What equipment would be needed for a top of the line hacking group? [closed]

Question

In my story a group is seeking to crack the security on an enemy group who has dangerous hackers within who are doing bad things to them. This group has essentially unlimited funds and resources and modern technology.

What would be the setup they should build to be really good at cracking enemy systems? They have groups of ultra violent people to threaten people and can use that route if needed, but they also need equipment to try and break encryption or track down enemies or to test operating systems and find zero day exploits to use or whatever is normal for such organizations.

I am not technical enough to know what the proper equipment needed to do this is though. I presume the NSA or other groups have such equipment so someone more experienced should be able to give me a clear picture of what the setup to a super hacking group would look like in terms of computers and hardware.

The limit of their budget is around a hundred trillion dollars, so they can afford to push the limits. Answers based around suggesting social engineering or raw violence would be wiser are not appreciated, since the antagonist has enough resources to protect themselves from those.

Answer 1

To do conventional hacking, it isn't necessary to have particularly expensive equipment, just computers (desktops or laptops) that are powerful enough to do their job without unnecessary delays, and maybe some off-the-shelf equipment that is designed for the use of penetration testers. The most dangerous tools in a true hacker's arsenal is software development software and the knowledge of what to do with it.

The main weapon in the arsenal of hackers - professional or otherwise - is knowledge. By knowing the exploits, these people are able to use them. Likewise, such hackers are able to protect themselves from others who would use those exploits against them, unless they are foolishly overconfident, and don't believe that others would be trying to hack them.

However, it is not impossible to hack the hackers. A search for 'scam callers hacked' would reveal a few videos by groups claiming to have located (and even taken over the security cameras within) call centres where 'script kiddie' call centre employees cold-call potential victims, phishing for those foolish enough to let them into their systems, and then use pre-made tools to exploit the openings.

However, a group with 'dangerous hackers' is likely not a bunch of script kiddies. If they suspect that anyone would be interested in stopping them, whether the police or counter-hackers, they are going to take precautions much better than the average person or business, maybe better than most governments. The developers writing the penetration software are probably going to do most of their work with their machines air-gapped, so that the only way to reach them is by taking advantage of the rare times when data is transferred from the outside via physical media.

I would hesitate to put a value on the knowledge and software available to such a group of hackers. Firstly, they wouldn't really need to buy software when they can simply steal - or write - it. Secondly, hacking is a specialised branch of Information Technology, and true experts are rare and can command large salaries, or hack their way to large amounts of ill-gotten gains in order to fund themselves.

So much for conventional hacking... but that's not the limit of what can be done. If a group can afford a quantum computer of sufficient capacity, they can be used in conjunction with Shor's Algorithm to crack many modern encryption schemes. This means that with a powerful enough quantum computer, a hacking group could crack many encrypted systems in a non-prohibitive time. Unless the targets changed their keys on a schedule that would prohibit quantum derivation of the keys from being useful, there would be windows of access to their systems that they might not anticipate... unless they anticipated this, and took advantage of post-quantum cryptography.

A quantum computer capable of cracking modern secure communications is currently theoretical, but is predicted to be achieved 'soon™'. There are commercial quantum computers for sale, though as the technology develops, the prices are changing rapidly... but this is where you could sink your millions or billions of dollars.

There's a saying, you can have a thing fast, cheap or good, pick no more than two. With a hundred trillion dollars, you could afford to throw an army of experts in quantum computing at the task of building a quantum computer soon enough to be able to hack your opposing hackers.

Once you have the other side's cryptographic keys, the task of hacking the hackers becomes a relatively easy job for the conventional hackers.

Answer 2

Remote network based hacking attacks is a common subset of hacking, and as @Monty Wild answered, the only thing you need for that is knowledge and some reasonably current computing hardware.

But there are some other parts of running an intelligence operation that may have fancier tech associated with them. Namely: engaging them in the physical world. Counter hacking to try stop them? Sure, but at some point you actually have to do something about it!

---

Want to track the motion of individuals around a city? You can track cellphones via their MAC addresses and triangulating the signal strength. You can do this either by running the cellphone towers (or hacking them), or with a network of passive sensors deployed across the area of interest. A ballpark estimate for doing this with off the shelf hardware across a small city is surprisingly cheap, this is well within the funds of a motivated lone engineer, let alone a hacking group. There's a defcon talk where a researcher does a proof of concept of pretty this in about 2013 (Defcon 21 - Stalking a City for Fun and Frivolity).
Yes, I considered doing this as a hobby project, no I didn't do it - although I would love the tech challenge of building it.

Satellite surveillance is also pretty good these days. Even as a civilian, a couple thousand dollars will get you 10cm resolution images updated every 24 hours (eg Maxar). For your trillion dollars you can possibly do better and launch custom satellites. I think 10cm pixels is pushing current physics/camera tech, so if that isn't good enough a fleet of high altitude solar powered aircraft can get you what you want. There are private companies currently working on building these systems. (Kea Aerospace)

Got an air gapped network you need access to (eg a companies LAN). Maybe robotics can solve this. A small remotely operated vehicles that can splice into an exposed ethernet cable is well within the realm of plausibility, though to my knowledge they don't exist yet. This won't give you everything as a lot of network data is encrypted, but it may allow some information exfiltration. Again, this device is possibly within reach of a dedicated hobbiest engineer, though the operational success of such a device is perhaps unlikely. Another conference talk I watched showed that data can be extracted from spliced ethernet cables and passive monitoring, but I can't remember the name of that talk.

---

What you actually want to do though is to stop the enemy from being able to deploy new hacking tools. In wartime you can either engage in a battle or you can target enemy infrastructure. What is the infrastructure of the enemy in this context? Their computers, their surveillance tools, their buildings, developers etc.

Can you target them economically. Where are their unlimited funds coming from? Can you reduce that? Or offer their developers a better salary if they work for you instead?

Can you target their ability to use the internet? Track down their ISP and bribe/blackmail the ISP to stop providing good service to them or to help you snoop on what they are op to?

---

So anyway, aside from computers and radio gear, consider what equipment such a team will need when they start to operate in the physical world rather than the purely digital.

If you want ideas, watch some Defcon or Blackhat talks. Those guys are often coming up with new ways to circumvent the physical layer of communications.

Answer 3

Part of my job is infosec so this kind of questions are always fun for me to answer.

I'm going to go about answering it in a few conflicting ways but in the end that's part of life, there's more then one way to go about things, and whatever gets the job done in the end is the right approach (there really isn't a best approach).

First if you're just asking "what's a really expensive tool hackers would love to get their hands on that will make their jobs easier" then to me the answer screams Quantum computers as it checks all the marks:

• Super rare and expensive
• Makes some (but not all) encryption algorithms trivial to break
• Has the Sci-fi feel to it
• There are some commercially available (really you can go out and buy one if you got a few millions to spare) but as this is really new tech they are more like PoC then usable tools right now, but at a hundred trillion dollars they can just build a farm of thousands of them and have a super quantum computer at hand

Now that said I'm going to have to ask why spend so much? There are much simpler ways to go about it, you mentioned them having goons willing to use physical force to get the access they need, which is a recognized form of hacking called rubber hose cryptanalysis (https://xkcd.com/538) which is simpler, cheaper and less prone to failures.

Most hacking (over 60% by some estimates) isn't done with clever zero days attack, most hacking is calling a person and saying something like "I'm the local password inspector, can you please tell me your password to pass inspection" (seriously, this is a real hacking that works more then you would believe), this is called social engineering and would likely be the first way any group would try before investing untold billions into a fancy quantum computer super cluster.