In military theory, they typically divide warfare up into three levels: tactics, operations, and strategy. Each of these levels give you a different perspective into the art of war, making you much more versatile as a practitioner. When it comes to the art of cyber, it’s no different. If you’re trying to learn something like hacking, it’s often easy to focus too heavily on the tactical level, which may be specific commands, tools, and techniques to hack a target. While this might be all you care about at first, you miss out on the bigger picture of why you’re running Kali and trying to pop a box in the first place. Which is why in this video, we’re going to go over the cyber kill chain, operations that happen at each step, and its strategic-level implications for cyber security. The cyber kill chain framework was originally published in a landmark paper, titled, Intelligence-Driven Computer Network Defense, back in 2013 by three Lockheed Martin analysts, Eric Hutchins, Michael Cloppert, and Rohan Amin. Just as how computer networking is described using conceptual layers of the TCP/IP or OSI models, the three analysts took the military kill chain and adapted it to describe the process for offensive security and hacking targets in seven-steps: reconnaissance, weaponization, delivery, exploitation, installation, command & control, and actions on the objective. Modern attackers will automate most of these steps during a hack, but it’s important to start-off by understanding all the components first. So the original idea of a kill-chain was a military concept that describes the structure of a kinetic attack, which involves finding, fixing, tracking, targeting, engaging and assessing stages against an opponent with a prime example being Operation Neptune Spear, which was a kill-or-capture mission of Osama Bin Laden in 2011. Pulling this off required years of hunting, months of mission planning, and less than 40 minutes to actually execute, which included assaulting Bin Laden’s safe house, taking his body, and extracting useful sources of data like hard disks, thumb drives, books, tapes, and other files from the compound. Analyzing all this intel would again, take maybe months or years. The cyber kill chain follows a similar tempo with long periods of reconnaissance and understanding your target, developing and assembling the right toolkits, followed by quick execution of the hack, and then a longer period of post-exploitation activities like escalating privileges, gaining more access, and stealing data. Unlike a kinetic operation with most of the action happening at the execution stage, for cyber, hacking onto a box is pretty anticlimactic with most of the exciting parts occurring after you’ve gained initial access. Can you do it? Yeah, it's done. It's been done this entire time? Yeah, man. Oh, drug dirt, real estate dirt, yacht dirt... So with all that being said, let’s get started with Step 1, reconnaissance. The reconnaissance step involves a considerable amount of planning and researching about a target of interest, whether a person, organization, or facility to map out any vulnerabilities. You’ll use a lot of OSINT, or open-source intelligence, as a passive way to collect data relevant for the hack. For a person, this might be personal identifiers like email addresses or phone numbers, or contextual information like hobbies, interests, and key relationships. Harvesting login credentials from data breach dumps would be fair game too. For a company, you might be more interested in policies, work hours, and organizational patterns-of-life. Dumpster diving, striking up casual conversations, and even social engineering are all ways to obtain intel. For technical data, you’d want to discover digital infrastructure like IP addresses, domain names, subdomains, and third-party services used. Common scanning tools like Nmap or Shodan can enumerate hosts and ports running on server-side infrastructure. Identifying the software that users have installed along with their versions can also help you find client-side avenues of approach to hack into the network. This might include web browsers, media players, or messaging apps like Discord or Slack. For instance if you knew someone used an outdated version of VLC to listen to rock music on his work computer, you’d have a decent amount of information to craft a hack that leverages this vector while watching out for a particular anti-virus or endpoint intrusion detection software that might be installed on the work laptop by this company. And that brings us to the weaponization step of the cyber kill chain, which involves combining exploit code together with a payload to run against a target. One reason this step is called weaponization is that for client-sided attacks, you’ll often need to hide and obfuscate the exploit and payload with a benign file like a PDF or Word document to make it become malicious. Depending on the target, exploiting a piece of software, whether service-side or client-side, can be really difficult to engineer. You might have to bypass traditional memory protection techniques like ASLR or data execution prevention, then escape sandboxes