Hacker attitudes

Several subgroups of the computer underground with different attitudes and aims use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree. Eric S. Raymond advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as one wider hacker culture, a view harshly rejected by Raymond himself. Instead of a hacker – cracker dichotomy, they give more emphasis to a spectrum of different categories, such as white hat (ethical hacking), grey hat, black hat andscript kiddie. In contrast to Raymond, they usually reserve the term cracker to refer to black hat hackers, or more generally hackers with unlawful intentions.

[edit]White hat

Main article: White hat

A white hat hacker breaks security for non-malicious reasons, for instance testing their own security system. This type of hacker enjoys learning and working with computer systems, and consequently gains a deeper understanding of the subject. Such people normally go on to use their hacking skills in legitimate ways, such as becoming security consultants. The word 'hacker' originally included people like this, although a hacker may not be someone into security.

[edit]Grey hat

Main article: Grey hat

A grey hat hacker is a hacker of ambiguous ethics and/or borderline legality, often frankly admitted.

[edit]Black hat

Main article: Black hat

A black hat hacker is someone who breaks computer security without authorization or uses technology (usually a computer, phone system or network) for vandalism, credit card fraud, identity theft, piracy, or other types of illegal activity.

[edit]Script kiddie

Main article: Script kiddie

A script kiddie is a non-expert who breaks into computer systems by using pre-packaged automated tools written by others, usually with little understanding. These are the outcasts of the hacker community.

[edit]Hacktivist

Main article: Hacktivism

A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hactivism involves website defacement or denial-of-service attacks. In more extreme cases, hactivism is used as tool for Cyberterrorism.

Common methods of Hacking

A typical approach in an attack on Internet-connected system is:

1. Network enumeration: Discovering information about the intended target.
2. Vulnerability analysis: Identifying potential ways of attack.
3. Exploitation: Attempting to compromise the system by employing the vulnerabilities found through the vulnerability analysis. ^[5]

In order to do so, there are several recurring tools of the trade and techniques used by computer criminals and security experts.

[edit]Security exploit

Main article: Exploit (computer security)

A security exploit is a prepared application that takes advantage of a known weakness. A common example of a security exploit is a fail programming attempt that would allow an SQL injection. Other exploits would be able to be used throughFTP, HTTP, PHP, SSH, Telnet and some web-pages. These are very common in website/domain hacking.

[edit]Vulnerability scanner

Main article: Vulnerability scanner

A vulnerability scanner is a tool used to quickly check computers on a network for known weaknesses. Hackers also commonly use port scanners. These check to see which ports on a specified computer are "open" or available to access the computer, and sometimes will detect what program or service is listening on that port, and its version number. (Note that firewalls defend computers from intruders by limiting access to ports/machines both inbound and outbound, but can still be circumvented.)

[edit]Packet sniffer

Main article: Packet sniffer

A packet sniffer is an application that captures data packets, which can be used to capture passwords and other data in transit over the network.

[edit]Spoofing attack

Main article: Spoofing attack

A spoofing attack involves one program, system, or website successfully masquerading as another by falsifying data and thereby being treated as a trusted system by a user or another program. The purpose of this is usually to fool programs, systems, or users into revealing confidential information, such as user names and passwords, to the attacker.

[edit]Rootkit

Main article: Rootkit

A rootkit is designed to conceal the compromise of a computer's security, and can represent any of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Rootkits may include replacements for system binaries so that it becomes impossible for the legitimate user to detect the presence of the intruder on the system by looking at process tables.

[edit]Social engineering

Main article: Social engineering (computer security)

Social Engineering is the art of getting persons to reveal sensitive information about a system. This is usually done by impersonating someone or by convincing people to believe you have permissions to obtain such information.

[edit]Trojan horse

Main article: Trojan horse (computing)

A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A trojan horse can be used to set up a back door in a computer system such that the intruder can gain access later. (The name refers to the horse from the Trojan War, with conceptually similar function of deceiving defenders into bringing an intruder inside.)

[edit]Virus

Main article: Computer virus

A virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. Thus, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells.

