Welcome back my aspiring cyberwarrior and others interested in cybersecurity!

When people find out I am a professional hacker, one of the most common questions they ask is, “Can the CIA (or other intelligence agency) track my every move?” The short answer is Yes!, they can track your every move if you have a cellphone AND the interested party (CIA or other intelligence agency) has your phone’s unique IMEI number.

Let’s look at how they do this and what you can do to make their job much harder.

IMEI

The IMEI or the International Mobile Equipment Identity number is unique to each phone and can not be altered. If the CIA or other intelligence agency knows this number of your phone, they can track your movements by tracking your phone. This number is available to them by subpoena, search warrant or US Patriot Act provisions.

The IMEI is stamped on your phone and when you open the phone you can find it like below.

In addition, you can find the IMEI under settings of your phone. It is different places in different phones, but look for something such as “About Phone” like below.

IMSI

It is also possible to track a phone and its user by its IMSI (International Mobile Subscriber Identity) number of the phone. Fortunately, this IMSI can be changed out by changing out the SIM (Subscriber Identification Module) card.

MSI numbers are broadcast by your phone when its sends a beacon to connect to the cell tower. It is possible for anyone with the right equipment to intercept and read those IMSI numbers. 

Every time a cell phone attempts to connect, it pings the cell towers in the area to determine which is closest. Every cell phone or other device connecting to the cellular network (such as iPads) does this. Every time a cellphone pings a tower, the phone’s IMSI, IMEI numbers as well as the the location of the cell tower is stored in the carrier’s database.

By triangulating (multiple towers are used to track the phone’s location by measuring the time delay that a signal takes to return back to the towers from the phone) between the pings to the towers in the area, the location of the phone can be determined within 50-500 meters, depending upon the concentration of cell towers. The closer the cell towers are together, such as in an big city, the more precise the data on the location of the phone. In urban areas, your location can be narrowed down to within 50 meters.

Stingrays

Although not a method of tracking but rather of eavesdropping, stingrays are one of the tools intelligence agencies and law enforcement use to listen to cellphones. A stingray is just a compact, mobile cell tower. Law enforcement and intelligence agencies can simply move one into your neighborhood. Your phone will then connect to the closest cell tower. The stingray looks and acts just like a cell tower so you phone connects to it without asking further questions. Once your cell phone connects to the cellular network, the owner of the stingray has access to all the calls and data leaving your phone. For more on stingrays, see my article here.

In the US and other countries (they are banned in the EU), you can buy an inexpensive, limited-feature, pre-paid phone at a local retailer without having to register your name. In this way, it is very difficult for intelligence agencies to connect the phone and its unique IMEI to your identity. To take further precautions, the phone should be purchased with cash so that no credit/debit card trail remains.

When purchasing a burner phone, make certain that you are NOT carrying your other phone with you. Your other phone is tracking all your movements. If you are carrying your that phone, you are creating a record of your visit to the “burner phone” retailer linking you to the purchase and the IMEI of the burner phone thereby frustrating your attempts to remain anonymous. 

Summary

The CIA, any intelligence agency or law enforcement can track your every move very precisely by tracking the cell towers your phone pings before it connects. All this data is stored in the phone carrier’s database and can be accessed by these agencies. The burner phone is probably the best way to frustrate this type of tracking but make certain to take the precautions described above.

The post Confessions of a Professional Hacker: Can the CIA or other Intelligence Agencies Track My Every Move? first appeared on Hackers Arise.

Welcome back, my aspiring SCADA/ICS security engineers!

SCADA/ICS hacking is one of the most important areas of cybersecurity and one of the least understood. SCADA/ICS systems power our entire industrial infrastructure and are critical to the every day functioning of our economy and lives. These systems include;

1. Electrical generation and transmission
2. Chemical processing
3. Oil refineries
4. Food processing
5. Pharmaceutical manufacturing
6. Water and wastewater systems
7. Cellular and mobile communication systems

Without any of these systems, an economy can be crippled. Hackers-Arise is one of the leaders in SCADA/ICS cybersecurity, and next month we are offering a new class in this discipline, SCADA/ICS Forensics.

If we are to protect these systems, we need to understand how hackers can access these systems and how we can detect their presence and actions.

