Do you think the Colonial Pipeline hackers were using Kali?
Kali is the OS, not the actual hack. Kali doesn't do anything on it's own. Some of the resources available within Kali? That's a different story but even then, much of what is publicly available and packaged in Kali ready-to-go already get detected pretty easily by most AV programs i.e generated payloads through msfvenom/metasploit framework as well as any generated malware you can create with various programs/scripts available for free on the internet. That's the sacrifice you make when you make hacking tools available en masse, naturally people use them and they get detected and/or the AV companies and affiliated security communities simply share the autopsies of successful hacks and then seek to bake this into signature detection, as well as improve heuristic and AI detection mechanisms. You have stuff like sandbox analysis/VM environments to run malware in which will down to a very granular level tell you exactly what the malware is doing so that you can create methods of preventing/reversing changes if/when you are compromised. So at the end of the day, much of the ready-to-go stuff itself won't get you passed most decently protected systems/networks. That being said, the actual tools themselves (which are not malware in and of themselves) will get help you get through said systems/networks, which is why it's used, as an accessory but not as a primary method of hacking. The OS is the environment in which to hack. The hacker has to know how to hack in order to use Kali, otherwise it's just a Debian based distro like any other only it's dressed up to party and nobody to take it to the dance.
For the BIG hacks, these use 0-day exploits usually along with undetectable fresh malware programmed from scratch and currently undetectable. Most of the current threats out there right now is undetectable malware, not the stuff we already know about, although unpatched and out-dated systems/networks always get caught out by this stuff. That's why it's important to regularly check for security updates, patches, hotfixes, regularly update definition lists, databases and even find products with cloud protection for real-time heuristic/AI driven detection methods. 0-days are basically secret holes in software that hackers discover and then use to hack systems/networks. Because it's undiscovered nobody can do sh*t about it until it's reported and then the vulnerabilities exploited. When will this happen? That depends on whether the 0-day gets found. If it's fresh and in the wild, it could be an hour, a week or even years. At this point the only person on the planet who knows about this bug in some software could be you and whoever else was there if anybody else was there. The US government stockpiles 0-day exploits. Remember the Stuxnet virus? That was propagated by 0-day exploits the US government had known about for a long time but never told Microsoft to patch so that, obviously, they could use it. It was an age-old vulnerability in SMB v1 if I am not mistaken? Simple file sharing capabilities over the network. Some of these vulnerabilities are several years old, even decades! Because 0-day exploits have no cure (until patched) they were able to effortlessly compromise systems and the very best detection techniques stand little chance. That and physical attacks ie plugging in USB sticks into exposed systems will also do the trick. Computers are programmed to detect and automatically trust certain devices and this includes USB drives, as well as HID devices, which also could be a USB stick modified to impersonate a HID device.
The browser you are using to read this message and browse this forum will have 0-day exploits and that means if the severity of the vulnerability is, well, severe, a hacker could gain access to your system without much effort, usually through something called ACE/RCE or arbitrary code execution/remote code execution. Presuming you can get a shell, the world is your oyster. Some vulnerabilities are fairly simple and maybe even baked into the code itself by adversaries, these are called backdoors. How do you know if your software/hardware doesn't have a backdoor? I guess most will never know that answer.
The pipeline hack would have been custom made for the job, if it happened as advertised in msm, especially on such a high profile target. These are called APT groups. These are your cream of the crop hackers. Often they actually are state sponsored, or even governments themselves. These guys can get anywhere. All the billions invested into cybersecurity for both offensive and defensive opportunities has culminated in the creation of ATP groups. It would have consisted of multiple areas that require a very high level of knowledge and experience to understand and bring together, which is why hackers have gone down in pop culture as mythical figures, because when you actually meet someone who can take down a corporation supposedly hidden behind MILLIONS and MILLIONS of dollars worth of security and protection with himself and maybe a few other guys, that mythical figure kinda has some sense behind it.
I'm not sure if you've looked into Cyber Polygon? I wouldn't get carried away with such a far-out sinister plot as some evildoers hidden in the shadows somewhere wanting to bring the world down. Cyber Polygon has explicitly talked about a whole array of real-world exercises that are designed to bring down whole infrastructures as and when necessary. And then you have the ongoing economical/financial/corporate transformations due to COVID-19 tied in and how convenient it would be to bring down our digital backbones in order to capitalize in the re-shuffling. In a way it sounds plausible, if not completely destructive and insane, to take down critical infrastructure. It's all about being able to implement new digital systems by crumbling archaic analog systems that came before them. How can you remove most of the old without people noticing something isn't right? You create 'the world is crashing down' scenario but for the digital world. Now you have a digital Osama Bin Laden everybody can point their fingers to while the real attackers are the very people telling you to point the finger at digital Osama Bin Laden. Basically put, the enemy is your own government and the established relationships with the corporate world and tied to that the global economy and financial sectors.
Was it a hack by a bogeyman? Or simply your own country attacking itself in order to create the illusion there is a real threat all for ulterior agendas? False flag, maybe? These are the questions.