[edit]Worm

Main article: Computer worm

Like a virus, a worm is also a self-replicating program. A worm differs from a virus in that it propagates through computer networks without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Many people conflate the terms "virus" and "worm", using them both to describe any self-propagating program.

[edit]Key loggers

Main article: Keystroke logging

A keylogger is a tool designed to record ('log') every keystroke on an affected machine for later retrieval. Its purpose is usually to allow the user of this tool to gain access to confidential information typed on the affected machine, such as a user's password or other private data. Often uses virus-, trojan-, and rootkit-like methods to remain active and hidden.

The programmer subculture of hackers

The computer security use is contrasted by the different understanding of hacker as a person who follows a spirit of playful cleverness and loves programming. It is found in an originally academic movement unrelated to computer security and most visibly associated withfree software and open source. It also has a hacker ethic, based on the idea that writing software and sharing the result on a voluntary basis is a good idea, and that information should be free, but that it's not up to the hacker to make it free by breaking into private computer systems. Academic hackers disassociate from the mass media's pejorative use of the word 'hacker' referring to computer security, and usually prefer the term 'cracker' for that meaning.

In this hacker culture, a computer hacker is a person who enjoys designing software and building programs with a sense for aesthetics and playful cleverness. The term hack in this sense can be traced back to "describe the elaborate college pranks that...students would regularly devise" (Levy, 1984 p.10). To be considered a 'hack' was an honour among like-minded peers as "to qualify as a hack, the feat must be imbued with innovation, style and technical virtuosity" (levy, 1984 p.10)

According to Eric S. Raymond,^[20] the Open source and Free Software hacker subculture developed in the 1960s among ‘academic hackers’^[21] working on early minicomputers in computer science environments in the United States. After 1969 it fused with the technical culture of the pioneers of the Arpanet. The PDP-10 machine AI at MIT, which was running the ITS operating system and was connected to the Arpanet, provided an early hacker meeting point. After 1980 the subculture coalesced with the culture of Unix, and after 1987 with elements of the early microcomputer hobbyists that themselves had connections to radio amateurs in the 1920s. Since the mid-1990s, it has been largely coincident with what is now called the free software and open source movement.

Many programmers have been labeled "great hackers,"^[22] but the specifics of who that label applies to is a matter of opinion. Certainly major contributors to computer science such as Edsger Dijkstra and Donald Knuth, as well as the inventors of popular software such as Linus Torvalds (Linux), and Dennis Ritchie and Ken Thompson (the C programming language) are likely to be included in any such list; see also List of programmers. People primarily known for their contributions to the consciousness of the academic hacker culture include Richard Stallman, the founder of the free software movement and the GNU project, president of the Free Software Foundation and author of the famous Emacs text editor as well as the GNU Compiler Collection (GCC), and Eric S. Raymond, one of the founders of theOpen Source Initiative and writer of the famous text The Cathedral and the Bazaar and many other essays, maintainer of the Jargon File (which was previously maintained by Guy L. Steele, Jr.).

Within the academic hacker culture, the term hacker is also used for a programmer who reaches a goal by employing a series of modifications to extend existingcode or resources. In this sense, it can have a negative connotation of using kludges to accomplish programming tasks that are ugly, inelegant, and inefficient. This derogatory form of the noun "hack" is even used among users of the positive sense of "hacker" (some argue that it should not be, due to this negative meaning; others argue that some kludges can, for all their ugliness and imperfection, still have "hack value"). In a very universal sense, hacker also means someone who makes things work beyond perceived limits in a clever way in general.^[3] That is, people who apply the creative attitude of software hackers in fields other than computing. This includes even activities that predate computer hacking, for example reality hackers.^[23] More recent examples of this usage are wetware hackers and media hackers. According to the Jargon File the word hacker was used in a similar meaning among radio amateurs already in the 1950s.^[24]

The culture sometimes uses jargon which is "incomprehensible to outsiders".^[25] Examples are 'losing' "when a piece of equipment is not working"^[25] and 'munged' "when a piece of equipment is ruined".^[25]

Home computer hackers

In a third meaning, hacker refers to computer hobbyists who push the limits of their software or hardware. The home computer hacking subculture relates to the hobbyist home computing of the late 1970s, beginning with the availability of MITS Altair. An influential organization was the Homebrew Computer Club.

