Hackers, Crackers, andNetwork Intruders.ppt

Hackers, Crackers, andNetwork Intruders CS-480b Dick Steflik Agenda Hackers and their vocabulary Threats and risks Types of hackers Gaining access Intrusion detection and prevention Legal and ethical issues Hacker Terms Hacking - showing computer expertise Cracking - breaching security on software or systems Phreaking - cracking telecom networks Spoofing - faking the originating IP address in a datagram Denial of Service (DoS) - flooding a host with sufficient network traffic so that it can’t respond anymore Port Scanning - searching for vulnerabilities Hacking through the ages 1969 - Unix ‘hacked’ together 1971 - Cap ‘n Crunch phone exploit discovered 1988 - Morris Internet worm crashes 6,000 servers 1994 - $10 million transferred from CitiBank accounts 1995 - Kevin Mitnick sentenced to 5 years in jail 2000 - Major websites succumb to DDoS 2000 - 15,700 credit and debit card numbers stolen from Western Union (hacked while web database was undergoing maintenance) 2001 Code Red exploited bug in MS IIS to penetrate spread probes random IPs for systems running IIS had trigger time for denial-of-service attack 2nd wave infected 360000 servers in 14 hours Code Red 2 - had backdoor installed to allow remote control Nimda -used multiple infection mechanisms email, shares, web client, IIS 2002 – Slammer Worm brings web to its knees by attacking MS SQL Server The threats Denial of Service (Yahoo, eBay, CNN, MS) Defacing, Graffiti, Slander, Reputation Loss of data (destruction, theft) Divulging private information (AirMiles, corporate espionage, personal financial) Loss of financial assets (CitiBank) CIA.gov defacement example Web site defacement example Types of hackers Professional hackers Black Hats – the Bad Guys White Hats – Professional Security Experts Script kiddies Mostly kids/students User tools created by black hats, To get free stuff Impress their peers Not get caught Underemployed Adult Hackers Former Script Kiddies Can’t get employment in the field Want