.
Speaker 1: Right.
Speaker 2: And then there's mesh. In a full mesh, every device
Speaker 2: connects directly to every other device.
Speaker 1: Wow, that sounds complicated, but.
Speaker 2: Robust, extremely robust, lots of redundant paths. If one link fails,
Speaker 2: data can easily reroute the Internet itself at a high
Speaker 2: level functions like a massive mesh network, and interestingly, some
Speaker 2: modern peer to peer mobile apps like Brier can create
Speaker 2: ad hoc mesh networks using Bluetooth or Wi Fi by
Speaker 2: passing the need for central servers.
Speaker 1: Fascinating. Okay, so we have protocols topologies. How do we
Speaker 1: conceptibly tie all these layers together? That's the OSI model.
Speaker 2: Right, ah, the o SI model, the Open System's interconnection model. Yes,
Speaker 2: it's a conceptual framework, a way to understand how different
Speaker 2: networking tasks are divided into layers, each performing a specific function.
Speaker 2: Seven layers in total.
Speaker 1: Seven layers. Can you list them? And maybe that mnemonic
Speaker 1: I always forget.
Speaker 2: Sure from top closest to the user to bottom closest
Speaker 2: to the physical wire layer. Seven is applications, six is presentation,
Speaker 2: five a session, four is transport, three is network, two
Speaker 2: is data link, and one is physical. Okay, the mnemonics
Speaker 2: help going down? All people seem to need data processing
Speaker 2: going up? Please do not throw sausage pizza away, chezy,
Speaker 2: but they work.
Speaker 1: Huh. Okay, Please do not throw sausage pizzaway. Physical, data link, network, transport, session, presentation, application.
Speaker 2: Got it?
Speaker 1: But why is This model useful, especially from a.
Speaker 2: Security viewpoint, because different types of attacks target different layers.
Speaker 2: Understanding the model helps you categorize threats and defenses.
Speaker 1: You give examples sure.
Speaker 2: Layer seven application is where you see application specific exploits
Speaker 2: like SQL injection on a web app. Layer six presentation
Speaker 2: deals with data formatting and encryption. Phishing attacks often try
Speaker 2: to trick users at this interface.
Speaker 1: Okay.
Speaker 2: Layer five session manages connection session hijacking attacks happen here.
Speaker 2: Layer four transport, where TCPUDP live is often targeted for
Speaker 2: reconnaissance like port scanning. Layer three network, where IP lives
Speaker 2: is vulnerable to things like men in the middle attacks
Speaker 2: or routing manipulation. Layer two data link MIIC addresses can
Speaker 2: see MP spoofing or ARP poisoning. And Layer one physical
Speaker 2: is where simple wiretapping or signal jamming occurs.
Speaker 1: So the model provides a map for understanding where things
Speaker 1: are can go wrong exactly.
Speaker 2: It's a foundational concept for network engineers and security pros.
Speaker 1: Okay, this is great foundational stuff. Let's shift gears a bit.
Speaker 1: We talked about running out of IPv four addresses. How
Speaker 1: do we use the ones we have more efficiently than involve.
Speaker 2: Subnetting, subnetting, yes, and cid R notation. The main reasons
Speaker 2: for subnetting are one to conserve that limited IPv four space,
Speaker 2: two to create network segments with a more realistic number
Speaker 2: of hosts instead of huge flat networks, and three to
Speaker 2: improve performance and security by dividing large networks into smaller,
Speaker 2: manageable broadcast domains.
Speaker 1: So a subnet is like a network within a network.
Speaker 2: That's a perfect way to put it. You take a
Speaker 2: larger block of IP addresses assigned to you and break
Speaker 2: it down into smaller logical networks.
Speaker 1: How does that work technically with the subnet mask?
Speaker 2: Right? The subnet mask is another thirty two BET number
Speaker 2: that looks like an IP address, like two five five
Speaker 2: point two five to five point zero. It's used mathematically,
Speaker 2: usually with a binary A and D operation to separate
Speaker 2: the network portion of an IP address from the host portion.
Speaker 2: Tells devices which part identifies the street network and which
Speaker 2: part identifies the house number host on that street.
Speaker 1: Okay, and CIDR, that slash notation like twenty.
Speaker 2: Four CIR class list inter domain roading is basically shorthand
Speaker 2: for the subnet mask. Instead of writing out the full mask,
Speaker 2: you just put a slash followed by the number of
Speaker 2: bits used for the network portion.
Speaker 1: So one nineteen point one six eight point one point
Speaker 1: zero two four means the first twenty four bits are
Speaker 1: the network.
Speaker 2: Part exactly, which corresponds to a subnetmask of two hundred
Speaker 2: five five point two FI five five point two five
Speaker 2: five point zero eight would be two hundred finty five
Speaker 2: point zero point zero and song.
Speaker 1: And you can use this to carve up networks.
Speaker 2: Absolutely. You could take a standard Class C range like
Speaker 2: that twenty four, giving you about two hundred and fifty
Speaker 2: four usable host addresses, and decide you need, say six
Speaker 2: smaller departments, each needing maybe twenty five hosts. By borrowing
Speaker 2: a few bits from the host portion for the network portion,
Speaker 2: making it say a twenty seven, you can create multiple
Speaker 2: smaller subnets from that original block. It's efficient and helps
Speaker 2: organize and secure the network.
Speaker 1: Makes sense. Okay, Now, how do we actually see what's
Speaker 1: happening on our network? What tools are there besides just theory?
Speaker 2: Good question. There are essential command line tools built into
Speaker 2: most operating systems. If CANFIG or IP addra on modern
Speaker 2: Linux shows your network interface configuration, IP address, MAC address, etc.
Speaker 2: Right Ping two, Ping, is fundamental. Sends a simple ECO
Speaker 2: request to see if a host is online and how
Speaker 2: long it takes to respond. Basic connectivity testing.
Speaker 1: What about seeing active connections for that?
Speaker 2: Netstat is classic? It shows all the network connections to
Speaker 2: and from your machine, TCPUDP, listening, poards, established connections, really
Speaker 2: useful for troubleshooting or even spotting suspicious activity like malware
Speaker 2: calling home.
Speaker 1: Is there a newer version?
