Hackers, Crackers, and Attackers, oh my! In 1
this lesson, we're going to start 2
thinking like an attacker by starting to 3
understand what are some of their 4
different motivations. So, hackers have a 5
very unique definition that has evolved 6
over time. Originally hackers were just 7
computer enthusiasts. It's people who 8
enjoy computers and tried to learn how, 9
what made them operate. And they would 10
tinker with them and take them apart and 11
try to go through the operating system and 12
understand it in depth. Now over time, 13
especially in the mid-80s and the late 14
80s, we started seeing a lot of computer 15
hackers becoming a negative connotation. 16
You see this pop up in movies, and TV, and 17
newspapers. And because of that, there's 18
actually a separate term that came out 19
called an ethical hacker, and ethical 20
hackers are people who are hired by a 21
company, they use the skills they learned 22
of hacking and taking apart a computer 23
to do security and penetration testing 24
for those networks. Because of that, the 25
term crackers evolved and that meant a 26
criminal hacker, someone who is doing 27
these hacking for a bad or malicious 28
reason. This is the people you usually think 29
of when you think about a movie or a 30
television show where you have this malicious 31
actor breaking into computers and trying 32
to steal all the information. So hackers 33
in general wear one of three hats. They 34
can be either white hats, black hats, or 35
gray hats. So white hat is your ethical 36
hacker. He's breaking into computer 37
systems with permission of the network 38
owner, and the reason why they do that is 39
just to increase the security of the network. 40
Now on the other side, we have the black 41
hats. The black hats are the malicious 42
actors. They're the criminals, they're the 43
ones who are breaking without permission, 44
they're trying to steal your information, 45
and they're trying to break your systems. 46
Now in the middle of that we have what's 47
called a gray hat. And a gray hat is 48
sometimes good and sometimes bad. It's 49
kind of a gray area, if you will. One of 50
the things that you'll see with a gray 51
hat for instance, is somebody who does 52
bug bounties. They might be searching 53
software to find the hidden 54
vulnerabilities known as bugs. Now if 55
they turn those into the company, that 56
would be a white hat action. If they used 57
it for a malicious intent to steal 58
information, that would be a black hat. 59
Well, what would you say if they found 60
that information and immediately posted it 61
to the internet for everybody to know? 62
Well we would consider that a gray 63
action because they didn't give the 64
company time to fix the problem, and so 65
now good guys and bad guys have access 66
to the information at the same time. That 67
becomes a gray action. It's not good, it's 68
not bad, it's kind of somewhere in the 69
middle. Sometimes they play nice, 70
sometimes they don't, and this is a 71
really difficult group of people to work 72
with because sometimes they're really helpful, 73
and sometimes they're really not. So some 74
other types of attackers that we want to 75
mention here is, we're going to start 76
with phreakers. Now phreakers are really 77
focused on telephones and PBX systems, 78
and the most famous of them was a 79
gentleman known as Captain Crunch. Now 80
the reason why he was known as Captain 81
Crunch, is because back in the 70s when 82
used to pay for long distance at a 83
payphone, you'd put in a series of coins 84
and you'd hear a beep, and there would be 85
a whistling sound essentially that would 86
tell the telephone company you've paid 87
enough money to make that long-distance 88
call. Well, this gentleman found a whistle 89
in the Cap'n Crunch cereal box that 90
made the right frequency, which is 2600 91
Hertz, and if he blew it it would give 92
you free long distance. So again, it's 93
just learning that system, and being able 94
to figure out where those security bugs are, in 95
this case they're doing for malicious 96
reasons, they want to get free long 97
distance, but that's what a phreaker is. They're 98
all about telephones and PBX systems. So 99
two other types that we have here our 100
software crackers and hackers, and system 101
crackers and hackers. So a software 102
cracker and hacker is looking at how to 103
disable registration keys and 104
essentially get software for free. This 105
was really popular with the old 106
Microsoft Windows, people would pirate 107
and steal the Microsoft Windows 108
operating system, but require that long 109
25-character password to be able to use 110
the software, and so they would find ways 111
to break that registration system so 112
they can get free access to the software. 113
Now system hackers and crackers, they're 114
all about figuring out what are the bugs 115
in the operating system that they can 116
exploit. So, for instance, I might 117
specialize in Windows hacking, or Linux 118
hacking, or Cisco IOS hacking if I want 119
to go after network routers and switches. 120
Another type of attacker is what's called a 121
suicide hacker. Now these are people that 122
know that they may get caught and they 123
may go to jail for what they're doing, 124
but they don't care and they're going to 125
do it anyway. That's why we call them a 126
suicide hacker, a lot like a suicide 127
bomber in the terrorist world. The one at 128
the bottom of the screen here is really 129
important to understand, especially from 130
a cyber security perspective, and that's 131
your disgruntled employees and your 132
insider threat. Now, why is that so 133
important? Well, these people may not be 134
technically savvy. They may just be your 135
receptionist or your sales clerk, but if 136
they have a beef with you, they can use 137
their privilege, their authorized 138
user access that they already have, their 139
usernames and passwords, to get on your 140
system and take information with them. 141
Probably the most famous 142
example of this is Edward Snowden 143
with the NSA, but there's tons of 144
examples throughout history of insider 145
threats where they steal your 146
information and they either sell it for 147
gain or put it out in the public domain. 148
Another type of attack that we have is 149
what we call script kiddies. Now, script 150
kiddies think they're hackers, but really 151
what they do is they download other 152
people's tools. So, they might go onto a 153
website, download a tool, like for 154
instance the ion cannon that was very 155
popular with hacktivists for a while. And 156
you would essentially just download this 157
piece of software, plug-in a website name, 158
hit go, and it would start doing a denial 159
of service attack. There was no skill 160
involved. There was no coding of their 161
own tools. It was just taking tools that were 162
readily available. Now, a lot of the 163
ethical hacker tools that are out there 164
are freely available and open source, and 165
so a lot of script kiddies will take those 166
tools and use those as a way to hack 167
into networks, but again there's no level 168
of skill in this, it's just very very 169
primitive. They grab the tool and they go. 170
Now, the problem is there's a lot more of 171
these tools available than there used to 172
be. And so as these tools keep increasing 173
in number, we start seeing a lot more 174
script kiddies in action. Another type of 175
hacker we have is a cyber-terrorist, 176
cyber criminals, or hacktivists. Now, cyber 177
terrorists, and cyber criminals and 178
hacktivists are a group that kind of get lumped 179
in together a lot. So if you start 180
thinking of things like LulzSec and 181
Anonymous, these are hacker groups and 182
some of them are very skilled, and some 183
of them are very unskilled, it depends on 184
who is in this group. They're very 185
loosely affiliated and they all try to 186
serve a common purpose. With hacktivism, 187
you're doing it as a political 188
motivation. With cyber criminals, it's 189
usually a money motivation. And with 190
cyber terrorists, it's usually an ideological motivation. And finally we 191
have the good guys, the ethical hackers. 192
These are folks who are hired by a firm 193
to come in and test those networks. They 194
have permission, they don't want to harm 195
the networks, and anything they do is 196
reversible. So, anything that they do in 197
their hacking and penetration testing, 198
they then create a report and give that 199
to your organization so the 200
organization can get better and do a 201
better job of securing their networks.