Security hacker
 | This article needs additional citations for verification. (November 2007) |
 | This article's tone or style may not reflect the encyclopedic tone used on Wikipedia. (May 2010) |
| Part of a series on |
| Computer hacking |
|---|
In common usage, a hacker is a person who breaks into computers and computer networks, either for profit or motivated by the challenge.[1] The subculture that has evolved around hackers is often referred to as the computer underground but is now an open community.[2]
Other uses of the word hacker exist that are not related to computer security (computer programmer and home computer hobbyists), but these are rarely used by the mainstream media because of the common stereotype that is in TV and movies. Some would argue that the people that are now considered hackers are not hackers, as before the media described the person who breaks into computers as a hacker there was a hacker community. This group was a community of people who had a large interest in computer programming, often sharing, without restrictions, the source code for the software they wrote. These people now refer to the cyber-criminal hackers as "crackers"[3].
History
In today society understanding the term Hacker is complicated because it has many different definitions. The term Hacker can be traced back to MIT (Massachusetts Institute Technology). MIT was the first institution to offer a course in computer programming and computer science and it is here in 1960 where a group of MIT students taking a lab on Artificial Intelligence first coined this word. These students called themselves hackers because they were able to take programs and have them perform action not intended for that program. “The term was developed on the basis of a particle joke and feeling of excitement because the team member would “hack away” at the keyboard hours at a time.” (Moore R., 2006).[4]
Hacking developed alongside "Phone Phreaking", a term referred to exploration of the phone network without authorization, and there has often been overlap between both technology and participants. The first recorded hack was accomplished by "Joe Engressia" also known as The Whistler. Engressia is known as the grandfather of Phreaking. His hacking technique was that he could perfectly whistle a tone into a phone and make free call.[5] Bruce Sterling traces part of the roots of the computer underground to the Yippies, a 1960s counterculture movement which published the Technological Assistance Program (TAP) newsletter. [6]. Other sources of early 70s hacker culture can be traced towards more beneficial forms of hacking, including MIT labs or the homebrew club, which later resulted in such things as early personal computers or the open source movement.
Artifacts and customs
The computer underground[1] is heavily dependent on technology. It has produced its own slang and various forms of unusual alphabet use, for example 1337speak. Writing programs and performing other activities to support these views is referred to as hacktivism. Some go as far as seeing illegal cracking ethically justified for this goal; a common form is website defacement. The computer underground is frequently compared to the Wild West.[7] It is common among hackers to use aliases for the purpose of concealing identity, rather than revealing their real names.
Hacker groups and conventions
The computer underground is supported by regular real-world gatherings called hacker conventions or "hacker cons". These drawn many people every year including SummerCon (Summer), DEF CON, HoHoCon (Christmas), ShmooCon (February), BlackHat, Hacker Halted, and H.O.P.E..[citation needed]. In the early 1980s Hacker Groups became popular, Hacker groups provided access to information and resources, and a place to learn from other members. Hackers could also gain credibility by being affiliated with a group.[8] Hackers could also gain credibility by being affiliated with an elite group.[8]
Hacker attitudes
Several subgroups of the computer underground with different attitudes and aims use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree. Eric S. Raymond (author of The New Hacker's Dictionary) advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as one wider hacker culture, a view harshly rejected by Raymond himself. Instead of a hacker/cracker dichotomy, they give more emphasis to a spectrum of different categories, such as white hat, grey hat, black hat and script kiddie. In contrast to Raymond, they usually reserve the term cracker. According to (Clifford R.D. 2006) a cracker or cracking is to " gain unauthorized access to a computer in order to commit another crime such as destroying information contianed in that system"e).[9] These subgroups may also defined by the legal status of their activities.[10]
According to Steven Levy an American journalist who has written several books on computers, technology, cryptography, and cybersecurity said most hacker motives are reflected by the Hackers Ethic. These ethic are as follows:"
- Access to computers and anything that might teach you something about the way the world works should be unlimited and total.always yield to the Hands-on imperative!
- All information should be free.
- Mistrust authority and promote decentralization.
- Hackers should be judged by their hacking, not bogus criteria such as degrees, age, race, or position.
- You can create art and beauty on a computer.
- Computers can change your life for the better."[5]
White hat
A white hat hacker breaks security for non-malicious reasons, for instance testing their own security system. This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. Often, this type of 'white hat' hacker is called an ethical hacker. The International Council of Electronic Commerce Consultants, also known as the EC-Council has developed certifications, courseware, classes, and online training covering the diverse arena of Ethical Hacking.[10]
Grey hat
A gray hat hacker is a combination of a Black Hat Hacker and a White Hat Hacker. A Grey Hat Hacker will surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked. Then they will offer to repair their system for a small fee.[4]
Blue Hat
A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.[11][12][13]
Black hat
A black hat hacker is someone who breaks computer security without authorization or uses technology (usually a computer, phone system or network) for vandalism, credit card fraud, identity theft, piracy, or other types of illegal activity.[10][14]
Elite (or known as 1337 or 31337 in 1337_speak)
Elite is a term used to describe the most advanced hackers who are said to be on "the cutting edge" of computing and network technology. These would be individuals in the earliest 2.5 percentile of the technology adoption lifecycle curve, referred to as "innovators." As script kiddies and noobs utilize and exploit weaknesses in systems discovered by others, elites are they who bring about the initial discovery.
