Some of the Most Prevalent Threat Actors are Teens

[plat]

Content source

https://www.theregister.com/2023/04/25/mandiant_rsa_teenage_hackers/

These teens "are incredibly effective social engineers, and they are able to convince people to do things that they ask them to do, like visit certain malicious websites and type in their username and password, or log into any desktop comm and download the AnyDesk client and provision access to somebody," he added. "We've seen very young individuals break into some of the biggest organizations by leveraging these techniques that are so hard to defend against."

Another way teenage hackers are pulling off these heists is by calling organizations' staffers and convincing them that they are help-desk employees by spoofing the caller ID to look like the real help-desk phone number.

Twitter

 

[MuzzMelbourne]

Its the modern equivalent of throwing stones on the gym teacher's roof at 2 in the morning. Bloody hilarious!

 

[Chuck57]

A few years ago, in Los Alamos, New Mexico USA, (birthplace of the atomic bomb) several teens from the local high school used high school computers to break into the Los Alamos National Laboratory computers. These computers hold a lot of above Top Secret information related to nuclear weapons, etc. When the break in was traced to the high school, the kids confessed. They were 16 years old. Nothing was done to them. A deal was reached. If the teens explained how they did it, no charges would be made.

What I found funny was, high school kids were teaching people with Masters and PH.Ds in computer security and such how to use computers. A couple of the Lab security people commented later that it was embarrassing. Here were kids unable to work at the computer division of the lab because they didn't have college degrees who actually knew more about computer security than the computer security people WITH such degrees.

 

[monkeylove]

That's the same term used in a book about hacking from a few decades back, i.e., "social engineering".

 

[piquiteco]

What @Chuck57 said is true I had 2 experiences that I witnessed with my own eyes 24 years ago, I will tell only one. I had a friend that was 14 years old at the time, he called me to go to his house, I went to his house, he was developing a malware to infect the computers in his school. My infecting his own school's computer, well come on. Programming language was new to me at that time, I already knew it by name, but I didn't know how it worked and until today I still don't lol, programming is pure logic, who is a programmer knows that. I am very skeptical when a person says something more complex, even more to a 14 years old boy, I laughed when he told me that about creating a malware, I know that it wouldn't be so easy, even more in the 90's, teenagers I think they all like to brag, I think it's just age and phase of life. He said to me, are you laughing at me, I said no of course I am not laughing at your way of speaking I do not doubt your ability I said, he told me it is good, I will show you something he opened a page, I then opened a terminal he always alternated between the terminal and page started typing commands used in FTP, he said look, I looked I only saw files I saw nothing much, I told him I am only seeing files defaut.html,index.htm, index.html, .jpg .gif and many others that I do not remember. In the 90's I knew very little about html, if I saw PHP, ASP was totally new to me I wouldn't know what it meant. He opened an internet service provider and news portal very well known at the time where I live like AOL many of you know AOL known at the time as America Online ? It was an internet service provider in my country just like AOL and he opened the provider's portal and showed that he had access to this provider, according to a gap left by them. I said, I only believe seeing, he said that he would deface the initial page of the portal, I said then do it, when I was going to do it I stopped a little thought and said no, then the police will come home, my parents will be in a bad way, I said why? he said because he has my IP probably they will get to me. Then I said I don't believe in all that you are doing, I will only believe it if you pinch or delete the files from the provider's home page and tomorrow I see the headlines in the newspaper, television that the provider was hacked. Conclusion, he didn't do it, he was a smart guy, but I don't believe him until today because I just keep talking about it. And I'm throwing wood on the fire.

 

[vtqhtr413]

Studying the Lapsus$ hacking playbook​

A ragtag bunch of amateur hackers, many of them teenagers with little technical training, have been so adept at breaching large targets, including Microsoft, Okta, Twillo, Nvidia, Samsung, T-Mobile, and Globant, among others, that the federal government is studying their methods to get a better grounding in cybersecurity.

The group, known as Lapsus$, is a loosely organized group that employs hacking techniques that, while decidedly unsophisticated, have proved highly effective. What the group lacks in software exploitation, it makes up for with persistence and creativity. One example is their technique for bypassing MFA (multi-factor authentication) at well-defended organizations.

Rather than compromising infrastructure used to make various MFA services work, as more advanced groups do, a Lapsus$ leader last year described his approach to defeating MFA this way: “Call the employee 100 times at 1 am while he is trying to sleep, and he will more than likely accept it. Once the employee accepts the initial call, you can access the MFA enrollment portal and enroll another device.”

How fame-seeking teenagers hacked some of the world’s biggest targets

With no skill in software exploitation or encryption busting, Lapsus$ wins anyway.

arstechnica.com