Speaker 2: Yeah? On Linux, USS socket statistics is generally preferred now,
Speaker 2: often faster and provides more detailed information than netstat.
Speaker 1: Okay, those are good for looking at my own machines connections.
Speaker 1: But yeah, what about seeing all the traffic flowing across
Speaker 1: the network segment?
Speaker 2: That's sniffing, right, that's network sniffing or packet analysis using
Speaker 2: tools called sniffers or packet analyzers. These are incredibly powerful.
Speaker 2: Network engineers use them constantly to diagnose problems, forensic investigators
Speaker 2: use them to capture digital evidences, and hackers use them
Speaker 2: for reconnaissance, finding vulnerabilities, capturing sensitive data if it's unencrypted,
Speaker 2: like passwords, session cookies, emails files.
Speaker 1: Is this legal? I remember hearing that FBI tool. Ah.
Speaker 2: Yeah, the source mentions the FBI's Carnivore system, which was controversial.
Speaker 2: Sniffing traffic on a network you don't own or have
Speaker 2: permission to monitor is generally illegal in most places, but
Speaker 2: for legitimate network administration and security testing on your own networks,
Speaker 2: it's an indispensable tool.
Speaker 1: What do you need to make it work?
Speaker 2: Two main things. First, your computer's network interface card and
Speaker 2: I SEE needs to be put into promiscuous mode. Normally,
Speaker 2: and I SEE ignores packets not addressed to its specific
Speaker 2: and MESSI doaters. Promiscuous mode tells it to grab every
Speaker 2: packet it sees on the wire or Wi Fi channel.
Speaker 1: Okay.
Speaker 2: Second, you need the sniffing software itself, and captured traffic
Speaker 2: is usually saved in a standard file format called dot
Speaker 2: p cap packet capture, which many different tools can read.
Speaker 1: Let's talk tools. The source mentions TCP dump.
Speaker 2: TCP dump the classic. It's a command line sniffer that's
Speaker 2: been around since the late eighties, available on Linux and
Speaker 2: Unix like systems. It's powerful and flexible, though the output
Speaker 2: can be a bit raw.
Speaker 1: How do you use it?
Speaker 2: You can just run TCP dump and it starts showing
Speaker 2: packet summary, scrolling by more usefully you use flags SS
Speaker 2: specifies the interface to listen on like F zero or
Speaker 2: one and zero. AW writs the raw packets to a
Speaker 2: dot pcap file for later analysis.
Speaker 1: What about filtering? Can it narrow down the traffic?
Speaker 2: Absolutely? That's its strength. You can filter by source or destination,
Speaker 2: IP address, SRC host or DCS host. You can filter
Speaker 2: by port port eighty for web traffic. You can filter
Speaker 2: by protocol TCP, UDP, ICP. You can even filter based
Speaker 2: on TCP flags, TCPDCP flags and tcps in equals zero
Speaker 2: to C only syn.
Speaker 1: Packets wow specific very You.
Speaker 2: Can combine filters with and or not. The source even
Speaker 2: shows examples of filtering for things like clear text passwords,
Speaker 2: password or specific user agent strings from web browsers or
Speaker 2: session cookies. It requires understanding the protocols, but it lets
Speaker 2: you zero in on exactly what you need.
Speaker 1: Powerful, but maybe not super user friendly for visualizing things.
Speaker 1: What's the go to graphical tool?
Speaker 2: That would be wire shark. The source calls it the
Speaker 2: de facto standard, and that's accurate. It's graphical, runs on Windows, Mac, Os, Linux,
Speaker 2: and it makes analyzing packet captures much easier.
Speaker 1: How does it display the data?
Speaker 2: It has three main pains. The top PAIN is the
Speaker 2: packet list, showing a summary of each captured packet. Click
Speaker 2: one there, and the middle pain packet details shows a
Speaker 2: decoded breakdown of all the protocol layers and fields within
Speaker 2: that packet Ethernet, IP, TCP, application data. The bottom pain
Speaker 2: packet bytes shows the raw hexadecimal and ask data.
Speaker 1: And filtering in wire Shark.
Speaker 2: Also very powerful. You can type display filters directly like
Speaker 2: IP dot adr equals one ninety two point one sixty
Speaker 2: eight point one point one, or TCP dot port equals
Speaker 2: eighty or HTTP contains Facebook. There's also an expression builder
Speaker 2: to help create complex filters.
Speaker 1: What about seeing a whole conversation like a web request
Speaker 1: in its response.
Speaker 2: Wireshark makes that super easy with the follow TCP stream
Speaker 2: or udpr SSLTLS stream feature. Write click a packet in
Speaker 2: a conversation, choose follow, and it opens a new window
Speaker 2: showing just the data exchange between those two end points,
Speaker 2: reassembled in order. Fantastic for reading HTTP requests, emails, chat
Speaker 2: messages if they're unencrypted.
Speaker 1: Okay, wire Shark sounds essential for digging into dot pcat files.
Speaker 1: Now we know how to see traffic, how do we
Speaker 1: control it. How do we block unwanted traffic? Firewalls?
Speaker 2: Firewalls, Yeah, your digital gatekeepers absolutely crucial. They can be
Speaker 2: software running on a single computer, a host based firewall
Speaker 2: protecting just that machine, or a dedicated hardware appliance protecting
Speaker 2: an entire network perimeter.
Speaker 1: The source focuses on Linux firewalls, specifically iptables right.
Speaker 2: Tiptables is the classic built in command line firewall utility
Speaker 2: for Linux kernels. Though NF tables is newer, iptables is
Speaker 2: still widely used and understood. It's incredibly flexible, but can
Speaker 2: be complex.
Speaker 1: How does it work conceptually? Tables chains.
Speaker 2: It uses a system of tables, chains, and rules. Tables
Speaker 2: group rules based on their general purpose. The main one
Speaker 2: is the filter table for packet filtering. Others include NAT
Speaker 2: for network address translation, mangle for modifying packets, and raw okay,
Speaker 2: and chains. Chains are lists of rules within a table
Speaker 2: that packets traverse. The key chains in the filter table
Speaker 2: are input for packets destined for the firewall host itself,
Speaker 2: output for packets originating from the firewall host, and forward
Speaker 2: for packets just passing through the firewall like in a router.
Speaker 1: So packets flow through these chains and rules are applied exactly.
