Hacker (computer security)
From Wikipedia, the free encyclopedia
This article is part of a series on |
Computer hacking |
---|
History |
Hacker ethic |
Computer crime |
Hacking tools |
Malware |
Computer security |
Groups |
Contents
History
Further information: Timeline of computer security hacker history
Bruce Sterling traces part of the roots of the computer underground to the Yippies, a 1960s counterculture movement which published the Technological Assistance Program (TAP) newsletter.[citation needed] TAP was a phone phreaking
newsletter that taught the techniques necessary for the unauthorized
exploration of the phone network. Many people from the phreaking
community are also active in the hacking community even today, and vice
versa.[citation needed]Classifications
Several subgroups of the computer underground with different attitudes use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree.Eric S. Raymond (author of The New Hacker's Dictionary) advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as one wider hacker culture, a view harshly rejected by Raymond himself. Instead of a hacker/cracker dichotomy, they give more emphasis to a spectrum of different categories, such as white hat, grey hat, black hat and script kiddie. In contrast to Raymond, they usually reserve the term cracker for more malicious activity.
According to Ralph D. Clifford, a cracker or cracking is to "gain unauthorized access to a computer in order to commit another crime such as destroying information contained in that system".[6] These subgroups may also be defined by the legal status of their activities.[7]
White hat
Main article: White hat
A white hat hacker
breaks security for non-malicious reasons, perhaps to test their own
security system or while working for a security company which makes
security software. The term "white hat" in Internet slang refers to an ethical hacker. This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. The EC-Council,[8]
also known as the International Council of Electronic Commerce
Consultants, is one of those organizations that have developed
certifications, course-ware, classes, and online training covering the
diverse arena of Ethical Hacking.[7]Black hat
A "black hat" hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005).[9] Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal".[10] Black hat hackers break into secure networks to destroy data or make the network unusable for those who are authorized to use the network. Black hat hackers also are referred to as the "crackers" within the security industry and by modern programmers. Crackers keep the awareness of the vulnerabilities to themselves and do not notify the general public or manufacturer for patches to be applied. Individual freedom and accessibility is promoted over privacy and security. Once they have gained control over a system, they may apply patches or fixes to the system only to keep their reigning control. Richard Stallman invented the definition to express the maliciousness of a criminal hacker versus a white hat hacker that performs hacking duties to identify places to repair.[11]Grey hat
Main article: Grey hat
A grey hat hacker is a combination of a black hat and a white hat
hacker. A grey hat hacker may surf the internet and hack into a computer
system for the sole purpose of notifying the administrator that their
system has a security defect, for example. Then they may offer to
correct the defect for a fee.[10]Elite hacker
A social status among hackers, elite is used to describe the most skilled. Newly discovered exploits will circulate among these hackers. Elite groups such as Masters of Deception conferred a kind of credibility on their members.[12]Script kiddie
A script kiddie (also known as a skid or skiddie) is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept—hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child—an individual lacking knowledge and experience, immature).[13] A decoy and a bored internet buff, who is on the quest for aimless pleasure; a Script kiddie is someone who looks out to exploit vulnerabilities with not so much as trying to gain access to administrative or root access to the system. However, achieving it nonetheless and enjoying the enormous consequential implications thereof, which might be worth over millions to the affected party but is trivial and insignificant in the eyes of this buffoon whatsoever. An intruder, at the core, a Script Kiddie remains an unwanted invader whose twenty minutes of aimless pleasure pursuit can cost somebody else twenty years of his hard work and perseverance. Script kiddies can hence be potentially dangerous as compared to the hackers because by merely modifying the script whether it is in any language, they can destroy your system or even cause a major loss, the main reason being that they do not know what effect their changes in the web scripts would have on others. Script kiddies; grab any opportunity that comes their way. Though their methods of serving their intentions are simple, they can cause immense damage without even getting identified. This random opportunistic vandalism and theft can be very dangerous and needs to be brought in our areas of concern when we talk about safety of your computer against computer hacking, internet crimes, privacy, or theft in the true sense of the term. Though there is no such master program which ensures complete security against such amateur yet skillful script kiddies, one can at most do his best to ensure that the chances of their system being hacked is reduced to minimum by using various techniques and tactics. As told earlier a script kiddie is not actually an expert but a complete amateur in this field, who keeps his tool simple. Their trick remains simpler, that is, modification of a program written by a pro. The programs are easily available on the internet and with a little bit of modification they become dangerous viruses out on a roll on the internet spreading as fast as they can. The work is indeed simple and one does not need to be computer expert to master all the harmful tasks. The need of the hour is to restrict the toolkit available to the common. The script kiddies usually search for loopholes. They do not bear any grudge against anyone in particular. Rather they target anyone or any IP address from the long list of IP addresses available to them. The tools could be even made simpler. As reported by an expert at Kaspersky Lab, David Jacoby, that now creating a harmful program was just a matter of few clicks or you could say that it requires only two clicks to create a program that could harm any computer. “Today I found a new tool which will allow anyone to create a malicious program with just a few simple mouse clicks. This being among the latest news that has only made the job of a script kiddie all the more easier.”[14]Neophyte
A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.[10]Blue hat
A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.[15][16][17]Hacktivist
A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks.Nation state
Intelligence agencies and cyberwarfare operatives of nation states.[18]Organized criminal gangs
Groups of hackers that carry out organized criminal activities for profit.[18]Attacks
Main article: Computer insecurity
Computer security |
---|
Computer insecurity |
- Network enumeration: Discovering information about the intended target.