SCADA/ICS Forensics Training Outline

1. Introduction to ICS/SCADA Systems

Overview of industrial control systems (ICS) and SCADA architecture

Key components: PLCs, RTUs, sensors, actuators, HMIs, data historians

Differences between IT and OT environments

2. ICS/SCADA Protocols and Communications

Common industrial protocols (Modbus, DNP3, OPC, PROFIBUS, etc.)

TCP/IP and fieldbus network topologies

Protocol vulnerabilities and forensic implications

3. Threats, Attacks, and Incident Scenarios

ICS-specific threats (insider, supply chain, targeted malware)

Case studies: from Russia’s attacks Ukraine’s infrastructure,Stuxnet, Industroyer, Triton, and ransomware in ICS

Attack methodologies unique to ICS/SCADA

4. ICS/SCADA Forensic Fundamentals

Principles of digital forensics in ICS/SCADA

Preservation of volatile and non-volatile evidence

Chain of custody, legal and compliance considerations

5. Evidence Collection Techniques

Safe imaging of PLCs, HMIs, and historian servers

Capturing network traffic in industrial environments

Handling physical and logical data acquisition in situ

6. Log Analysis and Event Correlation

ICS-specific log sources (controller logs, SCADA system logs)

Event timeline reconstruction and anomaly detection

Dealing with proprietary and legacy logging systems

7. Malware Analysis and Reverse Engineering in ICS

Identifying ICS-focused malware (e.g., OT ransomware, custom payloads)

Static and dynamic analysis of binaries from field devices

Artifact recovery from embedded devices and firmware

8. Network Forensics in OT/ICS Environments

Deep packet inspection of industrial protocol traffic

Identifying network-based evidence (command/response, unauthorized access)

Use of specialized tools (Wireshark with ICS dissectors, etc.)

9. Reporting and Remediation

Documentation of forensic findings for ICS/SCADA

Coordinating with OT/IT teams for incident response

Lessons learned and post-incident review practices

Summary

If you job requires you to protect SCADA/ICS systems or you simply want to add SCADA/ICS cybersecurity to your skill set, then this class is for you!

You can enjoy and benefit from all 4 of our SCADA/ICS classes in our SCADA/ICS career path here.

The post SCADA/ICS DFIR, October 27-29 first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Network packet monitoring has long been an important skill for tech experts, especially those in cybersecurity. Like any skill, it demands a bit of studying and hands-on practice. While Wireshark has been a go-to tool for many, it can be somewhat cumbersome for beginners who simply want to see whom they’re exchanging data with. To simplify network monitoring, Sniffnet was developed.

In this article, we’ll dive into what Sniffnet is, how to install it, and provide a practical comparison of its features alongside those of Wireshark. Let’s get rolling!

What is Sniffnet?

Sniffnet is an open-source, cross-platform network monitoring tool developed in Rust. It captures and analyzes traffic flowing through a device’s network interfaces in real-time. Unlike traditional packet analyzers that typically display raw packet data, Sniffnet prioritizes visual clarity. It features a user-friendly dashboard that showcases live charts, protocol breakdowns, and geographic context instead of just a continuous stream of hex dumps.

Step #1: Installation

In this demonstration, I’ll be testing Sniffnet on Kali Linux, though it’s also cross-platform compatible with Windows and macOS. To get started with installation, we need to visit the official download webpage and choose the package. I’ll choose the DEB file. To install, just run the following command:

kali> sudo dpkg -i Sniffnet_LinuxDEB_amd64.deb

That’s it; we’re ready to start monitoring the traffic.

After starting the app, we need to choose the network adapter and click Start. If your system makes any network connections, you’ll see it as shown below.

The interface is straightforward. The screen is divided into blocks. At the top right, we can see the traffic rate. Beyond the live chart, Sniffnet also renders a donut chart showing cumulative statistics for the entire capture session. It tracks total incoming, outgoing, and dropped data.

Any packet sniffer can show you an IP address and a port number. Sniffnet goes further. The application can identify more than 6,000 upper-layer services, protocols, trojans, and worms flowing across your interface. Instead of staring at port 443 traffic and shrugging, Sniffnet can tell you the actual service behind that connection, in this case, HTTPS.

