Exposing the Criminal
The computer security
problem includes not only hardware on local area networks, but more
importantly, the information contained by those systems and potential
vulnerabilities to remote-access breaches.
Market research reveals
that computer security increasingly is the area of greatest concern
among technology corporations. Among industrial security managers in one
study, computer security ranked as the top threat to people, buildings,
and assets (Check Point Software Technologies, 2000). Reported incidents
of computer hacking, industrial espionage, or employee sabotage are
growing exponentially. Some statistics proclaim that as much as 85
percent of corporate networks contain vulnerabilities.
In order to successfully
“lock down” the computer world, we have to start by securing local
stations and their networks. Research from management firms including
Forrester indicates that more than 70 percent of security executives
reveal that their server and Internet platforms are beginning to emerge
in response to demand for improved security. Online business-to-business
(B2B) transactions will grow to $327 billion in 2002, up from $8 billion
last year, according to Deborah Triant, CEO of firewall vendor Check
Point Software, in Redwood City, California. But to protect local
networks and online transactions, the industry must go beyond simply
selling firewall software and long-term service, and provide vulnerable
security clarifications. The best way to gain this knowledge is to learn
from the real professionals, that is, the hackers, crackers, phreaks,
and cyberpunks
Who are these so-called
professionals? Common understanding is mostly based on unsubstantiated
stories and images from motion pictures. We do know that computer
hacking has been around since the inauguration of computer technology.
The first hacking case was reported in 1958. According to the offenders,
all hackers may not be alike, but they share the same quest—for
knowledge. The following excerpt submission from the infamous hacker
guru, Mentor, reveals a great deal about this underground community:
Another one got caught
today; it’s all over the papers: “Teenager Arrested in Computer Crime
Scandal,’’ “Hacker Arrested after Bank Tampering.”
“Damn kids. They’re all
alike.”
But did you, in your
three-piece psychology and 1950’s technobrain, ever take a look behind
the eyes of the hacker? Did you ever wonder what made him tick, what
forces shaped him, what may have molded him?
I am a hacker; enter my
world… .Mine is a world that begins with school. I’m smarter than most
of the other kids; this crap they teach us bores me.
“Damn underachiever.
They’re all alike.”
I’m in junior high or
high school. I’ve listened to teachers explain for the fifteenth time
how to reduce a fraction. I understand it. “No, Ms. Smith, I didn’t show
my work. I did it in my head… ”
“Damn kid. Probably
copied it. They’re all alike.”
I made a discovery today.
I found a computer. Wait a second; this is cool. It does what I want it
to. If it makes a mistake, it’s because I screwed it up. Not because it
doesn’t like me, or feels threatened by me, or thinks I’m a smart-ass,
or doesn’t like teaching and shouldn’t be here.
“Damn kid; all he does is
play games. They’re all alike.”
And then it happened: a
door opened to a world. rushing through the phone line like heroin
through an addict’s veins; an electronic pulse is sent out; a refuge
from the day-to-day incompetencies is sought; a board is found. “This is
it… this is where I belong. I know everyone here… even if I’ve never met
them, never talked to them, may never hear from them again… I know you
all… .”
“Damn kid. Tying up the
phone line again. They’re all alike.”
You bet your ass we’re
all alike; we’ve been spoon-fed baby food at school when we’ve hungered
for steak. The bits of meat that you did let slip through were prechewed
and tasteless. We’ve been dominated by sadists, or ignored by the
apathetic. The few that had something to teach found us willing pupils,
but those few were like drops of water in the desert. This is our world
now… the world of the electron and the switch, the beauty of the baud.
We make use of a service already existing without paying for what could
be dirt-cheap if it weren’t run by profiteering gluttons. And you call
us criminals. We explore. And you call us criminals. We seek after
knowledge. And you call us criminals. We exist without skin color,
without nationality, without religious bias. And you call us criminals.
You build atomic bombs; you wage wars; you murder, cheat, and lie to us,
and try to make us believe it’s for our own good, yet we’re the
criminals…
Yes, I am a criminal. My
crime is that of curiosity. My crime is that of judging people by what
they say and think, not by what they look like. My crime is that of
outsmarting you, something that you will never forgive me for. I am a
hacker, and this is my manifesto. You may stop this individual, but you
can’t stop us all… after all, we’re all alike.
