Role of Intelligence Gathering in Hacking

Author: Ivan Shyshkou

Intelligence is the product resulting from collection, collation, evaluation, analysis, integration, and interpretation of collected information. Information gathering is the first step of hacking. At this stage, they formulate the purpose of the attacks and the idea of how to carry out the attacks. The hackers also identify potential weaknesses for further actions, including the names of employees and internal mail templates.

We distinguish between active and passive intelligence. These differ in the methods of obtaining information. With passive intelligence, hackers investigate publicly available sources and they do not interact with the object under investigation. As for active intelligence, hacking systems directly interact with the object under study. Active intelligence provides more data that is useful for a hacking attack, but the object may become aware about the intelligence gathering. Both approaches are applicable in penetration testing.

What are they looking for in the course of intelligence?

If the target is a particular person, an attacker might gather information through a passive search:

• Physical location
• Social media profiles
• Email addresses, nicknames, aliases, infrastructure owned by the user, such as servers and domain names
• Biography information, including criminal records, licenses, and jobs via official databases or professional organizations
• Publications, including articles, blog posts, and news releases
• Phone number, type of the mobile device the person uses

In case of a corporation or an organization, an attacker is interested in:

• Identifying the focus and types of work performed
• Infrastructure used, including ranges of IP addresses, network devices, firewalls and other means of protection, technologies, and types of servers
• Information from open devices, such as surveillance cameras, routers, servers, and online repositories
• Information about clients and partners
• Mail templates
• Public documents, marketing strategies, and financial technologies
• Information about financial performance from reports, financial statements, and purchases and sales

In case of active intelligence, the targets are as follows:

• Information about the device and the devices connected to it, other devices on the network
• Information about open ports, the version and type of the operating system, running services, and discovery of new hosts
• Subdomains, hidden pages, configuration files, and backup files
• Meta information, comments, error texts, and response headers

Intelligence Role

Based on the investigation, the attackers decide on the next steps of hacking. Having learned the types and versions of the software used, the hackers select appropriate hacking tools and suitable payloads. Having identified the templates of emails and email addresses of employees, they prepare phishing attacks on the employees. It is especially effective when they have revealed information about the situation in the organization and the processes taking place in it. Having identified open ports, the attackers try to interact with the attacked system via the ports. Having information about the location of users, they select appropriate lists of possible passwords. If they detect an additional resource that is less secure resource than the main one, the hackers can target attacks through this resource.

The data about the target allow for reducing the time of influence on the system. It is important because security methods are constantly evolving and can detect hacking attempts and notify the responsible department. Alternatively, the attackers may not have enough time to sort through all possible tools and payloads. Thus, intelligence increases the chances of success by reducing the time of influence on the system. Even if there is lack of reliable systems for responding to specific activity, the attackers’ activity affects the system in various degrees and the resource administrators might notice it if the attackers blindly resort to all possible means to hack the resource. Finally, the intelligence can signal about the expediency of carrying out further actions with the resource. The result may not even be comparable to the extended efforts.

What can you do to reduce the chances of attacks?

– Conduct intelligence on your own

Find out what data are available on the network and assess their threat to the security of your company

– Organize regular training of employees

An untrained and careless employee has always been the weakest link in any security system. Therefore, it is necessary to conduct regular training of employees. This will contribute to reducing chances of attacks, as well as to the employees’ awareness of how to act in case of any suspicious activity.

– Conduct cybersecurity audits

Systematic checks of programs, services, ports, networks, and infrastructure are a must. They will make it possible to identify weaknesses and vectors of attacks on systems, reduce risks in case of attacks, and respond to incidents faster.

Conclusion

In the rapidly evolving security landscape, intelligence provides a crucial advantage, minimizing system vulnerability. By embracing a holistic cybersecurity approach that integrates intelligence gathering, organizations can enhance their resilience against dynamic threats and protect their digital assets.

At IBA Group, we are committed to delivering comprehensive cybersecurity solutions. Our services encompass cutting-edge penetration testing, where we replicate real world attacks to identify vulnerabilities and reinforce defenses. Moreover, we prioritize human-centric security by offering customized training to empower personnel against social engineering and phishing threats – two prevalent risks in the digital era.

Stay tuned for more cybersecurity insights and explore the first, second, and third parts of our series for comprehensive coverage.