In a security context, a hacker is someone involved in computer security/insecurity, specializing in the discovery of exploits in systems (for exploitation or prevention), or in obtaining or preventing unauthorized access to systems through skills, tactics and detailed knowledge. In the most common general form of this usage, "hacker" refers to a black-hat hacker (a malicious or criminal hacker). There are also ethical hackers (more commonly referred to as white hats), and those more ethically ambiguous (grey hats). To disambiguate the term hacker, often cracker is used instead, referring either to computer security hacker culture as a whole to demarcate it from the academic hacker culture (such as by Eric S. Raymond^[1]) or specifically to make a distinction within the computer security context between black-hat hackers and the more ethically positive hackers (commonly known as the white-hat hackers). The context of computer security hacking forms a subculture which is often referred to as the network hacker subculture or simply the computer underground. According to its adherents, cultural values center around the idea of creative and extraordinary computer usage. Proponents claim to be motivated by artistic and political ends, but are often unconcerned about the use of criminal means to achieve them.

History

Artifacts and customs

Contrary to the academic hacker subculture, networking hackers have no inherently close connection to the academic world. They have a tendency to work anonymously and in private. It is common among them to use aliases for the purpose of concealing identity, rather than revealing their real names. This practice is uncommon within and even frowned upon by the academic hacker subculture. Members of the network hacking scene are often being stereotypically described as crackers by the academic hacker subculture, yet see themselves as hackers and even try to include academic hackers in what they see as one wider hacker culture, a view harshly rejected by the academic hacker subculture itself. Instead of a hacker – cracker dichotomy, they give more emphasis to a spectrum of different categories, such as white hat (?ethical hacking?), grey hat, black hat and script kiddie. In contrast to the academic hackers, they usually reserve the term cracker to refer to black hat hackers, or more generally hackers with unlawful intentions.

The network hacking subculture is supported by regular gatherings, so called Hacker cons. These have drawn more and more people every year including SummerCon (Summer), DEF CON, HoHoCon (Christmas), PumpCon (Halloween), H.O.P.E. (Hackers on Planet Earth) and HEU (Hacking at the End of the Universe). They have helped expand the definition and solidify the importance of the network hacker subculture. In Germany, members of the subculture are organized mainly around the Chaos Computer Club.

The subculture has given birth to what its many members consider to be novel forms of art, most notably ascii art. It has also produced its own slang and various forms of unusual alphabet use, for example leetspeak. Both things are usually seen as an especially silly aspect by the academic hacker subculture. In part due to this, the slangs of the two subcultures differ substantially. Political attitude usually includes views for freedom of information, freedom of speech, a right for anonymity and most have a strong opposition against copyright. Writing programs and performing other activities to support these views is referred to as hacktivism by the subculture. Some go as far as seeing illegal cracking ethically justified for this goal; the most common form is website defacement.

The security hackers have also edited some magazines, most notably:

• 2600: The Hacker Quarterly
• Hakin9
• TAP
• Blacklisted 411

Documents

Hackers from the network hacking subculture often show an adherence to fictional cyberpunk and cyberculture literature and movies. Widely recognized works include:

• Hackers (short stories)
• The Hacker Crackdown
• Snow Crash
• William Gibson's Sprawl trilogy
• WarGames
• Cyberpunk, by Katie Hafner and John Markoff
• The Matrix series
• Antitrust
• Hackers
• Enemy of the State
• Sneakers
• Swordfish
• The Net
• The Net 2.0
• Die Hard 4.0
• Untraceable

Absorption of fictional pseudonyms, symbols, values, and metaphors from these fictional works are very common. A non-fictional document with which many members of the subculture identify is the Hacker's Manifesto.

Hacker attitudes

The term "Hacker" may mean simply a person with mastery of computers; however the mass media most often uses "Hacker" as synonymous with a (usually criminal) computer intruder. See hacker, and Hacker definition controversy. In computer security, several subgroups with different attitudes and aims use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree.

White hat

A white hat hacker breaks security for altruistic or at least non-malicious reasons.

Grey hat

A grey hat hacker is a hacker of ambiguous ethics and/or borderline legality, often frankly admitted.

Blue Hat

A blue hat hacker is someone outside computer security consulting firms that are used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.

Black Hat

A black hat hacker is someone who subverts computer security without authorization or who uses technology (usually a computer or the Internet) for terrorism, vandalism (malicious destruction), credit card fraud, identity theft, intellectual property theft, or many other types of crime. This can mean taking control of a remote computer through a network, or software cracking.