- Vulnerability analysis: Identifying potential ways of attack.
- Exploitation: Attempting to compromise the system by employing the vulnerabilities found through the vulnerability analysis.[19]
Security exploits
Main article: Exploit (computer security)
A security exploit is a prepared application that takes advantage of a known weakness.[20] Common examples of security exploits are SQL injection, Cross Site Scripting and Cross Site Request Forgery
which abuse security holes that may result from substandard programming
practice. Other exploits would be able to be used through FTP, HTTP, PHP, SSH, Telnet and some web-pages. These are very common in website/domain hacking.Techniques
This section does not cite any references or sources. (August 2011) |
- Vulnerability scanner
- A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are "open" or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewalls defend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)
- Password cracking
- Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.
- Packet sniffer
- A packet sniffer is an application that captures data packets, which can be used to capture passwords and other data in transit over the network.
- Spoofing attack (Phishing)
- A spoofing attack involves one program, system, or website successfully masquerading as another by falsifying data and thereby being treated as a trusted system by a user or another program. The purpose of this is usually to fool programs, systems, or users into revealing confidential information, such as user names and passwords, to the attacker.
- Rootkit
- A rootkit is designed to conceal the compromise of a computer's security, and can represent any of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Rootkits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.
- Social engineering
- When a hacker, typically a black hat, is in the second stage of the targeting process, he or she will typically use some social engineering tactics to get enough information to access the network. A common practice for hackers who use this technique, is to contact the system administrator and play the role of a user who cannot get access to his or her system.
- Hackers who use this technique have to be quite savvy and choose the
words they use carefully, in order to trick the system administrator
into giving them information. In some cases only an employed help desk
user will answer the phone and they are generally easy to trick. Another
typical hacker approach is for the hacker to act like a very angry
supervisor and when his/her authority is questioned they will threaten
the help desk user with their job. Social engineering is very effective
because users are the most vulnerable part of an organization. All the
security devices and programs in the world won't keep an organization
safe if an employee gives away a password. Black hat hackers take
advantage of this fact. Social engineering can also be broken down into
four sub-groups. These are intimidation, helpfulness, technical, and
name-dropping:
- Intimidation As stated above, with the angry supervisor, the hacker attacks the person who answers the phone with threats to their job. Many people at this point will accept that the hacker is a supervisor and give them the needed information.
- Helpfulness Opposite to intimidation, helpfulness is taking advantage of a person's natural instinct to help someone with a problem. The hacker will not get angry and instead act very distressed and concerned. The help desk is the most vulnerable to this type of social engineering, because it generally has the authority to change or reset passwords, which is exactly what the hacker needs.
- Name-dropping Simply put, the hacker uses the names of advanced users as "key words", and gets the person who answers the phone to believe that they are part of the company because of this. Some information, like web page ownership, can be obtained easily on the web. Other information such as president and vice president names might have to be obtained via dumpster diving.
- Technical Using technology is also a way to get information. A hacker can send a fax or an email to a legitimate user in hopes to get a response containing vital information. Many times the hacker will act like he/she is involved with law enforcement and needs certain data for record keeping purposes or investigations.
- Trojan horses
- A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A trojan horse can be used to set up a back door in a computer system such that the intruder can gain access later. (The name refers to the horse from the Trojan War, with the conceptually similar function of deceiving defenders into bringing an intruder inside.)
- Computer virus
- A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Therefore, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells.
- While some are harmless or mere hoaxes, most computer viruses are considered malicious.
