Cybercriminals or cybersecurity specialists?

At ESED, we always talk about cybersecurity and ethical hacking to prevent cyberattacks and 'shut down' the bad intentions of cybercriminals, but sometimes we forget that cybercriminals are often IT experts/gurus/geniuses in computing and cybersecurity. In order to launch their cyberattacks, they must be familiar with the security barriers they might encounter in a system or infrastructure if they want to bypass them.

The truth is, cybersecurity specialists can either dedicate themselves to ethical hacking (being the heroes of the story) or become the villains and use their knowledge to spread malware across the world. Everyone chooses how to invest their knowledge.

Cybersecurity specialists who have turned into cybercriminals

We find some examples of cybersecurity experts who have decided to turn to the dark side and use their knowledge to carry out illegal activities.

Kevin Mitnick

During the 1980s and 1990s, he became famous for his skills in penetrating the computer systems of large companies and his use of social engineering to gain access to confidential data.

He was charged with multiple computer crimes, including software theft and intrusion into computer networks.

After serving his sentence, he became a security consultant to offer his expertise and help corporations improve their security.

Adrian Lamo

Known as the 'homeless hacker' for his unauthorized intrusions into high-profile networks, including those of The New York Times and Microsoft, he justified his illegal actions by claiming he was helping organizations identify security gaps.

Lamo was also known for reporting Chelsea Manning, the U.S. soldier who leaked classified documents to WikiLeaks.

Albert Gonzalez

He was the mastermind behind the theft of over 170 million credit and debit card numbers from companies like TJX and Heartland Payment Systems. In 2010, he was sentenced to 20 years in prison.

Hector Xavier Monsegur (Sabu)

He was one of the leaders of the LulzSec group, a offshoot of the Anonymous group. After being arrested, he cooperated with the FBI to identify other members belonging to the same groups.

Gary McKinnon

McKinnon was accused of carrying out the largest military cyberattack of all time. Between 2001 and 2002, he accessed 97 government computer systems in the United States, including NASA and the Pentagon, claiming he was searching for UFOs.

Ehud Tenenbaum (The Analyzer)

He is an Israeli cybercriminal who became famous in 1998 for leading a group that attacked military and civilian computer systems in the United States.

He was arrested and convicted in Israel; however, he was involved in other cyberattacks related to bank fraud.

In 2008, he was arrested again in Canada due to ATM hacking.

What cybersecurity knowledge do cybercriminals have?

As mentioned in previous paragraphs, cybercriminals often have technical knowledge in cybersecurity, but what does this knowledge entail?

• Technical knowledge in networks and protocols: Understanding how networks work, including TCP/IP, HTTP, HTTPS, DNS, etc., and the ability to intercept, analyze, and manipulate network traffic.
  
  

• Knowledge of common operating systems such as Windows or Linux to exploit specific vulnerabilities of each operating system.
  
  

• Knowledge in programming and scripting: Ability to write scripts and programs in languages like Python, JavaScript, Bash, or PowerShell.
  
  

• Proficiency with tools such as Nmap, Nessus, and Burp Suite.
  
  

• Knowledge of exploitation techniques such as buffer overflow, SQL injection, Cross-Site Scripting, etc.
  
  

• Ability to decompile software and analyze its operation to discover vulnerabilities.
  
  

• Proficiency with pentesting tools such as Metasploit, Wireshark, etc.
  
  

• Understanding how to use VPNs, Tor, and other tools to hide identity and location.
  
  

• Basic knowledge of cryptography.
  
  

Cybercriminals need to have a deep understanding of security technologies, system vulnerabilities, and advanced hacking tools. This expertise not only allows them to launch sophisticated attacks but also to evade defense measures implemented by organizations.

To counter this threat, it is crucial for companies to not only strengthen their technological defenses but also to foster a culture of cybersecurity that includes ongoing employee training and awareness of current risks. Cybersecurity specialists must stay one step ahead, constantly adapting to the evolving nature of threats and using their knowledge of cybercriminal tactics to anticipate and prevent potential attacks.