Regardless of the view of
hacker as criminal, there seems to be a role for the aspiring hacker in
every organization. Think about it: who better to secure a network, the
trained administrator or the stealthy hacker? Hackers, crackers,
phreaks, and cyberpunks seek to be recognized for their desire to learn,
as well as for their knowledge in technologies that are guiding the
world into the future. According to members of the Underground, society
cannot continue to demonstrate its predisposition against hackers.
Hackers want the populace to recognize that they hack because they have
reached a plateau; to them, no higher level of learning exists. To them,
it is unfair for the public to regard the hacker, cracker, phreak, and
cyberpunk as one malicious group. Still, remember what the Mentor said:
“I am a hacker, and this is my manifesto.You may stop this individual,
but you can’t stop us all… after all, we’re all alike.”
Profiling
the Hacker
Profiling the hacker has
been a difficult, if not fruitless undertaking for many years now.
According to the FBI postings on Cyber-Criminals in 1999, the profile
was of a nerd, then of a teen whiz-kid; at one point the hacker was seen
as the antisocial underachiever; at another, the social guru. Most
hackers have been described as punky and wild, because they think
differently, and it is reflected in their style. None of this rings true
anymore. A hacker may be the boy or girl next door. A survey of 200
well-known hackers reported that the average age of a hacker is 16-19,
90 percent of whom are male; 70 percent live in the United States. They
spend an average of 57 hours a week on the computer; and 98 percent of
them believe that they’ll never be caught hacking. The typical hacker
probably has at least three of the following qualities:
-
Is proficient in C,
C++, CGI, or Perl programming languages.
-
Has knowledge of
TCP/IP, the networking protocol of the Internet.
-
Is a heavy user of the
Internet, typically for more than 50 hours per week.
-
Is intimately familiar
with at least two operating systems, one of which is almost
certainly UNIX.
-
Was or is a computer
professional.
-
Is a collector of
outdated computer hardware and software.
Do any of these
characteristics describe you? Do you fit the FBI profile? Could they be
watching you? Further observations from the hacker profiles reveal
common security class hack attacks among many different hacker groups.
Specific penetrations are targeted at Security Classes C1, C2, B1, and
B2.
Security Levels
The National Computer
Security Center (NCSC) is the United States government agency
responsible for assessinging software/hardware security. It carries out
evaluations based on a set of requirements outlined in its publication
commonly referred to as the “Bright Orange Book.”
A Hacker’s Genesis
I remember it as if it
happened yesterday, in one brief, exhilarating moment. It was the fall
of 1981, the time of year when all picturesque, lively nature is
changing to beautiful demise. I was a young boy, and Christmas was right
around the corner. I had worked hard around the house the past summer,
never complaining about my chores. I was especially well mannered, too,
all in the hopes of finally getting the dirt bike I dreamed of. I
remember I couldn’t sleep Christmas Eve; I kept waking up, heart
pounding, to check the clock—in suspense.
Unfortunately, to my
dismay, on Christmas morning, when I ran to the front room, I found only
a small box for me under the tree, too small to be a motorbike and too
big to hold the key, owner’s manual, and a note that directed me to a
surprise in the garage. But even as I wondered how I had failed to
deserve a bike, I was aware there was still an unopened surprise for me
under the tree. The box was wrapped so precisely, hinting there may have
been something of great value in it. (I have always noticed that people
seem to take extra time and care to wrap the expensive presents.) I
could see this package had taken some time to wrap; the edges were
perfect, and even the tape snippets were precise. I tore this perfect
wrapping apart vigorously while noticing the box was moderately heavy,
all the time wondering what it could be. After removing a large piece of
wrapping paper that covered the top of the box, I stared at it unable to
focus for a moment on what it actually was. Then my eyes made contact;
there it was—a new computer.
At first I wasn’t quite
sure what this could mean for me. Then it hit me: I could play cool
games on this thing! (I remembered seeing advertisements, which gave so
many children hope, that computers weren’t just for learning and school,
that we could play really wicked games, too. I was always a pretty good
student; it didn’t take much effort for me to be on the Dean’s List. My
point is, it didn’t take me long to unbox, set up, and configure my new
computer system—without consulting the manuals or inspecting those
‘‘Read Me First” booklets. But I did go through them carefully when I
thought something was missing: I was a bit disappointed to discover that
the system didn’t included any games or software, aside from the
operating system and a programming language called BASIC. Nevertheless,
a half-hour later I was loading BASIC, and programming my name to scroll
across the screen in a variety of patterns. I guess that was when it all
started.