- Computer worm
- Like a virus, a worm is also a self-replicating program. A worm differs from a virus in that it propagates through computer networks without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Many people conflate the terms "virus" and "worm", using them both to describe any self-propagating program.
- Key loggers
- A key logger is a tool designed to record ("log") every keystroke on an affected machine for later retrieval. Its purpose is usually to allow the user of this tool to gain access to confidential information typed on the affected machine, such as a user's password or other private data. Some key loggers use virus-, trojan-, and rootkit-like methods to remain active and hidden. However, some key loggers are used in legitimate ways and sometimes to even enhance computer security. As an example, a business might have a key logger on a computer used at a point of sale and data collected by the key logger could be used for catching employee fraud.
- A thorough examination of tools, uses and procedures may be found in the Course workbook by Cengage Learning as part of the E|CSA certification knowledge-base.[21]
Notable intruders and criminal hackers
Main article: List of convicted computer criminals
Notable security hackers
Main article: List of hackers
- Jacob Appelbaum is an Advocate, Security Researcher, and Developer for the Tor project. He speaks internationally for usage of Tor by human rights groups and others concerned about internet anonymity and censorship.
- Eric Corley (also known as Emmanuel Goldstein) is the longstanding publisher of 2600: The Hacker Quarterly. He is also the founder of the H.O.P.E. conferences. He has been part of the hacker community since the late '70s.
- Ed Cummings (also known as Bernie S) is the longstanding writer for 2600: The Hacker Quarterly. He set legal precedents after denial of both a bail hearing and a speedy trial in 1995. Bernie S was charged with possession of technology which could be used for fraudulent purposes.
- Dan Kaminsky is a DNS expert who exposed multiple flaws in the protocol and investigated Sony's rootkit security issues in 2005. He has spoken in front of the US Senate on technology issues.
- Andrew Auernheimer, sentenced to 3 years in prison, is a grey hat hacker whose security group Goatse Security exposed a flaw in AT&T's iPad security.
- Gordon Lyon, known by the handle Fyodor, authored the Nmap Security Scanner as well as many network security books and web sites. He is a founding member of the Honeynet Project and Vice President of Computer Professionals for Social Responsibility.
- Gary McKinnon is a Scottish hacker facing extradition to the United States to face charges of perpetrating what has been described as a travesty of justice with many in the UK "show a little bit of compassion" to rule sooner who also suffers from Asperger syndrome.[22]
- Kevin Mitnick is a computer security consultant and author, formerly the most wanted computer criminal in United States history.[23]
- Rafael Núñez aka RaFa was a notorious most wanted hacker by the FBI since 2001.
- Meredith L. Patterson is a well-known technologist and biohacker who has presented research with Dan Kaminsky and Len Sassaman at many international security and hacker conferences.
- Len Sassaman was a Belgian computer programmer and technologist who was also a privacy advocate.
- Solar Designer is the pseudonym of the founder of the Openwall Project.
- Michał Zalewski (lcamtuf) is a prominent security researcher.
Customs
The computer underground[1] has produced its own slang and various forms of unusual alphabet use, for example 1337speak. Political attitude usually includes views for freedom of information, freedom of speech, a right for anonymity and most have a strong opposition against copyright.[citation needed] Writing programs and performing other activities to support these views is referred to as hacktivism. Some go as far as seeing illegal cracking ethically justified for this goal; a common form is website defacement. The computer underground is frequently compared to the Wild West.[24] It is common among hackers to use aliases for the purpose of concealing identity, rather than revealing their real names.Hacker groups and conventions
Main articles: Hacker conference and Hacker group
The computer underground is supported by regular real-world gatherings called hacker conventions or "hacker cons". These draw many people every year including SummerCon (Summer), DEF CON, HoHoCon (Christmas), ShmooCon (February), BlackHat, Chaos Computer Club, AthCon, Hacker Halted, and H.O.P.E..[citation needed].
