Hacking, Cracking, and Hactivism

1
Hacking, Cracking, and Hactivism

• Chantel Frenette, Roxanna Shinall, Brooke Walker

2
The Tech Model Railroad Club

• Hack definition
• 1) an article or project without constructive
  end
• 2) work undertaken on bad self-advice
• 3) an entropy booster
• 4) to produce, or attempt to produce, a hack

3
The Hacker Ethic-Steven Levy

• 1. Access to computers - and anything which might
  teach you something about the way the world works
  - should be unlimited and total. Always yield to
  the Hands-On imperative!
• 2. All information should be free.
• 3. Mistrust authority - promote decentralization.
  
• 4. Hackers should be judged by their hacking, not
  bogus criteria such as degrees, age, race, or
  position.
• 5. You can create art and beauty on a computer.
• 6. Computers can change your life for the better.

4
John Draper aka Capn Crunch
5
History Highlights

• BBSs and hacking groups emerge including Legion
  of Doom
• War Games
• Hacker magazines
• CFAA
• The Morris Worm
• Cyberespionage
• Hackers Manifesto

6
History Highlights

• Operation Sundevil
• Kevin Poulsen
• Def Con
• Kevin Mitnick
• AOHell
• Pentagon breakins
• Denial of Service attacks
• DNS Attacks

7
Kevin Mitnick
8
(No Transcript)
9
(No Transcript)
10
(No Transcript)
11
Hacking - For GoodEthical Hacking The Best
Defense Is A Good Offense.

• Performed for the sake of enhancing the
  performance of a device or exposing the
  vulnerabilities of a security system for the
  benefit of the system administrator.
• Penetration Testing- analysis and probe of system
  for purpose of targeting flaws and weaknesses
  that could be hacked and exploited by a malicious
  hacker (Black Hat hackers).
• - Old/unpatched software. -
  Poor configuration of
• - Disabled or faulty security
  Web servers.
• systems.

12
Hacking - For GoodWho are they?

• White Hat hackers.
• Computer and network experts who possess a
  variety of knowledge and skills concerning the
  web, network and operating systems, programming,
  and physical security.
• Abide by ethical principles which prevent them
  from abusing computer systems.
• Trusted individuals with strict confidentiality
  policies.

13
Hacking - For GoodEthical Hackers and
CertificationsUniversal Certification Does Not
Exist

• The EC-Council (International Council of
  Electronic Commerce Consultants) has released a
  certification called Certified Ethical Hacker
  test.
• Other certifications available
• OSCP-Offensive Security Certified Professional
• CEPT-Certified Expert Penetration Tester
• CPTE-Certified Penetration Testing Expert
• CPTS-Certified Penetration Testing Specialist
• ECSA-EC-Council Certified Security Analyst

14
Hackers - For goodWho uses them?

• Increasingly, companies of all types and sizes
  are hiring security
  experts to act like the enemy.
• Some companies have departments dedicated to
  ethical hacking
• IBM
• Microsoft

15
Hacking - For GoodWhere did it come from?

• Ethical hacking emerged from early open source
  software on the internet.
• Such software still exists such as Mozilla
  Firefox, Wikipedia, and Citizendium.

Open source is a development method for software
that harnesses the power of distributed peer
review and transparency of process.
16
Hacktivism
17
Hacktivism

• Fusion of hacking and activism.
• The act of hacking or breaking into a computer
  system, for a politically or socially motivated
  purpose.
• The individual who performs an act of hacktivism
  is said to be a hacktivist.
• Computer hacking always involves some degree of
  infringement on the privacy of others or damage
  to computer-based property such as files, web
  pages or software.
• The impact of computer hacking varies from simply
  being simply invasive and annoying to destructive.

