What is Hacking? Who are Hackers?

     Eric Raymond, compiler of “The New Hacker's Dictionary”, defines a hacker as a clever programmer. A "good hack" is a clever solution to a programming problem and "hacking" is the act of doing it. Raymond lists five possible characteristics that qualify one as a hacker, which we paraphrase here:

● A person who enjoys learning details of a programming language or

system

● A person who enjoys actually doing the programming rather

than just theorizing about it
● A person capable of appreciating someone else's hacking
● A person who picks up programming quickly
● A person who is an expert at a particular programming language or system

Types of Hackers:

Hackers can be broadly classified on the basis of why they are hacking system or why the are indulging hacking. There are mainly three types of hacker on this basis

● Black-Hat Hacker

A black hat hackers or crackers are individuals with

extraordinary

computing skills, resorting to malicious or destructive activities. That is black hat hackers use their knowledge and skill for their own personal gains probably by hurting others.

● White-Hat Hacker

White hat hackers are those individuals professing hacker skills and using them for defensive purposes. This means that the white hat hackers use their knowledge and skill for the good of others and for the common good.● ●Grey-Hat Hackers

These are individuals who work both offensively and defensively at

various times. We cannot predict their behaviour. Sometimes they use their skills for the common good while in some other times he uses them for their personal gains.

ETHICAL HACKING

Ethical hacking – defined as “a methodology adopted by ethical hackers to discover the vulnerabilities existing in information systems’ operating environments.”

With the growth of the Internet, computer security has become a

major concern for businesses and governments.

In their search for a way to approach the problem, organizations came to realize that one of the best ways to evaluate the intruder threat to their interests would be to have independent computer security professionals attempt to break into their computer systems.

What do an Ethical Hacker do?

An ethical hacker is a person doing ethical hacking that is he is a security personal who tries to penetrate in to a network to find if there is some vulnerability in the system. An ethical hacker will always have the permission to enter into the target network. An ethical hacker will first think with a mindset of a hacker who tries to get in to the system.

He will first find out what an intruder can see or what others can see. Finding these an ethical hacker will try to get into the system with that information in whatever method he can. If he succeeds in penetrating into the system then he will report to the company with a detailed report about the particular vulnerability exploiting which he got in to the system. He may also sometimes make patches for that particular vulnerability or he may suggest some methods to prevent the vulnerability

A Guide to Internet Security: Becoming an Uebercracker

Author: Christopher Klaus <cklaus@shadow.net>
Date: December 5th, 1993.
Version: 1.1

  This is a paper will be broken into two parts, one showing 15 easy steps
to becoming a uebercracker and the next part showing how to become a
ueberadmin and how to stop a uebercracker.  A uebercracker is a term phrased
by Dan Farmer to refer to some elite (cr/h)acker that is practically
impossible to keep out of the networks.

Here's the steps to becoming a uebercracker.

Step 1. Relax and remain calm. Remember YOU are a Uebercracker.

Step 2. If you know a little Unix, you are way ahead of the crowd and skip
past step 3.

Step 3. You may want to buy Unix manual or book to let you know what
ls,cd,cat does.

Step 4. Read Usenet for the following groups: alt.irc, alt.security,
comp.security.unix.  Subscribe to Phrack@well.sf.ca.us to get a background
in uebercracker culture.

Step 5. Ask on alt.irc how to get and compile the latest IRC client and
connect to IRC.

Step 6. Once on IRC, join the #hack channel. (Whew, you are half-way
there!)

Step 7. Now, sit on #hack and send messages to everyone in the channel
saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks
questions like "Why cant I join #warez?"

Step 8. (Important Step) Send private messages to everyone asking for new
bugs or holes. Here's a good pointer, look around your system for binary
programs suid root (look in Unix manual from step 3 if confused). After
finding a suid root binary, (ie. su, chfn, syslog), tell people you have a
new bug in that program and you wrote a script for it.  If they ask how it
works, tell them they are "layme". Remember, YOU are a UeberCracker. Ask
them to trade for their get-root scripts.