Speaker 2: Each rule has matches conditions the packet must meet, like source, ipe, destination,
Speaker 2: port protocol, and a target. What to do if the
Speaker 2: packet matches like accept it, drop it silently, reject it
Speaker 2: with an error, or log it.
Speaker 1: Can you set default actions?
Speaker 2: Yes, each chain has a default policy. You could set
Speaker 2: the EMPPUT policy to accept allow everything by default, then
Speaker 2: add specific drop rules, or more securely, set it to
Speaker 2: drop block everything by default, then adds specific accept rules
Speaker 2: for needed traffic.
Speaker 1: And the order of rules is important.
Speaker 2: Critically important. Iptables processes rules in a chain sequentially from
Speaker 2: top to bottom. The first rule that matches a packet
Speaker 2: determines its fate. So if you want to allow traffic
Speaker 2: from a specific IP but block all others, the allow
Speaker 2: rule must come before the general block rule.
Speaker 1: So you can use it to block specific ips or
Speaker 1: whole networks using CIDR, or block access to certain ports.
Speaker 2: All of that block incoming SSH from anywhere except your
Speaker 2: trusted IP, block outgoing connections to non malicious domains, allow
Speaker 2: incoming web traffic only to port eighty and four forty three.
Speaker 2: Very granular control.
Speaker 1: Okay, that covers wired network defenses. What about the wild
Speaker 1: West of wireless Wi Fi.
Speaker 2: Ah Wi Fi eight POH two point one one standard.
Speaker 2: It's everywhere convenient, but yeah, historically riddled with security issues.
Speaker 2: We've come a long way from the original WEP encryption,
Speaker 2: which was broken years ago.
Speaker 1: WP is basically useless now right completely.
Speaker 2: Then came WPA which was better but still flawed. Then
Speaker 2: WPA two using AES encryption became the standard for a
Speaker 2: long time, pretty strong but not perfect, and now we
Speaker 2: have WPA three, which aims to fix some of WP
Speaker 2: two's weaknesses.
Speaker 1: Let's cover some Wi Fi basics. AP, SSID PSK right.
Speaker 2: AP is the access point your wireless router. SSID is
Speaker 2: the service set identifier that's the network name you see
Speaker 2: and connect to. PSK is the pre shared key, the
Speaker 2: password you type in for WPA two WPA.
Speaker 1: Three Personal mode BSSID.
Speaker 2: BSID is basically the m address of the access points
Speaker 2: wireless interface uniquely identifies the AP and.
Speaker 1: For hacking Wi Fi, you often need special gear.
Speaker 2: Often, yes, specifically a wireless adapter that supports monitor mode
Speaker 2: like promiscuous mode, but for Wi Fi letting you see
Speaker 2: all nearby traffic. Then crucially, packet injection, the ability to
Speaker 2: craft and send your own wireless frames. The source recommends
Speaker 2: Alpha brand cards, which are popular for this.
Speaker 1: What about common security tips that might not be so secure,
Speaker 1: like hiding your SSID.
Speaker 2: Hiding the SSAD. Yeah, that provides almost no real security.
Speaker 2: Your devices still need to know the SSID to connect,
Speaker 2: so they send out probe requests asking for it. A
Speaker 2: hacker and monitor mode can just listen for these requests
Speaker 2: or the AP's responses and discover the hidden name easily.
Speaker 1: And MSc filtering only allowing specific devices.
Speaker 2: Same problem security through obscurity, an attacker can just sniff
Speaker 2: the traffic, see the MC address of an allowed client,
Speaker 2: and then change their own adapter's MC address, spoofing it
Speaker 2: with a tool like the changer to match the allowed
Speaker 2: one bypass achieved.
Speaker 1: Okay, so what are the real attacks against something like
Speaker 1: WPA two.
Speaker 2: The most common attack against WPA two PSK, the password version,
Speaker 2: involves capturing the four way handshake handshake. When a legitimate
Speaker 2: client connects to a WA two network, there's a four
Speaker 2: step process where the client and AP prove they both
Speaker 2: know the password and derive session keys without actually sending
Speaker 2: the password in the.
Speaker 1: Clear, But you can capture that exchange.
Speaker 2: Yes, an attacker puts their card in monitor mode and
Speaker 2: uses tools like aero dumping to watch for clients connecting.
Speaker 2: Or they can speed things up by sending a de
Speaker 2: authentication frame using airplaying to kick a connected client off
Speaker 2: the network, forcing them to reconnect and generate a new handshake,
Speaker 2: which the attacker captures.
Speaker 1: And once you have the handshake, the.
Speaker 2: Handshake contains a hash derived from the password. It's not
Speaker 2: the password itself, but you can take that captured handshake
Speaker 2: and feed it into an offline password cracking tool.
Speaker 1: Like hashcat, along with the word list exactly.
Speaker 2: Hashcat tries hashing every word in a massive dictionary or
Speaker 2: word list, using the network's SSID as part of the process.
Speaker 2: Comparing the result to the captured hash, it finds a match. Boom,
Speaker 2: You've got the Wi Fi password. Success depends heavily on
Speaker 2: the password complexity and the quality of the word list.
Speaker 1: Okay, that's the handshake attack. Yeah, what about WPS that buttons.
Speaker 1: Some routers have.
Speaker 2: WPS Wi Fi protected setup designed for ease of use,
Speaker 2: but the initial PI in implementation was a security disaster.
Speaker 2: How So, it uses an eight digit PN but it
Speaker 2: validates the first four digits separately from the next three.
Speaker 2: The last digit is just a check some This means
Speaker 2: an attacker only needs to guess a four digit number
Speaker 2: ten thousand possibilities, and then a three digit number one
Speaker 2: thousand possibilities. That's only eleven thousand total guesses.
Speaker 1: Maximum, which is easy to brood force.
Speaker 2: Trivial tools like reaver or Bully can try all possible pins,
Speaker 2: often in just a few hours, and recover the actual
Speaker 2: WPA two password. Many routers still have this vulnerable WPS
Speaker 2: enabled by default. Checking the WPS status is often the
Speaker 2: first thing an attacker tries.
Speaker 1: Thikes, okay, what about the evil twin attack? Sounds nasty?
Speaker 1: It is.
