GROUP 4
Hackers & Crackers
Wildan Fauzie Akbar
Muchammad Iqbal Saepulhaq
Arief Yuniarto
Agenda
Hackers and their vocabulary
Threats and risks
Types of hackers
Difference of Hacker and Cracker
Gaining access
Intrusion detection and prevention
Legal issues
What is Hacking?
Hacking refers to an array of activities which are done to
intrude some one elses personal information space so as to
use it for malicious, unwanted purposes.
Hacking is a term used to refer to activities aimed at
exploiting security flaws to obtain critical information for
gaining access to secured networks.
Hacker Terms
Hacking - showing computer expertise
Cracking - breaching security on software or systems
Phreaking - cracking telecom networks
Spoofing - faking the originating IP address in a
datagram
Denial of Service (DoS) - flooding a host with sufficient
network traffic so that it cant respond anymore
Port Scanning - searching for vulnerabilities
Hacking through the ages
1969 - Unix hacked together
1971 - Cap n Crunch phone exploit discovered
1988 - Morris Internet worm crashes 6,000 servers
1994 - $10 million transferred from CitiBank accounts
1995 - Kevin Mitnick sentenced to 5 years in jail
2000 - Major websites succumb to DDoS
2000 - 15,700 credit and debit card numbers stolen from Western Union
(hacked while web database was undergoing maintenance)
2001 Code Red
o exploited bug in MS IIS to penetrate & spread
o probes random IPs for systems running IIS
o had trigger time for denial-of-service attack
o 2nd wave infected 360000 servers in 14 hours
Code Red 2 - had backdoor installed to allow remote control
Nimda -used multiple infection mechanisms email, shares, web client,
IIS
2002 Slammer Worm brings web to its knees by attacking MS SQL
Server
The threats
Denial of Service (Yahoo, eBay, CNN, MS)
Defacing, Graffiti, Slander, Reputation
Loss of data (destruction, theft)
Divulging private information (AirMiles, corporate
espionage, personal financial)
Loss of financial assets (CitiBank)
Types of hackers
Professional hackers
o Black Hats the Bad Guys
o White Hats Professional Security Experts
Script kiddies
o Mostly kids/students
User tools created by black hats,
o To get free stuff
o Impress their peers
o Not get caught
Underemployed Adult Hackers
o Former Script Kiddies
Cant get employment in the field
Want recognition in hacker community
Big in eastern european countries
Types of Hackers
Criminal Hackers
o Real criminals, are in it for whatever they can get no matter
who it hurts
Corporate Spies
o Are relatively rare
Disgruntled Employees
o Most dangerous to an enterprise as they are insiders
o Since many companies subcontract their network services a
disgruntled vendor could be very dangerous to the host
enterprise
Ideological Hackers
o hack as a mechanism to promote some political or
ideological purpose
o Usually coincide with political events
Difference of Hacker &
Cracker
Hacker
Hacker have skill to analyzing the security of system
Hacker have ethics and creativity
Hacker may share her/his knowladge to the other.
Cracker
Cracker makes program just for interest and usually
have destroy effect, to find profit.
Gaining access
Front door
o Password guessing
o Password/key stealing
Back doors
o Often left by original developers as debug and/or
diagnostic tools
o Forgot to remove before release
Trojan Horses
o Usually hidden inside of software
Software vulnerability exploitation
o Crack and Keygen
Software vulnerability
exploitation
Buffer overruns
HTML / CGI scripts
Javascript hacks
Other holes / bugs in software and services
Tools and scripts used to scan ports for vulnerabilities
Password guessing
Default or null passwords
Password same as user name (use finger)
Password files, trusted servers
Brute force
Password/key theft
Dumpster diving
o Its amazing what people throw in the trash
Personal information
Passwords
o Many enterprises now shred all white paper
trash
Inside jobs
o Disgruntled employees
o Terminated employees (about 50% of
intrusions resulting in significant loss)
Once inside, the hacker
can...
Modify logs
o To cover their tracks
o To mess with you
Steal files
o Sometimes destroy after stealing
o A pro would steal and cover their tracks so to be
undetected
Modify files
o To let you know they were there
o To cause mischief
Install back doors
o So they can get in again
Attack other systems
Intrusion prevention
Patches and upgrades (hardening)
Disabling unnecessary software
Firewalls and Intrusion Detection Systems
Honeypots
Recognizing and reacting to port scanning
Risk management
Port scanner example
Computer Crimes
Financial Fraud
Credit Card Theft
Identity Theft
Computer specific crimes
o Denial-of-service
o Denial of access to information
o Viruses Melissa virus cost New Jersey man 20 months in jail
Melissa caused in excess of $80 Million
Intellectual Property Offenses
o
o
o
o
o
Information theft
Trafficking in pirated information
Storing pirated information
Compromising information
Destroying information
Content related Offenses
o Hate crimes
o Harrassment
o Cyber-stalking
Child privacy
Top intrusion justifications
Im doing you a favor pointing out your
vulnerabilities
Im making a political statement (?)
Because I can
Because Im paid to do it
Legal Recourse
Average armed robber will get $2500-$7500 and risk being
shot or killed; 50-60% will get caught , convicted and spent
an average of 5 years of hard time
Average computer criminal will net $50K-$500K with a risk
of being fired or going to jail; only 10% are caught, of
those only 15% will be turned in to authorities; less than 50%
of them will do jail time
Prosecution
o Many institutions fail to prosecute for fear of advertising
Many banks absorb the losses fearing that they
would lose more if their customers found out and
took their business elsewhere
Fix the vulnerability and continue on with business as usual
Coclusion
Some hacker not always the bad boy/man. Many
hacker is need into business for analyzing a
weekness of security system
Many way to pass the security system, so we have
keep our data
Cracker may have a bad purpose because he just
make provit to him self.
