The tricks hackers use, and what you can do to foil them.

I was going through an article at pc world and came across this. Please tech geeks looking for how hackers hack, here you are. I bring this piece of writing by Kim & Zetter to enlighten your mindset. 

The tricks hackers use, and what you can do to foil them.

Kim Zetter and Andrew Brandt, PCWorld.com

With the click of a mouse on one computer, the screen of the laptop a few feet away flashes wildly as a flood of data flies silently across a private network cable connecting the two machines. Within a minute the laptop's file sharing password is compromised.

"The computer is having a bad day," says a reporter as he watches the effect of the attack on his machine. "Packets are coming at it so fast, the firewall doesn't know what to do."

Some hackers claim they can teach a monkey how to hack in a couple of hours. We asked two hackers, Syke and Optyx (at their request, we are using their hacking pseudonyms rather than their real names), to give us non-simian reporters a demonstration.

What we got was a sometimes-frightening view of how easily nearly anyone's computer--at home or at work, protected or not--can be cracked by a determined hacker. But we also found out that computer users can make a hacker's job much harder by avoiding a few common mistakes.

Syke, a 23-year-old white-hat hacker, and Optyx, a 19-year-old self-proclaimed black hat, both work in computer security (Syke, until recently, for a well-known security software vendor; Optyx for an application service provider).

They launch their attack on our notebook from desktop computers located in the windowless basement that is New Hack City, a sort of hacker research-and-development lab (and part-time party lounge).

The lab's rooms are filled with over a dozen Sun SPARC servers, assorted network hubs and mountains of ethernet cable, an arcade-size Ms. Pac Man game, and a DJ tower stocked with music-mixing equipment for all-night hacker jams.

Hacking 101

"You should understand," says Optyx, as he enters a few commands that bring our machine to its knees, "no matter what people do, hackers will always find a way to get into systems."

Just as he says this, Optyx uses a program to get the laptop to spew out a bit of data identifying its operating system and version.

He then runs the program that cracked the file sharing password in the blink of an eye. We watch as he uses another tool to root through files in the laptop's shared directory.

As hacking goes, the methods our two instructors use on our laptop are not very elegant--the equivalent of using brute force to knock in a door--and through the machine's software firewall, we are immediately aware that the machine is being hacked. But, save from disconnecting our machine from the network cable, we're powerless to stop it.

Most hacking attacks, however, are much more invisible.
 

Open Sesame

The methods hackers use to attack your machine or network are fairly simple. A hacker scans for vulnerable systems by using a demon dialer (which will redial a number repeatedly until a connection is made) or a wardialer (an application that uses a modem to dial thousands of random phone numbers to find another modem connected to a computer).

Another approach used to target computers with persistent connections, such as DSL or cable connections, employs a scanner program that sequentially "pings" IP addresses of networked systems to see if the system is up and running.

Where can a hacker find such tools? On the Internet, of course.

Sites containing dozens of free, relatively easy-to-use hacking tools available for download are easy to find on the Net. While understanding how these tools work is not always easy, many files include homegrown documentation written in hacker shoptalk.

Among the programs available are scanning utilities that reveal the vulnerabilities on a computer or network and sniffing programs that let hackers spy on data passing between machines.

Hackers also use the Net to share lists of vulnerable IP addresses--the unique location of Internet-connected computers with unpatched security holes. Addresses of computers that have already been loaded with a Trojan horse are available for anyone to exploit (in many cases without the owner of the computer knowing).

Once the hacker finds a machine, he uses a hacker tool such as Whisker to identify in less than a second what operating system the machine is using and whether any unpatched holes exist in it. Whisker, one of a handful of legitimate tools used by system administrators to test the security of their systems, also provides a list of exploits the hacker can use to take advantage of these holes.

Security Software Alone Can't Stop Them

Syke and Optyx explain that several conditions make it easier for them to hack into a system. Lax security is one of them--such as when a company uses no passwords on its system or fails to change Windows' default passwords.

In October 2000 hackers broke into Microsoft's system and viewed source code for the latest versions of Windows and Office after discovering a default password that an employee never bothered to change.

Other common mistakes: When system administrators don't update software with security patches, they leave vulnerable ports open to attack. Or when they install expensive intrusion detection systems, some fail to monitor the alarms that warn them when an intruder is breaking in.

