Class, I hope you enjoyed this section on command and control of a windows in computer from Caleigh
using a piece of malware you created in the previous section on the attack phase.
I also hope that this has been a little bit scary for you to see how easy it is for an attacker to command
and control, to look at screen shots, keystrokes, spy through your webcam, upload, download and
view files, or even steal passwords from users on a Windows computer.
If you click through and download the wrong file, whether that's an executable file like the one we
created here, whether that is a movie that you think you're getting for free.
The latest movie from the box office.
And you didn't pay for it.
It could have a surprise package along with that file that takes advantage of vulnerability either in
Windows, in your Web browser or in a video player or other application.
It could you could get a virus through a word document, through a PDA file, through a simple Web page.
So being careful is one of the most important things to take out of this.
Well, it's really easy for an attacker to do a lot of damage and get access to a lot of information.
But the good news is it's also pretty easy to keep an attack like this from working.
There are just about three things that we need to remember to be able to keep attacks like this at bay.
And you don't have to.
You don't have to be the most secure person with the best passwords on the planet.
You just have to keep yourself from being low hanging fruit, from being an easy target for attackers.
There are just a few things that you need to do to make this kind of attack much harder for somebody
to pull off on you.
First of all, don't download.
Don't click and don't run.
Suspicious files that you download over the Internet.
So we just found this file fortnight, all skins or important document, not PDAF or funny cat video,
whatever would make you or one of your one of your clients click through if you're doing a security
assessment.
But as soon as we downloaded that and ran it, it gave complete command and control over a Windows computer
all the way down to our files, our keystrokes, our webcam, our passwords to a remote user over the
Internet.
Now, these are two computers that are sitting on the same physical machine.
But this could be on the other side of the planet.
I could be in North Carolina or Russia or New Zealand, any place on the planet, and run into an attack
like this against a customer who's asked me to do some penetration testing for them.
So this is really important.
It's also a great way to show family members just in your local safe ethical hacking lab why they should
be careful about clicking through those links or filling out a survey or watching videos that they may
be downloading illegally online.
This is a really good way to help people see how serious it is and how much control they could be giving
to an attacker over the Internet just by using that free thing that shouldn't be free of surfing to
that Web page that they probably shouldn't surf to.
So just being careful where you click, not downloading and running things or run them through virus
total or another program.
So if I take this file that I've just downloaded and go to virus total.
I can upload this file into virus total.
And I will choose the downloaded version so that it doesn't delete it.
And I'll confirm the upload.
In just a few seconds, you're going to be able to see with this is probably a safe file for you to
open and use or if this file is crawling with infection's.
And we can see really quickly that this file is definitely a Trojan.
A remote access Trojan, a file, it gives complete command and control over a Windows computer to a
Kalli machine.
So virus total is lighting up like a Christmas tree.
Here we've got red everywhere.
Dozens of different antivirus programs see this as a malicious file.
And I should also note that a handful of these do not yet detect this, but give it a little bit of
time to run through all of the different antivirus programs and you'll see that it's pretty clear that
this is a dangerous file.
So just doing a quick sanity check, if you're downloading something that you might be suspicious about,
uploading antivirus total could be one way to check it out or running a scan with your antivirus program.
That brings us to the second tip that you can use to keep yourself safe.
Use an antivirus and firewall.
That means make sure that they're running and then make sure that they're up to date.
So update your virus protection.
In fact, we're going to turn our virus in through a protection settings back on.
So we go to open.
And go to the virus and threats, protection settings, and we're gonna turn them back on.
Yes.
We're also going to change back over our Windows firewall and we're going to say.
Mitt S.H. advanced firewall's set all profiles to state on the.
And now our Windows firewall is back up and active.
And in fact, that interpreter session that we have over here, if I unless.
Look at that.
Nope, I still have access because I got him before they turned it on, that's a really important thing
to remember.
But in just a few moments, this connection will likely die because the Windows firewall.
And because of that Windows defender.
But this is really important to notice.
Notice that I downloaded and ran this file and paid maternity access.
Then when I turned on the antivirus and turned on the Windows firewall, I still have access to look
at files inside that remote computer.
So that's a really important thing to keep in mind, is that once you get infected, you're gonna have
to turn this computer off, take it off the network, run a full virus scan and then find this virus.
Delete it and take care of it.
But running a good firewall, an antivirus is a great second step.
After being careful what you download and click in the first place.
And then finally, one of the most important things you can do is keep your system up to date.
So run your windows updates.
Check for updates often.
You should do this at least once a month, once a week.
If you do a lot of Web surfing or if you download a lot of files over the Internet, it's a good week,
too.
It's a good thing.
The weekly check for your Windows operating system, your Microsoft Office, Java, or any programming
applications that you might have on your computer.
Definitely any Web browser updates if you don't do this at least once a week.
Sorry if you don't do this at least once a month.
That's a really good thing for you to start doing.
If you make it do a lot of credit card transactions over your computer, if you do a lot of online banking,
it's not a bad idea to do this once a week.
So every Friday before you log off, go do a check for updates, check your Web browser for updates,
check your Microsoft Office for updates.
It's a really good practice to get in the habit of.
So just by doing those three three things, not opening suspicious files, making sure your antivirus
and firewall protection are turned on and updating your operating system and applications often can
keep you safe from as much as 85 percent of the drive by attacks like the ones we've seen here on the
Internet.
So you don't have to be the most secure, the most careful person on the planet.
Just doing those three things can keep you from becoming an easy target or low hanging fruit for an
attacker out on the Internet.
So I hope this has been a really great couple of sections for you on the attack phase and the command
and control phase of hacking into a Windows team computer, seeing how much an attacker can do when
they're on your system remotely.
If you click through and download the wrong file and then it's really easy to keep yourself from being
a target just by being careful what you do online, making sure you've got good protection, and then
checking for updates often.
I hope there's been a great lesson for you.
We will see you in the next section.