GROUP 4

Hackers & Crackers

Wildan Fauzie Akbar

Muchammad Iqbal Saepulhaq
Arief Yuniarto

Agenda

Hackers and their vocabulary

Threats and risks
Types of hackers
Difference of Hacker and Cracker
Gaining access
Intrusion detection and prevention
Legal issues

What is Hacking?
Hacking refers to an array of activities which are done to
intrude some one elses personal information space so as to
use it for malicious, unwanted purposes.
Hacking is a term used to refer to activities aimed at
exploiting security flaws to obtain critical information for
gaining access to secured networks.

Hacker Terms
Hacking - showing computer expertise
Cracking - breaching security on software or systems
Phreaking - cracking telecom networks
Spoofing - faking the originating IP address in a
datagram
Denial of Service (DoS) - flooding a host with sufficient
network traffic so that it cant respond anymore
Port Scanning - searching for vulnerabilities

Hacking through the ages

1969 - Unix hacked together

1971 - Cap n Crunch phone exploit discovered
1988 - Morris Internet worm crashes 6,000 servers
1994 - $10 million transferred from CitiBank accounts
1995 - Kevin Mitnick sentenced to 5 years in jail
2000 - Major websites succumb to DDoS
2000 - 15,700 credit and debit card numbers stolen from Western Union
(hacked while web database was undergoing maintenance)
2001 Code Red
o exploited bug in MS IIS to penetrate & spread
o probes random IPs for systems running IIS
o had trigger time for denial-of-service attack
o 2nd wave infected 360000 servers in 14 hours
Code Red 2 - had backdoor installed to allow remote control
Nimda -used multiple infection mechanisms email, shares, web client,
IIS
2002 Slammer Worm brings web to its knees by attacking MS SQL
Server

The threats
Denial of Service (Yahoo, eBay, CNN, MS)
Defacing, Graffiti, Slander, Reputation
Loss of data (destruction, theft)
Divulging private information (AirMiles, corporate
espionage, personal financial)
Loss of financial assets (CitiBank)

Types of hackers
Professional hackers
o Black Hats the Bad Guys
o White Hats Professional Security Experts

Script kiddies
o Mostly kids/students
User tools created by black hats,
o To get free stuff
o Impress their peers
o Not get caught

Underemployed Adult Hackers

o Former Script Kiddies
Cant get employment in the field
Want recognition in hacker community
Big in eastern european countries

Types of Hackers

Criminal Hackers
o Real criminals, are in it for whatever they can get no matter
who it hurts
Corporate Spies
o Are relatively rare
Disgruntled Employees
o Most dangerous to an enterprise as they are insiders
o Since many companies subcontract their network services a
disgruntled vendor could be very dangerous to the host
enterprise
Ideological Hackers
o hack as a mechanism to promote some political or
ideological purpose
o Usually coincide with political events

Difference of Hacker &

Cracker
Hacker
Hacker have skill to analyzing the security of system
Hacker have ethics and creativity
Hacker may share her/his knowladge to the other.
Cracker
Cracker makes program just for interest and usually
have destroy effect, to find profit.

Gaining access
Front door
o Password guessing
o Password/key stealing

Back doors
o Often left by original developers as debug and/or
diagnostic tools
o Forgot to remove before release

Trojan Horses
o Usually hidden inside of software

Software vulnerability exploitation

o Crack and Keygen

Software vulnerability
exploitation

Buffer overruns
HTML / CGI scripts
Javascript hacks
Other holes / bugs in software and services
Tools and scripts used to scan ports for vulnerabilities

Password guessing

Default or null passwords

Password same as user name (use finger)
Password files, trusted servers
Brute force

Password/key theft
Dumpster diving
o Its amazing what people throw in the trash
Personal information
Passwords

o Many enterprises now shred all white paper

trash

Inside jobs
o Disgruntled employees
o Terminated employees (about 50% of
intrusions resulting in significant loss)

Once inside, the hacker

can...
Modify logs

o To cover their tracks

o To mess with you

Steal files

o Sometimes destroy after stealing

o A pro would steal and cover their tracks so to be
undetected

Modify files

o To let you know they were there

o To cause mischief

Install back doors

o So they can get in again

Attack other systems

Intrusion prevention

Patches and upgrades (hardening)

Disabling unnecessary software
Firewalls and Intrusion Detection Systems
Honeypots
Recognizing and reacting to port scanning

Risk management

Port scanner example

Computer Crimes

Financial Fraud
Credit Card Theft
Identity Theft
Computer specific crimes

o Denial-of-service
o Denial of access to information
o Viruses Melissa virus cost New Jersey man 20 months in jail
Melissa caused in excess of $80 Million

Intellectual Property Offenses

o
o
o
o
o

Information theft
Trafficking in pirated information
Storing pirated information
Compromising information
Destroying information

Content related Offenses

o Hate crimes
o Harrassment
o Cyber-stalking

Child privacy

Top intrusion justifications

Im doing you a favor pointing out your
vulnerabilities
Im making a political statement (?)

Because I can
Because Im paid to do it

Legal Recourse
Average armed robber will get $2500-$7500 and risk being
shot or killed; 50-60% will get caught , convicted and spent
an average of 5 years of hard time
Average computer criminal will net $50K-$500K with a risk
of being fired or going to jail; only 10% are caught, of
those only 15% will be turned in to authorities; less than 50%
of them will do jail time
Prosecution
o Many institutions fail to prosecute for fear of advertising
Many banks absorb the losses fearing that they
would lose more if their customers found out and
took their business elsewhere
Fix the vulnerability and continue on with business as usual

Coclusion
Some hacker not always the bad boy/man. Many
hacker is need into business for analyzing a
weekness of security system
Many way to pass the security system, so we have
keep our data
Cracker may have a bad purpose because he just
make provit to him self.