Hack Lab seal: APT 268, Cardinal Hackers, Rooted in Victory

INTLPOL 268: Hack Lab

Week 1

Introduction to Cybersecurity

Alex StamosStanford University
Fall 2026Friday, September 25, 2026

Welcome

What is this class?

This class…

  • Teaches cybersecurity from an offensive point of view
  • Does not require a CS background
  • Aims to give you a working understanding of some of the most common types of attacks
  • Should be a good basis upon which to learn more on your own

Course logistics

Grading

10%
Weekly Attendance
30%
Weekly Lab Assignments
due noon Thursday
25%
Midterm Exam
35%
Final Exam
  • Tests might be adjusted up
  • For late work, 50% credit applies for one week afterward
  • Assignments only available for a week!

Course logistics

A note on the labs…

Everybody is expected to get 100%!

Please:

Come to class
Ask questions on Ed
Form study groups

If you cannot complete the labs, then you will not pass the exams.

Course logistics

AI Policy

Allowed

Research

Use AI to learn: explain a concept, a protocol or a tool, the way you would use a search engine or the readings.

Allowed when specified

When an assignment says so

Some work explicitly calls for AI, such as the Attacking with AI lab in Week 7. The assignment will say what is permitted.

Not allowed

Everything else

Don’t use AI to do the labs, write your answers, or supplement what you submit.

Otherwise, do all of the labs yourself.

Syllabus, “Use of AI systems”: hacklab.info/syllabus

Fall 2026 · Fridays 1:30–3:20 PM · MIP Policy Studio

Ten wonderful weeks together

01Sep 25Networking Foundations Today
02Oct 2Network and Wi-Fi Security
03Oct 9Web Applications, Part 1
04Oct 16Web Applications, Part 2 Take-home midterm posted after class
05Oct 23Attacking AI Systems
06Oct 30Buffer Overflows and Exploits
07Nov 6Attacking with AI
08Nov 13Cryptography
09Nov 20Guest Speaker Speaker and topic to be announced
—Nov 27Thanksgiving Recess · no class
10Dec 4Review and Career Advice Take-home final posted after class

Schedule: hacklab.info/schedule

A nearly empty Stanford Stadium seen from the upper stands

A note on class…

Please show up!

Course logistics

Exams

Take-Home Midterm

Posted Fri, Oct 16
  • Available after class on Friday, October 16th; the due date and access window will be posted in Canvas
  • You will have four hours to complete what we intend to be a two-hour exam once you begin
  • Multiple-choice, short answer and practical challenges drawn from labs
  • The exam will be open note and open reading

Final Exam

Posted Fri, Dec 4
  • The final exam will be take-home and available after the last lecture on December 4th
  • The exam will have a bias towards post-midterm topics
  • Multiple-choice, short answer and practical challenges drawn from labs
  • The exam will be open note and open reading

I may adjust grades up to get a reasonable distribution.

Course logistics

Academic Accommodation

01 · Start with OAE

Students who may need an academic accommodation based on the impact of a disability must initiate the request with the Office of Accessible Education (OAE).

02 · Accommodation letter

Professional staff will evaluate the request with required documentation, recommend reasonable accommodations, and prepare an Accommodation Letter for faculty. Letters should be sent to stamos@stanford.edu

03 · Before the due date

Accommodation requests must come in before the due date for an assignment. Assignments cannot be accepted more than a week late for any reason.

04 · For the whole year

Unless the student has a temporary disability, Accommodation letters are issued for the entire academic year. Students should contact the OAE as soon as possible since timely notice is needed to coordinate accommodations.

Course logistics

Absences

If you must miss a lecture, please:

  1. Let me know ahead of time
  2. Get notes from other students

Please forward us a letter from OAE or advising for excused absences.

Heads up

I do not have recordings available this year.

Part one

Why learn cybersecurity in an International Policy class?

An enormous crowd of protesters filling a city square at night, lit by orange streetlights
Armored military vehicles deployed on a city street

Why it matters

Hacking has become a key tool of societal control

People filling gas cans and cars at a crowded gas station

Why it matters

Hacking leads to complex societal risks

Rows of sailors in white uniforms marching in a military parade

Why it matters

Hacking has become key to global competition

Black-and-white portrait of Joseph Nye

Cyber power is the ability to obtain preferred outcomes through use of the electronically interconnected information resources of the cyber domain.

