Cyber Security: Hacker

Web and Shodan MIS 510 Ali Hassan Alenizi, Farah J Jafar,

Nikhar Shah, Yirong Zhu

Introduction/ Background

• Hacker Web:

o Database of hacking forums

o Russian, Chinese, Arabic, English, Persian

o Tracks forums and types of hacking communities are interested in

• Shodan:

o APIs for extracting data regarding cyber vulnerability

o Huge amount of information on network devices could be accessed

through Python methods

• Research:

o Research questions formulated to extract data and analyze it giving

meaning to the data from the two databases

Research Questions 1. Do cultural differences trickle down to hacking, hacking topics, and hacking techniques? What are

the cultural implications found through the research? What is the probability that an Arabic

hackers forum and an English hackers forum will discuss the same topics?

2. Given the increasing threat of social media attacks, attackers such as Syrian Electronic Army are

increasingly using phishing and spamming attacks on different websites that are against the

Syrian Government in the Syrian Civil War. My hypotheses question involves looking at the trend

related to phishing attacks compared to other traditional types of security threats such as SQL

injection.

3. The recent research posted on github reflects the backdoor of routers on Port 32764. From this

Port, hackers would more likely be able to intrude because of the natural vulnerability on this port.

So, from the global view, which countries or area are facing this same issue? Which areas suffer

the most or have more potential risks and what does the distribution look like?

4. In this question, we would dig deeper into the 3rd question. What are the devices of these IP

addresses really accessible for attacking and be able to intrude into right now. What are the

locations distributed out there and how many devices for each country could be intrude through

Port 32764?

Question 1: Excel - Vctool

Top 30 ranked

threads for

Vctool with

weighted %.

Question 1: Excel - Arhack

Top 30 ranked

threads for

Arhack with

weighted %.

Question 1: Probabilities

threadID title numOfView numOfPosts %ofviews

1170 HowtoviewPrivateFacebookPics 6723 22 5.68440277

10290 LiveJasminCreditAdded,AccountMaker,#FreePasswordList 3905 12 3.30173923

1141 [Source]RainerstoffCrypter3.2b 3367 17 2.84685172

10102 [Get]FaceDominator(Cracked) 3280 10 2.77329185

107 MSNPasswordHacker(NEW2009) 2382 26 2.01401865

11355 MonsterCrypter-PrivateCrypter,0/37+Fullsoruce-OUT!!! 2271 13 1.9201664

1045 MW2AimbotandESPSourceCodeforCompiling 2173 9 1.83730585

10353 7-13-12Crypter 2088 2 1.765437

totincommon: 22.1432135

threadID title numOfView numOfPosts %ofviews

10016 اليومراحاشرحلكمكيفيتاختراقالبوكرالفيسبوكمنشرحيالخاص 7020 30 2.94316176

10286 برنامجفكباسوورداتالــ*****معالشرح 4663 72 1.95498053

10591 الدرسالاول-مقدمهعنعالماللتشفير 4453 0 1.86693723

1125 googleللختراقكود300منأكثر 4199 6 1.76044676

11409 ]دورةفيالهندسةالعكسية[كسرالبرامجوعملسيريالاتلهاصنعكراكاتالبرامج)ادخل( 3886 59 1.62922031

1121 الدرسالاول:_-_-_نظرةعامةعناختراقالبريدالالكتروني_-_-_ 9145 208 3.83407611

1148 _-_-_الدرسالثالثمندورةاختراقالبريدالكتروني_-_-_ 7725 89 3.2387357

totincommon 17.2275584

Probabilityofbothoccuring: 3.81473503

VcTool

Arhack

Question 1: Analysis

• Arhack:

o Focus on Social Hacking with few Organizational Hacking threads

o emails, social networks, sql injections, password hacking … etc

● Vctool:

○ Focus on Organizational Hacking with few Social Hacking threads

○ DDoS, botnet/bots, crypting, software cracks, coding ... etc

3.8% chance that Arhack members and Vctool members will talk about the

same hacking conepts. Most of these are crypting, and social hacking.

Question 2:Extracted

Dataset

Some of the

extracted using

the MySQL

query

Question 2: Word Schema

Word

Schema

used to find

related

thread

topics

Question 2:Mined Dataset

Some of the

data mined

dataset from

the extracted

dataset

Question 2: Analysis

Final Analysis:

• Increasing Phishing related Threads

• Increased Discussion of Phishing related activities

• Arab Spring also changing hackers ideologies

0

100

200

300

400

500

600

700

800

31-12-2009 29-11-2009 30-10-2009 31-12-2012 30-11-2012 29-10-2012

PO

ST

S

DATES

Moving Trend Based On # of Posts

Number of Posts Phishing Number of Posts SQL Injections

0

10

20

30

40

50

60

70

80

90

100

31-12-2009 29-11-2009 30-10-2009 31-12-2012 30-11-2012 29-10-2012

PO

ST

/VIE

WS

DATE

Number of Views Per Post

Phishing Threads: Views Per Post SQL Injection Threads: Views Per Post

Question 3: Data Extraction

Question 3: Country Details

Question 3: 100 Vul_IPs

100 Vulnerable IP Addresses Due to Port 32764 All Over the World

Question 3: Compared to What

Shodan Map API Does Shodan Map API Analyzes Port 32764 Based On Thousands of IP and Charges

$19 !

Distributions Are

Similar !!!

Prove Accuracy of

Our Analysis!

Question 4: Deeper

Analysis

• 55 Out Of the 100 Vulnerable IP Addresses of Port

32764 Could be truly attacked

• Within the 55 IP Addresses, 31 Devices Are

Available For Locating Visual Positions

Question 4: Core Code

1. Get the Host Of Each Of the 100 Vulnerable IP Addresses

2. Test If the Port == 80 That Is Open To Public

3. Then Get the Host IP

4. At Last, If Able to Locate, Get the Latitude And Longitude

Question 4: 31 Target Devices

31 Visual Devices That Could Be Targeted At In 100 Vulnerable IP

Addresses

Question 3 & 4：Summary

• Among All Of Vulnerable IP Addresses With Port

32764, About Half Could Be Intruded

• ⅓ Of the Host Port Could Be Visually Located On The

Map

• The Top Three Areas Exposed To the Vulnerability Are

United States, China, European Areas

References [1] Peterson, L. (n.d.). Hacking Diversity.Latoya Peterson. Retrieved February 25, 2014, from

http://latoyapeterson.com/presentations/hacking-diversity/

[2] Feuer, A. (2011, November 20). Culture Hacking. Adam Feuer. Retrieved February 25, 2014, from

http://adamfeuer.com/blog/2011/11/20/culture-hacking/

[3] John Matherly, (2014, February 18). Shodan Blog. Introducing Shodan Maps, from

http://shodanio.wordpress.com/2014/02/18/introducing-shodan-maps/

[4] Michael Horowitz (2014, January 24). How and why to check port 32764 on your router, from

http://blogs.computerworld.com/network-security/23443/how-and-why-check-port-32764-your-router

[5] John Scott-Railton (2013, June 19). A Call to Harm: New Malware Attacks Target the Syrian Opposition,

from

http://www.academia.edu/4231059/A_Call_to_Harm_New_Malware_Attacks_Target_the_Syrian_Opposition

[6] Mohamed N. El-Guindy (2013, December 25). Middle East Cyber Security Threat Report 2014, from

http://www.academia.edu/5522905/Middle_East_Cyber_Security_Threat_Report_2014