Init

Hacking, Hacker & Security

Hacking?

Understanding the phenomenon of a process, finding a way to tweak it the way you want; apply the tweak-process, and make it work the desired way.

It is not just limited to breaking security mechanisms.

Though in present scenario, maximum drive for hackers is bypassing the security measures of applications to make it work desired way.

Hacker?

A curious, innovative person trying to solve a problem or use a service in desired way, with no ill-intention but lawfully utilizing any technology in a tweaked stage not harming others.

NOT Script Kiddies. 'Script Kiddies' are newbie learners, who tend to find shared 'Hacking' material by 'Hackers' and use it to perform the same hacks. Being 'Script Kiddie' is not bad. But sticking to this status is.

To Hack a Technology, learn it as much you can... Stop being satisfied by limited features. Start thinking of what all you can make it do. Use your knowledge on how you can command/tweak it. Acquire Target, Apply Tweak. Try your luck...

Security?

Security, it's definition changes with different scenarios, but the main agenda is same. Agenda of enabling every person perform any task, without influence of illegitimate actions. Implementing security in a scenario is an ongoing task which needs regular supervision & updates.

Has 4 main elements ~

Confidentiality : "Hiding Secrets & Maintaining Privacy"

Authenticity : "Un-disputed Data Origin Guarantee"

Integrity : "Tamper-proof Data Encoding Mechanism"

Availability : "Avoid Service Access Exhaustion"

'Hacking' In a single sentence ~ "Outcome of Innovative Mind's Curosity."

Hacking & Hacker's Class

Hackers' Dress Code ;)

WhiteHat

All security experts who deal into hacking practices in a very ethical & legal way. They are mostly hired professionals for testing security of networks, products or services. They don't break any law while hacking as their attempts are protected by prior hacking permission.

Though, if some network/product is not covered under context of contract and they face hacking attempt without prior notification. Then it is a disputed action and isn't WhiteHat Hacking scenario.

BlackHat

They follow anti-WhiteHat philosophy. They hack without any notification to target. Mostly, they hack with malicious intent of money, power, revenge or just plain old-skool dark-fun.

GrayHat

They are those WhiteHat Hackers who don't wait to get hired to find vulnerabilties and exploits of a system. They feel injustice or careless attitude in any service, product or organization... and they attack.

They have intent of WhiteHat Hackers and hacking roadmap of BlackHat Hackers.

Seperate Streams

The.Mask Hackers

Those hackers (individual or group), who feel injustice or carelessness to public {common man} and show their wrath in the digital world. They try to become revolutionaries and keep floating on thin ice of Organization's tag of CyberTerrorism.

Security Suit

These are secretly hired hackers by Government or powerful organizations with digital 'License To Kill'. They act like online-hitman for Organizations.

Naked

These are 'Script Kiddies', who don't analyze technology closely to find a vulnerability, instead re-use other's created tools or so.

Referred as 'Naked', because that is what they become to hackers designing exploits. As, some hacker with ill-intentions could create an infected material over exploits. This would compromise Script Kiddie's system.

Were danger to some Ignorant Web Users. Though, the applications were full of simple security holes, there was lack of automated hacking tools. A basic understanding of technology was required even to apply other's hack. So only new recruits of geek-zone were part of Script Kiddies, hacking others.

Are danger to Maximum General Web Users. Now applications, compilers, platforms & even several technologists are aware of secure development practices. Softwares are more secure than they used to be in earlier days. Still, any exploit in the wild have several fully/semi-automated mechanisms to be used. Thus enabling any mouse-clicking newbie to launch a major attack.

Hacking & Ethical Hacking

Ethical Hacking

A Bad Example for this situation

"Ethical Hacking is like a practice match played for finale of a Cop-Thief game...
to identify offense tactics of your opponents, and likewise work on your defense strategies."

It is hacking performed by "Hired" Experts for determining flaw in a system and report it to system maintainers for patching. So that cyber-criminals cannot exploit it.

The only point of difference here is 'HIRED'. So, it's not illegal to exploit the network or service because you have been hired for it.

Making Hacking an Ethical Task

Completing legal formalities for permission

Preparing Vulnerability Assessment Report

Communicating Report just to Client

Helping in fixing security holes

Basic Roadmap to Ethical Hacking

You are hired, so Target is already set

Find what is exposed on Target

Research on exploits capable on Target

Suggest patches to fix vulnerabilities

Suggest mechanisms to identify attacks

It's more like 'Legal Hacking'... but due to such confusion on term 'Hacking', it's better coined as 'Ethical Hacking'.

Hacking, Crime & Law

Hacking & Crime

Script Kiddies were danger to most of ignorant Web Developers. Are danger to Maximum General Web Users.

Security Experts with (Political/Social/Economic) wrath. Don't normally target masses, but classes.

All Organizations are exposed online in a way or other, and thus vulnerable.

Unauthorized hacking attempts are crime, obviously if you get caught.

Hacking & Law

Without a legal permission, the intention is of no value for law.

Law doesn't get intimidated by your Hat, they just want approval on paper.

Every region (nation) have their cyber law, but the fundamentals are same. Maintain your own privacy and respect others.

Hacking & Hacker's Aim

Hacker's Aim

Check for 'Robust-ness' of a system, finding 'Vulnerability' in it... and creating an 'Exploit' for vulnerability. To prepare a 'Threat Model' for 'Target' and work on measures to secure it.

Robust-ness

A software/service is as robust as much it can withstand the abrupt, non-workflow behavior from users and still work in a desired secure way

Vulnerability

Any element of a service/software/technology compromising it's security parameters.

Mainly Two Types

Design-Level:

flaw in architecture of a software or protocol of a service.

Code-Level:

incompetency i.e. logical loopholes in "code" leading to "potential threats"

incapability i.e. an inherited flaw from compiler/framework/library used which is "present vulnerability" in code

Implementation-Level

a robust software/service implemented without adhering to the security guidelines, still enables Hackers to exploit it.

Chapter.0 Init