The areas that did not fit together with the academic hacker subculture focus mainly on commercial computer and video games, software cracking and exceptional computer programming (demo scene). Also of interest to some members of this group is the modification of computer hardware and other electronic devices, seemodding.

Computer security hackers

In computer security, a hacker is someone who focuses on security mechanisms of computer and network systems. While including those who endeavor to strengthen such mechanisms, it is more often used by the mass media and popular culture to refer to those who seek access despite these security measures. That is, the media portrays the 'hacker' as a villain. Nevertheless, parts of the subculture see their aim in correcting security problems and use the word in a positive sense. They operate under a code, which acknowledges that breaking into other people's computers is bad, but that discovering and exploiting security mechanisms and breaking into computers is still an interesting activity that can be done ethically and legally. Accordingly, the term bears strong connotations that are favorable or pejorative, depending on the context.

The subculture around such hackers is termed network hacker subculture, hacker scene or computer underground. It initially developed in the context of phreaking during the 1960s and the microcomputer BBS scene of the 1980s. It is implicated with 2600: The Hacker Quarterly and the alt.2600 newsgroup.

By 1983, hacking in the sense of breaking computer security had already been in use as computer jargon,^[15] but there was no public awareness about such activities.^[16] However, the release of the movie WarGames that year raised the public belief that computer security hackers (especially teenagers) could be a threat to national security. This concern became real when a gang of teenage hackers in Milwaukee, Wisconsin known as The 414s broke into computer systems throughout the United States and Canada, including those of Los Alamos National Laboratory, Sloan-Kettering Cancer Center and Security Pacific Bank. The case quickly grew media attention,^[17][10] and 17-year-old Neal Patrick emerged as the spokesman for the gang, including a cover story in Newsweek entitled "Beware: Hackers at play", with Patrick's photograph on the cover.^[11] The Newsweek article appears to be the first use of the word hacker by the mainstream media in the pejorative sense.

As a result of news coverage, congressman Dan Glickman called for an investigation and new laws about computer hacking.^[18] Neal Patrick testified before the U.S. House of Representatives on September 26, 1983 about the dangers of computer hacking, and six bills concerning computer crime were introduced in the House that year.^[19] As a result of these laws against computer criminality, white hat, grey hat and black hat hackers try to distinguish themselves from each other, depending on the legality of their activities.

Hacker (computer security)

In common usage, a hacker is a person who breaks into computers, usually by gaining access to administrative controls.^[1] The subculture that has evolved around hackers is often referred to as the computer underground. Proponents claim to be motivated by artistic and political ends, and are often unconcerned about the use of illegal means to achieve them.^[2]

Other uses of the word hacker exist that are not related to computer security (computer programmer and home computer hobbyists), but these are rarely used by the mainstream media.

Hacker definition controversy

The terms hacker and hack are marked by contrasting positive and negative connotations. Computer programmers often use the words hacking and hacker to express admiration for the work of a skilled software developer, but may also use them in a negative sense to describe the production of inelegant kludges. Some frown upon using hacking as a synonym for security cracking -- in distinct contrast to the larger world, in which the word hacker is typically used to describe someone who "hacks into" a system by evading or disabling security measures.

[edit]Controversy and ambiguity

While "hack" was originally more used as a verb for "messing about" with (e.g. "I hack around with computers"), the meaning of the term has shifted over the decades since it first came into use in a computer context. As usage has spread more widely, the primary meaning of newer users of the word has shifted to one which conflicts with the original primary emphasis.

Currently, "hacker" is used in two main ways, one pejorative and one complimentary. In popular usage and in the media, it most often refers to computer intruders or criminals, with associated pejorative connotations. (For example, "An Internet 'hacker' broke through state government security systems in March.") In the computing community, the primary meaning is a complimentary description for a particularly brilliant programmer or technical expert. (For example, "Linus Torvalds, the creator of Linux, is considered by some to be a hacker.") A large segment of the technical community insist the latter is the "correct" usage of the word (see the Jargon Filedefinition below).