Step 9. Make them send you some scripts before you send some garbage file
(ie. a big core file). Tell them it is encrypted or it was messed up and
you need to upload your script again.

Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be
obnoxious on #hack otherwise people will look down on you and not give you
anything.)

Step 11. Hopefully you will now have atleast one or two scripts that get
you root on most Unixes. Grab root on your local machines, read your
admin's mail, or even other user's mail, even rm log files and whatever
temps you. (look in Unix manual from step 3 if confused).

Step 12. A good test for true uebercrackerness is to be able to fake mail.
Ask other uebercrackers how to fake mail (because they have had to pass the
same test). Email your admin how "layme" he is and how you got root and how
you erased his files, and have it appear coming from satan@evil.com.

Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag
about your exploits on #hack to everyone. (Make up stuff, Remember, YOU are
a uebercracker.)

Step 14. Wait a few months and have all your notes, etc ready in your room
for when the FBI, Secret Service, and other law enforcement agencies
confinscate your equipment. Call eff.org to complain how you were innocent
and how you accidently gotten someone else's account and only looked
because you were curious. (Whatever else that may help, throw at them.)

Step 15. Now for the true final supreme eliteness of all uebercrackers, you
go back to #hack and brag about how you were busted.  YOU are finally a
true Uebercracker.


Now the next part of the paper is top secret.  Please only pass to trusted
administrators and friends and even some trusted mailing lists, Usenet
groups, etc. (Make sure no one who is NOT in the inner circle of security
gets this.)

This is broken down on How to Become an UeberAdmin (otherwise know as a
security expert) and How to stop Uebercrackers.

Step 1. Read Unix manual ( a good idea for admins ).

Step 2. Very Important.  chmod 700 rdist; chmod 644 /etc/utmp. Install
sendmail 8.6.4.  You have probably stopped 60 percent of all Uebercrackers
now.  Rdist scripts is among the favorites for getting root by
uebercrackers.

Step 3. Okay, maybe you want to actually secure your machine from the
elite Uebercrackers who can break into any site on Internet.

Step 4. Set up your firewall to block rpc/nfs/ip-forwarding/src routing
packets. (This only applies to advanced admins who have control of the
router, but this will stop 90% of all uebercrackers from attempting your
site.)

Step 5. Apply all CERT and vendor patches to all of your machines. You have
just now killed 95% of all uebercrackers.

Step 6. Run a good password cracker to find open accounts and close them.
Run tripwire after making sure your binaries are untouched. Run tcp_wrapper
to find if a uebercracker is knocking on your machines.  Run ISS to make
sure that all your machines are reasonably secure as far as remote
configuration (ie. your NFS exports and anon FTP site.)

Step 7. If you have done all of the following, you will have stopped 99%
of all uebercrackers. Congrads! (Remember, You are the admin.)

Step 8. Now there is one percent of uebercrackers that have gained
knowledge from reading some security expert's mail (probably gained access
to his mail via NFS exports or the guest account.  You know how it is, like
the mechanic that always has a broken car, or the plumber that has the
broken sink, the security expert usually has an open machine.)

Step 9. Here is the hard part is to try to convince these security experts
that they are not so above the average citizen and that by now giving out
their unknown (except for the uebercrackers) security bugs, it would be a
service to Internet.  They do not have to post it on Usenet, but share
among many other trusted people and hopefully fixes will come about and
new pressure will be applied to vendors to come out with patches.

Step 10.  If you have gained the confidence of enough security experts,
you will know be a looked upto as an elite security administrator that is
able to stop most uebercrackers.  The final true test for being a ueberadmin
is to compile a IRC client, go onto #hack and log all the bragging and
help catch the uebercrackers. If a uebercracker does get into your system,
and he has used a new method you have never seen, you can probably tell
your other security admins and get half of the replies like - "That bug
been known for years, there just isn't any patches for it yet. Here's my
fix." and the other half of the replies will be like - "Wow.  That is very
impressive. You have just moved up a big notch in my security circle."
VERY IMPORTANT HERE:  If you see anyone in Usenet's security newsgroups
mention anything about that security hole, Flame him for discussing it
since it could bring down Internet and all Uebercrackers will now have it
and the million other reasons to keep everything secret about security.