Local Hackfest groups organize and compete to develop skills to send a
team to a prominent convention to compete in group pentesting, exploit
and forensics on a wider scale. It was in the early 1980s that hacker
groups became popular, hacker groups provided access to information and
resources, and a place to learn from other members. BBS systems like
Utopias provided a platform for information sharing via dialup. Hackers
could also gain credibility by being affiliated with an elite group.[25]Hacking and the law
Netherlands
- Article 138ab of Wetboek van Strafrecht prohibits computervredebreuk which is defined as intruding an automated work or a part thereof with intention and against the law. Intrusion is defined as access by means of:
Hacking and the media
This section is in a list format that may be better presented using prose. (August 2008) |
Hacker magazines
Main category: Hacker magazines
The most notable hacker-oriented magazine publications are Phrack, Hakin9 and 2600: The Hacker Quarterly. While the information contained in hacker magazines and ezines was often outdated, they improved the reputations of those who contributed by documenting their successes.[25]Hackers in fiction
See also: List of fictional hackers
Hackers often show an interest in fictional cyberpunk and cyberculture literature and movies. Absorption of fictional pseudonyms, symbols, values, and metaphors from these fictional works is very common.[citation needed]Books portraying hackers:
- The cyberpunk novels of William Gibson—especially the Sprawl trilogy—are very popular with hackers.[27]
- Hackers (short stories)
- Helba from the .hack manga and anime series.
- Little Brother by Cory Doctorow
- Merlin, the protagonist of the second series in The Chronicles of Amber by Roger Zelazny is a young immortal hacker-mage prince who has the ability to traverse shadow dimensions.
- Lisbeth Salander in The Girl with the Dragon Tattoo by Stieg Larsson
- Snow Crash
- Alice from Kami-sama no Memo-chō
Non-fiction books
- Hacking: The Art of Exploitation, Second Edition by Jon Erickson
- The Hacker Crackdown
- The Art of Intrusion by Kevin D. Mitnick
- The Art of Deception by Kevin D. Mitnick
- Ghost in the Wires: My Adventures as the World's Most Wanted Hacker by Kevin D. Mitnick
- The Hacker's Handbook
- The Cuckoo's Egg by Clifford Stoll
- Underground by Suelette Dreyfus
- Stealing the Network: How to Own the Box, How to Own an Identity, and How to Own an Continent by various authors
Fiction books
See also
References
- ^ Jump up to: a b Sterling, Bruce (1993). "Part 2(d)". The Hacker Crackdown. McLean, Virginia: IndyPublish.com. p. 61. ISBN 1-4043-0641-2.
- Jump up ^ Blomquist, Brian (May 29, 1999). "FBI's Web Site Socked as Hackers Target Feds". New York Post.
- Jump up ^ "The Hacker's Dictionary". Retrieved 23 May 2013.
- Jump up ^ Raymond, Eric S. "Jargon File: Cracker". "Coined ca. 1985 by hackers in defense against journalistic misuse of hacker"
- Jump up ^ Political notes from 2012: September–December. stallman.org
- Jump up ^ Clifford, D. (2011). Cybercrime: The Investigation, Prosecution and Defense of a Computer-Related Crime. Durham, North Carolina: Carolina Academic Press. ISBN 1594608539.
- ^ Jump up to: a b Wilhelm, Douglas (2010). "2". Professional Penetration Testing. Syngress Press. p. 503. ISBN 978-1-59749-425-0.
- Jump up ^ EC-Council. eccouncil.org
- Jump up ^ Moore, Robert (2005). Cybercrime: Investigating High Technology Computer Crime. Matthew Bender & Company. p. 258. ISBN 1-59345-303-5.Robert Moore
- ^ Jump up to: a b c Moore, Robert (2006). Cybercrime: Investigating High-Technology Computer Crime (1st ed.). Cincinnati, Ohio: Anderson Publishing. ISBN 978-1-59345-303-9.
- Jump up ^ O'Brien, Marakas, James, George (2011). New York, NY: McGraw-Hill/ Irwin. pp. 536–537. ISBN 978-0-07-752217-9. Missing or empty
|title=
(help) - Jump up ^ Thomas, Douglas (2002). Hacker Culture. University of Minnesota Press. ISBN 978-0-8166-3346-3.
- Jump up ^ Andress, Mandy; Cox, Phil; Tittel, Ed (2001). CIW Security Professional. New York, NY: Wiley. p. 638. ISBN 0-7645-4822-0.
- Jump up ^ cite book |title=CIW Security Professional |last=Jacoby |first=David |coauthors=Cox, Phil; Tittel, Ed |year=2013 |publisher=Securelist|webpage=http://www.securelist.com/en/blog/2163/New_tool_allows_script_kiddies_to_build_botnets_via_Twitter
- Jump up ^ "Blue hat hacker Definition". PC Magazine Encyclopedia. Retrieved May 31, 2010. "A security professional invited by Microsoft to find vulnerabilities in Windows."
- Jump up ^ Fried, Ina (June 15, 2005). "Blue Hat summit meant to reveal ways of the other side". Microsoft meets the hackers. CNET News. Retrieved May 31, 2010.
