Cyber Hacks

Morris Worm (1988)

• Program copied itself uncontrollably
• Crippled early internet systems
• This exploited a network servers services used back then and the fact that some protocols trust eachother
• Used Password Guessing dictionary attack
A modern computer can guess every word in a standard English dictionary (approx. 170,000–500,000 words) in less than a second to a few seconds


• Could find other connected machines to spread
• Becuse of it's super fast spread and replicating itself, it's only harm was slowing machines down.

Simple idea: Endless messages crashing systems

Kevin Mitnick

• Used social engineering
• Tricked people into giving passwords

The "Callback" Tactic (Building Trust)

When someone is hesitant, Mitnick would offer a way for them to "verify" he is real, often using a callback number he controlled.

Target: "I’m not supposed to give my password over the phone."

Mitnick: "I completely understand. I actually prefer that for security reasons. Let me call you back on the main office number. What's your extension? Also, I need to send you a verification code via email, just read that back to me when I call."

[Callback happens]

Mitnick: "Okay, since we’ve verified it's you, I just need you to log in to this portal (a fake one) to test the new, stronger system."

Simple idea: Getting someone to hand you the key

Target Breach (2013)

• Entered through third-party vendor
• Stole credit card data
• Initial Entry: Attackers used a phishing email to steal credentials from Fazio Mechanical Services, a Pennsylvania-based HVAC vendor in Sharpsville.
• System Access: Using these credentials, the hackers gained access to Target's vendor portal, which provided a foothold to move into the company's network.
• Malware Installation: The attackers installed "RAM scraper" malware, known as Kaptoxa, on checkout systems (POS terminals). This malware intercepted credit card data in real-time, just before encryption. Lateral
• Movement & Exfiltration: The attackers moved to other, more sensitive areas of the network, compromising internal servers to store stolen data before transmitting it to external servers in Russia.
• Missed Warnings: Although Target's security software detected the intrusion, the company did not immediately act on the alerts, allowing the breach to continue undetected for nearly three weeks.

Simple idea: Digital card skimmer

Yahoo Breach

• Billions of accounts exposed
• Password reuse spread damage
• Initial Access (Spear-Phishing): Hackers, believed to be working for Russian intelligence, sent targeted phishing emails to Yahoo employees. These emails contained malware that allowed them to steal credentials and gain access to Yahoo’s internal network.
• Cookie Forging Attack: Once inside, the attackers stole Yahoo's proprietary code, specifically the "Account Management Tool" (AMT), which allowed them to generate "forged cookies". These cookies enabled attackers to bypass authentication and log in to any user account without needing a password.
• Data Stolen: The hackers stole names, email addresses, phone numbers, birthdays, and encrypted passwords. Security questions and answers were also taken, many of which were not securely hashed or encrypted, enabling further access.

Simple idea: One key opens many doors

Equifax Breach

• Personal financial data stolen
• Unpatched Vulnerability: Despite a security patch being released in March 2017, Equifax failed to update its Automated Consumer Interview System (ACIS).
• Failed Security Scans: The software designed to detect such vulnerabilities failed to identify the unpatched application.
• Expired Security Certificate: A security tool that was supposed to monitor network traffic for malicious activity had an expired certificate, allowing the hackers to move data out undetected for months.
• Lateral Movement: Once inside the ACIS system, hackers found unencrypted usernames and passwords, allowing them to access other parts of the network and steal data.
• The breach exposed names, Social Security numbers, birth dates, and addresses. The breach was attributed to Chinese military-affiliated hackers in a 2020 indictment.

Simple idea: Digital filing cabinet broken into

Stuxnet

• Targeted industrial machines
• Caused hidden damage
• USB Infection: The initial infection vector was infected USB flash drives, which bypassed air-gapped security, allowing the worm to enter secured networks.
• Network Propagation: Once on a system, it spread rapidly through local networks (LANs).
• Vulnerability Exploitation: It used multiple previously unknown ("zero-day") vulnerabilities to infect computers without user interaction.
• Targeted Search: It specifically scanned for Siemens Step7 software controlling Programmable Logic Controllers (PLCs).
• Rootkit Component: Stuxnet included a rootkit that hid its files and processes from detection.

