[MUSIC PLAYING]
Welcome to Hacker House Hands-On Hacking.
This is the first module in our course, which
is a purely academic module.
It's the only academic module in the course.
Now, we couldn't give a course teaching computer
hacking skills if we weren't able to focus
on the legal elements and what you are lawfully allowed to do.
So ethics and legalities.
When we talk about ethics and legalities,
ethics can mean different things to different people.
And they are very personal in terms of their regards.
But when we're talking about legalities,
these are a little bit more set in stone.
And these are actually the black-and-white printed laws,
which you must adhere to and follow throughout your career,
or else you'll get a visit from perhaps this guy in a Batman
suit at 6 o'clock in the morning.
And that could not be very pleasant for you.
So we focus on the ethics and legalities
from the UK perspective.
However, whichever country you are in
was most likely to have variants or similarities to these laws.
So here in the UK, we have the Computer Misuse Act, the Data
Protection Act, the Human Rights Act, the Wireless & Telegraphy
Act.
And these are laws which have been passed,
which directly impact the kinds of work
that you can do as a cybersecurity practitioner.
So the Computer Misuse Act focuses very heavily
on what you are and aren't authorized
to do against somebody's computers and indeed, your own.
And also, the Data Protection Act
is there, designed to ensure that information
is stored in a secure way, and that it's not being misused.
Equally, the Human Rights Act is there
to protect the individual and their right
to personal privacy.
So if you're targeting a company and you
start key-logging employees and individuals,
you might be in violation of perhaps their right to privacy,
depending on what their employer has told them
they can use their technology and computers for.
So these are laws you need to be aware of.
And equally, the Wireless & Telegraphy Act.
If you start attacking wireless infrastructure,
you need to be aware of what the regulations are around that.
So most countries will have a variant of this law.
In fact, a lot of countries implemented their own computer
laws, computer misuse laws based on the information that
was given from the UK Computer Misuse Act,
as it was one of the first countries
to successfully prosecute a computer crime.
And so the Computer Misuse Act has
been used for a lot of other countries
as the basis of their law.
But you may find that in your country
there is some slight variance to the legal aspects compared
to the UK.
Equally, there is a Hacker House Code of Conduct.
We have supplied the Hacker House Code of Conduct
to ensure that everybody has filled that in.
Whether you are taking our course in a classroom
environment or whether you are doing this
at home and the on demand, the code of conduct
is there to show you how we expect our students
to behave towards each other.
And we provide a safe space for learning,
so that we don't encourage people to be harassing
or other intolerable behavior towards other students
or indeed, tutors themselves.
So just please familiar yourself with your code of conduct,
because it is something that we do stress.
We do want people to have a good experience when
they're learning these things.
We'll also look at responsible disclosure practices, bug
bounties, and various things, and where
you can get legal support should you
encounter some complications.
So hacking laws and you.
The thing with the computer crime laws and computer hacking
laws is that the penalties for illegal hacking attacks
are extremely severe.
So if you are conducting illegal, criminal intrusions,
then you can face quite severe criminal penalties.
So it's very important to understand
what you can and can't do.
And generally speaking, testing your own computers
that you bought, you have, you own--
your property is more or less lawful.
There's not really any laws that cover
what you can do with that.
However, if you're testing your place of work
or you are testing a neighbor's computer system or similar,
then you need to ensure that you have permission
from the system owner.
If you don't have permission from that system owner,
then you are most likely in violation of some law.
So the scanning of internet-connected equipment--
while it's not technically illegal
is often frowned upon by some system administrators.
So whilst you can scan the internet for common
vulnerabilities-- and there are a number of services that do
that--
if you began scanning systems by yourself,
you may find that you'll get abuse complaint reports,
particularly if you scan the Department of Defense,
for instance.
Then you may receive some emails indicating that your behavior
is not welcome.
And so be cautious about scanning systems
without permission.
And using default passwords or accessing services
without permission is pretty much a gray area.
Some people claim that if I connect to a system
and it lets me straight in, then there was no password.
There was no protection.
And it was therefore a public access system.
However, this is a very gray area.
And it's very ill advised and definitely could land you
in legal trouble in the UK.
So we stress very hard that you should always
seek written permission from the system owner of the network
or environment that you are planning to test--
very important.
And it will help save you a lot of aggravation and stress
later on in life.
So when we conduct these kinds of assessment activities,
when we start to engage in kind of hacking for
hire, or we conduct a penetration test,
though we would follow a number of different methodologies.
And there are a number of common methodologies
which have surfaced over the years--
open standards and guidelines designed
for how you can conduct different test activities.