Well, this paper has shown the finer details of security on Internet. It has
shown both sides of the coin.  Three points I would like to make that would
probably clean up most of the security problems on Internet are as the
following:

1.  Vendors need to make security a little higher than zero in priority.
If most vendors shipped their Unixes already secure with most known bugs
that have been floating around since the Internet Worm (6 years ago) fixed
and patched, then most uebercrackers would be stuck as new machines get
added to Internet.  (I believe Uebercracker is german for "lame copy-cat
that can get root with 3 year old bugs.") An interesting note is that
if you probably check the mail alias for "security@vendor.com", you will
find it points to /dev/null.  Maybe with enough mail, it will overfill
/dev/null.  (Look in manual if confused.)

2.  Security experts giving up the attitude that they are above the normal
Internet user and try to give out information that could lead to pressure
by other admins to vendors to come out with fixes and patches.  Most
security experts probably don't realize how far their information has
already  spread.

3.  And probably one of the more important points is just following the
steps I have outlined for Stopping a Uebercracker.


Resources for Security:
   Many security advisories are available from anonymous ftp cert.org.
Ask archie to find tcp_wrapper, security programs.  For more information
about ISS (Internet Security Scanner), email cklaus@shadow.net.


Acknowledgements:

   Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
Miles, Scott Yelich, and Henri De Valois.


Copyright:

This paper is Copyright 1993, 1994.  Please distribute to only trusted
people.  If you modify, alter, disassemble, reassemble, re-engineer or have
any suggestions or comments, please send them to:

cklaus@shadow.net

Tabnapping Is The Latest Phishing Scheme

Tab Napping: A New Type of Phishing Attack

The web is a generative and wild place. Sometimes I think I missed my calling; being devious is so much fun.
 Too bad my parents brought me up with scruples.Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You’ve escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.What we don’t expect is that a page we’ve been looking at will change behind our backs, when we aren’t looking. That’ll catch us by surprise.
              
        

How The Attack Works

 1.  A user navigates to your normal looking site.
 2.  You detect when the page has lost its focus and hasn’t been interacted with for a while.



 3.  Replace the favicon with the Gmail favicon, the title with “Gmail: Email from Google”,and the page with a Gmail login look-a  -like.This can all be done with just a little bit of  Javascript that takes place instantly.
 4.  As the user scans their many open tabs, the favicon and title act as a strong visual cu—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they’ll see the standard Gmail login page, assume they’ve been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.  5.  After the user has entered their login information and you’ve sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.Targeted Attacks


There are many ways to potentially improve the efficacy of this attack.
Using my CSS history miner you can detect which site a visitor uses and then attack that site (although this is no longer possible in Firefox betas). For example, you can detect if a visitor is a Facebook user, Citibank user, Twitter user, etc., and then switch the page to the appropriate login screen and favicon on demand.
You can make this attack even more effective by changing the copy: Instead of having just a login screen, you can mention that the session has timed out and the user needs to re-authenticate. This happens often on bank websites, which makes them even more susceptible to this kind of attackEven more deviously, there are various methods to know whether a user is currently logged into a service. These methods range from timing attacks on image loads, to seeing where errors occur when you load an HTML webpage in a script tag*. Once you know what services a user is currently logged in to, the attack becomes even more effective.
  
Attack Vector


Every time you include a third-party script on your page, or a Flash widget, you leave yourself wide open for an evil doer to use your website as a staging ground for this kind of attack. If you are the evil doer, you can have this behavior only occur once in a while, and only if the user uses a targeted service. In other words, it could be hard to detect.
You can also use a cross-site scripting vulnerabilities to force the attack to be performed by other websites. And for browsers that do not support changing the favicon, you can use alocation.assign call to navigate the page to a controlled domain with the correct favicon. As long as the user wasn’t looking at the tab when the refresh occurred (which they won’t be), they’ll have no idea what hit them. Combine this with look-alike Unicode domain names and even the most savvy user will have trouble detecting anything is amiss.
Try it Out