internal to the software, or external ones like Docker containers and virtual machines. You might also need to chain more exploits together to achieve privilege escalation on the local operating system. Some sources of exploits that are more off-the-shell, proof-of-concept ones can be freely found on GitHub or ExploitDB, while others can run in the six to seven-figures for something that’s a reliable, zero-click, full-chain, zero-day for Android or iOS from brokers like Zerodium. Now on the payload side of the house, we’re concerned about what types of code to actually have the victim device run after exploiting a piece of software on it, whether it’s an interactive shell on the simple side to a fully-featured implant like Meterpreter on the complex side. The sophistication of your tool instrumentation is what actually allows you to control and affect the target, whether it’s bricking the device or using it to snoop on phone calls and text messages. Once you have the exploits and payloads ready, the next step of the cyber kill chain is delivery, which involves serving the package through an attack channel. Putting the hard work and due diligence in at the recon stage is going to offer you more ways to serve up the package. The three-primary vectors for delivery will be either client-side, service-side, or supply chain-based. Client-side attacks typically need end-users to interact like inserting a USB stick, clicking a link to a website, or opening a malicious file. Hacking end-user clients has become much more popular because vectors like email or text messages can bypass traditional perimeter security measures like firewalls and are cheaper to pull-off. For example, if you drop a bunch of USB drives in the parking lot of a company, chances are that somebody’s going to find it and plug it in to their computer. If that company didn’t implement removable media restrictions or logging, it’d be near-impossible to detect this delivery mechanism just monitoring the network. With just a bit of participation from the victim, client-side attacks lets you hack directly into end-user devices and steal credentials to abuse trust relationships within a network. Service-side attacks are rarer and more expensive to execute because they’re typically non-interactive and can be fired off directly, whether through the Internet at a web server, via radio frequency at a home wireless router, or at a phone through a WhatsApp call, as demonstrated by the Israeli spytech company, the NSO Group. Supply-chain attacks are another way to distribute implants deeply to a wide range of targets. For instance, in 2018, Bloomberg reported that China was able to compromise thousands of servers located in data centers used by cloud-providers like Amazon AWS, by installing the hardware implants shipped with the motherboards for servers made by Super Micro Computers. This is particularly effective since any company using these cloud-providers running the hardware with the bonus features, can now also be hacked with it being really difficult to know where the attacks originated from. Another delivery method using the supply-chain approach is by compromising software and code repositories, so when developers import libraries from these sources when they’re coding, the programs they compile will then carry the malicious payloads, executed downstream later on for end-users. Whatever the approach, having the right delivery method can be just as important as having the right tooling, and requires good reconnaissance to determine how to get your tools from point A to point B. Step 4, exploitation, involves the actual process of compromising a service or app and executing the payload on a target. On the surface there doesn't seem like much at this step, but in reality, the rabbit hole can get pretty deep. As we mentioned earlier, it might take chaining several exploits together to bypass different protections, and maybe even multiple stages of payloads to finally run your implant. Many programs' memory stacks might only support running a small initial payload that can then be run to download a larger one afterwards. Each payload may have layers and layers of packing, encryption, and obfuscation to bypass signature-based detections. If you want to take a deeper look at how things work under-the-hood for the exploitation step, topics like reverse engineering and return-oriented programming will help you understand how exactly buffer overflows work and different ways to bypass memory protections. Resources you can take a look at include the classic, “Hacking: The Art of Exploitation” by Jon Erickson, which covers the topics I just mentioned along with some networking and cryptology too. Capture-the-flag exercises, especially picoCTF by Carnegie Mellon University tend to have a lot of binary exploitation and reverse-engineering type challenges, with historical write-ups you can study, posted by other people online. Next up, we have installation, which involves securing persistence on a target, an activity typically performed by the installed implant. To survive reboots and crashes, attackers may often migrate their tool to a more stable system