![]() | |||||
|
| NetNews | September 25, 2001 |
Hackers Slip the Net a Mickey In the ‘60’s, hackers were cutting-edge corporate computer nerds. Today, hackers, crackers, hacktivists, phreakers, cyberpunks and virus writers are labeled vandals, con artists and malicious criminals. Virtually no nation remains untouched by hackers. The government of Malaysia, for example, was recently forced offline by hackers who mirrored government sites. In response, Britain and India are passing harsh laws for first time offenders, bringing hacking into the realm of terrorism. But are hackers terrorists? Philosophically, hackers unveil security flaws in networks and software. Network and software engineers then patch the holes. In this way, hackers evolve in a symbiotic relationship with technology and serve to make the net less vulnerable to a single cataclysmic attack. Evidently, Microsoft buys into this philosophy. They recently met face-to-face with Dutch teenager, Dmitri, who twice hacked into Microsoft Systems. Microsoft proved itself a gentle giant, downplaying an incident that briefly forced them offline by not seeking to prosecute Dmitri. An opposing philosophy was recently demonstrated by Adobe, which pushed for criminal prosecution of Russian programmer, Dmitry Sklyarov. Although Adobe has backed down from its original position, "boycott Adobe" sites remain active. Sklyarov presented a paper about Elcomsoft's program to remove restrictions on Adobe's encrypted PDF documents at DefCon9, on July 15th, and was arrested a day later by the FBI. While hackers were left wondering why a company would use the legal system to protect a security flaw in a software package, it was made crystal clear that all companies do not share Microsoft’s philosophy. The appearance, just weeks ago, of the Peachy virus in PDF documents with embedded files may yet prove to be an act of retribution for the arrest of Sklyarov; until recently, PDF files appeared immune to viruses. Once inside a network, a hacker "counts coup" by bringing something out or leaving something behind as proof of their access. Success is measured in terms of the prize; a password, credit card number or other personal information, or anything important enough to arouse public concerns. Sometimes hackers leave electronic trails to make access easier for other hackers. Hackers operate in a clandestine world of one-upman-ship, vying for status and position among hacker peers. Welsh teenager, Raphael Gray, suddenly became a hacker legend after obtaining Bill Gate's credit card information. Prominent hackers and hacker groupies gather at large conferences attended by the thousands, such as DefCon9 In Las Vegas in July 2001, and the upcoming H2K2 Hackers on Planet Earth (HOPE) conference in New York City in July 2002. While we have it on good authority that almost no one other than hackers attends these conventions, the presentation topics make it look like an internet security conference. Presentations are by software and hardware development group project leaders, network security researchers and engineers, network architects, security consultants, bank auditors, professors and law enforcement experts. Several national and international hacker networks operate newsgroups and IRC chatrooms where information about pirated software and other materials are posted daily. That means that it is increasingly easy to find reliable instructions on how to hack into sites or crack software codes. But making direct contact with a real hacker remains difficult at best, as one prominent television network recently found after being hoodwinked into believing that innocent teen pranksters were hardcore hackers. Most hacker networks require that you prove yourself to be a hacker by providing substantial proof that you have hacked into a system, or cracked a major piece of software that has not been "freed" yet. If you're good enough, you might get recognized. It is a tough world to get into, and members are tight knit. One has just to look at what they do to understand why. Add to that the danger of being "ratted out" by a less seasoned hacker bargaining for a lighter sentence when pressured by prosecutors and you have several good reasons to be leery of people you don't know. At the other end are the "evil" hackers, those committing actual credit card fraud, or loosing upon the unsuspecting netizenry the likes of Trojan horse viruses, that allow hackers indirect access to networks through others home computers. Worse yet are denial of service attacks, the equivalent of slipping a network a mickey. Denial of service attacks tie up networked servers with repetitive tasks which prevent provision of services to legitimate customers. This is the kind of attack made famous by Canada's teenage "Mafiaboy." Clearly, there are costs to these kinds of attacks, but as many companies have recently found, you can’t reclaim financial losses from teenage hackers. Perhaps one of the most amazing technical feats achieved by expert hackers is the ability to generate a mirror image of an official government or other site and to temporarily re-route customer traffic from the real site to a fully functional mirror site. Customers unwittingly provide those operating the mirror site with all of the same personal account information that they would normally provide those operating the original site. To perform such a task, particularly where it involves obtaining information and then abandoning or crashing the mirror site without leaving any traceable electronic pathway, goes beyond the realm of "hacker mayhem" to a whole new level nothing short of "hacker artisanship." Hackers even appear to have an honor code. Granted, everyone is out to better the other person and vie for position and status but a code is in effect. But don't cross the line; if one hacker stumbles into another's territory, it's open season and the best hacker may be the one that doesn't get framed. Often caught in the act, though, are the less seasoned hackers, who learn to breech network security, but unlike their veteran counterparts, lack the sophistication to cover their tracks or keep their mouths shut. The result, a slew of 15-18 year olds getting to know their bail bondsman on a first name basis. For example, 16 year old Norwegian Jon Johnsen, who cracked the code necessary to copy DVD's. Don't make a mistake, though. While most hackers languishing in jail cells or spending time in court rooms are teenagers and young adults, it is clear that many skillful teenage hackers are never caught. Often, those who are caught appear to suffer from an addiction to hacking... many simply do not realize the extent of criminal liability involved in their activities. Dr. W. David Currie *Co-author, Richard, has ties with the hacker community and does not provide his last name. |