Only a few weeks passed
until I realized I had reached the full potential of my computer. The
program I was working on had almost reached memory capacity; it included
a data array of questions, choices, and scenarios with character-block
graphics and audio beeps. In short, I had staged a world war on Earth
between the Evil Leaders and the Tactful Underdogs. Here’s the scenario:
The Underdogs had recently sustained an onslaught of attacks that
changed 90 percent of their healthy, young, soldiers into desolate
casualties. The odds were against the Underdogs from the beginning, as
their archaic arsenal couldn’t compare to the technological warfare used
by the Evil Leaders. From the start, they didn’t have much confidence;
only hope had brought these young boys and girls together as soldiers to
fight the aggressors.
Your best friends are
dying; your arsenal is empty; and you haven’t eaten in days. During all
this turmoil, that inner voice—the one you packed deep away inside
yourself from childhood—has spoken again, and it is dictating your
thoughts. Your view faded back to the time you found that spaceship in
the prairie at the end of your block. If it really were an unidentified
flying object, as confirmed by sightings throughout the city and
reported in the local newspapers… Then, maybe, there is some advanced
weaponry onboard; maybe you can figure out how to operate that thing—as
long as you can remember, there was a low electromagnetic-type hum
emanating from the ship. You were the last soldier of that special group
of friends who made the pact of silence years ago, after stumbling upon
the ship, while searching for logs to serve as support beams for your
prairie fort. At that moment, and what seemed a heavy pause, nausea
overwhelmed you as you come to realize that the fate of the Underdogs
might be in your hands alone (later you would understand that it would
be left to your mind rather than your hands to operate the ship).
Regardless, there might be one last hope… one last chance to bomb the
“Black House” and win the war for the Underdogs…
I was surprised when they
announced my name as one of the winners in the Science Fair that year.
So much of my time had been spent working on my game that I had
completely, and deliberately, blown off my original science project—I
still can’t remember what that was. At the last minute, I phoned my
teacher, scheduled time on a school television, and packed up my
computer to show as my project for the fair. My goal was twofold: I was
hoping to pass off my programming as my project and to secure my entry
in the fair (my grade would have been mortally wounded if I had failed,
as the Science Fair project was worth one-third of the overall grade).
Certainly I never expected to hear my name called as a winner. As it
turned out, my booth had generated more attention than all of the other
top projects combined. Everyone loved my game and seemed amazed at the
complexity of the programming and assumed I must have spent a great deal
of time on it (little did they know).
As a reward for my
success from my parents, I was allowed to trade in my computer and was
given some cash to acquire a more professional computer system. It was
exciting to move from cassette data storage to one with a floppy
diskette (the icing on the cake was that the system actually supported
color!). I spent hours every night working on the new system and getting
acquainted with a different operating system, one with so many more
commands and much more memory address space to work on my next project,
which was called Dragon’s Tomb. It proved to be the inspiration for the
development of Sorcery. Over countless evenings and on innumerable
tablets of graph paper, then using pixels, lines, circles, custom
fill-ins, multiple arrays, numerous variables, and 650 pages of code
(more than 46,000 lines of coding) in four separate modules, on four
floppy diskettes (later custom-pirate-modified as double-siders), the
results were extremely gratifying:
For many years, there has
been peace in your neighboring land of the long-forgotten city. The
fertile plain of the River Zoth has yielded bountifully; commerce has
prospered; and the rulers of the magic Orb of Power have been wise and
just. But of late, disturbing reports of death, destruction, and intense
torture have reached your village. According to the tales of whimpering
merchants and jaded travelers, the forgotten city has been overrun by
evil. In the days long past, the Orb of Power was summoned by a powerful
cleric. It is written that the Orb withholds the secrets of the
Universe, along with immense power to rule such. But if the Orb should
someday fall into the wrong hands… Days ago, you joined a desert caravan
of the strongest warriors and the wisest magic users. Firlor, among the
oldest of the clerics, has told you the magic words to unveil the
dreadful castle where the Orb is said to be guarded. The heat is making
it hard to concentrate—if you could only remember the
words when… a sandstorm!
The shrieking wind whips over you, driving sand into your eyes and mouth
and even under your clothing. Hours pass; your water is rapidly
disappearing; and you are afraid to sleep for fear you will be buried
beneath the drifts. When the storm dies down, you are alone. The caravan
is nowhere in sight. The desert is unrecognizable, as the dunes have
been blown into new patterns. You are lost… Tired and sore, you struggle
over the burning sands toward the long-forgotten city. Will you reach
the ruins in time to recover the magic Orb of Power? The sun beats down,
making your wounds stiff, and worsening the constant thirst that plagues
anyone who travels these waterless wastes. But there is hope—are those
the ruins over there?
