Hacking/Cracking Term Controversy

One of the most prevalent attitudes in the media is that hacking can be used for financial gain. A lot of the traditional, paper and TV media outlets, and several of the technological, new media channels brashly claim that hackers are the ones who decode websites, sneak around, and steal you identity. However the reality of the situation is quite different.

 

“In common usage, a hacker is a stereotypical person who breaks into computers and computer networks, either for profit or motivated by the challenge. The subculture that has evolved around hackers is often referred to as the computer underground but is now an open community.

Other definitions of the word hacker exist that are not related to computer security. They are subject to the long standing hacker definition controversy about the true meaning of hacker. In this controversy, the term hacker is reclaimed by computer programmers who argue that someone breaking into computers is better called cracker, not making a difference between computer criminals (“black hats”) and computer security experts (“white hats”). Some white hat hackers claim that they also deserve the title hacker, and that only black hats should be called crackers. None of this controversy has gained any relevance in mainstream media, TV and movies, however.” http://en.wikipedia.org/wiki/Hacker_(computer_security)

 

As this quote explains, the media’s portrayal of cyberthiefs as hackers, as seen in coverage of the Lush data theft [http://www.stuff.co.nz/technology/4662025/Kiwi-online-shoppers-details-stolen] and the Morgan Stanley data breach [http://www.computing.co.uk/ctg/news/2029564/morgan-stanley-network-hacked].

This term controversy should play a vital part in the media portray of hacking, as if the media were to utalise the correct terms, all those examples of data fraud and information theft wouldn’t be examples of hacking, but of cracking instead.

Below is a copypasta list of the different types of hackers, and the terms used by educated media outlets to describe them.

 

 

 

White hat

A white hat hacker breaks security for non-malicious reasons, for instance testing their own security system. This classification also includes individuals who perform penetration tests and vulnerability assessments within a contractual agreement. Often, this type of ‘white hat’ hacker is called an ethical hacker. The International Council of Electronic Commerce Consultants, also known as the EC-Council has developed certifications, courseware, classes, and online training covering the diverse arena of Ethical Hacking.^[10]

Black hat

A black hat hacker, sometimes called a cracker, is someone who breaks computer security without authorization or uses technology (usually a computer, phone system or network) for malicious reasons such as vandalism, credit card fraud, identity theft, piracy, or other types of illegal activity.^[10][11]

Grey hat

A grey hat hacker is a combination of a Black Hat and a White Hat Hacker. A Grey Hat Hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked, for example. Then they may offer to repair their system for a small fee.^[4]

Elite hacker

A social status among hackers, elite is used to describe the most skilled. Newly discovered exploits will circulate among these hackers. Elite groups such as Masters of Deceptionconferred a kind of credibility on their members.^{[12]:86,90,117} Elite (e.g. 31337) gives the term leet speak its name.

Script kiddie

A script kiddie is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding of the underlying concept—hence the term script (i.e. a prearranged plan or set of activities) kiddie (i.e. kid, child—an individual lacking knowledge and experience, immature).^[11]

Neophyte

A neophyte, “n00b”, or “newbie” is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.^[4]

Blue hat

A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoftalso uses the term BlueHat to represent a series of security briefing events.^[13][14][15]

Hacktivist

A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks. In more extreme cases, hacktivism is used as tool for cyberterrorism. [http://en.wikipedia.org/wiki/Hacker_(computer_security)]

 

Copypasta Explanation of Hacking Methods

Below is a list of many of the key methods used to hack and crack computers. This pay prove to be a handy reference point when decoding exactly what process or concept the media are talking about when they talk about “hacking” in a generic state, or a useful list to understand excatly what these terms mean when used by educated media outlets in context.

“Vulnerability scanner

A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are “open” or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewalls defend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)

Password cracking

Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.

Packet sniffer

A packet sniffer is an application that captures data packets, which can be used to capture passwords and other data in transit over the network.

Spoofing attack

A spoofing attack involves one program, system, or website successfully masquerading as another by falsifying data and thereby being treated as a trusted system by a user or another program. The purpose of this is usually to fool programs, systems, or users into revealing confidential information, such as user names and passwords, to the attacker.

Rootkit

A rootkit is designed to conceal the compromise of a computer’s security, and can represent any of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Rootkits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.