Cyber power can be used to produce preferred outcomes within cyberspace, or it can use cyber instruments to produce preferred outcomes in other domains outside cyberspace.”

— Joseph Nye, The Future of Power

Nye, J. S., Jr. (2011). The future of power. PublicAffairs.

Part two

Hacking

Hacking

What is hacking?

MIT is still waging a rearguard battle to define it:

The IHTFP Gallery is dedicated to documenting the history of hacking at MIT.

The word hack at MIT usually refers to a clever, benign, and “ethical” prank or practical joke, which is both challenging for the perpetrators and amusing to the MIT community (and sometimes even the rest of the world!).

Note that this has nothing to do with computer (or phone) hacking (which we call “cracking”).

A red MIT fire truck placed on top of MIT's Great Dome as a prank

IHTFP Hack Gallery. (n.d.). Hacks at MIT. MIT. http://hacks.mit.edu/

Hacking

What is hacking?

In the “cracking” sense of hacking, I would define it as:

“Manipulating a system of hardware and software to do something unintended by the designer or owner of that system”

You will find that hacking is sometimes as simple as asking a computer to do something.

In most cases, learning to hack means:

01Examining a system to understand its operation
02Brainstorming techniques to manipulate it
03Testing those techniques
A transparent practice padlock with lock picks inserted

Lockheed Martin

The Cyber Kill Chain®

01ReconnaissanceThe adversaries are in the planning phase of their operation. They conduct research to understand which targets will enable them to meet their objectives.
02WeaponizationThe adversaries are in the preparation and staging phase of their operation. Malware generation is likely not done by hand – they use automated tools. A “weaponizer” couples malware and exploit into a deliverable payload.
03DeliveryThe adversaries convey the malware to the target. They have launched their operation.
04ExploitationThe adversaries must exploit a vulnerability to gain access. The phrase “zero day” refers to the exploit code used in just this step.
05InstallationTypically, the adversaries install a persistent backdoor or implant in the victim environment to maintain access for an extended period of time.
06Command & Control (C2)Malware opens a command channel to enable the adversary to remotely manipulate the victim.
07Actions on ObjectivesWith hands-on keyboard access, intruders accomplish the mission’s goal. What happens next depends on who is on the keyboard.

Lockheed Martin. (n.d.). The Cyber Kill Chain®. lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

Hacking

Complex Example: SolarWinds

SUNSPOT, the implant in the
Orion build process, mapped to MITRE ATT&CK

TacticTechniqueObservable
ReconnaissanceT1592.002 Gather Victim Host Information – SoftwareStellarParticle had an understanding of the Orion build chain before SUNSPOT was developed to tamper with it.
Resource DevelopmentT1587.001 Develop Capabilities – MalwareSUNSPOT was weaponized to specifically target the Orion build to replace one source code file and include the SUNBURST backdoor.
PersistenceT1053.005 Scheduled TaskSUNSPOT is persisted in a scheduled task set to execute after the host has booted.
Defense EvasionT1140 Deobfuscate/Decode InformationThe configuration in SUNSPOT is encrypted using AES128-CBC. It contains the replacement source code, the targeted Visual Studio solution file name, and targeted source code file paths relative to the solution directory.
T1027 Obfuscated Files or InformationThe log file SUNSPOT writes is encrypted using RC4.
T1480 Execution GuardrailsThe replacement of source code is done only if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.
T1036 MasqueradingSUNSPOT masquerades as a legitimate Windows Binary, and writes its logs in a fake VMWare log file.
DiscoveryT1057 Process DiscoverySUNSPOT monitors running processes looking for instances of MsBuild.exe.
ImpactT1565.001 Data Manipulation – Stored Data ManipulationModification of the Orion source code to inject SUNBURST.

CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An implant in the build process. CrowdStrike. crowdstrike.com/blog/sunspot-malware-technical-analysis

Part three

Abstraction

Colorful origami figures

Abstraction

A very powerful idea: Abstraction

Modern computers are unfathomably complex.

The Internet is an unfathomably complex network of networks made up of these many complex nodes.

Abstraction allows us to interact with and build upon this complexity.