In the midst of broken
columns and bits of rubble stands a huge statue. This has got to be the
place! You’ve found it at last. Gratefully, you sink onto the sand. But
there’s no time to lose. You must hurry. So with a quavering voice, you
say the magic words, or at least what you remember them to be. And then
you wait… A hush falls over the ruins, making the back of your neck
prickle. At first nothing happens; then out of the east, a wind rises,
gently at first but quickly growing stronger and wilder, until it tears
at your clothes and nearly lifts you off your feet. The once-clear sky
is choked with white and gray clouds that clash and boil. As the clouds
blacken, day turns to night. Lightning flashes, followed by menacing
growls of thunder. You are beginning to wonder if you should seek
shelter, when all of a sudden there is a blinding crash, and a bolt of
lightning reduces the statue to dust!
For a moment, silence;
then, out of the statue’s remains soars a menacing flame. Its roar
deafens you, as higher and higher it climbs until it seems about to
reach the clouds. Just when you think it can grow no larger, its shape
begins to change. The edges billow out into horrifying crisp, ragged
shapes; the roar lessens; and before your eyes materializes a gigantic
dark castle… You stand before the castle pondering the evil that awaits.
Sorcery lies in the realm of dragons and adventure. Your quest begins at
the entrance of a huge castle consisting of many levels and over 500
dungeons. As you travel down the eerie hallways into the abyss of evil,
you will encounter creatures, vendors, treasure, and traps… sinkholes,
warps, and magic staffs.
Sorcery also includes
wandering monsters; choose your own character, armor, and weapons, with
a variety of spells to cast a different adventure each time you play. I
spent two years developing Sorcery back in the early eighties. My
original intent was to make my idea reality then distribute it to
family, friends, and other computer-enthusiasts. Although I did
copy-protect my development, I never did sell the product. Now as I
reflect, this rings a familiar sound: Could someone have stolen my
efforts? Anyway, little did I know that the Sorcery prelude manuscript
would alter the path of my future. Again, spending too much time working
on personal projects, and very little time concentrating on school
assignments, I had run into another brick wall. It was the eleventh hour
once more, and I had blown off working on an assignment that was due the
next day: I was supposed to give another boring speech in class. This
time, however, the topic could be of my own choosing. As you may have
deduced, I memorized my Sorcery introduction, but altered the tone to
make it sound as if I was promoting the product for sale. With fingers,
and probably some toes, crossed, I winged the speech, hoping for a
passing mark.
To my surprise, the class
listened to the speech with interest and growing concentration. As a
result, I was awarded the highest grade in my class. But the
unparalleled reward was yet to come. After classes that day, a fellow
student approached me apprehensively. I had previously noticed his
demeanor in class and had decided he was a quiet underachiever. With
unkempt greasy hair and crumpled shirts, he always sat at the back of
the classroom, and often was reprimanded for sleeping. The teachers
seemed to regard him as a disappointment and paid him no attention as he
passed through the hallways. As he drew near me, I could see he was
wide-eyed and impatient. I remember his questions that day very well. He
was persistent and optimistic as he asked whether my program really
existed or if I had made up the whole scenario for a better grade. It
was obvious to me that he wanted a copy. I told him the truth and asked
if he had a computer that was compatible with mine. At that, he laughed,
then offered me a software trade for a copy of Sorcery. I would have
given him a copy regardless, but thought it would be nice to add to my
own growing collection of programs. The software he offered included a
graphics file converter and a program to condense file sizes by reducing
the headers. I remember thinking how awesome it would be to condense my
own programs and convert graphics without first modifying their format
and color scheme.
