[ Anastasia Tikhonova ] There are many criminal hacker groups,
and they like to show off their wares
They also post bits of their files to brag that they really did it
This is the group's victory board
They're awaiting responses from the companies they hacked
There's a download link, saying: here's 100 GB, please click
Same for every organisation!
There are the Mexican government,
and also some health care institutions
The data's given a status: posted for sale, or free to download,
or the hacked company's decision is pending
There's ongoing correspondence with the hacked organisation
and a ransom's being negotiated
But they often fail to agree and the data,100 GB and more,
will be available for free download
If the organisation pays, it disappears from the list
All the data posted earlier vanishes
Hackers cover themselves as best they can,
so their sites' locations aren't easily found by Google, etc.
They're on the TOR network, a safer hacker haven
All this is illegal: compromising someone and getting your hands on their data...
Downloading this data is also illegal
ONE OF THE BEST-KNOWN ENCRYPTERS IS WANNACRY, RANSOMWARE THAT ATTACKED MILLIONS OF USERS IN MORE THAN 100 COUNTRIES, 2017-2018
WANNACRY ACCOUNTS FOR 35% OF CYBER ATTACKS ON INDUSTRIAL COMPANIES WORLDWIDE
IN 2019, IT RANKED FIRST AMONG ALL RANSOMWARE TYPES
[ Rustem Khairetdinov, director of development, BI.Zone ] Encrypters have a long history,
but it was the first time
they exploited a vulnerability without a human being involved
You won't get an email, or any link
Done and dusted! You've been encrypted. That was a shock for many
[ Hadi Hosn, CEO, Axon Technologies ] WannaCry – what happened was…
That specific vulnerability was exploited.
When you exploit the vulnerability, it means you create code
that is able to use that vulnerability to take control of the machine.
And the attacker that carried out that exploit,
put ransomware with that ‘WannaCry’.
So they released that into the web,
and they were scanning for all of those systems that had the old Windows version.
And when they found that systems they were just encrypted with that ransomware.
We ended up with, for example, the national health service in the UK, the NHS,
was completely wiped out from the ransomware attack.
If you are coming into a clinic, because you had a test or you had an operation,
they can’t find your records.
The systems were down, nobody was able to
do any sort of technology related activity –
they had to go back to pen and paper.
And that happened for a number of days.
The disruption and the cost from the WannaCry attack
went into the billions globally.
And there were so many different devices that were affected by this.
And it started to make people a bit more aware of a distractive nature of an attack.
[ Maher Yamut, lead analyst, Kaspersky global research and analysis group ] The thing is –
to detect all these complicated things you need complicated systems –
and that costs a lot of money, research costs a lot of money.
Therefore, you’d see like everyone is trying to adapt this,
everyone is trying to catch malware and different part
of technics used by different malwares and so on.
Technology is very big industry,
and there is a lot of opportunities for hackers.
[ Sergey Petrenko, head, information security center, Innopolis University ] 100% protection isn't guaranteed.
Every day, there are hundreds of thousands of incidents!
20% result in a loss
[ Khairetdinov ] Sber says the Russian economy's
annual losses from cyberattacks
could reach $48 billion
According to World Economic Forum reports,
the world will lose up to $6 trillion annually
and cumulative losses will exceed $90 trillion by 2030,
which is comparable to the GDP of many nations
The fact that cybercrime is a real threat is globally understood,
with counteraction departments being established
and experts being recruited from the market
[ Dmitry Gadar ] Information security's here.
Tracking down attacks enables us to react quickly
Our goal is to make hackers' efforts economically ineffective
If the cost of an attack exceeds potential benefits and profit,
hackers are highly unlikely to launch it
I think, since 2008 it's been mainly money that's driven the majority of criminals
[ Svetlana Ostrovskaya ] And here we are to the next part
which is about people who are trying to protect us.
So, step one: ‘Monitor’.
Actually, we have lots of different monitoring systems.