And there are a few of them listed on the slides here,
so the Information Systems Security Assessment Framework,
the Penetration Testing Execution Standard,
PCI pen testing guide, which I don't personally think
is worth the paper it's printed on,
the penetration testing framework,
and the Open Source Security Testing Methodology Manual.
Of these, I really rate the Penetration Testing Execution
Standard.
It contains a lot of guidance for how
to conduct an engagement, how to engage with clients,
issuance of reporting.
It does give you a kind of overall standard of how
somebody may expect a penetration
test to be conducted and also gives you
some guidance on how to actually execute some of those tasks.
So I really do like the P test standard.
Another manual which is quite worth it is the OSSTMM.
Although it's a little longer in the tooth
now and quite a little bit out of date,
you will find that there's a number of testing methodologies
written in there for systems like PBXs or voice mail
systems.
And it contains a lot of different methodologies.
So you might find information of value
to there, when you start in your career
if you're testing a new system or perhaps
coming across a technology you might not
have encountered before for security audit purposes.
So P tests and OSSTMMs are the two that I would recommend.
Again, they're not the only ones,
but they are just some brilliant ones to follow.
The penetration testing framework
is another good example.
As we've already explained, the concept of authorization
is extremely important when you're
dealing with computer security and particularly when
you're doing these kind of hacking activities.
It is imperative that a system owner approves your activities.
If you do not have authority to test a computer system,
you are potentially committing a criminal offense.
And as I've said before, the penalties are quite severe.
So please get us a signed copy of an authorization for testing
contracts in place with any system owner
before you begin conducting any testing
or any kind of experiments.
And indeed, this should clearly state that they will not
seek to prosecute you under the Computer Misuse Act
to avoid any further or future confusion.
And the best piece of advice I can give you, really,
when you're conducting this kind of assessment
is to just be very transparent and open about your activities
and always get permission before doing them.
You will avoid a lot of complications and headaches
if you are just very open about the type of testing
you're doing.
I'm going to assess this web server today.
I'm going to launch this exploit later on.
There may be a risk to that system.
And the system owner might say, please
only conduct that outside of office hours at 6:00 PM.
Or there may be some window of which they
would prefer you to conduct those more dangerous elements
of the assessment.
So, yes, always ensure you've got permission
and be transparent and open with the system owner.
Be clear and concise and explain to them what's going on.
Because at the end of the day, you
are a guest on their network.
You're a guest in their environment.
And you should be--
you should treat their network and environment as such.
Another concept which is quite commonly discussed
is the concept of disclosure.
So whilst you are conducting your information security-type
jobs, you are doing your pen testing.
You find a vulnerability.
And you find this vulnerability impacts
not just your client, but also all
of the users of that software.
It's a new kind of attack.
It's a new kind of exploit and therefore known as a zero day
or a zero-day attack, a previously unknown security
flaw that may require intervention or software
update from a vendor.
And the concept of responsible disclosure
is the practice of working with that vendor
to resolve the vulnerability and protect the consumers.
So the industry de facto guidelines suggest
that we give a 90-day window of opportunity
to allow for patching, so you contact the vendor.
You allow them 90 days to implement the fix.
After a fix has been supplied of the 90 days,
allow a further 30 days for customers to obtain that fix,
apply it to their servers before disclosing
details of the exploit and the analysis that were conducted.
And indeed, some vendors will reward your efforts
in a hall of fame.
Or those may be less rewarding and may not
be as happy to have vulnerabilities
in their products.
But if you stick to this responsible disclosure
guideline, give them 90 days and a further 30 days
after a patch is released before disclosing.
And if the vendor doesn't wish to disclose
or doesn't wish to work with you on that point,
then at that point, it would be OK to share the information
with the wider community and effectively force
the hand of the vendor to acknowledge the problem
and address the issue to protect its consumers.
Because you have also a moral obligation
to protect the impacted policies of the software,
not just the vendor and their reputation.
So that brings us to bug bounties.
Bug bounties are programs which are established
by organizations, so that they can receive vulnerability
or information from the public that
can then be used to address those bugs and vulnerabilities.
So it's actually a way of you being
able to conduct penetration tests against organizations
and gain some kind of commercial experience
for the processes involved in reporting of vulnerability.
And indeed, if you are successful in finding
weaknesses, you can indeed get some monetary rewards
for your efforts.
And now, you need to ensure when you are conducting assessments
against bug bounty programs that you fully review the terms
and conditions of that program and that you don't end up
overstepping the scope.
