Hack Like a Pro: How to Hack Like the NSA (Using Quantum Insert) « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Over the years, I have written many articles here on Null Byte chronicling the many the hacks of the NSA, includingthe recent hack of the Juniper Networks VPN. (By the way, my speculation in that article has proven to be correct. The NSAdidembed a backdoor on those devices.)Many readers here have expressed surprise, condemnation, and a bit of admiration at the capabilities and tools of the NSA. Much of that is undeserved. The NSA has legal authority to tap resources that none of us do (such as the ISPs and backdoors) as well as supercomputers and other powerful devices that assist them in their hacks. Sometimes, though, the NSA does something innovative and creative. It is one those hacks that I would detail here.A few years back, specifically 2013, the NSA and GCHQ (Britain's equivalent agency to the NSA) implemented a hack that came to be known as the "Quantum Insert." It was used against officials of OPEC and Belgacom (Belgium's telecom service), and is a variation on classicMitM attacksbut with a bit of a twist.Let's take a moment to break it down here and see if we could do the same.Step 1: Monitor/Recon the TargetThe first step in the Quantum Insert attack is tomonitor/reconthe target. The NSA has access to the ISPs and can see all the traffic from the target. From a non-NSA hacker, this would likely require being inside the local area network.For instance, if we are inside the target's LAN we may be able to sniff on the target's network. If we can do that, we can use sniffers such asTcpdumporWiresharkand filter by the target's IP address. We could automate this process by puttingSnorton the LAN and write a rule to see and alert traffic from the target's IP address. In this way, we could develop a pattern of the target's web browsing activity.Step 2: Predict the Target's Browsing HabitsAs we watch the target, we can see the target's browsing habits. In this way, we can predict what websites that the target is likely to go to each day. In the case of this hack by the NSA, they observed regular traffic to LinkedIn and Slashdot. Based upon what the attacker reconned, they can begin to develop a appropriate hacking strategy.Step 3: Build a Fake Web Server Near the TargetNow that the attacker know what websites the target is likely to visit, they can plan the attack. The key is to "insert" an HTTP reply from our fake website when the target requests the website with a HTTP request.If we can beat the legitimate website's reply, the target will get the bogus website. This is often referred to as a "race condition." If the attacker's fake HTTP reply arrives at the target before the legitimate reply—if only by a millisecond—the attacker will have won the race and the legitimate reply will be discarded when it arrives. Although the attacker may not win the "race condition" every time, they only need to win once.Of course, we need a web server and an exact replica of the legitimate website. We can useApacheas our web server andHTTrackto download an exact copy of the website. The closer the proximity of the attacker's web server is to the target, the faster the HTTP reply will arrive at the target.Although the NSA used this race condition, we could also useDnsspoofto redirect the target's request to our website, if we are on the local network. The problem with this approach is that avigilant security adminis likely to see the Dnsspoof packets and the rogue web server on the LAN—but not every security admin is vigilant.When the bogus webpage arrives, it contains thepayload/rootkitthat is inserted into the target's system. As we know, there are numerousAdobe Flashvulnerabilities we can take advantage of as well as almost innumerable browser vulnerabilities. We would have to determine which exploit to use based upon our recon/monitoring in Step #1. For instance, if we determine that the target is using a Firefox browser, we would find a Firefox exploit and embed it in the webpage they request.Step 4: Own the System!Now that the NSA/attacker has been able to send the malicious webpage to the target, the rootkit is embedded into the target's system and the attacker now own's the target's system!Thanks to WikiLeaks and Edward Snowden for the diagrams. Sometimes we can learn by observing other hackers successful exploits and the NSA is no different.Keep coming back, my greenhorn hackers, as we develop the most valuable skill set of the 21st century—hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedNews:The Hacking of Blackhat, the MovieHow To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)News:What REALLY Happened with the Juniper Networks Hack?How To:What to Do if You Accidentally Liked a Photo on InstagramHow To:Draw VegetaNews:Firefox Mobile Just Got Faster — New Browser Engine Brings Quantum's Speed to AndroidHow To:Walkthrough the James Bond video game Quantum of Solace for PlayStation 3Instagram 101:How to Share Photos to Instagram Stories Past 24 HoursNews:What to Expect from Null Byte in 2015News:What the Heck Was Stuxnet!?How To:9 Oreo Hacks That Make Life Worth LivingNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHow To:Hide All of the Social Numbers on Your Facebook Page with the DemetricatorNews:The Best Apps for Customized Cover Photos on Your Facebook TimelineNews:Apple Worries They're Being Bugged; Now They're Doing Something About ItHow To:This Quick & Easy Shortcut Minces Garlic in SecondsNews:James Bond - Quantum of SolaceNews:Quantum of Solace meets The Incredibles Trailer MashupHack Like a Pro:Creating Your Own Prism ProgramNews:Laphroaig WhiskyNews:Guess who else likes car cake.Whistleblower:The NSA is Lying–U.S. Government Has Copies of Most of Your EmaNull Byte:Never Let Us DieNews:NSA Axes Printed SCRABBLE News in Favor of Online PDFsNews:Anne Hathaway Is a Scrabble FiendContest:Potassium Nitrate CrystalsNews:Super Easy Piston ElevatorNews:Minecraft Super Compact Block ChangerNews:Online E-Commerce Video Games RetailersNews:Thrifty and Chic - PVC Pipe Mirror FramesNews:Slow Motion Footage of Surfers from Jaws Beach, HawaiiWATCH THIS INSTEAD:Fast FiveWATCH THIS INSTEAD:Water For ElephantsNews:REVIEW - PaulWATCH THIS INSTEAD:No Strings AttachedNews:>> To Start in a Good way =)How To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesNews:Gardening additionsNews:Getting to Know Google's Community Managers