18
What is Hacking?

• Unauthorized use of computer and network
  resources.
• Hacker originally meant a very gifted
  programmer.
• Hacking is a felony in the US and most other
  countries.
• When it is done by request and under a contract
  between an ethical hacker and an organization, it
  is OK!
• The difference is that the ethical hacker has
  authorization to probe the target.
• The number of really gifted hackers in the world
  is very small, but there are lots of
  wannabes(-Dr. Charles C. Palmer, IBM)

19
Definitions

• Hacker
• A person who enjoys exploring the details of
  programmable systems and how to stretch their
  capabilities, as opposed to most users, who
  prefer to learn only the minimum necessary.
• One who programs enthusiastically (even
  obsessively) or who enjoys programming rather
  than just theorizing about programming.
• A malicious meddler who tries to discover
  sensitive information by poking around. Hence
  password hacker', network hacker'. The correct
  term for this sense is cracker.

• Cracker
• One who breaks security on a system. Coined ca.
  1985 by hackers in defense against journalistic
  misuse of hacker.
• An earlier attempt to establish worm' in this
  sense around 1981--82 on Usenet was largely a
  failure.
• though crackers often like to describe
  themselves as hackers, most true hackers consider
  them a separate and lower form of life.

20
Who hacks?

• Hackers in Eastern Europe hacked about 1 million
  credit card numbers from 40 financial companies
  in the United States in 2003 alone.
• 64 of companies suffered losses from hackers
  activities.
• More serious offenders, able to cause damage to a
  system, are known as hackers.

21
Who cracks?

• There are 3 groups of crackers
• Vandals hack computer systems for destruction
  (deleting files).
• Jokers the most harmless hacking systems and
  carrying in different sounds, noises, and visual
  effects.
• Breakers professional criminals commit hacking
  of computer systems with the purpose of money
  theft, industrial or commercial espionage, and
  thefts of expensive software.

22
Laws, Fines, and Penalties

• Hackers, virus and worm writers could get 20
  years to life in federal prison.
• Anyone who uses computers to cause death or
  bodily harm, such as bringing down power grids or
  airport control centers, can get the maximum
  sentence.
• The sentence is increased by 25 if they steal
  personal information.
• The sentence is increased by 50 if they share
  the stolen information.
• If posted on the Internet, sentence is doubled!

23
Computer Fraud and Abuse Act

• Summary of CFAA Compromising Confidentiality
  Provisions
• Offense -Sentence
• Obtaining National Security Information -10 (20)
  years
• Compromising the Confidentiality of a Computer -1
  or 5
• Trespassing in a Government Computer -1 (10)
• Accessing a Computer to Defraud Obtain Value -5
  (10)
• Knowing Transmission and Intentional Damage -10
  (20 or life)
• Intentional Access and Reckless Damage -5 (20)
• Intentional Access and Damage -1 (10)
• Trafficking in Passwords -1 (10)
• Extortion Involving Threats to Damage Computer -5
  (10)

24
Computer Fraud and Abuse Act
Original 1986 ActIntentional Damage
Trespassers Felony Authorized Users
No crimeReckless Damage Trespassers Felony
Authorized Users No crimeNegligent
Damage Trespassers Felony Authorized
Users No crime 1994 Revision Intentional
Damage Trespassers Felony Authorized
Users Felony Reckless Damage Trespassers
Misdemeanor Authorized Users Misdemeanor Neglige
nt Damage Trespassers No crime
Authorized Users No crime 1996
Revision Intentional Damage Trespassers
Felony Authorized Users
Felony Reckless Damage Trespassers Felony
Authorized Users No crime Negligent
Damage Trespassers Misdemeanor Authorized
Users No crime
25
Works Cited