So there have to be people
who need to work with these systems and all of the logs
provided by these systems, and to analyze them.
Here we have, actually, the second step, which is ‘Response’.
We all are security specialists in one company.
First of all, we need to collect the full information about the infected hosts.
And here we need to perform some analyses
to get the list of infected hosts.
But we also need to think about lessons we could learn from here –
because we need also to do some actions to prevent
this situation from repeating, right? Our next step…
[ Man ] Like access the computer, see if there are some actions, suspicious or….
[ Ostrovskaya ] Exactly!
And this is, actually, digital forensics.
We have post-mortem analyses, and we are trying to find some evidences,
that something was done on this specific host.
And also a very important part of digital forensics
is to prepare the documentation of acquisition.
Let’s assume here,
there is a program, and we checked that hash, we checked everything, -
this is something unknown.
What we can do with this program?
[ Man ] To reverse it? [ Ostrovskaya ] Yeah! We can reverse it, right?
[ Ostrovskaya ] Reverse engineers trying to analyze functionality,
trying to find out the coming InControl service, they are
trying to analyze different scripts, everything,
everything, how actually for incident response,
how for digital forensics… Ok, and last step.
What if we found out that we collected all the evidences,
we created the full picture of incident -
and we probably know some IP-addresses or domain names,
or something about ‘digital personality’ of people who actually performed this attack.
What we can do? We need to find the people.
And here we go to ‘Investigation’.
[ Aleksandr Simonyan, digital forensics expert, group-IB ] What we see in films is close to reality
Special forces appear, followed by operatives, then us
We're often used for investigations as purely technical experts,
to advise, consult, and seize equipment properly
It's vital! Hard drives may have information helpful for the investigation
It could be correspondence, browser history,
or use of various applications to bypass blocking, and so on
Any crime leaves a digital footprint
Our main goal is finding those footprints
and making them legally relevant,
so they can be used as evidence
[ Simonyan ] We have a hard drive to examine. The criminal deleted everything,
but we restored most of the data pertinent to the investigation
The criminal was a major botnet administrator
We examined the drive
and revealed the presence of malware for infecting computers,
remote access to data and so on
That digital evidence was on the drive and we'll use it in the investigation
[ Aleksandr Kalinin, head, it emergency response team, group-IB ] You're in a 24/7 security operations center,
dealing with various threats,
from the spread of malware, and phishing attacks, to fraud
It's connected with other centers, both inside the company,
and in Europe and Asia, and to similar groups in other companies and states
We ask each other for additional information and help
What's all this global cooperation for?
Because there's hardly ever a cyberspace incident that's localised to one country
A name you clicked on in a browser might be registered in one country,
and the domain in another
The criminal might be from a 3rd!
There can be a huge amount of such evidence
The internet has no borders or states
This should also be so for dealing with computer incidents
Otherwise, it's just a letter exchange between different nations' police
[ Khairetdinov ] The villain's not here, but...
He didn't break the law in the country you're dealing with!
Why arrest him there? It's another problem we struggle with
The major cybersecurity challenge is the sovereignty of laws
But cyberspace has no borders, no sovereignty
[ Khairetdinov ] The current procedure is:
the police turn to Interpol, and it contacts the police of the country,
where, according to us, the hacker can be found
Then the police should do something. But they have no incentive to act
No crime on their territory... So no medals for them!
[ Khairetdinov ] Possibly those in, say, India, who have attacked a Russian bank,
may have carried out another attack targeting India
This might inspire them to open investigations
They start to put people under surveillance, which may get results
[ Hacker, 2014-2019 ] As they say, if you work on RU, they'll come after you
Frankly, you don't mess up your own backyard
Usually, those guys work from within, but work's overstating it, they play around
Guys who just got into IT and information security,
they're schoolkids, 1st or 2nd year students
They dip their toes in it, not because they want to sell something
They do it out of interest. How everyone started!
By hacking the neighbors’ Wi-Fi, when mum switched off the internet
I mean, you have to play! What to do? You have an itch!