Speaker 2: It's a man in the middle attack. The attacker sets
Speaker 2: up their own fake access point with the exact same
Speaker 2: SSID and security settings as the legitimate network you want
Speaker 2: to connect to, like a fake cofee shop WiFi exactly.
Speaker 2: Then they might use de authentication attacks to kick you
Speaker 2: off the real coffee shop WiFi. Your device, seeing the
Speaker 2: familiar network name, might automatically reconnect, but this time to
Speaker 2: the attacker's fake AP, and then all your Internet traffic
Speaker 2: flows through the attacker's machine. If you visit unencrypted websites HGTP.
Speaker 2: They can see everything in wireshirk usernames, passwords, anything you type.
Speaker 2: Even with HTTPS, they might try SSL stripping or prompt
Speaker 2: you with fake login pages. It's very effective in public areas.
Speaker 1: You mentioned the authentication attacks. Can they just be used
Speaker 1: to knock people offline?
Speaker 2: Oh?
Speaker 1: Yeah?
Speaker 2: Just continuously sending deof frames spoofing the AP's address to
Speaker 2: all connected clients basically creates a denial of service attack
Speaker 2: for that Wi Fi network. The source even shows a
Speaker 2: simple BSA script to automate this, making it persistently annoying.
Speaker 1: Is there anything newer attacking WPA two?
Speaker 2: Yes. A significant development from twenty eighteen is the PMKID
Speaker 2: attack pairwise master key identifier.
Speaker 1: How's that different from the handshake cap?
Speaker 2: The key difference is you don't need a client to
Speaker 2: be connecting or deauthenticate anyone. The attacker can potentially get
Speaker 2: the necessary password hash information directly from the access point
Speaker 2: itself in the first message, the RSNIE frame it sends
Speaker 2: when a client tries.
Speaker 1: To associate just one frame needed.
Speaker 2: Potentially Yes, Tools like hcx dump tool are used to
Speaker 2: request and capture this RSNIE containing the PMKID. Then, just
Speaker 2: like the handshake hash. You feed this pmkid data into
Speaker 2: hashcat for offline cracking against word lists. It's faster and
Speaker 2: stealthier than waiting for a full handshake.
Speaker 1: Wi Fi security is a constant cat mask game. What
Speaker 1: about Bluetooth? That's everywhere too.
Speaker 2: Bluetooth, designed for short range, low power communication, creates small
Speaker 2: personal area networks or peconets. Your headphones, speakers, keyboards, fitness trackers, cars.
Speaker 1: Yeah, tons of stuff. Are there Linux tools for it?
Speaker 2: Basic ones yeah. Hcnfig manages your Bluetooth adapter. H to
Speaker 2: tool can scan for nearby devices, and h dump can
Speaker 2: sniff Bluetooth traffic similar to TCP dump.
Speaker 1: Is Bluetooth secure It seems like it should be, with
Speaker 1: pairing and stuff.
Speaker 2: It has security features like frequency hopping to avoid interference
Speaker 2: and eavesdropping, and pairing involves generating shared keys, but vulnerabilities
Speaker 2: have consistently popped up over the years like what Classic
Speaker 2: attacks include blue smarfing connecting to a device without permission
Speaker 2: to steal data like contacts or calendars. Blue bugging goes
Speaker 2: further trying to take full control of the phone. Bluesmac
Speaker 2: is a simple denial of service attack.
Speaker 1: Anything more recent or severe.
Speaker 2: The source highlights the blueborne attack vector, discovered in twenty seventeen.
Speaker 2: This was a collection of vulnerabilities affecting billions of unpatched
Speaker 2: devices Android, Windows, Linux, older iOS s or did it allow?
Speaker 2: It exploited flaws in the Bluetooth implementation, particularly in the
Speaker 2: Service Discovery Protocol SDP. Critically, an attacker could trigger these
Speaker 2: flaws without needing to pair with the target device, and
Speaker 2: often even if the device wasn't set to discoverable mode,
Speaker 2: and the impact it could lead to remote code execution,
Speaker 2: potentially giving the attacker full control, even kernel level access.
Speaker 2: The source demonstrates using a Python script to exploit one
Speaker 2: of these volunds and extract memory content from a vulnerable device.
Speaker 2: Really serious stuff.
Speaker 1: Patching is key, definitely. Okay, let's move into some other crucial,
Speaker 1: maybe less obvious, network protocols ARP. Address Resolution Protocol.
Speaker 2: ARP essential on local Ethernet networks. Its job is simple
Speaker 2: but vital. It translates layer three IP addresses into layer
Speaker 2: two MC addresses.
Speaker 1: Why is that needed? If my computer knows the IP
Speaker 1: address of the printer, why does it need the MC address?
Speaker 2: Because on an Ethernet segment, devices ultimately communicate using physical
Speaker 2: MC addresses. When your computer wants to send a packet
Speaker 2: to the printer's IP, say one ninety two point one
Speaker 2: six eight point one point two zero on the same
Speaker 2: local network, it first needs to know the printer's hardware
Speaker 2: and MAC dress, so it sends out an ARP request
Speaker 2: broadcast who has one on two point one sixty eight
Speaker 2: point one point one two all, or tell me my
Speaker 2: IP in m AC. The printer sees this and replies
Speaker 2: with an a RP response one ninety two point one
Speaker 2: sixty eight point one point two zero is at MC
Speaker 2: address AA BBC d e e ff. Your computer then
Speaker 2: stores this mapping and its ARP table or cast.
Speaker 1: Oh okay, you can see this table.
Speaker 2: YEP the command in Windows or ARPN in Linux will
Speaker 2: show you the current IP TOMAC mappings your system knows about.
Speaker 1: How do attackers use AARP for reconnaissance?
Speaker 2: First off, tools like net Discover send out ARP requests
Speaker 2: for every possible IP on the local subnet. Any device
Speaker 2: that replies reveals its IP, its MMASS address, and often
Speaker 2: the vendor of its network card based on the first
Speaker 2: half of the MC address. It's a quick way to
Speaker 2: map out all the live hosts on the land, but.
Speaker 1: There are attacks too. ARP spoofing big time.