Still another boon to hackers is a firewall or router that is misconfigured, allowing hackers to "sniff" pieces of data--passwords, e-mail, or files--that pass through the network.
 

Got Root?

Once a hacker cracks into a system, his next goal is to get root, or give himself the highest level of access on the machine. The hacker can use little-known commands to get root, or can search the documents in the system's hard drive for a file or e-mail message that contains the system administrator's password.

Armed with root access, he can create legitimate-looking user accounts and log in whenever he wants without attracting attention. He can also alter or delete system logs to erase any evidence (such as command lines) that he gained access to the system.

But a hacker doesn't need root access to affect a system. He can misroute traffic intended to go to one company's Web server to a different one. Or, exploiting a well-documented bug (for which there's a patch that many sites haven't applied), a hacker can replace any Web page with his own text using a simple set of UNIX commands typed into the browser's Address bar.

Denying Service

A more serious threat, however, comes from skilled hackers who launch a denial-of-service attack, in which a Web server is flooded with so many requests that it stops responding altogether.

Previously one of the most common attacks, DoS attacks are now much harder to accomplish. Large Internet companies counter them by buying larger Internet pipes, which are harder to fill with the junk data hackers throw at them. The more bandwidth a company has, the more service the hacker needs to interrupt in order to produce a noticeable effect.

Hackers quickly learned that a single computer couldn't send enough phony requests to deny service, so they came up with a clever approach that employs dozens of hacked computers, working in synch to execute a distributed denial-of-service attack.

A DDoS attack uses as many computers as the hacker can control (called "zombies") to send bogus data requests to a targeted server. To unleash the attack, the hacker sends just one command, which propagates to all of the zombies and causes a near-instantaneous death-by-data on the Web server.

A hacker can also use an army of compromised computers to steal data--such as credit card numbers and proprietary corporate files--without leaving a clear trail. The hacker hops from machine to machine and then launches an attack that passes through all of them, creating a maze of connections for authorities to sift through.

University systems are prime targets for such activity, since administrators often leave student accounts active after students have graduated. A hacker can take over the account and use it as a base to attack another system.

In December 2000 hackers broke into a U.S. Air Force system in Virginia and downloaded code for controlling communication and spy satellites to a computer in Sweden. The Swedish company that owned the system housing the data had no idea hackers were using its computer, and cooperated with authorities.

From Sweden the activity was traced to a university machine in Germany, which authorities also believe was being used by a distant hacker.
 

Online Espionage

Hackers can silently collect information from a machine for months without being detected. Using a Trojan horse, a hacker can log keystrokes on a computer (to obtain a user's passwords) or use a "sniffing" program to collect sensitive data as it passes from one computer to another.

Sniffer software is a bit like a radio in that it simply listens for traffic to pass by it on the network wire. Sniffers are undetectable by the user and (usually) by the system administrator.
 

Nowhere to Hide

It might seem that, with all the ways hackers can get into your system, there's no safe place for your data to hide. Optyx would agree--to a point.

Casually typing commands on his keyboard that sends our laptop into further frenzy, Optyx says that simply running antivirus software alone, or having a firewall or intrusion detection system, won't prevent the theft of data or hacking of your computer.

"If people hack your machine," continues Optyx, "they hack it through a vulnerability."

He recommends that, in addition to using the above tools, every user install the latest security patches on their critical software, including the operating system and the applications they regularly use. "The only way to protect yourself is to patch up the holes," he says.

Kim Zetter and Andrew Brandt are PC World senior associate editors who cover security and privacy issues.

A Pro Definition of 'Hacker'? Is that the same as a 'hax0r'?

Question: What is a 'Hacker'? Is that the same as a 'hax0r'?

You've heard of "hackers", and you've seen sensationalized versions of hackers in movies. But what exactly is a hacker? And are they the same as "haxors"?

Answer: A hacker is a computer user who, for either negative or positive motivations, will manipulate and break into computer systems. You will see the "hacker" term spelled creatively in different ways, such as "haxor", "Hax0r", and "H4X0R", all of which mean the same thing.