You can try it out on this very website (it works in all major browsers). Click away to another tab for at least five seconds. Flip to another tab. Do whatever. Then come back to this tab.
It’s hard to find, isn’t it? It looks exactly like Gmail. I was lazy and took a screenshot of Gmail which loads slowly. It would be better to recreate the page in HTML.
Update: Many people have reported that the attack doesn’t change the favicon in Chrome. This was due to a bug in Chrome which has been fixed in the version 6.0.408.1. Chrome is fully susceptible to this attack.
You can get the source code here: bgattack.js.


 The Fix


This kind of attack once again shows how important our work is on the Firefox Account Manager to keep our users safe. User names and passwords are not a secure method of doing authentication; it’s time for the browser to take a more active role in being your smart user agent; one that knows who you are and keeps your identity, information, and credentials safe.

Ankit Fadia, well known ethical hacker and computer security intelligence consultant

Ankit Fadia is an Indian computer security consultant based in Silicon Valley, USA. He has authored several books on computer security. Fadia is currently pursuing his Bachelors in Management Science & Engineering at Stanford University.

Fadia was educated at Delhi Public School. He started a website called “HackingTruths”, which he claims was judged as the “second best hacking site in the world by the FBI”. He claims that when he was 14, he trashed the front page of an Indian magazine’s website. He then sent an e-mail to the editor confessing to the hack, suggesting counter measures. At 15, his book on Ethical Hacking made him the youngest author to be published by Macmillan India. He claims that in 2001, he discovered links between the Chinese government and the China Eagle Union, a cracker group responsible for defacing many U.S. web sites. He stated that the “long-term goal of the Chinese government is actually to take over the internet and control all parts of the internet”. However none of these claims have been proved by substantial
evidence so far.                                                                                                        

                                                                                           

Breaking into computer systems which once was a pastime for geeks, has become a full-fledged career option. Ethical hackers are in demand from government as well as private sector. Ankit Fadia, well known ethical hacker and independent computer security intelligence consultant tells Piyali Mandal how hacking can be a rewarding career option. Excerpts:

How far is hacking an acceptable career option in India? 
Ethical hacking is a career option worth exploring. In recent years, there has been an alarming increase in the number of cyber crime cases on the Internet. Hacking email accounts, stealing and intercepting sensitive data, abusive emails, trojan attacks and espionage are some of the many concerns that have started affecting email users. All these threats have increased the demand for ethical hackers who test security systems and look out for critical vulnerability, albeit for a good purpose.

Are their formal courses available? 
Usually, companies hire geeks and train them. But there are courses available and any engineering graduate can select between a six months and a one year Post-Graduate Diploma programme. One needs to be computer savvy and gadget friendly to be in this field. One should have keen interest in the Internet and have basic knowledge of networking and programming to stay updated. After pursuing a course in ethical hacking, students can join organisations as security analysts and grow to becoming Chief Information Officers.

Are ethical hackers in demand?
Currently, there is a huge gap between the demand and supply of ethical hackers in India. This is because there is a shortage of skilled people, poor pay packages and growth opportunities. According to NASSCOM, demand for ethical hackers is estimated at over 77,000 in India every year. Against this, India produces only 20,000-25,000 ethical hackers. So there is a big gap to be filled.

Which sectors require them?
The demand for ethical hackers is coming mostly from the government agencies. People have woken up to realise the importance of cyber security experts especially after the Mumbai terror attacks in 2008; Chinese cyber attacks on different countries and bomb blasts in different parts of India. Also, organisations including banks, hotels, airlines, telecom companies, IT and IT enabled services companies, outsourcing units, retail chains and Internet firms are seeking ethical hackers to check for vulnerability within their own systems.

How attractive are the pay packets?
Though it is a matter of pride to be able to help the Indian government, the projects are not as financially rewarding. In the private sector however, starting salaries in India range between Rs 3 lakh to Rs 4.2 lakh per annum and can go up to 32.5 lakh per annum