Besides that, every remote host your machine communicates with gets mapped to a physical location, so you can see at a glance whether your traffic is staying local or hopping across continents to servers you’ve never heard of. Beyond location, Sniffnet also pulls the Autonomous System Number and domain name associated with each host. Knowing the ASN tells you which organization or provider owns that piece of the internet. As you can see from the screenshot above, most requests were made to Cloudflare US servers. Nothing fancy, but it makes overall analysis much simpler for beginners.

The main page provides a very good overview of the network traffic. But when we find something valuable, let’s say an interesting host, we can click on it and see the whole communication history.

Practical Comparison: Sniffnet vs. Wireshark

Step 1: Getting an Overview of the Capture

When you load a pcap file into Sniffnet, it will immediately render the total traffic, direction split, and the donut chart of incoming, outgoing, and dropped data. In Wireshark, we can show this information too, but it takes navigating a menu and reading a table rather than seeing it visually on load. Pull up Statistics > Capture File Properties or Statistics > Protocol Hierarchy to get an equivalent summary.

Both tools can answer “what’s in this capture,” but one shows it, the other tells it.

Step 2: Finding the Suspicious Host

Let’s imagine that we want to view hosts by traffic volume.

As you can see in the screenshot above, at Sniffnet we need to change the data representation to packets, and that’s it. At Wireshark, we need to click Statistics > Endpoints > IPv4. Note that Wireshark has no built-in geolocation or ASN lookup, so you’d need a GeoIP database configured separately, or you’d have to pivot to an external tool like whois.

Step 3: Digging Into the Actual Conversation

Wireshark clearly stands out in this scenario. By simply right-clicking on the suspicious stream and selecting “Follow TCP Stream,” we can uncover the actual payload, which may include plaintext credentials, encoded commands, or unusual headers. For instance, in the case of the XWorm malware infection I examined, this Remote Access Trojan (RAT) encrypts commands sent from the Command and Control (C2) server using the AES encryption algorithm in ECB mode, making the payload unreadable. While we can see the ciphertext, Sniffnet lacks the capabilities to analyze it in this way. Sniffnet only presents connection metadata, service labels, and host details, as it isn’t designed for interpreting raw payloads. This underlines the importance of continuing to use Wireshark, even after Sniffnet performs the initial triage.

Step 4: Extracting Evidence

Since version 1.3, Sniffnet allows exporting the captured network traffic as a PCAP file. You can configure whether to export a capture file on the initial page of the app. By default, this functionality is not active, but you can enable it by clicking on the dedicated checkbox.

Wireshark offers a variety of flexible export options. You can save the entire packet capture in formats like PCAP, export only the packets you’ve selected, or even extract packet dissections as plain text. Additionally, you can choose to export specific protocol objects, such as HTTP files, or save the raw packet bytes.

Step 5: Filtering Down to What Matters

Sniffnet has built-in filtering options, filtering by IP address, port, protocol, or application layer service directly through the UI. This is menu-driven and requires no syntax to learn.

Wireshark has display filters, like ip.addr == 158.94.209.180 and tcp.port == 6000. Its filter syntax is far more expressive. You can chain logical operators, filter on specific packet fields deep inside a protocol, filter by string content inside payloads, or filter by flags. None of that granularity exists in Sniffnet.

Summary

When comparing Sniffnet and Wireshark, it’s clear that Sniffnet serves as a useful tool for monitoring network traffic, allowing you to keep tabs on your internet usage. It’s effective for gathering statistics and identifying your data exchange partners, but it falls short for more in-depth network investigations. On the other hand, Wireshark provides a much broader range of features for monitoring, filtering, and exporting traffic.

Therefore, if you’re just looking to casually check your traffic, Sniffnet will do the job. However, if you’re aiming to dive deeper and enhance your skills in network analysis, Wireshark is the way to go. Hackers-Arise offers a dedicated course titled “Wireshark for Cybersecurity” or you can opt for the Cybersecurity Starter Bundle, which includes this course along with 11 additional courses at a great price.

The post Network Forensics: Getting Started with Sniffnet Monitoring Tool first appeared on Hackers Arise.