Originally, a hacker of the 1980's was strictly evil and dishonest: a criminal who would illegally and unethically take control of computers and networks. And indeed, that criminal definition still applies today in the 21st century. However, the term hacker has also broadened to include non-criminal computer users. Today, "hacker" encompasses "black hat", "white hat", and "grey hat" computer users:

There are 3 modern types of hackers:

   1. Black Hats: Criminal Hackers. Common job: Penetration Tester.
   2. White Hats: Ethical Hackers. Common job: Network Security Specialist.
   3. Grey Hats: Deals in both of the above (jack of all trades, master of none).

1) Classic "Black Hat" Hackers = Criminals/Lawbreakers
 

This is the classic definition of a hacker: a computer user who willfully seeks to vandalize or commit theft on other people's networks. This classic hacker is also known as a "black hat hacker" because of his malicious motivations. Black hats are gifted but unethical computer users who are motivated by feelings of power and petty revenge. They are electronic thugs, in every sense of the word, and share the same personality traits as punk teens who smash bus stop windows for personal satisfaction.

Black hat hackers are renowned for the following common cybercrimes:
 

• DOS/DDOS attacks that overload Internet servers.Defacing websites by hijacking control and replacing the main page photos with rude slogans. (see example here)
• Performing identity theft by stealing private information of individuals.
• Botnetting: taking remote control of dozens of personal computers, and programming them to "zombie" as spam broadcasters.

2) White Hat "Ethical Hackers" = Network Security Specialists
 

Different from the classic black hat hackers, white hat hackers have honorable, or at least benign, motivations. A white hat "ethical hacker" is a talented computer security user employed to help protect computer networks. These white hats are not unlike former convicts who take on work as store security guards. While they themselves may not be completely ethical, their vocation is considered white hat. Ethical hackers are usually motivated by a steady paycheck. It is not surprising to see ethical hackers spending those paychecks on very expensive personal computers in their personal lives, so they can play online games after work. As long as they have a good-paying job to support their personal habits, an ethical hacker is usually not motivated to destroy nor steal from their employer.

Related: White Hat "Academic Hackers" = Creative Computer Artists
 

Another kind of white hat is the "academic hacker": a computer artisan who is not interested in protecting systems, but rather in creating clever programs and beautiful interfaces. If you are an academic hacker, for example, you will take existing programmatic code, and improve upon it through clever alterations and additions. "Academic hacking" is about obsessively innovating computer code so that it becomes more beautiful or more efficient as a program. Academic hackers, in general, are harmless and do not seek to hurt other people's networks. Academic white hats are often graduate students in computer programming.

3) Grey Hat Hackers = Uncertain which side of the law to stand for.
 

Grey hats are often "hobby hackers": users with basic or intermediate tech skills who like to disassemble and modify their own computers for hobby pleasure, and who also dabble in minor white collar crimes, like file-sharing movies or cracking software. Yes, millions of p2p downloaders are hobby hackers. And indeed, if you have ever modified your router and firewall to allow faster p2p downloads, you could describe yourself as a "grey hat" hobby hacker. Gratefully, only a small percentage of hobby hackers ever escalate into becoming serious black hat hackers.

Question: are you a white hat or grey hat hobby hacker?

Answer: if you obsessively tinker with your computer hardware and software, the answer is yes, you are a white hat hobby hacker. If you obsessively tinker and you like to dabble in breaking software locks and music copyright, then you are a grey hat hobby hacker. In 2010, this connotation is not a negative thing.

The Most Important Basic Hacking Skills You Should Know First

The hacker attitude is vital, but skills are even more vital. Attitude is no substitute for competence, and there's a certain basic toolkit of skills which you have to have before any hacker will dream of calling you one.

This toolkit changes slowly over time as technology creates new skills and makes old ones obsolete. For example, it used to include programming in machine language, and didn't until recently involve HTML. But right now it pretty clearly includes the following:

1. Learn how to program.

This, of course, is the fundamental hacking skill. If you don't know any computer languages, I recommend starting with Python. It is cleanly designed, well documented, and relatively kind to beginners. Despite being a good first language, it is not just a toy; it is very powerful and flexible and well suited for large projects. Good tutorials are available at the Python web site.