Script kiddie

A script kiddie is a person, usually not an expert in computer security, who breaks into computer systems by using pre-packaged automated tools written by others.

Hacktivist

A hacktivist is a hacker who utilizes technology to announce a political message. Web vandalism is not necessarily hacktivism.

Common methods

There are several recurring tools of the trade and techniques used by computer criminals and security experts:

Security exploit

A security exploit is a prepared application that takes advantage of a known weakness.

Vulnerability scanner

A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are "open" or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewalls defend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)

Packet Sniffer

A packet sniffer is an application that captures TCP/IP data packets, which can maliciously be used to capture passwords and other data while it is in transit either within the computer or over the network.

Spoofing attack

A spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining illegitimate access.

Rootkit

A rootkit is a toolkit for hiding the fact that a computer's security has been compromised, is a general description of a set of programs which work to subvert control of an operating system from its legitimate (in accordance with established rules) operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Root kits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.

Social engineering

Social Engineering is simply the art of getting unsuspecting persons to reveal sensitive information about a system. This is usually done by impersonating someone or by convincing people to believe you have permissions to obtain such information. A typical example would be eavesdropping on or discussing company security details at a café. A more subtle method would be via impersonation: requesting promotional material or technical reference material regarding a company's systems while pretending to be co-worker or contractor working under pressure or within unseen limitations.

Trojan horse

A Trojan horse is a program designed as to seem to being or be doing one thing, such as a legitimate software, but actually being or doing another. They are not necessarily malicious programs but can be. A trojan horse can be used to set up a back door in a computer system so that the intruder can return later and gain access. Viruses that fool a user into downloading and/or executing them by pretending to be useful applications are also sometimes called trojan horses. (The name refers to the horse from the Trojan War, with conceptually similar function of deceiving defenders into bringing an intruder inside.) See also Dialer.

Virus

A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Thus, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells.

Worm

Like a virus, a worm is also a self-replicating program. The difference between a virus and a worm is that a worm does not create copies of itself on one system: it propagates through computer networks. After the comparison between computer viruses and biological viruses, the obvious comparison here is to a bacterium. Many people conflate the terms "virus" and "worm", using them both to describe any self-propagating program. It is possible for a program to have the blunt characteristics of both a worm and a virus.

Key loggers

A keylogger is a software program designed to record ('log') every keystroke on the machine on which it runs. Often uses virus-, trojan-, and rootkit-like methods to remain active and hidden from the victim (and possibly self-replicate). The log is later transferred to the 'owner' of the keylogger. Hardware-assisted and hardware-based keyloggers also exist.

Notable intruders and criminal hackers

The 414s

The 414s were a gang of six teenagers named after their Milwaukee, Wisconsin area code, who broke into dozens of computer systems throughout the United States and Canada in 1983. Their exploits included Los Alamos National Laboratory, Sloan-Kettering Cancer Center and Security Pacific Bank. ^[2][3] The incident appeared as the cover story of Newsweek with the title Beware: Hackers at play,^[4] possibly the first mass-media use of the term hacker in the context of computer security. As a result, the U.S. House of Representatives held hearings on computer security and passed several laws ^[5].

Onel A. de Guzman

de Guzman of Philippines brainchild of The ILOVEYOU virus release in May 4, 2006, also known as VBS/Loveletter and Love Bug virus, is a computer virus written in VBScript. The virus is programmed to search all drives which are connected to the infected computer and replace files with the appending to the file name .VBS extension. Infecting 10 percent of all computers connected to the Internet and causing about $5.5 billion in damage. Most of the "damage" was the labor of getting rid of the virus. The Pentagon, CIA, and the British Parliament had to shut down their e-mail systems to get rid of the virus, as did most large corporations. de Guzman's Love Bug was acknowledged as the most cost- damaging virus ever release in realm of cyberspace.

Mark Abene

Mark Abene (also known as Phiber Optik) inspired thousands of teenagers around the country to "study" the internal workings of the United States phone system. One of the founders of the Masters of Deception group.

Dark Avenger

Dark Avenger is the pseudonym of a Bulgarian virus writer who invented polymorphic code in 1992 as a means to circumvent the type of pattern recognition used by Anti-virus software, and nowadays also intrusion detection systems.

