Hackers

To the layman, hackers have a reputation akin to poltergeists -- you notice their presence by the things they destroy. In my opinion, I think a lot of them are misunderstood (see the Hacker's Manifesto). To be a true hacker -ie. to be able to write programs that exploit security holes in browsers and/or operating systems, -requires in-depth knowledge of networking protocols, operating systems and more-than-passing knowledge of C and Assembly Language. This is NOT easy. I've tried writing a few programs and compiling others, and have almost always been frustrated.

Interestingly enough, I think there are few incidents out there of what the public thinks as a typical hacking scenario : a lone teenager, working alone, writing a program from scratch and cracking into some highly secure (until now!) corporate network or even the Pentagon !

The danger comes mostly from the teenager, who downloads some pre-compiled program that hacks or cracks into a system -- just for the hell of it-- or the disgruntled employee out to wreak havoc on the network of his employer -- or former employer.

Nevertheless, the danger is out there, and there are quite a lot of websites out there devoted to just hacking networks. And there are a LOT of pre-compiled programs that you CAN download to accomplish whatever hacking tasks you may have in mind.

An example website is : Exploit World - Micro$oft section

So, what does a hacker look for ? What does he need to know to hack into your network ?

First off, the hacker is NOT a witch doctor. He cannot hack into a system that is turned off, or a network that he has no access to -- that is, a network that is not on the Internet or accessible via dial-up phone lines, and which he has no physical access to.

Second, the hacker must have a motive. Sometimes hackers crack into a network "because they can". But more often than not, they hack into a system to prove a point : to advance their cause, air their grievances, or for plain revenge.

In order for a hacker to penetrate your network, he must have one of these things :

  1. Physical Access to your network -- this means that he could be an employee or a guest who has access to a server or PC on the network, or can log into one of your systems (server or PC) remotely
  2. Dial into the network. If he hacks into the network this way, he may need to be authenticated. Which means that he needs to have a login id and password. A login account and password is easily obtained by running a cracking program, or by borrowing an account from an existing user.
  3. If the hacker is trying to penetrate the system via the Internet, he will need to know the IP address of the target (your system). This can be done using a 'sniffer' program. But more frequently, they already know your address because you have a website on the Internet.
  4. If all the hacker wishes to do is crash your system, or make it inaccessible by other systems on the Internet, he only needs to know your IP address
  5. If the hacker wishes to steal information on your network, or change the content in your network in any way, he will need a valid login account and password (or several accounts and passwords)

    So, as you can see, it really isn't black magic that enables the hacker to get into your system, no matter what Hollywood might tell you, it is, however, a black art.

    Next, we will attempt to categorize the several types of hacking attacks. Read on...