I used to recommend Java as a good language to learn early, but this critique has changed my mind (search for “The Pitfalls of Java as a First Programming Language” within it). A hacker cannot, as they devastatingly put it “approach problem-solving like a plumber in a hardware store”; you have to know what the components actually do. Now I think it is probably best to learn C and Lisp first, then Java.

There is perhaps a more general point here. If a language does too much for you, it may be simultaneously a good tool for production and a bad one for learning. It's not only languages that have this problem; web application frameworks like RubyOnRails, CakePHP, Django may make it too easy to reach a superficial sort of understanding that will leave you without resources when you have to tackle a hard problem, or even just debug the solution to an easy one.

If you get into serious programming, you will have to learn C, the core language of Unix. C++ is very closely related to C; if you know one, learning the other will not be difficult. Neither language is a good one to try learning as your first, however. And, actually, the more you can avoid programming in C the more productive you will be.

C is very efficient, and very sparing of your machine's resources. Unfortunately, C gets that efficiency by requiring you to do a lot of low-level management of resources (like memory) by hand. All that low-level code is complex and bug-prone, and will soak up huge amounts of your time on debugging. With today's machines as powerful as they are, this is usually a bad tradeoff — it's smarter to use a language that uses the machine's time less efficiently, but your time much more efficiently. Thus, Python.

Other languages of particular importance to hackers include Perl and LISP. Perl is worth learning for practical reasons; it's very widely used for active web pages and system administration, so that even if you never write Perl you should learn to read it. Many people use Perl in the way I suggest you should use Python, to avoid C programming on jobs that don't require C's machine efficiency. You will need to be able to understand their code.

LISP is worth learning for a different reason — the profound enlightenment experience you will have when you finally get it. That experience will make you a better programmer for the rest of your days, even if you never actually use LISP itself a lot. (You can get some beginning experience with LISP fairly easily by writing and modifying editing modes for the Emacs text editor, or Script-Fu plugins for the GIMP.)

It's best, actually, to learn all five of Python, C/C++, Java, Perl, and LISP. Besides being the most important hacking languages, they represent very different approaches to programming, and each will educate you in valuable ways.

But be aware that you won't reach the skill level of a hacker or even merely a programmer simply by accumulating languages — you need to learn how to think about programming problems in a general way, independent of any one language. To be a real hacker, you need to get to the point where you can learn a new language in days by relating what's in the manual to what you already know. This means you should learn several very different languages.

I can't give complete instructions on how to learn to program here — it's a complex skill. But I can tell you that books and courses won't do it — many, maybe most of the best hackers are self-taught. You can learn language features — bits of knowledge — from books, but the mind-set that makes that knowledge into living skill can be learned only by practice and apprenticeship. What will do it is (a) reading code and (b) writing code.

Peter Norvig, who is one of Google's top hackers and the co-author of the most widely used textbook on AI, has written an excellent essay called Teach Yourself Programming in Ten Years. His "recipe for programming success" is worth careful attention.

Learning to program is like learning to write good natural language. The best way to do it is to read some stuff written by masters of the form, write some things yourself, read a lot more, write a little more, read a lot more, write some more ... and repeat until your writing begins to develop the kind of strength and economy you see in your models.

Finding good code to read used to be hard, because there were few large programs available in source for fledgeling hackers to read and tinker with. This has changed dramatically; open-source software, programming tools, and operating systems (all built by hackers) are now widely available. Which brings me neatly to our next topic...

2. Get one of the open-source Unixes and learn to use and run it.

I'll assume you have a personal computer or can get access to one. (Take a moment to appreciate how much that means. The hacker culture originally evolved back when computers were so expensive that individuals could not own them.) The single most important step any newbie can take toward acquiring hacker skills is to get a copy of Linux or one of the BSD-Unixes or OpenSolaris, install it on a personal machine, and run it.

Yes, there are other operating systems in the world besides Unix. But they're distributed in binary — you can't read the code, and you can't modify it. Trying to learn to hack on a Microsoft Windows machine or under any other closed-source system is like trying to learn to dance while wearing a body cast.

Under Mac OS X it's possible, but only part of the system is open source — you're likely to hit a lot of walls, and you have to be careful not to develop the bad habit of depending on Apple's proprietary code. If you concentrate on the Unix under the hood you can learn some useful things.