We made the trade after
school the following day, and I hurried home to load the software from
the disk. The graphics converter executed with error, and disappointed,
I almost discarded the floppy without trying the file condenser. Upon
loading that program later that night, and to my disbelief, it ran
smoothly. What really caught my attention, however, was the pop-up
message I received upon exiting the program: It told of an organization
of computer devotees who traded software packages and were always
looking for qualified members. At the end of the message was a post
office box mailing address: “snd intrest 2:” I jumped at this potential
opportunity. I could hardly imagine an organized group whose members
were as interested in technology as I was, and who exchanged software,
ideas, and knowledge. I composed my letter and mailed it off that very
same day. Only a week passed before I received my first reply and group
acceptance request from the leader of the group (a very fond welcome
indeed, for those of you who can identify him from this). At that
moment, the path my life had begun to take reached a new intersection,
one that would open the door to a mind-boggling new genesis
A
Hacker’s Vocation
As I stood there
pondering my new found potential source of goodies, I realized I was a
bit confused: The letter stated that there were a few prerequisites
before I would be considered a tyro member. First and foremost, I had to
draft a few paragraphs as an autobiography, including my expectations
of, and prospective personal offerings to, the group. Second, I had to
include a list of software, hardware, and technologies in which I
considered myself skilled. The third requirement mandated a complete
listing of all software and hardware in my current possession. Last, I
was required to make copies of this information and mail them to the
names on a list that was included on an enclosed diskette. I was
especially excited to see that list. I wondered: Was it a member list?
How many computer enthusiasts, like myself, could there be? I
immediately popped the disk in my system and executed the file,
runme.com. Upon execution, the program produced an acceptance statement,
which I skimmed, and quickly clicked on Agreed. Next I was instructed to
configure my printer for mailing labels. This I was happy to do since I
had just purchased a batch of labels and couldn’t wait to print some
out. To my surprise, however, my printer kept printing and printing
until I had to literally run to the store and buy some more, and then
again—five packets of 50 in all. Then I had to buy 265 stamps. I
couldn’t believe the group had more than 260 members: How long ago had
this group been established? I was eager to find out, so I mailed my
requirements the very next morning. The day after, as I walked back from
the post office, I thought I should make a copy of my membership disk;
it did have important contacts within. But when I arrived home and
loaded the diskette, the runme.com file seemed to have been deleted.
(Later I discovered a few hidden files that solved that mystery.) The
list was gone, so I waited.
Patience is a virtue—at
least that’s what I was brought up to believe. And, in this case it paid
off. It wasn’t long before I received my first reply as a new member of
this computer club. The new package included another mailing
list—different from the first one and much smaller. There was also a
welcome letter and a huge list of software programs. The latter half of
the welcome note included some final obligatory instructions. My first
directive was to choose a handle, a nickname by which I would be
referred in all correspondence with the club. I chose Ponyboy, my
nickname in a neighborhood group I had belonged to some years back. The
next objective was twofold: First I had to send five of the programs
from my submission listing to an enclosed address. In return, as the
second part of the objective, I was to choose five programs I wanted
from the list enclosed with the welcome letter. I didn’t have a problem
sending my software (complete original disks, manuals, and packaging) as
I was looking forward to receiving new replacements.
Approximately a week and
a half passed before I received a response. I was surprised that it was
much smaller than the one I had mailed—there was no way my selections
could fit in a parcel that small. My initial suspicion was that I had
been swindled, but when I opened the package, I immediately noticed
three single-sided diskettes with labels and cryptic handwriting on both
sides. It took a moment for me to decipher the scribble to recognize the
names of computer programs that I had requested, plus what appeared to
be extra software, on the second side of the third diskette. Those bonus
programs read simply: hack-005. This diskette aroused my curiosity as
never before. I cannot recall powering on my system and scanning a
diskette so quickly before or since.
The software contained
Underground disk copy programs, batches of hacking text files, and file
editors from ASCII to HEX. One file included instructions on pirating
commercial software, another on how to convert single-sided diskettes
into using both sides (that explained the labels on both sides of what
would normally have been single-sided floppies). And there was more:
files on hacking system passwords and bypassing CMOS and BIOS
instructions. There was a very long list of phone numbers and access
codes to hacker bulletin boards in almost every state. There was also
information on secret meetings that were to take place in my area. I
felt like a kid given free rein in a candy store. In retrospect, I
believe that was the moment when I embarked on a new vocation: as a
hacker.
Glossary
802.3 The standard
IEEE 802.3 format; also known as Novell 802.2.
10BaseT IEEE 802.3
Physical Layer specification for twisted-pair Ethernet using unshielded
twisted pair wire at 10 Mbps. 10BaseT is nomenclature for 10 Mbps,
Baseband, Twisted Pair Cable.
Activation The
point at which the computer initially ‘‘catches” a virus, commonly from
a trusted source.
API (Application
Programming Interface) A technology that enables an application on
one station to communicate with an application on another station.
ARP (Address
Resolution Protocol) A packet broadcast to all hosts attached to a
physical network.This packet contains the IP address of the node or
station with which the sender wishes to communicate.
