It’s always big news when computers are broken into and sensitive information is stolen. But many a time, computer owners don’t even realise when somebody controls their computer and uses it for malicious activities.
You’ve probably also heard of emails that profess to be from banks or credit-card companies and prompt users to enter details that will enable the sender to gain access to these accounts. All such activities, which are designed to gain access to others’ computers, email, or personal information, are popularly termed ‘hacking’.
What is hacking?
Hacking, however, has another meaning. Before its pejorative interpretation became popular in the 1980s, hacking meant any activity designed to gain an intimate understanding of the internal workings of computers, computer networks or any other system.
In one of his articles on his website, Richard Stallman defines hacking as “exploring the limits of what is possible, in the spirit of playful cleverness”. In this context, hackers have no criminal intent; they are enthusiasts who enjoy understanding how systems work and what can be done with them.
The hacking community uses the term ‘cracking’ for activities that result in breaking security systems to gain unauthorized entry, and the people who do this are termed ‘crackers’.
The upside of hacking
Several organizations, including companies that make security software, employ hackers to strengthen their security systems and software. Called ‘ethical hackers’ or ‘white hats’, these people use their technical expertise and knowledge to test an organization’s security setup by actually trying to break into the setup.
To do this, hackers first gather as much information about the company as possible. They use Internet searches to find out more about the company, its financial results, and its employees. The hacker also uses domain-name searches to get the names of the servers that the company owns. After this, they use tools to look for vulnerabilities on these servers. These include servers where patches have not been applied for known bugs or inadequately protected servers. All the security holes thrown up in this exercise are then plugged by the organization.
Similarly, security software - antivirus programs or firewalls, for instance - is tested by allowing these hackers to break into computers or servers that are protected by the software in question.
The downside of hacking
Virtually anything can be attacked on the Internet. This includes your computer, your email account, and information you exchange with a banking or ecommerce site.
Hackers, or crackers, or black hats, use various means to launch such attacks. Social engineering is a currently popular method. This means that the cracker sends an email or makes a telephone call, professing to be from an authorized source, such as your bank, credit-card company or the system administrator of your email account. The cracker asks for information like username or password, or other such details, for ostensibly legitimate purposes.
Phishing is one form of social engineering, where you may receive an email professing to be from a trusted source, which prompts you to go to a website, which is actually bogus, to confirm certain personal details. Banking account or credit-card numbers form part of the information that’s stolen from you in this way.
Other ways of getting at your passwords include hash algorithms or dictionary attacks. There are several tools out there, most of them easy to get and use, designed for the specific purpose of discovering passwords.
Websites are attacked through several programs or by launching distributed denial of service (DoS) attacks. The latter involve throwing so many requests at a Web server for a particular service that the server gets jammed. Any Web server with known vulnerabilities is an easy target for such attacks. By breaking into the website of an online retailer, a black hat hacker can potentially steal credit-card information of online shoppers from the retailer’s database.
Another commonly used means of attack is to send email with malicious attachments or induce the user to visit a website that installs such mal-ware on the user’s computer. Pornographic websites or peer-to-peer networks are notable for this. Trojans are one such mal-ware that professes to be harmless, but includes a payload that is malicious. Some Trojans self-install when you click on them, and do things like deleting your files, or open a backdoor for a black hat on your computer.
Viruses and worms could also travel as Trojans. Trojans could also include keyloggers that log every stroke of your keyboard, including the passwords you enter; or spyware that notes your browsing behavior and communicates it to the installer, who may use it for advertising purposes.
Once your system has been compromised, the attacker could use it for anything—distributing more mal-ware, launching distributed DoS attacks, steal sensitive information, and so on. What’s more, most of these programs stay hidden after installation and often cannot be detected and deleted.
What you can do
Hacking, ethical or otherwise, is not very difficult to learn. The Web is full of resources for anyone who is interested in it.
However, as a computer user, whether at home or at work, there are several things you can do to block the entry of intruders into your systems.
The first thing to do is ensure that all your software is updated and you have applied patches for known vulnerabilities. This is especially true of the operating system and the Web browser. Second, your antivirus software has to be updated regularly. Consider installing a software firewall and an anti-spyware program to further strengthen security. This also holds true for Web and other critical servers in organizations. Intrusion-detection systems should be installed on such servers.
Then, use the Web and email wisely. You should not trust any email you receive blindly - in case you have received email that professes to be from your bank or other service providers, it’s better to check with them whether such an email has been sent. Banks usually do not send any email that asks you for personal details, especially passwords and PINs.. Similar caution should be exercised when visiting new websites. Be very wary of email from people you don’t know.
Also, keep your passwords secure by making them difficult to guess and changing them frequently. Don’t store your passwords on your PC. And do not share them with others.
Regards
Nikhil Deshmukh