It's cool, really awesome, when a desire to take that path starts when you're young
That's amazing!
[ Svetlana Ostrovskaya, digital forensics coach, group-IB ] There are many movies
about hackers, and all this stuff
There's still some romance about it
People who study, who choose such careers, are usually motivated,
because they realise it enables them to help others, to provide some protection
It's great they see right away practical uses for their skills
[ Ivan Botanov, penetration tester ] Certainly, too much romanticising!
This is sentiment of a particular kind
I don't call myself a hacker!
I think of a hacker as a person engaged in illegal activities
I call myself, well, a pentester! I don't break the law.
On the contrary, I help make the internet a better place
[ Ostrovskaya ] Experience is vital in cybercrime fighting
You need to know how to use tools...
many practical things, how attacks are carried out
Books on security aren't enough!
4 or 5 years ago a program called Secure Systems and Network Engineering appeared
It trains security professionals from a practical standpoint
There's much lab work
You try to do it all, find a way to defend yourself, to play attack-defence,
study the various technologies used. It's amazing
[ Khairetdinov ] There are specific techniques, many and various,
to explore system protection and the ability to withstand attacks
There are so called pentests, which is short for penetration test
In these exercises, people pretend to be hackers
Hacking's simulated at various levels
First, with no system knowledge
Second, the hackers have inside knowledge and know how defence works
They are given different tasks respectively,
and based on different input data, pentesters try to hack the system
[ Botanov ] How easy or hard is it to be a pentester?
To progress, you need to understand code written in PHP
But how hard is it? Who knows? It depends on your skills
[ Hacker ] Authorised guys from InfoSec have two teams:
Red and Blue. Red attacks, Blue defends
It's about how you develop: either in offence or defence
These are actually different directions, no matter how absurd that sounds
A defender can't necessarily attack, and vice versa
[ Khairetdinov ] Training, for example,
might involve a team simulating an unspecified attack,
with a target but an undisclosed launch time
[ Anastasia Tikhonova, head, complex threat monitoring department, group-IB ] Regards the difference between white and black hats,
they're both eager to find vulnerabilities
It's just that some want to help a company,
while others want to cause damage!
[ Hacker ] Everyone who deals with information security starts romanticising
They start with stories they've read on the internet
Something like, all hackers have a black terminal with green letters
When you become obsessed with the romance, you start to realise
that it's just not that easy!
Because anyone who joins InfoSec needs to understand what they want out of it
If they want to be a regular employee,
who deals with pentesting, which is legal
All that stuff's been whitewashed
But those inspired by exciting tales of drugs, drink, a Rock'n'Roll lifestyle,
and feeling invincible,
usually aren't happy because all this stuff is killing them!
I'm no saint myself, I've done stuff!
It did no good, actually
Because now you have to whitewash the work, basically whitewash your karma
Problems get in the way, the consequences of that lifestyle...
You wonder why you needed all that
[ Botanov ] There's an internet resource called HackTheBox
It's a laboratory for pentesters...
for ethical hackers
There are 100k users, with about 1,000 online at any one time
1,000s of pentesters worldwide
There are some internet servers that are used for hacking practice
Whether it's servers, such as FB's or training servers,
software practice is more or less the same
They use the same protocols, ports, etc.
Such platforms enable white hackers - pentesters, to look for holes,
and to stop black hackers from hacking and destroying infrastructure in some way,
stealing users' data and so on
There are job offers for pentesters of hacker level and higher
There's a chance of being offered a job based on your HackTheBox record of hacks
If you're an absolute beginner
and don't know where to poke around,
HackTheBox's academy teaches you for free
And then in HackTheBox, you'll participate in CTFs and so on
That's how to get into pentesting and hacking
Which path to choose is up to you
A pentester's skills can most probably open the doors to cybercrime
I think you can say so
It depends on your ethics, your upbringing, and why you need that
[ Hacker ] Let me put it this way: knowing how to launch a script
won't make a hacker out of you
It may sound absurd, but most legit pentesters just activate the scanner
and wait for reports on vulnerabilities
No offence, but what does that give you? A program did the job for you!