ARPANET An
experimental wide area network that spanned the United States in the
1960s, formed by the U.S. Department of Defense’s Advanced Research
Projects Agency, ARPA (later called DARPA).
ASCII (American
Standard Code for Information Interchange) The universal standard
for the numerical codes computers use to represent all upper- and
lowercase letters, numbers, and punctuation.
Asynchronous
Stations transmit in restricted or nonrestricted conditions; a
restricted station can transmit with up to full ring bandwidth for a
period of time allocated by station management; nonrestricted stations
distribute all available bandwidth, minus restrictions, among the
remaining stations.
Backdoor A means
and method by which hackers gain and retain access to a system and cover
their tracks.
Bandwidth A
measure of the amount of traffic the media can handle at one time. In
digital communication, describes the amount of data that can be
transmitted over the line measured in bits per second (bps).
Bit A single-digit
number in Base-2 (a 0 or a 1); the smallest unit of computer data.
Buffer Flow Control
As data is passed in streams, protocol software may divide the stream to
fill specific buffer sizes. TCP manages this process to prevent a buffer
overflow. During this process, fast-sending stations may be periodically
stopped so that slow-receiving stations can keep up.
Buffering
Internetworking equipment such as routers use this technique as memory
storage for incoming requests. Requests are allowed to come in as long
as there is enough buffer space (memory address space) available. When
this space runs out (buffers are full), the router will begin to drop
packets.
Byte The number of
bits (8) that represent a single character in the computer’s memory.
Cracker A person
who overcomes the security measures of a network or particular computer
system to gain unauthorized access. Technically, the goal of a cracker
is to obtain information 816 illegally from a computer system or to use
computer resources illegally; however, the majority of crackers merely
want to break into the system.
CRC (Cyclic Redundancy
Check) A verification process for detecting transmission errors. The
sending station computes a frame value before transmission. Upon frame
retrieval, the receiving station must compute the same value based on a
complete, successful transmission.
CSMA/CD (Carrier Sense
with Multiple Access and Collision Detection) Technology bound with
Ethernet to detect collisions. Stations involved in a collision
immediately abort their transmissions. The first station to detect the
collision sends out an alert to all stations. At this point, all
stations execute a random collision timer to force a delay before
attempting to transmit their frames. This timing delay mechanism is
termed the back-off algorithm. If multiple collisions are detected, the
random delay timer is doubled.
Datagram The
fundamental transfer unit of the Internet. An IP datagram is the unit of
data commuted between IP modules.
Demultiplexing The
separation of the streams that have been multiplexed into a common
stream back into multiple output streams.
DSL (Digital
Subscriber Line) A high-speed connection to the Internet that can
provide from 6 to 30 times the speed of current ISDN and analog
technology, at a fraction of the cost of comparable services. In
addition, DSL uses telephone lines already in the home
Error Checking A
function that is typically performed on connection-oriented sessions
whereby each packet is examined for missing bytes. The primary values
involved in this process are termed checksums. With this procedure, a
sending station calculates a checksum value and transmits the packet.
When the packet is received, the destination station recalculates the
value to determine whether there is a checksum match. If a match takes
place, the receiving station processes the packet. If there was an error
in transmission, and the checksum recalculation does not match, the
sender is prompted for packet retransmission.
Error Rate In data
transmission, the ratio of the number of incorrect elements transmitted
to the total number of elements transmitted.
FDDI (Fiber
Distributed Data Interface) Essentially a high-speed Token Ring
network with redundancy failover using fiber optic cable.
File Server A
network device that can be accessed by several computers through a local
area network (LAN). It directs the movement of files and data on a
multiuser communications network, and “serves” files to nodes on a local
area network.
Fragmentation Scanning
A modification of other scanning techniques, whereby a probe packet
is broken into a couple of small IP fragments. Essentially, the TCP
header is split over several packets to make it harder for packet
filters to detect what is happening.
Frame A group of
bits sent serially (one after another) that includes the source address,
destination address, data, frame-check sequence, and control
information. Generally, a frame is a logical transmission unit. It is
the basic data transmission unit employed in bit-oriented protocols.
Full-Duplex
Connectivity
Stream transfer in both directions, simultaneously, to reduce overall
network traffic.
Hacker Typically,
a person who is totally immersed in computer technology and computer
programming, and who likes to examine the code of operating systems and
other programs to see how they work. This individual subsequently uses
his or her computer expertise for illicit purposes such as gaining
access to computer systems without permission and tampering with
programs and data.