You need to ensure that your activities are
within the scope of the program, so that you do not
inadvertently expose yourself to any kind of legal risk.
And what I mean by that is as an example,
though as a bug bounty of Facebook--
and an individual breached the Facebook server
and then continued to operate outside of the scope of the bug
bounty program by accessing internal Facebook services
and querying information on Facebook users.
And subsequently, when he submitted his bug report,
instead of a monetary award, Facebook arrested him.
So you need to ensure that whenever you are conducting
these kinds of bug bounty programs,
review the terms and conditions and ensure
that any activity you do is within the scope
of the program.
If it says do not go targeting admin.company.com,
then ensure that you don't target those systems
and servers.
If you are worried about overstepping a boundary,
you feel like you might be operating out
of the scope of a program, the best thing
to do is to check with the program owner.
It comes back to that openness and transparenceness
as long as you are open and transparent about these kinds
of tests and these assessment activities
and you are doing things within scopes of bug bounty programs.
And being open and transparent will
get you-- clear a lot of confusion
and make sure there's no complications down the road.
It can be quite an intrusive thing
when you are breaching into networks and systems.
So you need to ensure that when you are doing that
and you're using these intrusive powers that you respect
the rules and the scopes of any programs
that you might be involved in.
And most of all, have fun.
It's an enjoyable and profitable pastime for many people
to get involved in bug bounties.
And so it's a great way for you to get
some commercial experience.
It certainly helps the interview stage
when you are being shown--
when you're showing how you have progressed,
all the things that you can do, to show and demonstrate
some kind of capacity and skills in this area
if you're just trying to get into the industry.
So bug bounties are a great way for you
to get some experience on this kind of assessment activities.
What happens should you ever find yourself
in a legal predicament?
So if you do need legal advice and support,
I can assure you cyber and cybercrime lawyers
are really expensive.
And I mean, seriously, lawyers are really expensive.
They can cost upwards of $1,000 an hour,
depending on the level of advice that you need
and the legal system that you're working with.
So be aware.
Lawyers are really expensive.
So you want to avoid using them as best as possible.
If you do, however, find yourself in a situation
where you might need legal advice,
then you could get in contact with two organizations.
One is the Electronic Frontier Foundation,
who could put you in touch with some lawyers who
specialize in cyber.
And also, EDRI, which is the European equivalent, who
can also help find you support or legal practitioners
that are well versed in cyber and EU-related laws.
The best advice that can be given to you
is if you are arrested or experience
any kind of complications, then seek professional legal advice
immediately and do not answer any questions before consulting
a qualified legal professional.
I am not a legal professional.
And I would advise you that should you find yourself
in a situation where you need a legal professional,
speak to the legal professional, and don't answer any questions
or speak to anybody else, and only operate and follow
the advice of the legal practitioners.
And it's very important that you get
one that is well versed in the world of cyber,
as it is quite confusing for many legislators.
And there are often miscarriages of justice in this space.
So that's what to do.
If you do encounter any problems,
get in touch with the EFF or EDRI, depending on your region,
to find a well-versed cyber practitioner who
can help you with the law.
Equally, Hacker House has its code of conduct.
And if you take our course, then you
must have agreed to our code of conduct,
because we're going to be teaching you real-world attack
techniques that you could use to commit criminal acts.
And Hacker House will not be held accountable
for such actions.
We teach you these skills to show you
how computer systems are broken, so
that we can understand how to better defend those systems.
We'll show you how systems can be breached.
We'll show you the tools and techniques
used by computer hackers for many different reasons.
And you could use these in a nefarious way.
But we will teach only people who
intend to follow industry de facto best practice guidelines.
And we will only teach people who
agree to our code of conduct.
And we'll be performing ethical hacking activities
within a legal way.
And ignoring these guidelines, of course,
can lead to legal problems for you.
And so please familiarize yourself
with our code of conduct, whether you're at home
or whether you are in our classroom
to ensure that you are following your expected behavior.
And that kind of brings me nicely
to the end of this module.
So it is the only academic theory module.
So for this module, all I need you to do
is familiarize yourself with any differences in the law.
If you're in America, for instance, the Computer
Fraud and Abuse Act.
And some of the Digital Millennium Copyright
Act and other laws will also be applicable to you.
This, of course, has a UK-centric area of the law,
so the Computer Misuse Act being the main one here.
And most of these laws require you to seek permission,
so it's important to understand.
Always get permission.
Always work within the scope of any program.
And always be open and transparent with system owners
to avoid any confusion and complications.
Thank you.
[MUSIC PLAYING]