Speaker 2: AARP is inherently trusting, it doesn't really authenticate responses. This
Speaker 2: makes it vulnerable to ARP spoofing or ARP poisoning, which
Speaker 2: is the basis for many Man in the Middle MATM.
Speaker 1: Attacks on a land How does that work?
Speaker 2: An attacker sends out forged ARP replies. For example, they
Speaker 2: tell the victim computer that the router's IP address corresponds
Speaker 2: to the attackers MC address, and they tell the router
Speaker 2: that the victim's IP address corresponds to the attackers and
Speaker 2: mass C address.
Speaker 1: So all traffic between the victim and the router now
Speaker 1: goes through the attacker precisely.
Speaker 2: The attacker sits in the middle relaying the traffic, but
Speaker 2: able to read modifier block anything unencrypted. Tools like ettercap
Speaker 2: or arpspoof automate this process very effective on switch networks
Speaker 2: where simple sniffing doesn't work well.
Speaker 1: Scary stuff on the local network. Okay, what about the
Speaker 1: global phone book DNS?
Speaker 2: Domain Name system DNS absolutely fundamental to how we use
Speaker 2: the Internet. It's core job translate human friendly domain names
Speaker 2: like www, dot Google dot com into the numerical IP
Speaker 2: addresses that computers actually use to connect like one seventy
Speaker 2: two point two to one c point one six to
Speaker 2: zero point one four to two.
Speaker 1: Without it, we b typing numbers all day.
Speaker 2: We would And domain names have that hierarchy right at
Speaker 2: the top the route, then top level domains dot com,
Speaker 2: dot org, dot UK, then second level domains Google, BBC,
Speaker 2: and potentially subdomains www, the whole thing together like mail
Speaker 2: dot Google dot com is a fully qualified domain name
Speaker 2: or FQDN.
Speaker 1: Is the old host's file still relevant?
Speaker 2: Surprisingly, Yes, that simple text file on your computer echosts
Speaker 2: on LinuxMac C Window System thirty two drivers on Windows
Speaker 2: contains manual domain to IP mappings, and crucially, your system
Speaker 2: checks this file before it makes a DNS query out
Speaker 2: to the network.
Speaker 1: So you can hijack DNS locally by editing that file.
Speaker 1: You could.
Speaker 2: Malware sometimes modifies the host's file to redirect users from
Speaker 2: legitimate sites like their bank, to malicious fishing sites hosted elsewhere.
Speaker 2: It's a simple form of DNS spoofing on a local machine.
Speaker 1: But generally DNS is this huge distributed system.
Speaker 2: Massively distributed, hierarchical and dynamic. That's why it's so resilient.
Speaker 2: It's not just one server, it's a global network of servers.
Speaker 2: Key components include the DNS cash on your computer, storing
Speaker 2: recent lookups, resolvers, servers often run by your ISP that
Speaker 2: handle your queries, Authoritative name servers which hold the actual
Speaker 2: records for a domain and the overall name space, and.
Speaker 1: The records themselves a cripple amx right.
Speaker 2: Domains are organized into zone files, which contain various resource records,
Speaker 2: soa startup authority defines administrative info. NS lists the authoritative
Speaker 2: name servers. A map's a name to an IPv four address,
Speaker 2: quad a maps to an IPv six address. Cname creates
Speaker 2: an alias pointing to another name. PTR does the reverse
Speaker 2: look up IP to name, and MX mail exchanger tells
Speaker 2: email servers where to send mail for that domain. Has
Speaker 2: DNS always been secure historically No, It was designed for openness,
Speaker 2: not security. Vulnerabilities included fragility. Early versions could be crashed easily,
Speaker 2: information leakage attackers could query DNS servers to learn man
Speaker 2: internal network structures, DNS recon and denial of service. Taking
Speaker 2: down a company's DNS server effectively takes them offline.
Speaker 1: What about redirecting traffic.
Speaker 2: Malicious zone transfers were a problem, tricking a server into
Speaker 2: giving up its entire zone file, and attackers could compromise
Speaker 2: DNS servers or registration accounts to change legitimate records, pointing
Speaker 2: users to bad sites. The source mentions Iranian state actors
Speaker 2: doing this in twenty eighteen twenty nineteen to redirect users
Speaker 2: and steal credentials.
Speaker 1: Is there a fix?
Speaker 2: The main security enhancement is DNSSECNS Security Extensions. It uses
Speaker 2: digital signatures to add authentication and integrity to DNS data.
Speaker 2: When you get a DNS response, dnssec allows your resolver
Speaker 2: to verify that the data came from the legitimate source
Speaker 2: and hasn't been tampered with. Adoption is growing, but it's
Speaker 2: not universal.
Speaker 1: Yet, and you can build your own DNS server. Yeah.
Speaker 2: The source gives steps using BND, the most common DNS
Speaker 2: server software on Linux. Good way to understand the moving parts.
Speaker 1: Okay, moving on SMB server message block. The source seems
Speaker 1: to think this one is particularly troublesome.
Speaker 2: SMB Yes, it's described as often impenetrable but critical. It's
Speaker 2: an application layer protocol, mostly known for file and printer
Speaker 2: sharing and Windows networks, but also used for other interprocess communication.
Speaker 2: It usually runs over tcpport four five the older dialect
Speaker 2: CIFS Common Internet File System is basically SMB version one.
Speaker 1: Why is it considered so problematic?
Speaker 2: History? It has been a consistent source of major critical
Speaker 2: vulnerabilities and Windows for decades. Linux implementations via Samba have
Speaker 2: had issues too. These aren't minor bugs. They often lead
Speaker 2: to full remote system compromise.
Speaker 1: Any famous examples, Oh yeah.
Speaker 2: The source specifically calls out MS seventeen zero six seven,
Speaker 2: a classic vulnerability exploited by the configure worm, and even
Speaker 2: more significantly, MS seventeen zero ten, the vulnerability exploited by
Speaker 2: the NSA's eternal Blue tool.
Speaker 1: Eternal Blue that was leaked.
Speaker 2: Right, leaked by the Shadow Brokers group. Yes, and it
Speaker 2: was quickly weaponized in massive ransomware attacks like Wanacry and
Speaker 2: Pettianapaedia in twenty seventeen, causing global disruption. Eternal Blue allowed
Speaker 2: attackers to gain complete control over unpatched Windows systems simply
Speaker 2: by sending malicious SMB packets. It highlights just how dangerous
Speaker 2: SMB flaws can be.