John Draper

John Draper (also known as Captain Crunch) is widely credited with evangelizing the use of the 2600 hertz tone generated by whistles distributed in Captain Crunch cereal boxes in the 1970s, and sometimes inaccurately credited with discovering their use. Draper served time in prison for his work, and is believed to have introduced Steve Wozniak to phone phreaking through the 2600Hz tone. Draper now develops anti-spam and security software.

Farid Essebar

Farid Essebar (also known as Diabl0) is the creator of Zotob

Nahshon Even-Chaim

Nahshon Even-Chaim (also known as Phoenix) was a leading member of Australian hacking group The Realm. He targeted US defense and nuclear research computer systems in late 1980s until his capture by Australian Federal Police in 1990. He and fellow Realm members Electron and Nom were the world's first computer intruders prosecuted based on evidence gathered from remote computer intercept.

MaddoxX

MaddoxX was a 20 year old hacker from Maastricht, Netherlands. He successfully hacked into Valve Corporation's Cybercafe Service in April, 2007 and stole thousands of customer's financial records and credit card details by exploiting flaws in Valve's servers. Later that year, MaddoxX hacked into a UK Ticket Holding site and extracted over 50,000 credit card details which he then used for playing online poker and purchasing computer hardware. MaddoxX used remote PC's to cover his activites over the Internet, but was arrested on June 27th, 2008 by the Dutch Police. Damages for the stolen credit card details are at 13 Million Euros.

It is also reported that in 2006 MaddoxX hacked into Activision Inc's servers and stole a developmental copy of Enemy Territory: Quake Wars, which was unreleased at that time.

Markus Hess

Markus Hess is a West German who hacked into United States Military sites and collected information for the KGB; he was eventually tracked down by Clifford Stoll.

Jonathan James

Jonathan James (also known as c0mrade) downloaded $1.7 million dollars worth of software which controlled the International Space Station's life sustaining elements, and intercepted thousands of electronic messages relating to U.S. nuclear activities from the Department of Defense. Sentenced at age 16, he was the youngest person ever incarcerated for cybercrime in the United States.

ne0h

ne0h was reported to have been employed by a Pakistani terrorist with Al-Qaeda connections, in order to steal student information from a Chinese university (reportedly, one comparable to MIT), India's Bhabha Atomic Research Centre, and SIPRNet, the U.S. Department of Defense's Defense Data Network.

Adrian Lamo

Lamo surrendered to federal authorities in 2003 after a brief manhunt, and was charged with nontechnical but surprisingly successful intrusions into computer systems at Microsoft, The New York Times, Lexis-Nexis, MCI WorldCom, SBC, Yahoo!, and others. His methods were controversial, and his full-disclosure-by-media practices led some to assert that he was publicity-motivated.

Vladimir Levin

Vladimir Levin allegedly masterminded the Russian hacker gang that tricked Citibank's computers into spitting out $10 million. To this day, the method used, or even if Vladimir was a mathematician, is unknown.

Kevin Mitnick

Kevin Mitnick was held in jail for four and a half years and released on January 21, 2000. He was convicted of computer related crimes and possession of several forged identification documents. Once "the most wanted man in cyberspace", Mitnick went on to be a prolific public speaker, author, and media personality.

Robert Tappan Morris

Robert T. Morris, while a graduate student at Cornell University in 1988, created the first worm, Morris Worm, which used buffer overflows to propagate. He is the son of Robert Morris, the former chief scientist at the National Computer Security Center, a division of the National Security Agency (NSA). Morris was not exactly a hacker of the computer security hacker culture, but a user of the MIT-AI, the home machine of the early academic hacker culture. According to Steven Levy, he was a true hacker who blundered.

v00d00

Jason Burks born October 2 1976, also referred to as "v00d00" is a former computer hacker, and malicious software writer. He is best known for writing the Juggernaut Hydra, and releasing it into the Progressive Insurance mainframe.

Craig Neidorf

In 1990, Neidorf (a co-founder of Phrack) was prosecuted for stealing the E911 document from BellSouth and publicly distributing it online. BellSouth claimed that the document was worth $80,000; they dropped the charges after it was revealed that copies of the document could simply be ordered for a minuscule $13.

Brian Salcedo

Brian Salcedo was convicted in 2004 of conspiracy to commit wire and computer fraud for hacking the Lowe's home improvement chain's unsecured wireless LAN in an attempt to capture credit card numbers used during transactions. The FBI claimed that the crime could have caused more than $2.5 million in damages. He was sentenced to 9 years in federal prison. The government claims that at the time of its imposition, Brian Salcedo's sentence was the longest federal prison sentence ever given for a computer related offense.