Unix is the operating system of the Internet. While you can learn to use the Internet without knowing Unix, you can't be an Internet hacker without understanding Unix. For this reason, the hacker culture today is pretty strongly Unix-centered. (This wasn't always true, and some old-time hackers still aren't happy about it, but the symbiosis between Unix and the Internet has become strong enough that even Microsoft's muscle doesn't seem able to seriously dent it.)

So, bring up a Unix — I like Linux myself but there are other ways (and yes, you can run both Linux and Microsoft Windows on the same machine). Learn it. Run it. Tinker with it. Talk to the Internet with it. Read the code. Modify the code. You'll get better programming tools (including C, LISP, Python, and Perl) than any Microsoft operating system can dream of hosting, you'll have fun, and you'll soak up more knowledge than you realize you're learning until you look back on it as a master hacker.

For more about learning Unix, see The Loginataka. You might also want to have a look at The Art Of Unix Programming.

To get your hands on a Linux, see the Linux Online! site; you can download from there or (better idea) find a local Linux user group to help you with installation.

During the first ten years of this HOWTO's life, I reported that from a new user's point of view, all Linux distributions are almost equivalent. But in 2006-2007, an actual best choice emerged: Ubuntu. While other distros have their own areas of strength, Ubuntu is far and away the most accessible to Linux newbies.
You can find BSD Unix help and resources at www.bsd.org.

A good way to dip your toes in the water is to boot up what Linux fans call a live CD, a distribution that runs entirely off a CD without having to modify your hard disk. This will be slow, because CDs are slow, but it's a way to get a look at the possibilities without having to do anything drastic.

I have written a primer on the basics of Unix and the Internet.

I used to recommend against installing either Linux or BSD as a solo project if you're a newbie. Nowadays the installers have gotten good enough that doing it entirely on your own is possible, even for a newbie. Nevertheless, I still recommend making contact with your local Linux user's group and asking for help. It can't hurt, and may smooth the process.

3. Learn how to use the World Wide Web and write HTML.

Most of the things the hacker culture has built do their work out of sight, helping run factories and offices and universities without any obvious impact on how non-hackers live. The Web is the one big exception, the huge shiny hacker toy that even politicians admit has changed the world. For this reason alone (and a lot of other good ones as well) you need to learn how to work the Web.

This doesn't just mean learning how to drive a browser (anyone can do that), but learning how to write HTML, the Web's markup language. If you don't know how to program, writing HTML will teach you some mental habits that will help you learn. So build a home page. Try to stick to XHTML, which is a cleaner language than classic HTML. (There are good beginner tutorials on the Web; here's one.)

But just having a home page isn't anywhere near good enough to make you a hacker. The Web is full of home pages. Most of them are pointless, zero-content sludge — very snazzy-looking sludge, mind you, but sludge all the same (for more on this see The HTML Hell Page).

To be worthwhile, your page must have content — it must be interesting and/or useful to other hackers. And that brings us to the next topic...

4. If you don't have functional English, learn it.

As an American and native English-speaker myself, I have previously been reluctant to suggest this, lest it be taken as a sort of cultural imperialism. But several native speakers of other languages have urged me to point out that English is the working language of the hacker culture and the Internet, and that you will need to know it to function in the hacker community.

Back around 1991 I learned that many hackers who have English as a second language use it in technical discussions even when they share a birth tongue; it was reported to me at the time that English has a richer technical vocabulary than any other language and is therefore simply a better tool for the job. For similar reasons, translations of technical books written in English are often unsatisfactory (when they get done at all).

Linus Torvalds, a Finn, comments his code in English (it apparently never occurred to him to do otherwise). His fluency in English has been an important factor in his ability to recruit a worldwide community of developers for Linux. It's an example worth following.

Being a native English-speaker does not guarantee that you have language skills good enough to function as a hacker. If your writing is semi-literate, ungrammatical, and riddled with misspellings, many hackers (including myself) will tend to ignore you. While sloppy writing does not invariably mean sloppy thinking, we've generally found the correlation to be strong — and we have no use for sloppy thinkers. If you can't yet write competently, learn to.

And if you still have some good suggestions please do use the comment box below.