Security hacker

Asecurity hackeror security researcher is someone who explores methods for breaching defenses andexploitingweaknesses in acomputer systemornetwork.Hackers may be motivated by a multitude of reasons, such as profit, protest, information gathering,challenge, recreation,or evaluation of a system weaknesses to assist in formulating defenses against potential hackers.
Longstanding controversy surrounds the meaning of the term "hacker". In this controversy,computer programmersreclaim the termhacker, arguing that it refers simply to someone with an advanced understanding of computers and computer networks,and thatcrackeris the more appropriate term for those who break into computers, whether computer criminals (black hats) or computer security experts (white hats).A 2014 article noted that "the black-hat meaning still prevails among the general public".The subculture that has evolved around hackers is often referred to as the "computer underground".
The subculture around such hackers is termed network hacker subculture, hacker scene, or computer underground. It initially developed in the context ofphreakingduring the 1960s and the microcomputerBBS sceneof the 1980s. It is implicated with2600: The Hacker Quarterlyand thealt.2600newsgroup.
In 1980, an article in the August issue ofPsychology Today(with commentary byPhilip Zimbardo) used the term "hacker" in its title: "The Hacker Papers." It was an excerpt from a Stanford Bulletin Board discussion on the addictive nature of computer use. In the 1982 filmTron, Kevin Flynn (Jeff Bridges) describes his intentions to break into ENCOM's computer system, saying "I've been doing a little hacking here." CLU is thesoftwarehe uses for this. By 1983, hacking in the sense of breaking computer security had already been in use as computer jargon,but there was no public awareness about such activities.However, the release of the filmWarGamesthat year, featuring a computer intrusion intoNORAD, raised the public belief that computer security hackers (especially teenagers) could be a threat to national security. This concern became real when, in the same year, a gang of teenage hackers inMilwaukee, Wisconsin, known asThe 414s, broke into computer systems throughout theUnited StatesandCanada, including those ofLos Alamos National Laboratory,Sloan-Kettering Cancer CenterandSecurity Pacific Bank.The case quickly grew media attention,and 17-year-old Neal Patrick emerged as the spokesman for the gang, including a cover story inNewsweekentitled "Beware: Hackers at play", with Patrick's photograph on the cover.TheNewsweekarticle appears to be the first use of the wordhackerby the mainstream media in the pejorative sense.
Pressured by media coverage, congressmanDan Glickmancalled for an investigation and began work on new laws against computer hacking.Neal Patrick testified before theU.S. House of Representativeson September 26, 1983, about the dangers of computer hacking, and six bills concerning computer crime were introduced in the House that year.As a result of these laws against computer criminality, white hat,grey hatand black hat hackers try to distinguish themselves from each other, depending on the legality of their activities. These moral conflicts are expressed inThe Mentor's "The Hacker Manifesto", published 1986 inPhrack.
Use of the term hacker meaning computer criminal was also advanced by the title "Stalking the Wily Hacker", an article byClifford Stollin the May 1988 issue of theCommunications of the ACM. Later that year, the release byRobert Tappan Morris, Jr.of the so-calledMorris wormprovoked the popular media to spread this usage. The popularity of Stoll's bookThe Cuckoo's Egg, published one year later, further entrenched the term in the public's consciousness.
In computer security, a hacker is someone who focuses on the security mechanisms of computer and network systems. Hackers can include someone who endeavors to strengthen security mechanisms by exploring their weaknesses and also those who seek to access secure, unauthorized information despite security measures. Nevertheless, parts of the subculture see their aim in correcting security problems and use the word in a positive sense. White hat is the name given to ethical computer hackers, who utilize hacking in a helpful way. White hats are becoming a necessary part of the information security field.They operate under a code, which acknowledges that breaking into other people's computers is bad, but that discovering and exploiting security mechanisms and breaking into computers is still an interesting activity that can be done ethically and legally. Accordingly, the term bears strong connotations that are favorable or pejorative, depending on the context.
Subgroups of the computer underground with different attitudes and motives use different terms to demarcate themselves from each other. These classifications are also used to exclude specific groups with whom they do not agree.
Eric S. Raymond, author ofThe New Hacker's Dictionary, advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as a wider hacker culture, a view that Raymond has harshly rejected. Instead of a hacker/cracker dichotomy, they emphasize a spectrum of different categories, such aswhite hat,grey hat,black hatandscript kiddie. In contrast to Raymond, they usually reserve the termcrackerfor more malicious activity.
According to Ralph D. Clifford, acrackerorcrackingis to "gain unauthorized access to a computer in order to commit another crime such as destroying information contained in that system."These subgroups may also be defined by the legal status of their activities.
Awhite hat hackerbreaks security for non-malicious reasons, either to test their own security system, performpenetration testsorvulnerability assessmentsfor a client, or while working for a security company that makes security software. The term is generally synonymous withethical hacker, and certifications, courseware, classes, and online training covering the diverse arena of ethical hacking have been developed.
Ablack hat hackeris a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005).The term was coined byRichard Stallman, to contrast the maliciousness of a criminal hacker versus the spirit of playfulness and exploration inhacker culture, or the ethos of thewhite hat hackerwho performs hacking duties to identify places to repair or as a means of legitimate employment.Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal".
A grey hat hacker lies between a black hat and a white hat hacker, hacking for ideological reasons.A grey hat hacker may surf the Internet and hack into a computer system for the sole purpose of notifying the administrator that their system has a security defect, for example. They may then offer to correct the defect for a fee.Grey hat hackers sometimes find the defect in a system and publish the facts to the world instead of a group of people. Even though grey hat hackers may not necessarily perform hacking for their personal gain, unauthorized access to a system can be considered illegal and unethical.
Asocial statusamong hackers,eliteis used to describe the most skilled. Newly discoveredexploitscirculate among these hackers. Elitegroupssuch asMasters of Deceptionconferred a kind of credibility on their members.
Ascript kiddie(also known as askidorskiddie) is an unskilled hacker who breaks into computer systems by using automated tools written by others (usually by other black hat hackers), hence the term script (i.e. a computer script that automates the hacking) kiddie (i.e. kid, child an individual lacking knowledge and experience, immature),usually with little understanding of the underlying concept.
A neophyte ("newbie", or "noob") is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology and hacking.
Ablue hathacker is someone outside computer security consulting firms who is used to bug-test a system prior to its launch, looking for exploits so they can be closed.Microsoftalso uses the termBlueHatto represent a series of security briefing events.
A hacktivist is a hacker who utilizes technology to publicize a social, ideological, religious or political message.
Hacktivismcan be divided into two main groups:
Intelligence agencies andcyberwarfareoperatives of nation states.
Groups of hackers that carry out organized criminal activities for profit.Modern-daycomputer hackershave been compared to theprivateersof by-gone days.These criminals hold computer systems hostage, demanding large payments from victims to restore access to their own computer systems and data.Furthermore, recentransomwareattacks on industries, including energy, food, and transportation, have been blamed oncriminal organizationsbased in or near astate actor– possibly with the country's knowledge and approval.Cyber theftand ransomware attacks are now the fastest-growing crimes in the United States.Bitcoinand othercryptocurrenciesfacilitate theextortionof huge ransoms from large companies, hospitals and city governments with little or no chance of being caught.
Hackers can usually be sorted into two types of attacks: mass attacks and targeted attacks.They are sorted into the groups in terms of how they choose their victims and how they act on the attacks.
A typical approach in an attack on Internet-connected system is:
In order to do so, there are several recurring tools of the trade and techniques used by computer criminals and security experts.
A security exploit is a prepared application that takes advantage of a known weakness.Common examples of security exploits areSQL injection,cross-site scriptingandcross-site request forgerywhich abuse security holes that may result from substandard programming practice. Other exploits would be able to be used throughFile Transfer Protocol(FTP),Hypertext Transfer Protocol(HTTP),PHP,SSH,Telnetand some Web pages. These are very common in Web site and Web domain hacking.
Tools and Procedures
The computer undergroundhas produced its own specialized slang, such as1337speak. Writing software and performing other activities to support these views is referred to ashacktivism. Some consider illegal cracking ethically justified for these goals; a common form iswebsite defacement. The computer underground is frequently compared to the Wild West.It is common for hackers to use aliases to conceal their identities.
The computer underground is supported by regular real-world gatherings calledhacker conventionsor "hacker cons". These events includeSummerCon(Summer),DEF CON,HoHoCon(Christmas),ShmooCon(February),Black Hat Conference,Chaos Communication Congress, AthCon, Hacker Halted, andH.O.P.E.Local Hackfest groups organize and compete to develop their skills to send a team to a prominent convention to compete in group pentesting, exploit and forensics on a larger scale. Hacker groups became popular in the early 1980s, providing access to hacking information and resources and a place to learn from other members. Computerbulletin board systems(BBSs), such as the Utopias, provided platforms for information-sharing via dial-up modem. Hackers could also gain credibility by being affiliated with elite groups.
Maximum imprisonment is one year or a fine of the fourth category.
18 U.S.C.§ 1030, more commonly known as theComputer Fraud and Abuse Act, prohibits unauthorized access or damage of "protected computers". "Protected computers" are defined in18 U.S.C.§ 1030(e)(2)as:
The maximum imprisonment or fine for violations of theComputer Fraud and Abuse Actdepends on the severity of the violation and the offender's history of violations under theAct.
TheFBIhas demonstrated its ability to recover ransoms paid incryptocurrencyby victims of cybertheft.
The most notable hacker-oriented print publications arePhrack,Hakin9and2600: The Hacker Quarterly. While the information contained in hacker magazines andezineswas often outdated by the time they were published, they enhanced their contributors' reputations by documenting their successes.
Hackers often show an interest in fictionalcyberpunkandcybercultureliterature and movies. The adoption offictionalpseudonyms,symbols, values andmetaphorsfrom these works is very common.