Annotated die shot of the Apple M1 chip showing GPU cores, performance and efficiency CPU cores, cache and neural engine
Apple M1 system-on-chip: GPU, performance and efficiency cores, cache, Neural Engine

Android Developers. (n.d.). Platform architecture. developer.android.com/guide/platform · Frumusanu, A. (2020, November 10). Apple announces the Apple Silicon M1. AnandTech. anandtech.com/show/16226

Film still of a character offering a red pill in an outstretched hand

Successfully hacking a system usually requires you to understand the truth underneath the abstraction

Abstraction

A basic abstraction

InternetYouA friend
World map of submarine telecommunications cables crossing the Atlantic, Pacific and Indian oceans
Zoomed-in cable map of the central California coast showing several trans-Pacific cables landing at Grover Beach
Cables landing at Grover Beach
Satellite map of Grover Beach, California, between Pismo Beach and Oceano, with a pin inland from the beach
Grover Beach, CA
Facebook post in The SLO County Life group: a large ship anchored off Pismo Beach is the Cable Innovator, working on the trans-Pacific fiber optic cable that comes ashore at Grover Beach

TeleGeography. (n.d.). Submarine cable map. submarinecablemap.com · Google. (n.d.). [Satellite view of Grover Beach, CA]. Google Maps. · Jackoway, R. (2026, September 16). [Facebook post]. The SLO County Life.

NBC New York · September 21, 2026

This physical infrastructure is quite fragile

Hundreds of flights canceled or delayed across Northeast after tech problems

Open article ↗

Beckford, C. (2026, September 21). Hundreds of flights canceled or delayed across Northeast after tech problems [Video]. NBC New York. nbcnewyork.com/video/…/6550427

Networks

The Internet is really a network of networks

ComcastVerizonHurricane ElectricHurricane ElectricCenturyLinkAT&TYouA friend

Networks · History

How it used to work — Circuit Switching

CallerCalleeExchange 1Exchange 2Exchange 3One dedicated circuit, held for the whole call
Historic photograph of rows of telephone switchboard operators at work
A red rotary-dial telephone
A mechanical electromechanical telephone switch mounted on a stand
A technician working on racks of electromechanical telephone switching equipment

Networks · History

1962

On Distributed Communications Networks

Paul Baran · The RAND Corporation, Santa Monica, California

First page of Paul Baran's paper On Distributed Communications Networks, RAND Corporation

Baran, P. (1962). On distributed communications networks (P-2626). RAND Corporation. rand.org/pubs/papers/P2626.html

Networks · History

1974

A Protocol for Packet Network Intercommunication

Vinton G. Cerf and Robert E. Kahn

First page of Cerf and Kahn's paper A Protocol for Packet Network Intercommunication

Cerf, V. G., & Kahn, R. E. (1974). A protocol for packet network intercommunication. IEEE Transactions on Communications, 22(5), 637–648. cs.princeton.edu/…/cerf74.pdf

Networks

Packet Switching

LaptopPhoneRouterRouterRouter

Networks · Packet switching

Packet switching means multiple paths

The original message is Green, Blue, Red.

Host 1ADGBEHCFHost 2
G
B
R

Adapted from File:Packet Switching.gif [Animation]. (n.d.). Wikimedia Commons. commons.wikimedia.org/wiki/File:Packet_Switching.gif

Networks

Back to our network of networks

ComcastVerizonHurricane ElectricHurricane ElectricCenturyLinkAT&TYouA friend

Networks

What defines the Internet?

IP + BGPComcastVerizon

Two protocols must be spoken by internet connected networks:

IP

Internet Protocol

BGP

Border Gateway Protocol

In theory, the network shouldn’t really understand anything else!

Layers

  1. 04Application
  2. 03Transport
  3. 02Internet
  4. 01Physical/Link
A slice cut from a tall layered cake, revealing layers shading from white to deep pink

Layers

Each layer wraps the one above it

Layer 1 · Link

Physical/Link Layer

  • Moves actual data between two systems
  • Only provides for ability to communicate one hop
  • Link and physical are generally tied together to make things “just work”

Best example: Ethernet

Coaxial Ethernet cable with a T-connector
A small five-port Ethernet switch
A home Wi-Fi router with three antennas