Social engineering

Social engineering is the art of getting persons to reveal sensitive information about a system. This is usually done by impersonating someone or by convincing people to believe you have permissions to obtain such information.

Trojan horses

A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A trojan horse can be used to set up a back door in a computer system such that the intruder can gain access later. (The name refers to the horse from the Trojan War, with conceptually similar function of deceiving defenders into bringing an intruder inside.)

Viruses

A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Therefore, a computer virus behaves in a way similar to abiological virus, which spreads by inserting itself into living cells.

While some are harmless or mere hoaxes most computer viruses are considered malicious.

Worms

Like a virus, a worm is also a self-replicating program. A worm differs from a virus in that it propagates through computer networks without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Many people conflate the terms “virus” and “worm”, using them both to describe any self-propagating program.

Key loggers

A key logger is a tool designed to record (‘log’) every keystroke on an affected machine for later retrieval. Its purpose is usually to allow the user of this tool to gain access to confidential information typed on the affected machine, such as a user’s password or other private data. Some key loggers uses virus-, trojan-, and rootkit-like methods to remain active and hidden. However, some key loggers are used in legitimate ways and sometimes to even enhance computer security. As an example, a business might have a key logger on a computer used at a point of sale and data collected by the key logger could be used for catching employee fraud. [http://en.wikipedia.org/wiki/Hacker_(computer_security)]”

A Brief Overview

When it comes to portraying hacking, many different types of media outlets use many different methods; the newer, younger generation driven media outlets occasionally have a good grasp on the processes involved, whereas occasionally the traditional, old fashioned media outlets sometimes don’t know where to begin. Often, instead of fully explaining (perhaps even fully understanding) the occasionally complex, occasionally simple processes involved when people hack, they choose to simply staple the word “hacking” onto anything that features technology and information manipulation, using it to explain away a number of offences, from news reporters “hacking” into voicemail messages [http://www.guardian.co.uk/media/2011/feb/10/phone-hacking-john-prescott-named], to cyberthiefs “hacking” into websites [http://www.guardian.co.uk/money/2011/jan/21/lush-website-hack-customers-fraud] (arguably, this attack on Lush is a better example of “cracking” then it is of hacking) Because of this umbrella usage of a term not many people fully understand, the act of hacking gains this mysterious allure, becoming a common feature of everyday cyberlife that most people have no understanding of.

Of course the media writers that do have a basic understanding can’t go into depth when it comes to hacking, the last thing they want is to unintentionally educate a league of new cybercriminals. It would perhaps be prudent if they explained it a little better, however. Instead of leaving the readers to imagine a technological wizard tapping away strings of green binary code on a black screen, they could point out that on a basic, yet still profitable level, a lot of hacking is still just a mix of trial and error and dumb luck. For example, a lot of the celebrities affected by the News of the World’s hacking affair [http://www.bbc.co.uk/news/uk-11195407] weren’t caught out by some amazing feat of binary manipulation, but more the simple process of calling their voicemail numbers and typing in the basic password numbers, ie, 1111 or 1234, in the hope that the owner had neglected to change them. Similarity, a lot of e-mail hacks, or computer access hacks are carried out by attaining an e-mail address, then either guessing the password (or using a programme that runs through common English words and phrases), or answering a security question (after all, thanks to the wonders of Google, learning your mothers maiden name or the town she was born in isn’t all that hard).

The realities of hacking aren’t all that glamorous, after all, all hackers have to start from something, and as much as the media would like us to believe that hacking is the big bad wolf, often the realities are a lot less glamorous. But people do just love making mountains out of molehills, after all.

 

Here is a list of the 500 most common passwords a hacker will use. If your password is on this list, it would probably be a good idea to choose a better one.

Well Hello!

Hi there! Welcome to my newly created blog, my first steps into the lovely world of cyberspace. Over the next few weeks I intend to look at how hacking and hackers are portrayed in both the new and the old media outlets. Any comments or ideas are lovingly accepted and appreciated, and I hope you stick around to see if I’ve got anything interesting to say, or at least get a laugh out of my slightly scatty grasp on the actual concept and processes hackers use. Any corrections or ideas, please feel free to send them to me, and thank you for taking the time out to read this. Au revoir!