Hackers, Crackers, and Network Intruders
Agenda Hackers and their vocabulary Threats and risks Types of hackers Gaining access Intrusion detection and prevention Legal and ethical issues
Hacker Terms Hacking - showing computer expertise Cracking - breaching security on software or systems Phreaking - cracking telecom networks Spoofing - faking the originating IP address in a datagram Denial of Service (DoS) - flooding a host with sufficient network traffic so that it can t respond anymore Port Scanning - searching for vulnerabilities
Hacking through the ages 1969 - Unix hacked together 1971 - Cap n Crunch phone exploit discovered 1988 - Morris Internet worm crashes 6,000 servers 1994 - $10 million transferred from CitiBank accounts 1995 - Kevin Mitnick sentenced to 5 years in jail 2000 - Major websites succumb to DDoS 2000-15,700 credit and debit card numbers stolen from Western Union (hacked while web database was undergoing maintenance) 2001 Code Red exploited bug in MS IIS to penetrate & spread probes random IPs for systems running IIS had trigger time for denial-of-service attack 2 nd wave infected 360000 servers in 14 hours Code Red 2 - had backdoor installed to allow remote control Nimda -used multiple infection mechanisms email, shares, web client, IIS 2002 Slammer Worm brings web to its knees by attacking MS SQL Server
The threats Denial of Service (Yahoo, ebay, CNN, MS) Defacing, Graffiti, Slander, Reputation Loss of data (destruction, theft) Divulging private information (AirMiles, corporate espionage, personal financial) Loss of financial assets (CitiBank)
Types of hackers Professional hackers Black Hats the Bad Guys White Hats Professional Security Experts Script kiddies Mostly kids/students User tools created by black hats, To get free stuff Impress their peers Not get caught Underemployed Adult Hackers Former Script Kiddies Can t get employment in the field Want recognition in hacker community Big in eastern european countries Ideological Hackers hack as a mechanism to promote some political or ideological purpose Usually coincide with political events
Types of Hackers Criminal Hackers Real criminals, are in it for whatever they can get no matter who it hurts Corporate Spies Are relatively rare Disgruntled Employees Most dangerous to an enterprise as they are insiders Since many companies subcontract their network services a disgruntled vendor could be very dangerous to the host enterprise
What is Hacking? Unauthorized use of computer and network resources. Hacker originally meant a very gifted programmer. When it is done by request and under a contract between an ethical hacker and an organization, it is OK! The difference is that the ethical hacker has authorization to probe the target. The number of really gifted hackers in the world is very small, but there are lots of wannabes (-Dr. Charles C. Palmer, IBM)
Definitions Hacker: A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming. A malicious meddler who tries to discover sensitive information by poking around. Hence `password hacker', `network hacker'. The correct term for this sense is cracker. Cracker: One who breaks security on a system. Coined ca. 1985 by hackers in defense against journalistic misuse of hacker. An earlier attempt to establish `worm' in this sense around 1981--82 on Usenet was largely a failure. though crackers often like to describe themselves as hackers, most true hackers consider them a separate and lower form of life.
Who hacks? Hackers in Eastern Europe hacked about 1 million credit card numbers from 40 financial companies in the United States in 2003 alone. 64% of companies suffered losses from hackers activities. More serious offenders, able to cause damage to a system, are known as hackers.
Who cracks? There are 3 groups of crackers: Vandals: hack computer systems for destruction (deleting files). Jokers: the most harmless; hacking systems and carrying in different sounds, noises, and visual effects. Breakers: professional criminals commit hacking of computer systems with the purpose of money theft, industrial or commercial espionage, and thefts of expensive software.
Hacking - For Good Ethical Hacking The Best Defense Is A Good Offense. Performed for the sake of enhancing the performance of a device or exposing the vulnerabilities of a security system for the benefit of the system administrator. Penetration Testing- analysis and probe of system for purpose of targeting flaws and weaknesses that could be hacked and exploited by a malicious hacker (Black Hat hackers). - Old/unpatched software. - Poor configuration of - Disabled or faulty security Web servers. systems.
Hacking - For Good Who are they? White Hat hackers. Computer and network experts who possess a variety of knowledge and skills concerning the web, network and operating systems, programming, and physical security. Abide by ethical principles which prevent them from abusing computer systems. Trusted individuals with strict confidentiality policies.
Hacking - For Good Ethical Hackers and Certifications Universal Certification Does Not Exist The EC-Council (International Council of Electronic Commerce Consultants) has released a certification called Certified Ethical Hacker test. Other certifications available: OSCP-Offensive Security Certified Professional CEPT-Certified Expert Penetration Tester CPTE-Certified Penetration Testing Expert CPTS-Certified Penetration Testing Specialist ECSA-EC-Council Certified Security Analyst
Hackers - For good Who uses them? Increasingly, companies of all types and sizes are hiring security experts to act like the enemy. Some companies have departments dedicated to ethical hacking: IBM Microsoft
Hacking - For Good Where did it come from? Ethical hacking emerged from early open source software on the internet. Such software still exists such as Mozilla Firefox, Wikipedia, and Citizendium. Open source is a development method for software that harnesses the power of distributed peer review and transparency of process.
Laws, Fines, and Penalties Hackers, virus and worm writers could get 20 years to life in federal prison. Anyone who uses computers to cause death or bodily harm, such as bringing down power grids or airport control centers, can get the maximum sentence. The sentence is increased by 25% if they steal personal information. The sentence is increased by 50% if they share the stolen information. If posted on the Internet, sentence is doubled!
Top intrusion justifications I m doing you a favor pointing out your vulnerabilities I m making a political statement Because I can Because I m paid to do it
Gaining access Front door Password guessing Password/key stealing Back doors Often left by original developers as debug and/or diagnostic tools Forgot to remove before release Trojan Horses Usually hidden inside of software that we download and install from the net (remember nothing is free) Many install backdoors Software vulnerability exploitation Often advertised on the OEMs web site along with security patches Fertile ground for script kiddies looking for something to do
Password guessing Default or null passwords Password same as user name (use finger) Password files, trusted servers Brute force make sure login attempts audited!
Password/key theft Dumpster diving Its amazing what people throw in the trash Personal information Passwords Good doughnuts Many enterprises now shred all white paper trash Inside jobs Disgruntled employees Terminated employees (about 50% of intrusions resulting in significant loss)
Once inside, the hacker can... Modify logs To cover their tracks To mess with you Steal files Sometimes destroy after stealing A pro would steal and cover their tracks so to be undetected Modify files To let you know they were there To cause mischief Install back doors So they can get in again Attack other systems
Intrusion detection systems (IDS) A lot of research going on at universities Doug Somerville- EE Dept, Viktor Skorman EE Dept Big money available due to 9/11 and Dept of Homeland Security Vulnerability scanners pro-actively identifies risks User use pattern matching When pattern deviates from norm should be investigated Network-based IDS examine packets for suspicious activity can integrate with firewall require one dedicated IDS server per segment
Intrusion prevention Patches and upgrades (hardening) Disabling unnecessary software Firewalls and Intrusion Detection Systems Honeypots Recognizing and reacting to port scanning
Computer Crimes Financial Fraud Credit Card Theft Identity Theft Computer specific crimes Denial-of-service Denial of access to information Viruses Melissa virus cost New Jersey man 20 months in jail Melissa caused in excess of $80 Million Intellectual Property Offenses Information theft Trafficking in pirated information Storing pirated information Compromising information Destroying information Content related Offenses Hate crimes Harrassment Cyber-stalking Child privacy