David L. Smith

In 1999, Smith launched the Melissa Worm, causing $80 million dollars worth of damage to businesses. Originally sentenced to 40 years, he eventually served only 20 months when he agreed to work undercover for the FBI.

rembrandt

In 2007, rembrandt was suspected to have taken control of the internal networks of Deutsche Bank and likely parts of the european SWIFT System. The only confirmed information is that rembrandt contacted Deutsche Bank, namely Mr. Karsten Heidrich [leader of DBCert] (as documented in released documents and e-Mails) and informed the Bank about this problem. Deutsche Bank decided to inform and misrepresent the situation to the german LKA (federal police). Some weeks later as rembrandt and an affiliate went to attend to a second meeting (invited by Mr. Karsten Heidrich again) both where arrested and their apartments raided. It is unclear why the police released rembrandt and his affiliate only 12 hours later. All that's known is that no fingerprints were taken from rembrandt and that his affiliate received his hardware 48 hours later. Rembrant's hardware is still kept by the german LKA even though a judicial order that would legitimize this was never filed. It is also suspected that rembrandt social engineered passwords and accounts and that the people supporting him released part of the ~400GB set of files suspected to have been copied from Deutsche Bank on to ThePirateBay for a short time.

Until now the only documents released seem to prove that Mr. Karsten Heidrich lied to the german LKA to get rembrandt busted. The released information also proves that Deutsche Bank used very weak and even default passwords in the internal network. This may explain the resulting reactions and decicions made by Deutsche Bank as one attemping to hide embarassment. To this day no claim made by Deutsche Bank has been proven.

It's also documented that the prosecutor demanded a 3 month observation of rembrandt's apartment, claiming in official documents that this was needed to re-arrest rembrandt. Furthermore, the responsible prosecutor allegedly attemped to blackmail rembrandt 3 separate times, by offering a deal wherein rembrandt would plead guilty for crimes he didn't commit. He was told that if he failed to take the deal, he would be the victim of a suit and particularly strict judgement from the court.

The most recent information suggests he did not comply with the prosecutor's offer.

Trainreq

Trainreq is most famous (or infamous) for hacking certain celebrities' phones in order to steal raunchy, private pictures that they may have, most recently hacking Miley Cyrus' e-mail and stealing certain pictures she had. He currently has an account on Digital Gangster, which is a notorious website for forums that mainly revolve around hacking.

Notable Security Hackers

Eric Corley

Eric Corley (also known as Emmanuel Goldstein) is the long standing publisher of 2600: The Hacker Quarterly and founder of the H.O.P.E. conferences. He has been part of the hacker community since the late '70s.

Fyodor

Gordon Lyon (better known as Fyodor) authored the Nmap Security Scanner as well as many network security books and web sites. He is a founding member of the Honeynet Project and Vice President of Computer Professionals for Social Responsibility.

Johan Helsingius

Johan "Julf" Helsingius operated the world's most popular anonymous remailer, the Penet remailer (called penet.fi), until he closed up shop in September 1996.

Tsutomu Shimomura

Shimomura helped catch Kevin Mitnick, the United States' most infamous computer intruder, in early 1994. He is the co-author of a book about the Mitnick case, Takedown: The Pursuit and Capture of Kevin Mitnick, America's Most Wanted Computer Outlaw-By the Man Who Did It (ISBN 0-7868-8913-6), though Mitnick himself along with fellow hacker ygo2slow have raised questions about the book's accuracy.

Solar Designer

Solar Designer is the pseudonym of the founder of the Openwall Project.

Micha? Zalewski

Micha? Zalweski (lcamtuf) is a prominent security researcher.

References

1. ↑ The glider: an Appropriate Hacker Emblem
2. ↑ Detroit Free Press, September 27, 1983
3. ↑ The 414 Gang Strikes Again, Philip Elmer-DeWitt, Time magazine, Aug. 29, 1983, p. 75
4. ↑ Beware: Hackers at play, Newsweek, September 5, 1983, pp. 42-46,48
5. ↑ David Bailey, "Attacks on Computers: Congressional Hearings and Pending Legislation," sp, p. 180, 1984 IEEE Symposium on Security and Privacy, 1984.

Related literature

• Code Hacking: A Developer's Guide to Network Security by Richard Conway, Julian Cordingley

External links

ar:???? de:Hacker (Computersicherheit) fr:Hacker (sécurité informatique) he:?????? pl:Haker (bezpiecze?stwo komputerowe) zh:?? (????)