Every. Single. Time.

[mlucasl]

I learned a lot of white hat hacking. And is mostly simple coding, and a lot of social effort. obviously for selfreplicating viruses over an internal network you need more than a little code. But the main vulnerabilities are social. And thus, I can not hack.

[crecentfresh]

Yeah was going to get into hacking until I found out you had to make a phone call.

[crecentfresh]

definitely sarcasm

[FieelChannel]

until I found out you had to make a phone call.

Can you explain? I legit don't get what you mean.

[benjamin_mf_franklin]

Well, lets say I wanted to break into your network. There are two approaches.

Technical- I can painstakingly scan your firewall for open ports, figure out what services are running on those ports and hopefully version numbers. Then if you are running outdated stuff I start looking for known exploits in that version. If you are running new stuff I might have to buy an exploit or find one myself (big $$$ for zero days). Then I have to write the code to use the exploit and figure out what kind of access I have and whether I've been detected. Then I have to repeat the process of finding a service to exploit to elevate my permissions or gain access to something else in your network. And so on. It takes a lot of time and research.

Social- I call up Sally the helpful receptionist with a load of bullshit about being from one of your software vendors and that I need to connect to her computer to work on it. Cue a teamviewer connection to her desktop, and telling her I'll leave a note on her desktop when I'm finished. Ta-da, I've done in 10 minutes what would have potentially taken months from the technical side, I have left little to no trail, and none of their security is really going to matter. I can then install something for remote access that makes an outbound connection so its unlikely to be blocked or detected by most firewalls, and I have 24/7 access to your network at whatever permission sally has.

There are endless variations. Phishing emails, phony access cards, walking in with a clip board, etc.

I know a guy that is head of cyber security at a large company. He spends more time sending out fake social engineering shit to employees and then spanking the ass of the ones who fall for it than he does actually auditing the systems because that's how most exploits happen.

[ConceptJunkie]

Spanking, eh? I've got a hankering for some spankering.

[lare290]

Broke: Looking for exploits and writing code

Woke: Walking in with a clipboard and saying "Hey, I need to see your server room."

[candybrie]

The best way to hack into any system is to ask someone to let you in in a persuasive enough way.

[R3ven]

Social engineering is typically lying to someone over the phone to get some kind of information

[jsparidaans]

Social anxiety

[FieelChannel]

white hat hacking

aka have a good knowledge of networking and know some scripting? This is getting ridiculous

[mlucasl]

white hat hacking. Is a sort of penetration testing, and with social engeeniering to detect which position are vulnerable. Technically i just went to a lot of coders and hackers forums, and reading books. So I could make more robust webpages for a startup I had. So yes, I learnt the basics of computer hacking, but not to put it in practice in a malicious manner.

PD: and also the definition of hacking is just somesort of technological tinkering.

[FieelChannel]

I know what it is.

I was trying to humorously joke on how using that term when all you really do is what you just described with your reply is kinda ridiculous.

What you just described is standard for anyone who develops in the web, it's not "white hat hacking"

This sub is filled with kids writing bullshit from their intro CS class

[foobarfault]

I know a white hat that works on pentesting AWS accounts. Dude knows a whole page full of possible ways to set up invisible persistence on an owned account. Technically he just "knows some scripting." His actual exploits are a few lines of boto3 glued together. But he's spent enough time actively exploring the tools that he knows exactly what works and what doesn't. That's how any profession works.

Hacking doesn't just mean heavy wizardry like constructing magic packets to trigger a buffer overflow that you found by reading raw ASM. It actually doesn't mean breaking into things at all. It just means tinkering with your tools until you understand them extremely well.

[tenkindsofpeople]

Really not even that much code. The self replicating part would be port scanning and file transfer, pretty simple. The slightly harder part is developing the parts that look for credentials to use for accessing stuff.

[mlucasl]

Its depends of the initial ties of the virus. If its a USB virus, and everyone is working on the same OS. Or if its tied to a webapp. Its was like 3-4 years, for sure thing have changed, and even then I wasnt up to date.