Simple idea: Sabotage while systems look normal

Sony Hack

• Emails and data leaked
• Initial Compromise: Hackers used targeted emails (spear-phishing) to trick employees into downloading malicious software designed to look like a document or media file.
• Sender: Spoofed to look like Apple Care or official system administration.
• Subject: Urgent Alert: AppleID account information required, or "Action Required: Security Update".
• Content: The email would claim there was a security issue with their account, urging the user to click a link to verify their login information within 48 hours to prevent being locked out.
• Destination: The link led to a fake website that looked highly convincing and asked for user credentials.


• Infiltration & Data Theft: For weeks, attackers silently crawled through Sony Pictures Entertainment’s network, stealing intellectual property, unreleased films, and sensitive employee data.
• Destructive Malware (Wiper): The attackers used a variant of "Shamoon" wiper malware, designated for data destruction. This malware corrupted the Master Boot Record (MBR) of thousands of computers, rendering them unusable and erasing data.
• Extortion & Threats: After the systems were compromised, the attackers, calling themselves "Guardians of Peace," demanded unspecified concessions, later threatening physical attacks on cinemas screening

Simple idea: Private conversations exposed

WannaCry

• Locked files for ransom
• Spread rapidly worldwide
• Vulnerability Exploitation: The malware utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to target a vulnerability in Microsoft's SMBv1 protocol, allowing remote code execution.
• Worm Capabilities: Unlike traditional ransomware, WannaCry acted as a worm, automatically scanning both local networks and the wider internet for other vulnerable, unpatched computers to spread rapidly.
• Ransomware Payload: Upon infecting a machine, it encrypted files and demanded approximately $300–$600 in Bitcoin.
• Kill Switch: The malware included a check for a specific, unregistered domain name (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com). If the domain was not found, the malware proceeded with infection. Researchers later discovered this, and registering the domain halted the spread.
• Impact: The attack caused massive global disruption, notably affecting the UK's National Health Service (NHS), shipping companies, and manufacturers.

Simple idea: Computer kidnapping

Colonial Pipeline

• Fuel supply disrupted
• Initial Access: The attackers exploited a legacy VPN account that was no longer in use by a former employee but had not been properly deactivated. The password for this account was reportedly found in a batch of leaked credentials on the dark web. The lack of multi-factor authentication on this specific account was the critical vulnerability that allowed the initial breach.
• Data Theft and Ransomware Deployment: Once inside the business network, the hackers moved laterally across the systems. They stole approximately 100 gigabytes of data and deployed their DarkSide ransomware. The malware encrypted files and systems, making them inaccessible.
• Extortion: The DarkSide group used a "double extortion" method: they demanded a ransom payment in exchange for a decryption key to unlock the files and threatened to leak the stolen data online if payment was not made. Operational Shutdown: The attack primarily targeted the company's business and IT systems (like billing and accounting), not the operational technology (OT) that physically controls the pipeline. However, to prevent the potential spread of the ransomware to the OT network and ensure safety, Colonial Pipeline proactively decided to shut down all pipeline operations.
• Ransom Payment and Recovery: Colonial Pipeline's CEO made the decision to pay a ransom of 75 bitcoins (worth approximately $4.4 million at the time) one day after the attack to obtain the decryption key and restore operations as quickly as possible. The company was able to restart most of the pipeline systems by May 13, 2021. The U.S. Department of Justice later recovered a significant portion of the ransom (around 63.7 bitcoins) by seizing the private key for the hackers' digital wallet

Simple idea: Digital attack affects real life

Key Takeaways

• Weak spots are exploited
• People are the biggest risk
• Impacts real life

Protect Yourself

• Use unique passwords
• Enable 2FA
• Keep systems updated
• Be cautious with emails

5-Minute Fix

• Enable updates
• Turn on security
• Secure email
• Fix one password-to unlock others
• Back up files

Stay Safe

• Update everything
• Use 2FA
• Don't trust urgency
• Back up data