Hackers & Cyber Attacks: Crash Course Computer Science #32

0:03 Hi, I’m Carrie Anne, and welcome to CrashCourse Computer Science!

0:05 Last episode, we talked about the basics of computer security,

0:09 principles and techniques used to keep computer systems safe and sound.

0:12 But, despite our best efforts,

0:13 the news is full of stories of individuals, companies

0:15 and governments getting cyberattacked by hackers,

0:18 people who, with their technical knowledge,

0:20 break into computer systems.

0:21 Not all hackers are bad though.

0:23 There are hackers who hunt for bugs and try

0:25 to close security holes in software to make

0:27 systems safer and more resilient.

0:28 They’re often hired by companies and

0:31 governments to perform security evaluations.

0:33 These hackers are called White Hats, they’re the good guys.

0:35 On the flip side, there are Black Hats,

0:38 malicious hackers with intentions to steal, exploit

0:40 and sell computer vulnerabilities and data.

0:42 Hackers’ motivations also differ wildly.

0:45 Some hack for amusement and curiosity,

0:47 while cybercriminals hack most often for monetary

0:49 gain.

0:50 And then there are hacktivists,

0:51 who use their skills to promote a social or political goal.

0:53 And that’s just the tip of the iceberg.

0:55 Basically,

0:55 the stereotypical view of a hacker as some unpopular kid sitting in a dark room

0:59 full of discarded pizza boxes probably better describes

1:02 John Green in college than it does hackers.

1:05 Today, we’re not going to teach you how to be a hacker.

1:07 Instead,

1:07 we’ll discuss some classic examples of how hackers break into computer systems

1:11 to give you an idea of how it’s done.

1:13 INTRO The most common way hackers get into

1:24 computer systems isn’t by hacking at all;

1:26 it’s by tricking users into letting them in.

1:28 This is called social engineering,

1:30 where a person is manipulated into divulging confidential

1:33 information,

1:33 or configuring a computer system so that it permits entry by attackers.

1:38 The most common type of attack is phishing,

1:40 which you most often encounter as an email

1:42 asking you to login to an account on a website, say your bank.

1:45 You’ll be asked to click a link in the email,

1:47 which takes you to a site that looks legit

1:49 to the casual observer, but is really an evil clone.

1:52 When you enter your username and password,

1:54 that information goes straight to the hackers,

1:56 who then can login to the real website as you.

1:59 Bad news!

2:00 Even with a 1/10th of one percent success rate,

2:02 a million phishing emails might yield

2:04 a thousand compromised accounts.

2:06 Another social engineering attack is pretexting,

2:08 where attackers call up, let's say a company,

2:11 and then confidently pretend to be from their IT department.

2:14 Often attackers will call a first number,

2:16 and then ask to be transferred to a second,

2:18 so that the phone number appears to be internal to the company.

2:20 Then, the attacker can instruct an unwitting user

2:23 to configure their computer in a compromising

2:25 way, or get them to reveal confidential details,

2:27 like passwords or network configurations.

2:29 Sorry, one sec… Oh.

2:32 Hey, it's Susan from It.

2:33 We’re having some network issues down here,

2:35 can you go ahead and check a setting for me?”...

2:39 and it begins.

2:40 Attackers can be very convincing,

2:41 especially with a little bit of research beforehand to

2:44 find things like key employees’ names.

2:46 It might take ten phone calls to find an victim,

2:48 but you only need one to get in.

2:50 Emails are also a common delivery mechanism for trojan horses,

2:53 programs that masquerade as harmless attachments, like a photo or invoice,

2:57 but actually contain malicious software, called malware.

3:00 Malware can take many forms.

3:02 Some might steal your data, like your banking credentials.

3:05 Others might encrypt your files and demand a ransom, what's known as ransomware.

3:08 If they can’t run malware or get a user to let them in,

3:11 attackers have to force their

3:12 way in through other means.

3:14 One method, which we briefly discussed last episode,

3:16 is to brute force a password, try

3:19 every combination of password until you gain entry.

3:22 Most modern systems defend against this type

3:24 of attack by having you wait incrementally

3:26 longer periods of time following each failed attempt,

3:28 or even lock you out entirely after

3:31 a certain number of tries.

3:32 One recent hack to get around this is called NAND Mirroring,

3:34 where if you have physical

3:36 access to the computer,

3:37 you can attach wires to the device's memory chip and make a perfect

3:40 copy of its contents.

3:41 With this setup, you can try a series of passwords,

3:44 until the device starts making you wait.