Hacker’s Technology
Handbook A collection of the key concepts vital to developing a
hacker’s knowledge base.
Handshaking A
process that, during a session setup, provides control information
exchanges, such as link speed, from end to end.
HTML (Hypertext Markup
Language) A language of tags and codes by which programmers can
generate viewable pages of information as Web pages.
Hub The center of
a star topology network, also called a multiport repeater. The hub
regenerates signals from a port, and retransmits to one or more other
ports connected to it.
InterNIC The
organization that assigns and controls all network addresses used over
the Internet. Three classes, composed of 32-bit numbers, A, B, and C,
have been defined.
IP (Internet Protocol)
An ISO standard that defines a portion of the Layer 3 (network) OSI
model responsible for routing and delivery. IP enables the transmission
of blocks of data (datagrams) between hosts identified by fixed-length
addresses.
IPX (Internetwork
Packet Exchange) The original NetWare protocol used to route packets
through an internetwork. IPX is a connectionless datagram protocol, and,
as such, is similar to other unreliable datagram delivery protocols such
as the Internet Protocol.
ISDN (Integrated
Services Digital Network) A digital version of the switched analog
communication.
LAN (Local Area
Network)
Group of computers and other devices dispersed over a relatively limited
area and connected by a communications link that enables any station to
interact with any other. These networks allow stations to share
resources such as laser printers and large hard disks.
Latency The time
interval between when a network station seeks access to a transmission
channel and when access is granted or received. Same as waiting time.
Mail bombs Email
messages used to crash a recipient’s electronic mailbox; or to spam by
sending unauthorized mail using a target’s SMTP gateway. Mail bombs may
take the form of one email message with huge files attached, or
thousands of e-messages with the intent to flood a mailbox and/or
server.
Manipulation The
point at which the “payload” of a virus begins to take effect, as on a
certain date (e. g. , Friday 13 or January 1), triggered by an event (e.
g. , the third reboot or during a scheduled disk maintenance procedure).
MAU (Multistation
Access Unit) The device that connects stations in a Token Ring
network. Each MAU forms a circular ring.
MTU (Maximum Transfer
Unit) The largest IP datagram that may be transferred using a
data-link connection during the communication sequences between systems.
The MTU value is a mutually agreed value, that is, both ends of a link
agree to use the same specific value.
NetBEUI (NetBIOS
Extended User Interface) An unreliable protocol, limited in
scalability, used in local Windows NT, LAN Manager, and IBM LAN server
networks, for file and print services.
NetBIOS (Network Basic
Input/Output System) An API originally designed as the interface to
communicate protocols for IBM PC networks. It has been extended to allow
programs written using the NetBIOS interface to operate on many popular
networks.
Noise Any
transmissions outside of the user’s communication stream, causing
interference with the signal. Noise interference can cause bandwidth
degradation and, potentially, render complete signal loss.
Novell Proprietary
Novell’s initial encapsulation type; also known as Novel Ethernet 802. 3
and 802. 3 Raw.
OSI (Open Systems
Interconnection) Model A seven-layer set of hardware and software
guidelines generally accepted as the standard for overall computer
communications
Packet A bundle of
data, usually in binary form
Phreak A person
who breaks into telephone networks or other secured telecommunication
systems.
PPP (Point-to-Point
Protocol) An encapsulation protocol that provides the transportation
of IP over serial or leased line point-to-point links.
Protocol A set of
rules for communication over a computer network.
PVC (Permanent Virtual
Circuit) Permanent communication sessions for frequent data
transfers between DTE devices over Frame Relay.
RARP (Reverse Address
Resolution Protocol) A protocol that allows a station to broadcast
its hardware address, expecting a server daemon to respond with an
available IP address for the station to use.
Replication The
stage at which a virus infects as many sources as possible within its
reach.
Service Advertisement
Protocol A method by which network resources, such as file servers,
advertise their addresses and the services they provide. By default,
these advertisements are sent every 60 seconds.
Scanning (Port
Scanning)
A process in which as many ports as possible are scanned, to identify
those that are receptive or useful to a particular hack attack. A
scanner program reports these receptive listeners, analyzes weaknesses,
and cross-references those frailties with a database of known hack
methods for further explication.
Sniffers Software
programs that passively intercept and copy all network traffic on a
system, server, router, or firewall.
Source Quenching
In partnership with buffering, source quenching sends messages to a
source node as the receiver’s buffers begin to reach capacity. The
receiving router sends time-out messages to the sender instructing it to
slow down until buffers are free again.