The mainstream media's current usage of the term may be traced back to the early 1980s (see History). When the term was introduced to wider society by the mainstream media in 1983, even those in the computer community referred to computer intrusion as "hacking", although not as the exclusive use of that word. In reaction to the increasing media use of the term exclusively with the criminal connotation, the computer community began to differentiate their terminology. Several alternative terms such as "black hat" and "cracker" were coined in an effort to distinguish between those performing criminal activities, and those whose activities were the legal ones referred to more frequently in the historical use of the term "hack". Analogous terms such as "white hats" and "gray hats" developed as a result. However, since network news use of the term pertained primarily to the criminal activities despite this attempt by the technical community to preserve and distinguish the original meaning, the mainstream media and general public continue to describe computer criminals with all levels of technical sophistication as "hackers" and does not generally make use of the word in any of its non-criminal connotations.

As a result of this difference, the definition is the subject of heated controversy. The wider dominance of the pejorative connotation is resented by many who object to the term being taken from their cultural jargon and used negatively,^[7] including those who have historically preferred to self-identify as hackers. Many advocate using the more recent and nuanced alternate terms when describing criminals and others who negatively take advantage of security flaws in software and hardware. Others prefer to follow common popular usage, arguing that the positive form is confusing and unlikely to become widespread in the general public. A minority still stubbornly use the term in both original senses despite the controversy, leaving context to clarify (or leave ambiguous) which meaning is intended. It is noteworthy, however, that the positive definition of hacker was widely used as the predominant form for many years before the negative definition was popularized.

"Hacker" can therefore be seen as a shibboleth, identifying those who use the technically-oriented sense (as opposed to the exclusively intrusion-oriented sense) as members of the computing community.

A possible middle ground position has been suggested, based on the observation that "hacking" describes a collection of skills which are used by hackers of both descriptions for differing reasons. The analogy is made to locksmithing, specifically picking locks, which — aside from its being a skill with a fairly high tropism to 'classic' hacking — is a skill which can be used for good or evil. The primary weakness of this analogy is the inclusion of script kiddies in the popular usage of "hacker", despite the lack of an underlying skill and knowledge base.

Fred Shapiro thinks that "the common theory that 'hacker' originally was a benign term and the malicious connotations of the word were a later perversion is untrue." He found out that the malicious connotations were present at MIT in 1963 already and then referred to unauthorized users of the telephone network^[8] (which are also called phreakers).

[edit]History

• 1950s: amateur radio enthusiasts defined the term hacking as creatively tinkering to improve performance.
• 1959: hack is defined in MIT's Tech Model Railroad Club Dictionary as "1) an article or project without constructive end; 2) a project undertaken on bad self-advice; 3) an entropy booster; 4) to produce, or attempt to produce, a hack(3)." hacker is defined as "one who hacks, or makes them." Much of the TMRC's jargon is later imported into early computing culture.
• 1963: The first recorded reference to hackers in the computer sense is made in The Tech (MIT Student Magazine).^[9]
• 1972: Stewart Brand publishes "S P A C E W A R: Fanatic Life and Symbolic Death Among the Computer Bums" in Rolling Stone, an early piece describing computer culture. In it, Alan Kay is quoted as saying "A true hacker is not a group person. He's a person who loves to stay up all night, he and the machine in a love-hate relationship... They're kids who tended to be brilliant but not very interested in conventional goals[...] It's a term of derision and also the ultimate compliment."
• 1980: The August issue of Psychology Today prints (with commentary by Philip Zimbardo) "The Hacker Papers", an excerpt from a Stanford Bulletin Board discussion on the addictive nature of computer use.
• 1982: In the film TRON, Kevin Flynn (Jeff Bridges) describes his intentions to break into ENCOM's computer system, saying "I've been doing a little hacking here". CLU is the software he uses for this.
• 1983: The movie WarGames, featuring a computer intrusion into NORAD, is released. A gang of 6 teenagers is caught breaking into dozens of computer systems, including that of Los Alamos National Laboratory.^[10] Newsweek features the cover story "Beware: Hackers at play."^[11] First Usenet post on the use of the termhacker in the media (CBS News) to mean computer criminal.^[12] Pressured by media coverage of computer intrusions, Congress begins work on new laws for computer security.^[13]
• 1984: Steven Levy publishes Hackers: Heroes of the Computer Revolution. The book publicizes, and perhaps originates the phrase "Hacker Ethic" and gives a codification of its principles.
• 1988: Stalking the Wily Hacker, an article by Clifford Stoll appears in the May 1988 issue of the Communications of the ACM and uses the term hacker in the sense of a computer criminal. Later that year, the release by Robert Tappan Morris, Jr. of the so-called Morris worm provoked the popular media to spread this usage.
• 1989: The Cuckoo's Egg by Clifford Stoll is published, and its popularity further entrenches the term in the public's consciousness.
• 2008: Global movement of Hackerspaces emerges. These labs are technological, cultural and social creative places enabling hackers to develop projects together, code, create open source projects or hardware designs.