Layer 1 · Link · on the wire

Ethernet II, as Wireshark shows it

Ethernet II, Src: JuniperN_76:68:82 (38:4f:49:76:68:82), Dst: Apple_94:09:65 (dc:a9:04:94:09:65)
▾ Destination: Apple_94:09:65 (dc:a9:04:94:09:65)
    Address: Apple_94:09:65 (dc:a9:04:94:09:65)
    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
▾ Source: JuniperN_76:68:82 (38:4f:49:76:68:82)
    Address: JuniperN_76:68:82 (38:4f:49:76:68:82)
    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
  Type: IPv6 (0x86dd)

Layers

Next up: the Internet layer

Layer 2 · Internet

Internet Layer

  • Provides for addresses that work across the world
  • Is best-effort, no guarantee it will arrive
  • Can be carried on many different physical layers
  • All IP packets arrive in the same “inbox” at destination

Lyon, G. (n.d.). TCP/IP reference. Nmap Network Scanning. nmap.org/book/tcpip-ref.html

Layer 2 · Internet · on the wire

IPv4 and IPv6 on the wire

IPv4Src: 172.22.239.45, Dst: 75.126.78.226
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
▸ Differentiated Services Field: 0x00
Total Length: 584
Identification: 0x0000 (0)
▸ Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x030c [validation disabled]
Source: 172.22.239.45
Destination: 75.126.78.226
IPv6Src: 2607:f8b0:400a:809::200e
0110 .... = Version: 6
▸ Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
Flow Label: 0x00000
Payload Length: 38
Next Header: UDP (17)
Hop Limit: 48
Source: 2607:f8b0:400a:809::200e
Destination:
  2620:10d:c096:107:c16:2a9a:6b48:3440

Layer 2 · Internet

Private IP networks

Private networkPublic Internet192.168.1.5192.168.1.10192.168.1.17Router / firewall192.168.1.163.45.21.1434.238.60.105www.stanford.edu

Layers

Next up: the Transport layer

Layer 3 · Transport

Transport Layer

  • Provides reliability
  • Allows for multiple services
  • Allows for multiplexing

Lyon, G. (n.d.). TCP/IP reference. Nmap Network Scanning. nmap.org/book/tcpip-ref.html

A long, dim corridor lined with closed server rack doors
Terminal — April 2018
nobody:~ alexstamos$ nmap -A www.stanford.edu

Starting Nmap 7.60 ( https://nmap.org ) at 2018-04-23 12:48 PDT
Nmap scan report for www.stanford.edu (34.238.60.105)
Host is up (0.096s latency).
Other addresses for www.stanford.edu (not scanned): 34.237.173.243
rDNS record for 34.238.60.105: ec2-34-238-60-105.compute-1.amazonaws.com
Not shown: 997 filtered ports
PORT     STATE  SERVICE  VERSION
22/tcp   closed ssh
80/tcp   open   http     nginx
|_http-server-header: nginx
|_http-title: Site doesn't have a title.
443/tcp  open   ssl/http nginx
|_http-server-header: nginx
|_http-title: 400 The plain HTTP request was sent to HTTPS port
| ssl-cert: Subject: commonName=www.stanford.edu/organizationName=Stanford University/stateOrProvinceName=CA/countryName=US
| Subject Alternative Name: DNS:www.stanford.edu
| Not valid before: 2018-02-10T00:00:00
|_Not valid after:  2021-02-09T23:59:59
|_ssl-date: TLS randomness does not represent time
| tls-nextprotoneg:
|   h2
|_  http/1.1

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.65 seconds
Film still: a screen showing nmap output Film still: a person at a desk in front of a monitor with scan output Film still: a person looking at a wall of screens with terminal output Film still: a monitor showing a terminal session

Nmap.org. (n.d.). Nmap in the movies. nmap.org/movies

Layers

Next up: the Application layer

Layer 4 · Application

The Application Layer

HTMLCSSWeb APIsJavaScriptHTTPDNSUDPTCPTLSIPTheWeb
HTTP request
GET /search/?q=ips+268&search_type=web&submit= HTTP/1.1
Host: www.stanford.edu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: _ga=GA1.2.1601417521.1522636676;
Connection: close
Upgrade-Insecure-Requests: 1

MDN Web Docs. (n.d.). An overview of HTTP. Mozilla. developer.mozilla.org/en-US/docs/Web/HTTP/Overview

Hands on

Lab

Lab instructions and your assigned systems are in the course console: console.hacklab.info