Question: You aim to prevent hacking; what is the most interesting/impressive piece of hacking you have seen and why?

Andy Smith answered on 1 Jul 2020:

Wow Daisy, you really got me thinking here. Hackers are very creative and have come up with so many clever sneaky ways to trick computers (and people!) into doing things they shouldn’t. Most hacks are made up of multiple individual techniques all chained-together. For example, one technique might be used to get some code running on a computer, then a separate technique used to gain administrator privileges, then another technique used to steal data without setting off any alarms. My “favourite” techniques are the ones which involve a hacker taking advantage of an innocent function or feature, and then turning it into something evil. For example, most computers come with some tools to help physically-disabled people use a computer easier, such as by making the screen bigger, or using a computer-generated voice to describe what the screen is showing, or showing a virtual keyboard on the screen. But it’s possible for a hacker to tamper with one of these tools, resulting in them then being able to completely bypass the logon process for a computer and access it without a username or password!!

In terms of an overall hack which I find most impressive/interesting, I have to go with the Stuxnet virus. It’s over 10 years old, so why do I still like it?
• The code was designed to attack industrial control systems – the computers which control factories and machinery. This virus was made to have a physical impact in the real world.
• It contained lots of checks to make sure it only infected systems which met a very specific criteria. In other words, it was written to target one very specific factory. That factory was a nuclear enrichment facility in Iran, used to make nuclear fuel (and possibly nuclear weapons!)
• It used four separate “zero-day” exploits to infect it’s target – these are software weaknesses which nobody else knew about and could have been sold to other hackers for many hundreds of thousands of dollars each.
• It didn’t just infect the control systems to damage the factory, it also infected the management systems in order to prevent humans from realising anything was wrong.
• Although neither country has openly admitted responsibility, it’s widely believed that Stuxnet was a cyberweapon built jointly by the United States and Israel.

There’s lots more information publicly available if you’d like to learn more – just google for “Stuxnet”.