Speaker 1: Can you practice with SMB? Say?
Speaker 2: The source suggests setting up a Samba server on Calley
Speaker 2: Linux Samba implements the SMB protocol so you can configure
Speaker 2: it to act like a Windows file share, letting you
Speaker 2: experiment with tools and techniques in a controlled lab environment.
Speaker 1: Good tip, Okay. Another daily protocol SMTP.
Speaker 2: For email SMTP simple Mail Transfer Protocol the backbone of
Speaker 2: email delivery. It's primarily used for transferring email between mail servers,
Speaker 2: mail transfer agents, or MTAs, typically on TCP port twenty five.
Speaker 1: How does the whole email process work?
Speaker 2: Generally, your email client Mail user agent MUA sends your
Speaker 2: outgoing message to your organizations or ISP's mail submission agent MSA.
Speaker 2: The MSA then uses SMTP to relay that message to
Speaker 2: the recipient's MTA. Finally, the recipient's MTA passes it to
Speaker 2: their mail delivery Agent MDA, which puts it in their
Speaker 2: inbox for their MUA to retrieve, often using protocols like
Speaker 2: POP three or IMAP. SMTP is that server to server
Speaker 2: relay part.
Speaker 1: Has SMTP had recent security issues too?
Speaker 2: Yes? Even major. The source mentions significant vulnerabilities in a
Speaker 2: Microsoft Exchange server in twenty twenty one, allegedly exploited by
Speaker 2: Chinese state actors, which prompted an unusual response where the
Speaker 2: FBI remotely patched vulnerable servers in the US. WOW and XIM,
Speaker 2: another very popular mail server software used on Linux Unix,
Speaker 2: had critical vulnerabilities in twenty nineteen and twenty twenty that
Speaker 2: could allow remote code execution or unauthorized access. Email servers
Speaker 2: are high value targets.
Speaker 1: How would someone probe? An SMTP server?
Speaker 2: Reconnaissance often starts with NMAP. You scan port twenty five
Speaker 2: to confirm SMTPS running and identify the server software and
Speaker 2: version like Microsoft Exchange EXEM postfix. Then NMAP has specific
Speaker 2: scripts NSE scripts that can try to enumerate valid usernames
Speaker 2: on the server using VRFY or EXPN commands if enabled,
Speaker 2: or even check for known vulnerabilities based on the detected.
Speaker 1: Version exploit it.
Speaker 2: If a non vulnerability exists like the source describes for
Speaker 2: an older EXUM version CVE twenty ten four three fourty four,
Speaker 2: you could use a framework like metasp mesaplat has modules
Speaker 2: specifically designed to exploit known flaws. In that EXEM example,
Speaker 2: successfully exploiting a heat buffer overflow could grant the attacker
Speaker 2: a remote shell, potentially with root privileges on the mail server.
Speaker 1: Full compromise okay one more standard protocol. The source highlights
Speaker 1: has often overlooked SNMP.
Speaker 2: SNMP simple network management protocol. The source calls it least
Speaker 2: understood yet so vitally important and that's fair. It's used
Speaker 2: by network administrators to monitor and manage network devices, routers, switches, servers, printers.
Speaker 2: It usually runs on UDP ports one hundred and sixty
Speaker 2: one requests and one hundred and sixty two traps notifications.
Speaker 1: How does it work? Manage agent exactly?
Speaker 2: SNMP managers like a central monitoring station, query SNMP agents
Speaker 2: running on the managed devices. The agents gather information requested
Speaker 2: by the manager.
Speaker 1: Where does the information come from? The MIIB?
Speaker 2: The MiB Management information base. It's a hierarchical database structure
Speaker 2: defined on each managed device. It contains a ton of
Speaker 2: information or orgize using object identifiers ODS, things like device uptime,
Speaker 2: network interface statistics, running processes, installed software, user accounts, system
Speaker 2: hardware details, potentially very sensitive data.
Speaker 1: What's the security issue? Especially with SNMPv one?
Speaker 2: SNMP version one had notoriously weak security. Authentication relied solely
Speaker 2: on plaintext community strings, which essentially act like passwords. There
Speaker 2: are typically two a read only string often default public,
Speaker 2: and a read right string often default.
Speaker 1: Private public ampress.
Speaker 2: Seriously, if devices were left with these defaults, anyone on
Speaker 2: the network could potentially query the device using the public
Speaker 2: string to extract vast amounts of information from the MIP,
Speaker 2: and if the private string was guessable or default, they
Speaker 2: could even change configuration settings on the device remotely via
Speaker 2: snmps set commands.
Speaker 1: How would you find this info?
Speaker 2: Tools like splot can dump large sections of the MiB
Speaker 2: if you know the community string. Some check is specifically
Speaker 2: designed for enumerting. SNMP infoe and tools like one sixty
Speaker 2: one are built to rapidly broute force common community strings
Speaker 2: against a list of IP addresses.
Speaker 1: So SNMP could be a gold mine for attacker doing.
Speaker 2: Reconnaissance, absolutely and potentially a way to control devices. The
Speaker 2: source even mentions an alleged NSA exploit called extra Bacon,
Speaker 2: which targeted a vulnerability in Cisco's SNMP implementation to bypass
Speaker 2: firewalls and monitor VPN traffic. It underscores that SNMP, if
Speaker 2: not properly secured, using newer versions like SNMPv three with
Speaker 2: encryption and strong authentication, can be a major security risk.
Speaker 1: Okay, we've covered a lot of the traditional IT network
Speaker 1: round Now for the really cutting edge stuff. The source
Speaker 1: gets into hacking physical systems, starting with cars automobile networks.
Speaker 2: Yeah, this is described as a leading edge area. As
Speaker 2: cars get loaded with more electronics, sensors, and connectivity, entertainment,
Speaker 2: remote diagnostics, driver assyst their attack surface expands dramatically. Autonomous
Speaker 2: vehicles magnify this concern hugely.
Speaker 1: What's the main next work inside a car? CANbus?
Speaker 2: The CANbus controller area network is the workhorse. It connects
Speaker 2: the various electronic control units ECUs and the car engine control, transmission, breaks, airbags,
Speaker 2: dashboard entertainment.