3:46 When this happens,

3:47 you just reflash the memory with the original copy you made, essentially

3:50 resetting it, allowing you to try more passwords immediately, with no waiting.

3:55 This technique was shown to be successful on an iPhone 5C,

3:58 but many newer devices include

3:59 mechanisms to thwart this type of attack.

4:01 If you don’t have physical access to a device,

4:04 you have to find a way to hack it remotely,

4:06 like over the internet.

4:07 In general,

4:08 this requires an attacker to find and take advantage of a bug in a system, and

4:12 successfully utilizing a bug to gain capabilities

4:14 or access is called an exploit.

4:16 One common type of exploit is a buffer overflow.

4:19 Buffers are a general term for a block of memory reserved for storing data.

4:23 We talked about video buffers for storing pixel data in Episode 23.

4:27 As a simple example,

4:28 we can imagine an operating system’s login prompt, which has fields

4:31 for a username and password.

4:33 Behind the scenes,

4:34 this operating system uses buffers for storing the text values that are entered.

4:38 For illustration, let's say these buffers were specified to be of size ten.

4:42 In memory, the two text buffers would look something like this:

4:45 Of course,

4:45 the operating system is keeping track of a lot more than just a username and

4:48 password, so there’s going to be data stored both before and after in memory.

4:52 When a user enters a username and password,

4:55 the values are copied into the buffers, where

4:57 they can be verified.

4:58 A buffer overflow attack does exactly what the name suggests:

5:01 overflows the buffer.

5:02 In this case,

5:03 any password longer than ten characters will overwrite adjacent data in

5:07 memory.

5:08 Sometimes this will just cause a program or operating system to crash,

5:11 because important values are overwritten with gobbledygook.

5:14 Crashing a system is bad,

5:15 and maybe that’s all that a mischievous hacker wants to do,

5:18 be a nuisance.

5:19 But attackers can also exploit this bug

5:21 more cleverly by injecting purposeful new values

5:24 into a program’s memory, for example, setting an “is admin” variable to true.

5:29 With the ability to arbitrarily manipulate a program’s memory,

5:32 hackers can bypass things

5:33 like login prompts,

5:34 and sometimes even use that program to hijack the whole system.

5:37 There are many methods to combat buffer overflow attacks.

5:41 The easiest is to always test the length

5:42 of input before copying it into a buffer,

5:44 called bounds checking.

5:46 Many modern programming languages implement bounds checking automatically.

5:49 Programs can also randomize the memory location of variables,

5:53 like our hypothetical “is

5:54 admin” flag,

5:55 so that hackers don’t know what memory location to overwrite, and are

5:59 more likely to crash the program than gain access.

6:01 Programs can also leave unused space after buffers,

6:03 and keep an eye on those values to

6:05 see if they change; if they do,

6:07 they know an attacker is monkeying around with memory.

6:10 These regions are called canaries,

6:11 named after the small birds miners used to take underground

6:14 to warn them of dangerous conditions.

6:16 Another classic hack is code injection.

6:19 It’s most commonly used to attack websites that use databases,

6:22 which pretty much all

6:23 big websites do.

6:24 We won’t be covering databases in this series,

6:26 so here’s a simple example to illustrate

6:28 this type of attack.

6:29 We’ll use Structured Query Language, S-Q-L,

6:32 also called sequel, a popular database API.

6:35 Let’s imagine our login prompt is now running on a webpage.

6:38 When a user clicks “login”,

6:40 the text values are sent to a server, which executes code

6:43 that checks if that username exists,

6:45 and if it does, verifies the password matches.

6:47 To do this, the server will execute code,

6:50 known as a SQL query, that looks something

6:52 like this.

6:53 First, it needs to specify what data we’re retrieving from the database.

6:56 In this case, we want to fetch the password.

6:59 The server also needs to specify from what

7:01 place in the database to retrieve the value

7:03 from.

7:03 In this case,

7:04 let’s imagine all the users’ data is stored in a data structure called

7:07 a table labeled “users”.

7:09 Finally,

7:09 the server doesn’t want to get back a giant list of passwords for every user

7:13 in the database,

7:14 so it specifies that it only wants data for the account whose username

7:17 equals a certain value.

7:19 That value is copied into the SQL query by the server,

7:22 based on what the user typed in,

7:24 so the actual command that’s sent to the

7:26 SQL database would look something like this,

7:27 where username equals philbin.

7:29 Note also that SQL commands end with a semicolon.

7:32 So how does someone hack this?