[edit]Contemporary use

The modern, computer-related use of the term is considered likely rooted in the goings on at the Massachusetts Institute of Technology (MIT) in the 1960s, long before computers became common; the word "hack" was local slang which had a large number of related meanings. One was a simple, but often inelegant, solution to a problem. It also meant any clever prank perpetrated by MIT students; logically, the perpetrator was a hacker. To this day the terms hack and hacker are used in several ways at MIT, without necessarily referring to computers. When MIT students surreptitiously put a fake police car atop the dome on MIT's Building 10, that was a hack, and the students involved were therefore hackers. Another type of hacker — one who explores undocumented or unauthorized areas in buildings — is now called a reality hacker or urban spelunker.

The term was fused with computers when members of the Tech Model Railroad Club started working with a Digital Equipment Corporation PDP-1 computer and applied local model railroad slang to computers.

The earliest known use of the term in this manner is from the 20 November 1963 issue of The Tech, the student paper of MIT:

Many telephone services have been curtailed because of so-called hackers, according to Prof. Carlton Tucker, administrator of the Institute phone system. […] The hackers have accomplished such things as tying up all the tie-lines between Harvard and MIT, or making long-distance calls by charging them to a local radar installation. One method involved connecting the PDP-1 computer to the phone system to search the lines until a dial tone, indicating an outside line, was found. […] Because of the 'hacking', the majority of the MIT phones are 'trapped'.

Originally, the term "hack" was applied almost exclusively to programming or electrical engineering, but it has come to be used in some circles for almost any type of clever circumvention, in phrases such as "hack the media", "hack your brain" and "hack your reputation".

[edit]Negative usage in engineering

Another meaning of the term "hack", similar to kludge and distinct from both the positive and security-related meanings discussed above, derives from the everyday English sense "to cut or shape by or as if by crude or ruthless strokes" [Merriam-Webster]. In other words to "hack" at an original creation, as if with an axe, is to force-fit it into being usable for a task not intended by the original creator, and a "hacker" would be someone who does this habitually. (The original creator and the hacker may be the same person.)

This usage is common in both programming^[14] and engineering. In programming, hacking in this sense appears to be tolerated and seen as a necessary compromise in many situations. In non-software engineering, the culture is less tolerant of unmaintainable solutions, even when intended to be temporary, and describing someone as a "hacker" might imply that they lack professionalism. In this sense, the term has no real positive connotations, except for the idea that the hacker is capable of doing modifications that allow a system to work in the short term, and so has some sort of marketable skills. There is always, however, the understanding that a more skillful, or technical, logician could have produced successful modifications that would not be considered a "hack-job".

The definition is similar to other, non-computer based, uses of the term "hack-job". For instance, a professional modification of a production sports car into a racing machine would not be considered a hack-job, but a cobbled together backyard mechanic's result could be. Even though the outcome of a race of the two machines could not be assumed, a quick inspection would instantly reveal the difference in the level of professionalism of the designers.