Speaker 1: And it's vulnerable fundamentally. Yes.
Speaker 2: Standard CANbus is a broadcast protocol. Every message sent by
Speaker 2: any ECU is seen by all other ECUs. More importantly,
Speaker 2: it typically has no built in encryption or authentication at
Speaker 2: the protocol level.
Speaker 1: No authentication, so you can just inject messages essentially.
Speaker 2: Yes, If you gain access to the CANbus you can
Speaker 2: potentially send messages pretending to be any ECU. This makes
Speaker 2: boofing attacks and man in the middle relatively straightforward compared
Speaker 2: to typical IT networks. Access is often gained via the
Speaker 2: OBED two port under the dashboard, the same one mechanics
Speaker 2: used for diagnostics.
Speaker 1: How do people practice this? The source mentions.
Speaker 2: Tools for learning. Can U tools is a set of
Speaker 2: Linux command line utilities for working with can and ICSM
Speaker 2: is an open source instrument cluster simulator, basically a little
Speaker 2: video game dashboard that simulates can traffic for things like speed, turn, signals, doors.
Speaker 2: You can interact with ICSIM using can utils as if
Speaker 2: it were real.
Speaker 1: Car networks, so you can try to reverse engineer the
Speaker 1: signals exactly.
Speaker 2: The source describes the process. Use can sniffer part of
Speaker 2: can utils while interacting with the simulator, say pressing the
Speaker 2: accelerator pedal, and ICSIM can sniffer highlights which can message
Speaker 2: IDs change their data values.
Speaker 1: Find the ID for acceleration.
Speaker 2: Find the ID in the specific data bytes that control acceleration.
Speaker 2: Once you figured that out, you can use cansen to
Speaker 2: inject your own message onto the simulated can bus with
Speaker 2: that ID in data, telling the car to accelerate. If
Speaker 2: you loop the Cansen command, you can effectively take autonomous
Speaker 2: control of that function in the simulator.
Speaker 1: Like making the simulated car floor.
Speaker 2: It exactly, making it go to one hundred milar hour,
Speaker 2: turn the wheel, unlocked doors, whatever functions you can reverse
Speaker 2: engineer and control via CAN messages. Applying this to real
Speaker 2: cars is obviously much more complex and dangerous, but the
Speaker 2: principle is the same.
Speaker 1: What about key fobs? Can they be hacked?
Speaker 2: Keyfobs often use rolling codes now, making simple replay attacks difficult,
Speaker 2: But the source details a different technique, Signal amplification relay
Speaker 2: attack or SARAH.
Speaker 1: How does SARAH work?
Speaker 2: It requires two attackers working together, each with a device
Speaker 2: that can relay radio signals. Attacker one stands near the car.
Speaker 2: Attacker two stands near the owner carrying the keyfob, maybe
Speaker 2: outside their house or following them in a store. Attacker
Speaker 2: one's device triggers the car to send it's where's the
Speaker 2: key signal. This signal is relayed to attacker two's device
Speaker 2: near the fob. The fob responds. That response is relayed
Speaker 2: back to Attacker one's device near the car. The car
Speaker 2: thinks the fob is nearby and unlocks or allows the
Speaker 2: ignition to start.
Speaker 1: So they just boost the signal range. They don't need
Speaker 1: to crack the code exactly.
Speaker 2: They don't decrypt anything. They just relay the legitimate encrypted
Speaker 2: communication over a much longer distance. The source compares it
Speaker 2: to a pass the HASH attack in networking using the
Speaker 2: credential without needing to know the under lying secret very
Speaker 2: effective against passive keyless entry systems.
Speaker 1: Clever and scary. Okay, from cars to even more critical
Speaker 1: systems SCATA and ICs industrial control systems.
Speaker 2: Satas supervisory control and data acquisition and ICs industrial control systems.
Speaker 2: These are the systems running critical infrastructure, power grids, water
Speaker 2: treatment plants, oil refineries, manufacturing lines, pipelines. The source rightly
Speaker 2: calls securing them the most important and overlooked field. An
Speaker 2: attack here can have devastating real world consequences.
Speaker 1: How are they different from regular IT networks.
Speaker 2: They often use specialized, sometimes proprietary communication protocols designed for
Speaker 2: industrial environments, not necessarily with security as the top priority. Initially,
Speaker 2: reliability and real time operation were often the main goals.
Speaker 2: Protocols like modbus, DNP three, profinet ethernet APE are common.
Speaker 2: They also often involve programmable logic controllers PLCs directly interacting
Speaker 2: with physical machinery.
Speaker 1: The source folk this is on modbus.
Speaker 2: Mod Bus is one of the oldest and most widely
Speaker 2: used industrial protocols. It's a simple master slave protocol, but
Speaker 2: its simplicity is also its weakness.
Speaker 1: What are the vulnerabilities?
Speaker 2: Big ones standard mod bus has no authentication, any device
Speaker 2: can send commands, no encryption, All data is sent in
Speaker 2: the clear. The TCPIP version lacks checksums sometimes and no
Speaker 2: broadcast suppression. Easy to flood the network with requests, causing
Speaker 2: a denial of service.
Speaker 1: Can you find these systems online?
Speaker 2: Worryingly Yes. Search engines like showdand specialize in finding Internet
Speaker 2: connected devices, including industrial controllers. The source shows how to
Speaker 2: search showdown for specific Schneider Electric TM two twenty one PLCs,
Speaker 2: a common type that are exposed directly to the Internet,
Speaker 2: often running.
Speaker 1: Mod bus and can you interact with them.
Speaker 2: If they're unsecured?
Speaker 1: Yes.
Speaker 2: The source demonstrates using a command line tool called modbus Clay.
Speaker 2: This tool can connect to a mod bus device using
Speaker 2: its IP address found DA SHOWDAN and send commands to
Speaker 2: read or write values to its internal memory LOOE lotions
Speaker 2: called coils and registers.
Speaker 1: What does writing to a register do?
Speaker 2: It depends on what that register controls in the plc's program.
Speaker 2: It could start or stop a motor, open or close
Speaker 2: a valve, change a temperature set point, directly manipulating the
Speaker 2: physical industrial process.
Speaker 1: And the source mentions this was used in the Ukraine conflict.