Streams Data is
systematized and transferred as a stream of bits, organized into 8-bit
octets or bytes. As these bits are received, they are passed on in the
same manner.
Subnetting The
process of dividing an assigned or derived address class into smaller
individual, but related, physical networks.
SVC (Switched Virtual
Circuit) A periodic, temporary communication session for infrequent
data transfers.
Synchronous A
system whereby stations are guaranteed a percentage of the total
available bandwidth.
TCP (Transmission
Control Protocol) A protocol used to send data in the form of
message units between computers. TCP tracks the individual units of data
called packets.
TCP FIN Scanning A
more clandestine from of scanning. Certain firewalls and packet filters
watch for SYNs to restricted ports, and programs such as Synlogger and
Courtney are available to detect these scans. FIN packets, on the other
hand, may be able to pass through unmolested, because closed ports tend
to reply to FIN packet with the proper RST, while open ports tend to
ignore the packet in question.
TCP Port Scanning
The most basic form of scanning. With this method, an attempt is made to
open a full TCP port connection to determine whether that port is
active, or “listening.”
TCP Reverse Ident
Scanning A protocol that allows for the disclosure of the username
of the owner of any process connected via TCP, even if that process
didn’t initiate the connection. It is possible, for example, to connect
to the HTTP port and then use identd to find out whether the server is
running as root.
TCP SYN Scanning
Often referred to as half-open or stealth scanning, because a full TCP
connection is not opened. A SYN packet is sent, as if opening a real
connection, waiting for a response. A SYN/ACK indicates the port is
listening. Therefore, a RST response is indicative of a nonlistener. If
a SYN/ACK is received, an RST is immediately sent to tear down the
connection. The primary advantage to this scanning technique is that
fewer sites will log it.
Threat An
activity, deliberate or unintentional, with the potential for causing
harm to an automated information system or activity.
Trojan A
malicious, security-breaking program that is typically disguised as
something useful, such as a utility program, joke, or game download.
UDP (User Datagram
Protocol) A communications protocol that offers a limited amount of
service when messages are exchanged between computers in a network that
uses IP.
UDP ICMP
Port-Unreachable Scanning A scanning method that uses the UDP
protocol instead of TCP. This protocol is less complex, but scanning it
is significantly more difficult. Open ports don’t have to send an
acknowledgment in response to a probe, and closed ports aren’t required
to send an error packet. Fortunately, most hosts send an
ICMP_PORT_UNREACH error when a packet is sent 820 to a closed UDP
port. Thus it is possible to determine whether a port is closed, and by
exclusion, which ports are open.
UDP recvfrom( ) and
write( ) Scanning Nonroot users can’t read port-unreachable errors
directly; therefore, Linux informs the user indirectly when they have
been received. For example, a second write( ) call to a closed port will
usually fail. A number of scanners such as netcat and pscan. c, do this.
This technique is used for determining open ports when nonroot users use
-u (UDP).
Virtual Circuits
When one station requests communication with another, both stations
inform their application programs and agree to communicate. If the link
or communication between these stations fails, both stations are aware
of the breakdown and inform their respective software applications. In
this case, a coordinated retry will be attempted.
Virus A computer
program that makes copies of itself by using, therefore requiring, a
host program.
VLSM
(Variable-Length Subnet Masking) The broadcasting of subnet information
through routing protocols.
Vulnerability A
flaw or weakness that may allow harm to occur to an automated
information system or activity.
WAN (Wide Area
Network)
A communications network that links geographically dispersed systems.
Well-known Ports
The first 1,024 of the 65,000 ports on a computer system, which are
reserved for system services; as such, outgoing connections will have
port numbers higher than 1023. This means that all incoming packets that
communicate via ports higher than 1023 are actually replies to
connections initiated by internal requests.
Windowing With
this function, end-to-end nodes agree upon the number of packets to be
sent per transmission. This packet number is termed the window size. For
example, with a window size of 3, the source station will transmit three
segments and then wait for an acknowledgment from the destination. Upon
receiving the acknowledgment, the source station will send three more
segments, and so on.
Wanna Make some money?
If
you have access to your own email account, you can get paid.
Our
first ‘‘intermission” begins by taking time out to define the terms
hacker, cracker, phreak, and cyberpunk. This is necessary, because they
are often used interchangeably; for example, a hacker could also be a
cracker; a phreak may use hacking techniques; and so on. To help
pinpoint the specifics of each of these, let’s define how they’re
related: