1

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

the term hacker simply referred to an adept computer user, and gurus still use the term to refer to themselves in that original sense.  when breaking into computer systems (technically known as cracking) became popular, the media used the hacker to refer only to computer criminals

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

2

Hacking is illegal. Title 18, United States Code, Section 1030, by Congress in 1984  the perpetrator must “knowingly” commit the crime  notification that unauthorized access is illegal be posted  For a computer-related crime to become a federal crime, the attacker must be shown to have caused at least $5,000 worth of damage.

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

3

2004 CANSPAM Act specifically criminalizes the transmission of unsolicited commercial e-mail without an existing business relationship.  Before that, spamming was not a crime! 

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

4

 Because

of the time it takes, there are only two serious types of hackers:
› the underemployed and › those hackers being paid by someone to

hack.

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

5

Hackers fall quite specifically into these categories, in order of increasing threat:
› › › › › › ›

Security experts Script kiddies Underemployed adults Ideological hackers Criminal hackers Corporate spies Disgruntled employees

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

6

 Most

security experts are capable of hacking but decline to do so for moral or economic reasons.  Computer security experts have found that there’s more money in preventing hacking than in perpetrating it  hundreds of former hackers now consult independently as security experts to medium-sized businesses.
Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

7

Script kiddies are students who hack  These hackers may use their own computers, or (especially at colleges) they may use the more powerful resources of the school to perpetrate their hacks.  joyride through cyberspace looking for targets of opportunity  concerned mostly with impressing their peers and not getting caught.

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

8

in most instances, you’ll never know they were there unless you have software that detects unusual activity or unless they make a mistake.  These hackers constitute about 90 percent of the total manual hacking activity on the Internet.  They use the tools produced by others,  script kiddies hack primarily to get free stuff  They share pirated software and serial numbers

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

9

 Underemployed

adults are former script kiddies  either dropped out of school or failed to achieve full-time employment and family commitments  Many of the tools script kiddies use are created by these adult hackers  Adult hackers often create the “crackz” applied by other hackers to unlock commercial software.  This group also writes the majority of the software viruses.

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

10

Ideological hackers are those who hack to further some political purpose.  Since the year 2000, ideological hacking has gone from just a few verified cases to an information war  They deface websites or perpetrate DoS attacks against their ideological enemies.  looking for mass media coverage of their exploits  have the implicit support of their home government

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

11

Criminal hackers hack for revenge, to perpetrate theft, or for the sheer satisfaction of causing damage.  exceedingly rare because the intelligence required to hack usually also provides ample opportunity for the individual to find some socially acceptable means of support  little risk to institutions that do not deal in large volumes of computer-based financial transactions

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

12

very rare because it’s extremely costly and legally very risky to employ illegal hacking tactics against competing companies  Many high technology businesses are young and naïve about security  Nearly all high-level military spy cases involve individuals who have incredible access to information but as public servants don’t make much money

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

13

 Disgruntled

employees are the most dangerous—and most likely—security problem of all  Attacks range from the complex (a network administrator who spends time reading other people’s e-mail) to the simple (a frustrated clerk who takes a fire axe to your database server).

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

14

There are only four ways for a hacker to access your network: 1. By connecting over the Internet 2. By using a computer on your network directly 3. By dialing in via a Remote Access Service (RAS) server 4. By connecting via a nonsecure wireless network

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

15

Solving the direct intrusion problem is easy:  Employ strong physical security at your premises  treat any cable or connection that leaves the building as a security concern.  putting firewalls between your WAN links and your internal network or behind wireless links

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

16

Put your RAS servers outside your firewall in the public security zone,  force legitimate users to authenticate with your firewall first to gain access to private network resources.  Allow no device to answer a telephone line behind your firewall.

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

17

802.11b came with a much-touted built-in encryption scheme called the WiredEquivalent Privacy (WEP) that promised to allow secure networking with the same security as wired networks have.  It sounded great.  Too bad it took less than 11 hours for security experts to hack it

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

18

 newer

128-bit WEP service is more secure, but it should still not be considered actually equivalent to wired security

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

19

 Target

selection  Information gathering  Attack

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

20

To pass this stage, some vector of attack must be available, so the machine must have either advertised its presence or have been found through some search activity.
› › › ›

DNS Look-up Network Address Scanning Port Address Scanning Service Scanning
Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

21

› SNMP Data gathering › Architecture probes › Directory service look-up

Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

22

 Phishing  Automated

password guessing  Buffer overflow  MiM  Session Hijacking  Source Routing  Trojan horse  Forged e-mails  Floods
Rushdi Shams, Lecturer, Dept of CSE, KUET, Bangladesh

23

Sign up to vote on this title
UsefulNot useful