process through memory injection, or by modifying a software’s linked libraries with a malicious version, so that they can load together. When an implant gets fully installed, you might see new registry entries or startup scripts appear, which will automatically run the program upon boot. To evade detection by anti-virus products, implants may be written to run only in-memory or with an encrypted virtual file system located in hidden parts of the hard drive. To hide any traces of its presence and activity, you may also see a hacker drop rootkits disguised as drivers to patch the operating system kernel. More insidious rootkits can even modify the bootloader, or flash firmware like the BIOS to further hide malicious activities at a low-level. Properly written rootkits are really difficult to find without offline forensics or live debugging of the operating system, so they’re pretty useful for maintaining stealth and persistence upon installation. But just evading detection on the device itself isn’t enough, since the implant’s got to somehow phone back home to communicate with its command-and-control servers. Speaking of command-and-control, also called C2, this happens to be step 6 of the cyber kill chain. To avoid detection by network security monitoring, when communicating between the target and your hacking infrastructure, it’s important to use common protocols like HTTP, preferably encrypted with TLS, since custom protocols on non-standard ports are easy to detect. Long persistent connections will also stand out as anomalous as well as large amounts of files transferred in a short period of time. Evasion methods like timing high-volume activity during work hours, sending data slowly over longer periods of time, blending in with normal user traffic, can all help mask communications. Along with rootkits, good C2 methods can help a hacker’s ability to maintain stealth and persistence on a target network. In situations where devices are air-gapped, or disconnected from the Internet, there are techniques like worming through USB drives, which was how the Stuxnet virus got into Iran’s nuclear-enrichment facility. Less traditional techniques might include using the speakers and microphone on a device to communicate via sound waves, or even radio frequencies to another infected device that does have network connectivity, thereby bridging the air gap. The C2 servers you’re using are a big consideration as well. If you’re using hard-coded IP addresses with a cloud VPS instance, they can easily get blacklisted, DDoS’d, or hacked back into. If you’re using domain names along with a reverse-proxy service like Cloudflare, you can mitigate some of the previous concerns. But when the domains get reported as malicious, they can get also sinkholed and taken down. An alternative to centralized servers are peer-to-peer botnets, which make great forms of C2 infrastructure since they’re distributed with fewer single points-of-failure to account for, but are much more complicated to develop and manage. However you build the command-and-control systems, as long as there’s a way to phone home over the Internet, it’s easy to carry on a hacking operation with all sorts of different covert channels. The last and arguably most important step of the cyber kill chain is actions on the objective, sometimes also referred to as the post-exploitation stage. Once you’ve gained initial access, follow-on actions might include harvesting credentials from the system, exfiltrating data, or using the victim device as a jump point for more reconnaissance on the internal network and for launching subsequent attacks, and the entire kill-chain process repeats itself. Personally, I think defining your actions-on-objective step is the most important of the entire cyber kill chain because it directly contributes to an end-state. It doesn’t matter how much recon or tooling you do, if there’s no clear purpose with a set of actions to achieve, all the work you’ve put in the previous steps are a bit of a waste. This is where the strategic-level considerations for cyber security start to matter because it’s the foundation for all the tactics and operations in the entire kill chain. Examples of strategic objectives might include intelligence gathering or industrial espionage for governments, or theft, fraud, and extortion for criminals. As a cyber professional, a personal strategy can be to become a red teamer or a more capable blue teamer. Whoever you are, hacking is really just a means to an end, with the cyber kill chain as a path to guide you there. Always define the end-state first, and learn responsibly. Highly recommend you go out and read the original Lockheed Martin paper, and if you’re really motivated, check out a more comprehensive version called, The Unified Kill Chain, which has some more steps broken down in detail. Links are in the description below. So that’s it for this video on the cyber kill chain. If you like what we’re doing here with Cyberspatial, remember to subscribe, like, and comment on the video if you enjoyed it, and be sure to share the goodness with friends. Thanks so much for watching, and I’ll see you soon!