Script kiddie
A script kiddie is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept—hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child—an individual lacking knowledge and experience, immature).[14]
Neophyte
A neophyte or "newbie" is a term used to describe someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.[4]
Hacktivism
A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks. In more extreme cases, hacktivism is used as tool for Cyberterrorism.
Common methods
A typical approach in an attack on Internet-connected system is:
- Network enumeration: Discovering information about the intended target.
- Vulnerability analysis: Identifying potential ways of attack.
- Exploitation: Attempting to compromise the system by employing the vulnerabilities found through the vulnerability analysis.[15]
In order to do so, there are several recurring tools of the trade and techniques used by computer criminals and security experts.
Security exploit
A security exploit is a prepared application that takes advantage of a known weakness. Common examples of security exploits are SQL injection, Cross Site Scripting and Cross Site Request Forgery which abuse security holes that may result from substandard programming practice. Other exploits would be able to be used through FTP, HTTP, PHP, SSH, Telnet and some web-pages. These are very common in website/domain hacking.
Vulnerability scanner
A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are "open" or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewalls defend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)
Password cracking
Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.
Packet sniffer
A packet sniffer is an application that captures data packets, which can be used to capture passwords and other data in transit over the network.
Spoofing attack
A spoofing attack involves one program, system, or website successfully masquerading as another by falsifying data and thereby being treated as a trusted system by a user or another program. The purpose of this is usually to fool programs, systems, or users into revealing confidential information, such as user names and passwords, to the attacker.
Rootkit
A rootkit is designed to conceal the compromise of a computer's security, and can represent any of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Rootkits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.
Social engineering
Social Engineering is the art of getting persons to reveal sensitive information about a system. This is usually done by impersonating someone or by convincing people to believe you have permissions to obtain such information.
Trojan horse
A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A trojan horse can be used to set up a back door in a computer system such that the intruder can gain access later. (The name refers to the horse from the Trojan War, with conceptually similar function of deceiving defenders into bringing an intruder inside.)
Virus
A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Therefore, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells.
While some are harmless or mere hoaxes most computer viruses are considered malicious.
Worm
Like a virus, a worm is also a self-replicating program. A worm differs from a virus in that it propagates through computer networks without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Many people conflate the terms "virus" and "worm", using them both to describe any self-propagating program.
Key loggers
A keylogger is a tool designed to record ('log') every keystroke on an affected machine for later retrieval. Its purpose is usually to allow the user of this tool to gain access to confidential information typed on the affected machine, such as a user's password or other private data. Some key loggers uses virus-, trojan-, and rootkit-like methods to remain active and hidden. However, some key loggers are used in legitimate ways and sometimes to even enhance computer security. As an example, a business might have a key logger on a computer that was used as at a Point of Sale and data collected by the key logger could be use for catching employee fraud.
Notable intruders and criminal hackers
Notable Security Hackers
Kevin Mitnick
Kevin Mitnick is a computer security consultant and author, formerly the most wanted computer criminal in United States history.[16]
Eric Corley
Eric Corley (also known as Emmanuel Goldstein) is the long standing publisher of 2600: The Hacker Quarterly. He is also the founder of the H.O.P.E. conferences. He has been part of the hacker community since the late '70s.
Fyodor
Gordon Lyon, known by the handle Fyodor, authored the Nmap Security Scanner as well as many network security books and web sites. He is a founding member of the Honeynet Project and Vice President of Computer Professionals for Social Responsibility.
Solar Designer
Solar Designer is the pseudonym of the founder of the Openwall Project.
Michał Zalewski
Michał Zalewski (lcamtuf) is a prominent security researcher.
Gary McKinnon
Gary McKinnon is a British hacker facing extradition to the United States to face charges of perpetrating what has been described as the "biggest military computer hack of all time".[17]
Hacking and the media
|
Hacker magazines
The most notable hacker-oriented magazine publications are Phrack, Hakin9 and 2600: The Hacker Quarterly. While the information contained in hacker magazines and ezines was often outdated, they improved the reputations of those who contributed by documenting their successes.[8]
Hackers in fiction
Hackers often show an interest in fictional cyberpunk and cyberculture literature and movies. Absorption of fictional pseudonyms, symbols, values, and metaphors from these fictional works is very common.[citation needed]
Books portraying hackers:
- The cyberpunk novels of William Gibson — especially the Sprawl Trilogy — are very popular with hackers.[18]
- Hackers (short stories)
- Snow Crash
- Helba from the .hack manga and anime series.
