Hey, guys, welcome back to another episode on how to defend and to do with looking at how can we check
if a mobile device has already been hacked.
OK, so this is going to be a little more technical.
OK, so we need some form of command line interface, define up the processes as well as the network
elbaum connections that we're having from our mobile device all the way out onto the Internet or into
some hacking server that is in control of all mobile devices.
So the first thing we want to do is, of course, want to highlight over here, I have an Android device
running on the left side of the screen, as you can see.
And it can be the same for a physical Android device that you can do the same to.
OK, so you can go ahead and plug in your Android device into a computer system which already has Android
debark running.
So if you're not sure what is Android debark, which we have a video tutorial on that, so do check
it out on a channel.
So what are we going to do now is to actually go ahead and open up command problem?
OK, is it going to open it up?
And of course, I'm going to zoom in a little more so it's easier for you to see.
OK, so I'm going to put this as for in twenty eight, OK, so what we'll do now is to actually kick
start EDB.
So we will need a connection into the Android device or discus shell and we can issue some interesting
commands to find out what's going on on the device.
OK, on a background, on a background, I actually have a colonics machine running, so we'll look
at what's normal and what is abnormal.
What are some of the indicators that your phone has already been compromised?
So first of all, you can go in, enter Adibi devices and it will show us a list of Android devices
that are connected to your computer system.
OK, so you could do the same for any form of operating system.
So go ahead, enter AB Shell and this would bring us into the device itself.
So now we are currently controlling the device on the left side.
You can see.
So of course, one of those things that we can do is to issue some commands and one of those commands
is, of course, Nestande.
So instead help us find out what are some of the elbow connection or establish connections that we have
and a really important areas over here to really important areas over here.
So we have here what is normal.
OK, so we have an established connection, active Internet connections.
OK, so over here, this is what we're seeing.
All right.
And what I'm going to do next is over here.
I really have a malicious application installed into the device in the back door.
I'm going to start up display.
OK, so I'm going to go into terminal.
OK, so this is colonics.
I'm going down to MSF console to start up exploit and I'm going to open up.
OK, a reverse shell from the device all the way into decolonize system.
OK, so go ahead, enter.
So I'm going to set to table now.
OK, so I will, of course, enter DDR to find the IP address of two colleagues machine and set the
alehouse.
So, of course in this case, the IP address of our colleagues machine is one or two one six eight zero
one zero six.
Go ahead and hit enter and that enter show options to see all the listed options and go ahead and enter
exploit.
So basically what I'm doing here is to start up a hacking server that would then give us control of
the Android device.
So of course, once the Android device and the user has those applications running and the users clicked
onto the malicious application, is sometimes what the hackers would do is they will use a legitimate
application and beat this malicious software on top of it.
And this would give them a instantaneous access into the mobile device.
Giving them access to the geolocation dismisses everything.
OK, so over here, what we're seeing is that we have a L port of four four four for this running.
So it could be any other port numbers that hackers could be using to gain control of your device.
All right.
And if I go into command from now and if I enter, I enter up arrow.
So I Antonet start once more, then we just increase the font size.
So it's a little easier for you to see.
Two thirty six.
OK.
So what I would do next is, again, the same issuing the same come in Internet stat.
All right, and what we will see here, OK, if I scroll back up to the top again.
All right.
So unlike the earlier results that we got in.
All right.
So going back to the top, we can see a foreign address.
All right.
Of four four four four.
OK, so we see that there is a connection.
All right.
Coming in from the device.
OK, this is it.
Elbow connection to a foreign address.
And this is definitely something amiss.
OK, so the other things we can look at for not just a network connection, which could be showing all
the suspicious elbow connections.
OK, so why would a mobile device have such a connection outwards?
OK, so there's something to take note off.
All right.
As part of the investigation, whether a device has already been compromised.
The second thing that we could take a look at is in terms of looking at the list of users, looking
at the processes that are actually being run in the system so you can enter a top GOP enter on deck.
And this will show us all the different processes to actually running inside the Android device in our
case.
OK, we have Shell running.
All right.
And we have all these number of uses over here.
So we have root.
We have a system, we have zero.
We have all these different uses who are actually inside the environment right now.
And of course, we have no idea what you're doing.
Right.
So we're trying to investigate what's going on.
So, of course, I can go and enter a game talk and we can see all the different information.
I mean, as well as the users, the processes are running and so on, so forth.
So, of course, on the on our case over here, OK, what we're seeing is that there are certain processes
that shouldn't be there, just the processes that are suspicious.
And of course, in our case, if I go back to colonics, know if I had to shell.
All right, this means that the hacker is having a command line interface into the device.
All right.
And for example, if a hacker who am I to get the username over here so we can see the username as you
zero on a score, a one, two, three, four.
OK, so in our case, when we go back to command from looking at a top, we can see over here, OK,
we have a user, you zero, a one, three, four, and they have a shell.
So if you think about it now, if you think about it from a mobile device perspective, why would a
mobile device have a shell running?
Why would a mobile device have a terminal running at all?
OK, so this is another big indicator that your device could have already been compromised in a hacker
is interfacing at a shell level.
OK, so that can be another form of indicator of attack.
OK, next.
And the final sharing is, of course, in terms of looking at piece stands for processes they're running.
So you can enter this will list all the processes inside the systems again and a capital A and we can
see all of those different processes.
They're running into the system.
And of course, we're looking at it again for certain processes that shouldn't be there.
So, for example, over here, OK, we have the common ones like com dot android and we have here Kamden
deployed on state.
Let's split, of course, is a hacking framework that we use and we have done a lot of lectures and
tutorials on it.
So that is going to be one suspicious indicator of suspicious indicators are going to be shell or a
shell is also another suspicious indicator if it is being run as a process inside your mobile device.
OK, so this is some of the processes and indicators of attacks that we can look at or indicate compromise
that we can look at.
OK, so there are many, many other ways for us to further filtering future down into what exactly is
going on in the process, looking for what is considered normal and what is considered abnormal in those
situations, in those cases.
All right.
And this is how we were able to detect when there was a cyber attack inside our system.
OK, so with that, I hope you've learned something valuable in today's tutorial.
And if you like what you just watch, remember, like sharing, subscribe to the channel so that you
can be kept abreast of the latest cyber security.
Thank you so much once again for watching.