Speaker 2: Yes, it explicitly states that maud Disclin was used often
Speaker 2: to disrupt Russian industrial systems during the Ukraine Russia War.
Speaker 2: It's presented as a real world example of how knowledge
Speaker 2: of these protocols and vulnerabilities can be applied, in this
Speaker 2: case for cyber warfare or activism.
Speaker 1: Powerful implications. Okay, Last, major area radio frequency hacking with SDR.
Speaker 2: SDR software defined radio. This is another fascinating frontier. So
Speaker 2: many things communicate wirelessly using radio frequencies RF, Wi Fi, Bluetooth, yes,
Speaker 2: but also car keyfobs, garage door openers, drones, baby monitors,
Speaker 2: weather stations, aircraft communications, GPS, satellite signals, cellular.
Speaker 1: Network Mayer's full of signals completely.
Speaker 2: And many of these RF applications, especially older or cheaper ones,
Speaker 2: weren't designed with strong security in mind. This opens them
Speaker 2: up to sniffing, eavesdropping, replay attacks, recording a signal and
Speaker 2: playing it back later like opening a garage door, signal
Speaker 2: deception or spoofing, sending fake signals, and jamming or denial
Speaker 2: of service.
Speaker 1: What does SDR let you do?
Speaker 2: Traditionally, working with different radio figurals required different specialized hardware radios.
Speaker 2: SDR replaces much of that dedicated hardware with software running
Speaker 2: on a computer. You use relatively inexpensive SDR hardware that
Speaker 2: just handles the raw radio reception and sometimes transmission, and
Speaker 2: the computer software does all the demodulation, filtering, and processing
Speaker 2: for different types of signals.
Speaker 1: So one piece of hardware can tune into many different.
Speaker 2: Things potentially yes, depending on its frequency range and capabilities.
Speaker 2: The source mentions popular SDR hardware, the super cheap rtl
Speaker 2: SDR dongles receive only great for beginners, the hack RF
Speaker 2: one transmit and receive mid range, and higher end options
Speaker 2: like blader F or Lime SDR.
Speaker 1: Can you give a simple example.
Speaker 2: Sure, you can get an RTLSDR for maybe thirty dollars,
Speaker 2: plug it into your computer's USB port, install software like
Speaker 2: SDR sharp SDR sharp on Windows or g corex on Linux,
Speaker 2: attached an antenna, and you can immediately tune into broadcast
Speaker 2: FM radio stations just like a regular radio, but seeing
Speaker 2: the signal visually on a waterfall display.
Speaker 1: Okay, cool, but what about more interesting signals?
Speaker 2: The source shows intercepting aircraft communication, air traffic control, and
Speaker 2: pilot communications are typically unencrypted AM signals in the VHF airband.
Speaker 2: With an SDR and the right software, you can listen
Speaker 2: in YEP. Also, aircraft constantly broadcast their position, altitude, speed,
Speaker 2: and flight number using a system called ADSB Automatic Dependent
Speaker 2: Surveillance Broadcast. This is also unencrypted. Tools like dump ten
Speaker 2: ninety used with an SDR can capture these ADSB signals,
Speaker 2: decode them, and even plot the planes on a map
Speaker 2: like Google Maps in real time. You can build your
Speaker 2: own personal flock.
Speaker 1: That's amazing. What about the GPS spoofing example.
Speaker 2: Ah GPS spoofing. This requires an SDR that can transmit
Speaker 2: like the hack or f one. GPS signals from satellites
Speaker 2: are actually very weak and unencrypted. Specialized software like GPSSDR
Speaker 2: sim can generate a simulated GPS signal data file for
Speaker 2: any location on.
Speaker 1: Earth, so you can create a fake signal for say
Speaker 1: Moscow exactly.
Speaker 2: You generate the data file for coordinates in Moscow, then
Speaker 2: you use software like hack transfer to transmit that simulated
Speaker 2: signal using your hack RF. Any GPS receivers nearby, like smartphones,
Speaker 2: might lock onto your stronger fake signal instead of the
Speaker 2: real satellite signal.
Speaker 1: And think they're in Moscow and.
Speaker 2: Think they're physically located in the Kremlin or wherever you chose.
Speaker 2: The source smashins potential applications like hiding shroop movements or
Speaker 2: spoofing the locations of assets like oligarch yachts during conflicts.
Speaker 2: It's a powerful demonstration of manipulating radio frequencies that underpin
Speaker 2: critical systems.
Speaker 1: Wow, we have really covered an enormous amount of ground today,
Speaker 1: from the absolute basics of IPS and TCP, through firewalls,
Speaker 1: Wi Fi hacks, all the way to cars, industrial systems,
Speaker 1: and now spoofing GPS with radio waves.
Speaker 2: It's a huge landscape, isn't it. But understanding these pieces,
Speaker 2: even at a high level, gives you such a different
Speaker 2: perspective on the technology we use every single day.
Speaker 1: Absolutely, and it really drives home that this knowledge isn't
Speaker 1: just for hackers in the stereotypical sense. It's for anyone
Speaker 1: curious about how this interconnected world actually works for you
Speaker 1: listening now, Understanding this stuff helps you navigate it all
Speaker 1: more effectively, more securely. It sheds light on the how
Speaker 1: and why.
Speaker 2: You become a much more informed user, developer, or defender
Speaker 2: of these systems. You can ask better questions, spot potential issues,
Speaker 2: and appreciate the complexity involved.
Speaker 1: Definitely. So to wrap up, let's leave our listeners with
Speaker 1: a thought to chew on the source network basics for
Speaker 1: hackers offers some cyber warrior wisdom. At the end, it
Speaker 1: says knowledge is most valuable when understood and applied. Every adversary,
Speaker 1: no matter how how strong and powerful, always has a weakness.
Speaker 1: Find the weakness and exploit it.
Speaker 2: That's a powerful quote, it is, and.
Speaker 1: While it's framed in hacking terms, think about how that
Speaker 1: applies more broadly, not just to digital security, but to
Speaker 1: understanding any complex system you encounter, any challenge you face,
Speaker 1: maybe even any opportunity you want to pursue in your
Speaker 1: own life. Where's the underlying structure, Where's the potential leverage point?
Speaker 1: Something to think about.