- Jump up ^ Markoff, John (October 17, 2005). "At Microsoft, Interlopers Sound Off on Security". New York Times. Retrieved May 31, 2010.
- ^ Jump up to: a b Chabrow, Eric (February 25, 2012). "7 Levels of Hackers: Applying An Ancient Chinese Lesson: Know Your Enemies". GovInfo Security. Retrieved February 27, 2012.
- Jump up ^ Gupta, Ajay; Klavinsky, Thomas and Laliberte, Scott (March 15, 2002) Security Through Penetration Testing: Internet Penetration. informit.com
- Jump up ^ Rodriguez, Chris; Martinez, Richard. "The Growing Hacking Threat to Websites: An Ongoing Commitment to Web Application Security". Frost & Sullivan. Retrieved 13 August 2013.
- Jump up ^ Press, EC-Council (2011). Penetration Testing: Procedures & Methodologies. Clifton, NY: CENGAGE Learning. ISBN 1435483677.
- Jump up ^ "Gary McKinnon extradition ruling due by 16 October". BBC News. September 6, 2012. Retrieved September 25, 2012.
- Jump up ^ "Kevin Mitnick sentenced to nearly four years in prison; computer hacker ordered to pay restitution ..." (Press release). United States Attorney's Office, Central District of California. August 9, 1999. Retrieved April 10, 2010.
- Jump up ^ Jordan, Tim and Taylor, Paul A. (2004). Hacktivism and Cyberwars. Routledge. pp. 133–134. ISBN 978-0-415-26003-9. "Wild West imagery has permeated discussions of cybercultures."
- ^ Jump up to: a b Thomas, Douglas (2003). Hacker Culture. University of Minnesota Press. p. 90. ISBN 978-0-8166-3346-3.
- Jump up ^ Artikel 138ab. Wetboek van Strafrecht, December 27, 2012
- Jump up ^ Staples, Brent (May 11, 2003). "A Prince of Cyberpunk Fiction Moves Into the Mainstream". The New York Times. "Mr. Gibson's novels and short stories are worshiped by hackers"
Related literature
- Taylor, Paul A. (1999). Hackers. Routledge. ISBN 978-0-415-18072-6.
- Kevin Beaver (January 12, 2010). Hacking For Dummies. ISBN 978-0-7645-5784-2.
- Richard Conway, Julian Cordingley. Code Hacking: A Developer's Guide to Network Security. ISBN 978-1-58450-314-9.
- “Dot.Con: The Dangers of Cyber Crime and a Call for Proactive Solutions,” by Johanna Granville, Australian Journal of Politics and History, vol. 49, no. 1. (Winter 2003), pp. 102–109.
- Katie Hafner & John Markoff (1991). Cyberpunk: Outlaws and Hackers on the Computer Frontier. Simon & Schuster. ISBN 0-671-68322-5.
- David H. Freeman & Charles C. Mann (1997). @ Large: The Strange Case of the World's Biggest Internet Invasion. Simon & Schuster. ISBN 0-684-82464-7.
- Suelette Dreyfus (1997). Underground: Tales of Hacking, Madness and Obsession on the Electronic Frontier. Mandarin. ISBN 1-86330-595-5.
- Bill Apro & Graeme Hammond (2005). Hackers: The Hunt for Australia's Most Infamous Computer Cracker. Five Mile Press. ISBN 1-74124-722-5.
- Stuart McClure, Joel Scambray & George Kurtz (1999). Hacking Exposed. Mcgraw-Hill. ISBN 0-07-212127-0.
- Michael Gregg (2006). Certfied Ethical Hacker. Pearson. ISBN 978-0-7897-3531-7.
- Clifford Stoll (1990). The Cuckoo's Egg. The Bodley Head Ltd. ISBN 0-370-31433-6.
- Shon Harris, Allen Harper, Chris Eagle, Jonathan Ness & Michael Lester (2004). Gray Hat Hacking : The Ethical Hacker's Handbook. McGraw-Hill Osborne Media. ISBN 978-0072257090.
External links
Wikibooks has a book on the topic of: Hacking |
Wikimedia Commons has media related to Hackers. |
- CNN Tech PCWorld Staff (November 2001). Timeline: A 40-year history of hacking from 1960 to 2001
- Discovery Channel Documentary. History of Hacking Documentary video
- sumber: http://en.wikipedia.org/wiki/Hacker_%28computer_security%29
0 komentar:
Posting Komentar