[Day 1] 1. Other than PPT

1. Where and How is Credit Card Data Stored?

Credit card data is typically stored in databases by merchants or financial institutions. It is stored in compliance with the Payment Card Industry Data Security Standard (PCI DSS) to ensure security. The storage includes:

Cardholder Data (CHD): Primary Account Number (PAN), cardholder name, expiration date, etc.
Sensitive Authentication Data (SAD): Includes CVV, magnetic stripe data, and PINs, which must not be stored after authorization.

Encryption and Decryption:

Data is encrypted using strong cryptographic algorithms (e.g., AES-256) during storage and transit.
Decryption requires secure keys stored in a Key Management System (KMS).
Tokenization is often used to replace sensitive data with tokens that are meaningless outside a specific system.

2. Schemes Used to Steal Credit Card Data

Skimming: Attaching devices to card readers to copy card information.
Phishing: Tricking users into providing card details via fake websites or emails.
Man-in-the-Middle (MITM) Attacks: Intercepting data during online transactions.
Malware: Injecting malicious software into systems to extract card data.
E-skimming: Injecting malicious scripts into e-commerce websites to steal card information.

3. File Timestamp Modifications

Files have three timestamps:

Creation Timestamp: When the file was created.
Last Modified Timestamp: When the file's content was last changed.
Last Accessed Timestamp: When the file was last opened or read.

Commands and Their Effects:

```
touch file1
```
: Updates the Last Modified Timestamp without altering the file content.
```
cat file1
```
: Updates the Last Accessed Timestamp when the file content is read.

File Transfers Across Devices:

When a file is moved from one device to another, all three timestamps are typically reset. However, this behavior can depend on:
- The file systems of the devices (e.g., FAT32, NTFS, ext4).
- Metadata preservation settings during the transfer.
- Tools or commands used for the transfer (e.g.,
```
rsync
```
  can preserve timestamps).

4. Tracking Social Profiles or IDs Used for Defamation

IP Address Tracking: Identifying the IP address associated with the account activities.
ISP Logs: Internet Service Providers can provide logs linking IP addresses to users.
Device Fingerprinting: Analyzing the unique characteristics of the device used.
Account Metadata: Examining email addresses, phone numbers, and linked accounts.
Court Orders: Obtaining warrants to access service provider data.

Preventive Measures:

Encouraging strong authentication practices.
Educating users about online safety.
Implementing stricter platform policies.

5. Remote Physical Damage to Computers

Yes, it is possible to damage a computer remotely by exploiting vulnerabilities:

Overclocking: Sending commands to overclock hardware and cause overheating.
Malicious Firmware Updates: Corrupting firmware to damage hardware.
Voltage Manipulation: Exploiting hardware-level vulnerabilities to cause electrical damage.
Bricking Devices: Overwriting critical system files or firmware.

6. Why Are Most Metasploit Payloads Reverse (e.g., Reverse SSH)?

Firewalls typically block incoming traffic but allow outgoing traffic.
A reverse shell establishes a connection from the target machine back to the attacker, bypassing the firewall's restrictions.
This makes it easier to exploit the target system while remaining undetected.

7. Role of Hard Disks in Cyber Forensics

In cyber forensics, investigators often analyze hard disks directly without access to the original system. This involves:

Extracting data from the disk using forensic tools.
Identifying deleted or hidden files.
Analyzing file metadata and timestamps.
Recovering encrypted or corrupted files.

Command-line tools may not always be available, so forensic methods rely on specialized software (e.g., Autopsy, FTK, EnCase) and manual data analysis techniques.