• Baase, Sara. A Gift of Fire. Upper Saddle River
  Pearson, 2003.
• A Convicted Hacker Debunks Some Myths. CNN.com.
  13 Oct 2005. CNN. 3 Nov 2007. /2005/TECH/internet/10/07/kevin.mitnick.cnna/.
• Draper, John. The Story so Far Capn Crunch in
  Cyberspace. 2005. 3 Nov 2007. chers.com/crunch/story.html.
• Eltringham, Scott (ed.). Prosecuting Computer
  Crimes. Computer Crime Intellectual Property
  Section of the United States Department of
  Justice. Feb 2007. United States Department of
  Justice. 3 Nov 2007. ccmanual/index.html.
• InfoSec Institute, "Ethical Hacking and
  Countermeasures." Certified Ethical Hacking.
  EC-Council. 10 Nov 2007. tute.com/.
• Kreider, Aaron. Ambiguous Definitions of Hacker
  Conflicting Discourses and their Impact Upon the
  Possibilities of Resistance. Campus Activism. 13
  Dec 1999. Campus Activism. 3 Nov 2007.
  ers/index.html.
• Lemos, Robert. "New laws make hacking a
  black-and-white choice." CNET News.com. 23 Sep
  2002. CNET News. 11 Nov 2007
• 2009-1001-958129.html?tagfd_lede.
• McMillan, Robert. "Hackers at Microsoft?! ."
  Washingtonpost.com. 6 Oct 2007. PC World. 7 Nov
  2007 /article/ 2007/10/06/AR2007100600065.html.

26
Works Cited

• The National Information Infrastructure
  Protection Act of 1996 Legislative Analysis.
  Computer Crime Intellectual Property Section
  of the United States Department of Justice.
  1996. United States Department of Justice. 3 Nov
  2007. l.
• PCWorld.com staff. Hackings History.
  PCWorld.com. 2007. PC World Magazine. 3 Nov
  2007. e,1/article.html.
• Peterson, Craig R. "The Laws, Fines and Penalties
  Facing Hackers." Mainstream Security Services,
  LLC. 4 Nov 2007. y/ hacker_laws_sentencing_penalties.shtml.
• ProzacOD. Business card for Mitnick Security
  Consulting, LLC. Online Image. Mitnick Security
  Consulting, LLC. 10 Nov 2007.
• www.kevinmitnick.com/.
• Raymond, Eric S. The New Hackers Dictionary.
  Jargon File Resources. 25 July 1996. 3 Nov 2007.
  .
• Redfern, Chad. "What is Ethical Hacking?." PRWeb
  Press Release News Wire. 29 Dec 2004. PRWeb
  Press Release News Wire. 11 Nov 2007.
  22.htm.
• Sabadash, Victor. "What is Hacking?" Computer
  Crime Research Center. 2 Nov 2007.
  .
• Sabadash, Victor. "Who hacks? Who cracks?"
  Computer Crime Research Center. 2 Nov 2007.
  .

27
Works Cited

• Samavati, Shaheen. "More companies using ethical
  hackers to pose as enemy in the name of
  security." The Plain Dealer. 1 Oct 2007. The
  Plain Dealer Newspaper. 8 Nov 2007.
  ndex.ssf?/base/other/119122827862110.xml.
• Samson, Pete (derived). Abridged Dictionary of
  the TMRC Language. The Tech Model Railroad Club
  of MIT. 23 Nov 2005. Tech Model Railroad Club. 3
  Nov 2007. .
• Scholes, Dan. Kevin Mitnick The Most Notorious
  Hacker. Webster University Worldwide. Webster
  University. 3 Nov 2007.hilosophy/umbaugh/courses/frosh/dairy/mitnick.htm
  .
• Various. "Ethical Hacking." The Ethical Hacker
  Network. 2007. The Ethical Hacker Network. 11
  Nov 2007. tegory/ 1/31/3/.
• Various. Various dates. Online images.
  myoldmac.net. 10 Nov 2007. FAQ/TheBlueBox-1.htm.
• Various. Various dates. Online images. Amazon.
  10 Nov 2007. .
• Various. Various dates. Online Images.
  Google.com. 10 Nov 2007. .
• Various. "Welcome to Offensive-Security.com."
  Offensive-Security. Various dates.
  Offensive-Security. 11 Nov 2007.
  .
• Various. White Hat." Wikipedia. 2007.
  wikipedia.org. 11 Nov 2007. .org/wiki/White_hat.