i ; '/ I 1̧ Hackers, Crackers and

Phreakers Oh My! Hackers, Crackers and

Phreakers Oh My/

Hackers, Crackers and

Phreakers Oh My/

T he hackers , c rackers and p h r e a k e r s are considered the arch enemy, the criminals of

t o d a y ' s v i r tua l c o m m u n i t y , c y b e r s p a c e , or whatever clich~ you want to choose to describe us living in the world of Internet, intranets, national information infrastructures, global information i n f r a s t r u c t u r e s and the l ike. These j u v e n i l e delinquents, punks, gang members and wannabe's that travel through our sys tems are not to be confused with the real miscreants - - the criminals who have learned to use a computer instead of a gun to rob, defraud, and flim-flam the unsuspecting traveller on the Internet these days.

Nope, the hackers' profession was once a noble one. These were the computer enthusiasts born of the 1960s MIT Railroad Club and similar loosely knit groups of young, enthusiastic, male-dominated inquis i t ive men who looked with wonder at the computer. They saw its potential to help society in so many ways, to unleash the world's information to all, if only it could be enhanced, modified, made more powerful to help mankind progress into the future.

So, these hackers threw away their toy trains, chemistry sets, erector sets, and crystal radio sets, and began the new journey into the realm of computers. However, their unbridled, unbounded interest and love for these new 'toys' was soon met with the industrial age bureaucrats, administrators, managers and their ilk who tried to control the systems and the hackers who

used them. These 'Controllers' were met by hackers who found ways to circumvent the controls in order to try to make the systems become more powerful, and do things that had not been done before.

The hackers unbridled quest for knowledge of and through the use of computers was not supported nor even understood by the old industrial age Controllers. Thus began the long struggle continuing now these 30-

p lus years . This

"The criminal hacker new p h e n o m e n a did not escape the

became known as press and its quest

crackers because to sell newspapers through

they cracked sensational stories,

passwords to break and the hackers ' issue was virgin

into systems," territory for them. Consequently, the

hackers, these computer enthusiasts, were marked by the press as anything from criminals who can wreak havoc and destroy a modern society to the Robin Hoods of the Information Age.

Later, to separate these hackers , compu te r enthusias ts , f rom those that v io la ted the new computer crime laws, the criminal hacker became known as crackers because they cracked passwords to break into systems. Around that same time, the phreakers were named for those who attacked telephone systems, which had become computer-driven with the advance of telecommunications hardware and software.

No matter who came up with what new word to describe the computer criminals, it was too late to stick. The term hacker had been tattooed on anyone who violated or attempted to violate any type of i n fo rma t i on secu r i t y pol icy , p r o c e d u r e or law relative to the use - - misuse - - of computers.

So, that brings us to 1999, where there are more hackers than ever, due primarily to the exponential expansion of the Internet coupled with cheaper and more powerful computers systems. It is difficult to tell if the number of hackers are increasing due to hacking being the new sport, or if the numbers of hackers, from a ratio perspective, is staying about the same as the number of new Internet hosts and Web sites coming

18 Computer Fraud & Security April 1999 3723/99/$20.00 © 1999 Elsevier Science Ltd. All rights reserved

online. One thing is certain, the hackers of old who had broken into computers to learn more about them and then quietly leave without causing any harm, have been replaced. They have been replaced by some truly undisciplined wannabe hackers, miscreants, and punks - - who now thrive on the news media's accounts of their exploits without condemnation like so many awards for bad behaviour.

These miscreants with their juveni le mentality usually know very little about the software that they use lo attack systems. They search the Internet for hacker tools, press the download button, find a site, and press the execute button. Their inexperience is holed when looking at the audit trails of systems they have attacked and some of their attempted commands, e.g. using a Unix command against a non-Unix system.

These miscreants are more vicious than their predecessors and have

"The term hacker had been tattooed on anyone who violated or attempted to violate any type of information security policy,"

a similar mindset as the graffiti writers of our wal ls and h i g h w a y s s igns coupled with the evil intent of a d r ive-by shooter. They build up their own poor self- es teem by t rying to display their power on the In ternet . They hide beh ind the a n o n y m i t y that the

I n t e r n e t o f f e r s them - - and they do so wi th impunity.

T h e s e m i s c r e a n t s who are the j u v e n i l e d e l i n q u e n t s of the I n f o r m a t i o n Age, act wi th impunity because they often attack systems in other nations and are safe from the jurisdiction of their victims. In addition, law enforcement at all levels does not have the resources or often the capabilities to go after these offenders.

Law enforcement's computer crime units are not only understaffed but also under-equipped. Some may get thei r d e p a r t m e n t to p u r c h a s e them a

computer but then are told to go find the software they need in the evidence room and make a copy to use on their machine. (Heyt Isn't there some law against that?) Another department in a multi-million- p o p u l a t i o n c i ty has on ly nine p e o p l e in thei r computer crime unit, using five computers running Windows 3, 1 I !

"These miscreants with their juvenile mentality usually know very little about the software that they use to attack systems."

Two other factors hamper ing law enforcement are that their citizens have a different agenda and priority, and that is to e l imina te gangs, drugs and v io len t crimes. Consequently, and rightly so, that is where the majority of resources are targeted. Furthermore, duty in a computer crime unit is career limiting. Thus, a law e n f o r c e m e n t

officer wanting to move up the ranks must move out of the computer crime unit and back into basic law enforcement.

So, that leaves f ight ing these hackers to the bus inesses and governmen t agenc ies defend ing themselves. Many have sought out computer security and computer crime specialists to be their 'hired guns'. One thing is for certain: the hackers will continue to be on the offensive and their victims and their hired consultants will continue to react to the attacks in a defensive manner.

It is time for that to change - - but more about that next time.

This is the first installment of a new column written anonymously by a leading computer security expert. Whilst wishing to remain anonymous he would like to instigate discussion surrounding this column. Any questions, comments or ideas f o r .future columns should be E-mailed to the Editor at the address given at the back of the publication, these will then be passed on to the author for response.

Computer Fraud & Security April 1999 3723/99/$20.00 © 1999 Elsevier Science Ltd. All rights reserved

19