7:34 By sending in a malicious username, with embedded SQL commands!

7:38 Like, we could send the server this funky username:

7:40 When the server copies this text into the SQL Query,

7:43 it ends up looking like this:

7:44 As I mentioned before,

7:46 semicolons are used to separate commands, so the first command

7:49 that gets executed is this: If there is a user named ‘whatever’, the

7:53 database will return the password.

7:55 Of course, we have no idea what ‘whatever’s’ password is,

7:57 so we’ll get it wrong and the

7:59 server will reject us.

8:00 If there’s no user named ‘whatever’,

8:02 the database will return no password or provide

8:04 an error, and the server will again reject us.

8:07 Either way, we don’t care,

8:09 because it’s the next SQL command we’re interested in:

8:11 “drop table users”– a command that we

8:14 injected by manipulating the username field.

8:16 This command instructs the SQL database to

8:18 delete the table containing all user data.

8:21 Wiped clean!

8:22 Which would cause a lot of headaches at a place like a bank...

8:24 or really anywhere.

8:25 And notice that we didn’t even break into the system– it’s not like we correctly

8:28 guessed a username and password.

8:30 Even with no formal access, we were able to create mayhem by exploiting a bug.

8:34 This is a very simple example of code injection,

8:37 which almost all servers today have defenses

8:39 against.

8:39 With more sophisticated attacks,

8:40 it’s possible to add records to the database– like a

8:43 new administrator account– or even get the database to reveal data,

8:47 allowing hackers to steal things like credit card numbers,

8:50 social security numbers and all sorts of nefarious

8:52 goodies.

8:53 But we’re not going to teach you how to do that.

8:55 As with buffer overflows,

8:56 programmers should always assume input coming from the outside

8:59 to be potentially dangerous, and examine it carefully.

9:02 Most username and password forms on the web

9:04 don’t let you include special symbols like

9:06 semicolons or quotes as a first level of defense.

9:09 Good servers also sanitize input by removing

9:12 or modifying special characters before running

9:14 database queries.

9:15 Working exploits are often sold or shared online.

9:17 The more prevalent the bug, or the more damaging the exploit,

9:20 the higher the price or prestige

9:22 it commands.

9:23 Even governments sometimes buy exploits,

9:25 which allow them to compromise computers for purposes

9:28 like spying.

9:29 When a new exploitable bug is discovered

9:30 that the software creators weren’t aware of,

9:32 it’s called a zero day vulnerability.

9:35 Black Hat Hackers rush to use the exploit

9:37 for maximum benefit before white hat programmers

9:39 release a patch for the bug.

9:41 This is why it’s so important to keep your computer’s software up to date;

9:44 a lot of those downloads are security patches.

9:47 If bugs are left open on enough systems,

9:48 it allows hackers to write a program that jump

9:51 from computer to computer automatically which are called worms.

9:54 If a hacker can take over a large number of computers,

9:56 they can be used together, to form

9:58 what’s called a botnet.

10:00 This can have many purposes,

10:01 like sending huge volumes of spam, mining bitcoins using

10:04 other people's computing power and electricity,

10:06 and launching Distributed Denial of Service

10:09 or DDoS attacks against servers.

10:11 DDoS is where all the computers in the botnet send a flood of dummy messages.

10:15 This can knock services offline,

10:16 either to force owners to pay a ransom or just to be

10:19 evil.

10:20 Despite all of the hard working white hats,

10:22 exploits documented online, and software engineering

10:24 best practices, cyberattacks happen on a daily basis.

10:28 They cost the global economy roughly half a trillion dollars annually,

10:31 and that figure

10:32 will only increase as we become more reliant on computing systems.

10:35 This is especially worrying to governments,

10:38 as infrastructure is increasingly computer-driven,

10:40 like powerplants, the electrical grid,

10:42 traffic lights, water treatment plants, oil refineries,

10:44 air traffic control, and lots of other key systems.

10:48 Many experts predict that the next major war will be fought in cyberspace,

10:51 where nations are brought to their knees not by physical attack,

10:54 but rather crippled economically and

10:56 infrastructurally through cyberwarfare.

10:58 There may not be any bullets fired,

11:00 but the potential for lives lost is still very high...

11:03 maybe even higher than conventional warfare.

11:05 So, we should all adopt good cybersecurity practices.

11:08 And, as a community interconnected over the internet,

11:10 we should ensure our computers are

11:12 secured against those who wish to use their great potential for harm.

11:16 So maybe stop ignoring that update notification?

11:19 I’ll see you next week.