That's all well and good regarding industrial activities...
but in terms of hacking, I can't call them real hackers
[ Botanov ] True hackers, those involved in cybercrime,
customise various parts of Linux
They take all they need to customise their assembly
For legit pentesters
there are open source versions like Kali Linux and Parrot OS
There are others, but they're the most popular
A pentester uses them to find a vulnerability,
share that with the company and get rewarded
A hacker is after a vulnerability to exploit,
and then carry out illegal activities with it
[ Gadar ] Data security is developing. Business is beginning to understand
what they need the security for
It's great that business
is asking specifically for an information security service
It helps information security develop
Actually, there are huge staff shortages
[ Hacker ] As for legit InfoSec, and pentesting,
you contact companies and hawk your services
You say, 'We'll overhaul your system to prevent outsiders accessing it'
Generally, it's cool. You make money for nothing, actually
Notionally, you can have a good, solid team
But I don't know how long such hacker sentiments could last
[ Gadar ] By the way, it's important to note that
the psychology of information security is different
It's contrary to that of a hacker or an attacker
What's a hacker? First, an explorer...
But those who explore information systems differ from those protecting them,
because it's enough for them to explore a system, find a hole and penetrate it
In security, there's an unknown number of variables,
a great number of holes on the internet, exploits appear and so on,
and you need to prioritise risks properly.
[ Gadar ] Hiring hackers is risky
A hacker's someone who's already on the dark side
Who knows what he'll do, if he finds a breach in an organisation
If he's broken the law, he's likely to do it again,
especially when teased by information security breaches
[ Khairetdinov ] Better not hire someone who's been on the dark side!
Not necessarily a black mark, but best not use them, just in case
Once a hacker...
always a hacker!
[ Hacker ] A hacker is what exactly?
Being a hacker means having freedom, and a free hand to dig around, plus a desire...
to, well, destroy the system!
In today's reality, there's really no such thing as a hacker
Everyone says they've died out
So, they're all information security specialists,
as we usually term them
There aren't many researchers left,
those interested in the hackers' philosophy and the romance of it
Many cross the line and become tougher, more wicked
Others become whiter
This actually depends on the personality and their situation
Most do it for the money
But there are those who work for fun
It's just an attitude that professionals should stick to
No matter whether it's IT or not,
you're a pro, investing time in it and that's the most valuable resource
You do it just to be able to say: 'Guys, look! I did it!'
There are definitely those kinds of people
They get very excited when they manage to mess with the system
That's cool... really cool!
But you must rise to that. A year or two of hard work won't cut it.
It's a very difficult path
Not everything's as romantic, nice and lovely
as people think... that hackers are filthy rich
Yes, there are millionaires,
but earning your first million requires a huge effort,
lots of hardware and so on
ELLIOTT GUNTON (GLUBZ) DAMAGE: STOLE ETHERDELTA
CRYPTOCURRENCY EXCHANGE USERS’ DATA AND FUNDS
SENTENCED TO IMPRISONMENT IN THE UK
AARON SWARTZ DAMAGE: THEFT AND NETWORK DISTRIBUTION OF CLASSIFIED FILES
CONVICTED FOR CYBERCRIMES, FOUND HANGED AT HOME
SCORPO (VLADIMIR DRINKMAN) DAMAGE: $312 MLN
SENTENCED TO 12 YEARS IMPRISONMENT IN 2018 BY US COURT
SUMMER 2021: UNKNOWN HACKER STOLE $611 MILLION FROM POLY NETWORK CRYPTOCURRENCY PROJECT
THE ATTACK IS THE BIGGEST CYBERTHEFT IN HISTORY
SOME TIME LATER, MOST OF THE MONEY WAS ANONYMOUSLY RETURNED TO THE PLATFORM’S USERS