- Little Brother by Cory Doctorow
- Rice Tea by Julien McArdle
- Lisbeth Salander in Men who hate women by Stieg Larsson
Films also portray hackers: Template:Multicol
Non-fiction books
- Hacking: The Art of Exploitation, Second Edition by Jon Erickson
- The Hacker Crackdown
- The Art of Intrusion by Kevin D. Mitnick
- The Art of Deception by Kevin D. Mitnick
- Takedown
- The Hacker's Handbook
- The Cuckoo's Egg by Clifford Stoll
- Underground by Suelette Dreyfus
Fiction books
See also
References
- Taylor, 1999
- Taylor, Paul A. (1999). Hackers. Routledge. ISBN 9780415180726.
- ^ a b Sterling, Bruce (1993). "Part 2(d)". The Hacker Crackdown. McLean, Virginia: IndyPublish.com. p. 61. ISBN 1-4043-0641-2.
- ^ Blomquist, Brian (May 29, 1999). "FBI's Web Site Socked as Hackers Target Feds". New York Post. Retrieved on October 21, 2008.
- ^ S. Raymond, Eric. "Jargon File: Cracker". Retrieved 2010-05-08.
Coined ca. 1985 by hackers in defense against journalistic misuse of hacker
- ^ a b c Moore, Robert (2006). Cybercrime:Investigating High-Technology Computer Crime. Cincinnati, Ohio: Anderson Publishing. Cite error: The named reference "Cybercrime:Investigating High-Technology Computer Crime" was defined multiple times with different content (see the help page).
- ^ a b Kizza, Joseph M. (2005). Computer Network Security. New York, LLC: Springer-Verlag.
- ^ TAP Magazine Archive. http://servv89pn0aj.sn.sourcedns.com/~gbpprorg/2600/TAP/
- ^ Tim Jordan, Paul A. Taylor (2004). Hacktivism and Cyberwars. Routledge. pp. 133–134. ISBN 9780415260039.
Wild West imagery has permeated discussions of cybercultures.
- ^ a b c Thomas, Douglas. Hacker Culture. University of Minnesota Press. p. 90. ISBN 9780816633463. Cite error: The named reference "thomas" was defined multiple times with different content (see the help page).
- ^ Clifford, Ralph D. (2006). Cybercrime:The Investigation, Prosecution and Defense of a Computer-Related Crime Second Edition. Durham, North Carolina: Carolina Academic Press.
- ^ a b c Wilhelm, Douglas. "2". Professional Penetration Testing. Syngress Press. p. 503. ISBN 9781597494250.
- ^ "Blue hat hacker Definition". PC Magazine Encyclopedia. Retrieved 31 May 2010.
A security professional invited by Microsoft to find vulnerabilities in Windows.
- ^ Fried, Ina (June 15, 2005). ""Blue Hat" summit meant to reveal ways of the other side". Microsoft meets the hackers. CNET News. Retrieved 31 May 2010.
- ^ Markoff, John (October 17, 2005). "At Microsoft, Interlopers Sound Off on Security". New York Times. Retrieved 31 May 2010.
- ^ a b Andress, Mandy. CIW Security Professional. New York, NY: Hungry Minds, Inc. p. 10. ISBN 0764548220.
{{cite book}}:|access-date=requires|url=(help); More than one of|pages=and|page=specified (help); Unknown parameter|coauthors=ignored (|author=suggested) (help) - ^ Hacking approach
- ^ "Kevin Mitnick sentenced to nearly four years in prison; computer hacker ordered to pay restitution ..." (Press release). United States Attorney's Office, Central District of California. 9 August 1999. Retrieved 10 April 2010.
- ^ Boyd, Clark (30 July 2008). "Profile: Gary McKinnon". BBC News. Retrieved 2008-11-15.
- ^ Staples, Brent (May 11, 2003). "A Prince of Cyberpunk Fiction Moves Into the Mainstream". Retrieved 2008-08-30.
Mr. Gibson's novels and short stories are worshiped by hackers
Related literature
- Kevin Beaver. Hacking For Dummies.
- Code Hacking: A Developer's Guide to Network Security by Richard Conway, Julian Cordingley
- “Dot.Con: The Dangers of Cyber Crime and a Call for Proactive Solutions,” by Johanna Granville, Australian Journal of Politics and History, vol. 49, no. 1. (Winter 2003), pp. 102–109.
- Katie Hafner & John Markoff (1991). Cyberpunk: Outlaws and Hackers on the Computer Frontier. Simon & Schuster. ISBN 0-671-68322-5.
- David H. Freeman & Charles C. Mann (1997). @ Large: The Strange Case of the World's Biggest Internet Invasion. Simon & Schuster. ISBN 0-684-82464-7.
- Suelette Dreyfus (1997). Underground: Tales of Hacking, Madness and Obsession on the Electronic Frontier. Mandarin. ISBN 1-86330-595-5.
- Bill Apro & Graeme Hammond (2005). Hackers: The Hunt for Australia's Most Infamous Computer Cracker. Five Mile Press. ISBN 1-74124-722-5.
- Stuart McClure, Joel Scambray & George Kurtz (1999). Hacking Exposed. Mcgraw-Hill. ISBN 0-07-212127-0.
- Michael Gregg (2006). Certfied Ethical Hacker. Pearson. ISBN 978-0789735317.
- Clifford Stoll (1990). The Cuckoo's Egg. The Bodley Head Ltd. ISBN 0-370-31433-6.