Inside the Mind of Hackers: Behavior, Motivation, and Notable Cases
Explore the intriguing world of hackers, delving into their behavior, motivations, and infamous cases such as Kevin Mitnick's social engineering hacks and Adrian Lamo's unique approach to vulnerability disclosures. Discover how figures like Stephen Wozniak and Loyd Blankenship transitioned from hacking to successful careers, shedding light on the diverse facets of hacking culture.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
THE MIND OF THE HACKER AN INSIDE LOOK INTO THE BEHAVIOR AND MOTIVATION OF HACKERS (2019) DR. ROBERT R. PERKOSKI ASSISTANT PROFESSOR SCHOOL OF COMPUTING AND INFORMATION
CYBERCRIME AN ECONOMY $860 billion Illicit/illegal online markets $500 billion Theft of trade secrets/IP $160 billion Data trading $1.6 billion Crimeware-as-a-Service $1 billion Ransomware Read more at: https://www.thesslstore.com/blog/cybercrime-pays-new-study-finds- cybercriminal-revenues-hit-1-5-trillion-annually/
FAMOUS HACKER CASES - https://www.telegraph.co.uk/technology/6670127/Top-10-most-famous- hackers.html Kevin Mitnick Hacked into large technology and telecom companies including Nokia, Fujitsu, and Motorola. Served a five year sentence and released on parole. He referred to his hacking as social engineering.
FAMOUS HACKER CASES Kevin Poulson Hacked into phones to make sure he would win contests. Had an alias named Dark Dante. Hacked into a federal investigation database. After release from prison he entered journalism.
FAMOUS HACKER CASES Adrian Lamo Noted as homeless hacker because he used coffee shops, libraries and internet cafes. Broke into internet sites and showed vulnerabilities to companies. Broke into New York Times used the LexisNexis account to view information on high profile people.
FAMOUS HACKER CASES Stephen Wozniak While at college he created blue boxes devices for bypassing the phone system. After dropping out of college he co-founded Apple.
FAMOUS HACKER CASES Loyd Blankenship Member of elite hacking groups like the Legend of Doom. Author of the Hacker Manifesto cornerstone of hacker philosophy. Views the activities of a hacker motivated by curiosity. Currently a writer.
FAMOUS HACKER CASES - SHORT SUMMARY Hack into Companies Phones Federal databases What they achieved Win contests View info of other people In the following slides, we will use these key words to help you understand concepts Add by: Xin Liu
HACKER : A DEFINITION The term hacker originated in the 1950 s at Massachusetts Institute of Technology. Originally it referred to pranks at the college and did not necessarily involve computers. However, the word evolved to describe pranks involving the college s mainframe computers. In the 80 s, the term again changed and reflected computer acts that were either illegal or unethical. Famous example Phones, databases
DETAILS OF THE HACKER AT MIT - Initially, started in late 50 s to 60 s with members of the Tech Model Railroad Club exploring mainframes. Computers used paper tape and were in air conditioned rooms. MIT obtained a TX-0, one of the first programmable computers. Students snuck into the lab after midnight and experimented with the computer trying to figure out how it worked there were no manuals. In 1961 MIT obtained a PDP -1, one of the first minicomputer. Rayner, T. (2018).Hacker culture and the new rules of innovation.
THE HACKER GROWS AND MOVES ON - The hackers created assembler language, debuggers, and text editors. Everything that was learned was written down and shared by all. In the early 60 s hackers created first word processor, first interactive debugger, first computer chess program and computer music. Games: Hackers created SpaceWar - guiding rocket ships and shooting missiles. In the 70 s hackers moved west along with the counterculture movement. Many joined the HomeBrew club including Steve Wozniak. The major event that promoted hacking was the creation and introduction of the Linux operating system. Rayner, T. (2018).Hacker culture and the new rules of innovation.
THE TAKE OFF POINT FOR HACKING Linux s success changed that. Linux signaled that hacker culture had come of age. When Torvalds placed his source code files online and invited people to hack and improve them, he drew a line in the sand between the old world of planning- and management-intensive software development, and the new world of agile, experimental, collaborative hacking. This act was a rallying cry for hackers the world over. https://learning.oreilly.com/library/view/hacker-culture-and/9781351595742/10-9781351595742_chapter- chapter1.xhtml#chapter1
GOOD VS. EVIL The term hacker can refer to people who practice security techniques for the good of society. But, most often the term is used to refer to someone who uses computer tools and techniques to conduct unauthorized access to confidential information. Famous example View others info Hackers are typically portrayed as mythical creatures with unlimited intellectual prowess. In some cases, they are extremely bright but in most cases they have developed a skill set that most people could acquire.
THE ETHICAL HACKER Key points regarding ethical hacking. Requires written permission of the victim . Hacker uses the same tools and techniques as malicious hackers. It can produce harm to a system so proceed with care. It requires detailed knowledge of malicious techniques. It requires that rules of engagement be written and understood by both parties. Solomon, M. G. and Oriyano, S. (2018) Hacker Techniques, Tools, and Incident Handling. Retrieved from https://learning.oreilly.com/library/view/hacker-techniques-tools/9781284147810/
THE ETHICAL HACKER Some companies provide a bounty for finding bugs in their software. Some companies have hackers on staff. The results of penetration testing can yield very positive results and insights. Ethical hackers ensure the C-I-A Triad: Confidentiality Ensuring that only authorized subjects can access protected data. Integrity Ensuring that only authorized subjects can modify protected data. Availability Ensuring that information and the resources that manage information are available on demand to authorized subjects. Solomon, M. G. and Oriyano, S. (2018) Hacker Techniques, Tools, and Incident Handling. Retrieved from https://learning.oreilly.com/library/view/hacker-techniques-tools/9781284147810/
PERCEPTION OF A HACKER Still, even when writers aren t calling bad guy hackers super smart, readers often assume they are because they appear to be practicing some advanced black magic that the rest of the world does not know. In the collective psyche of the world, it s as if malicious hacker and super intelligence have to go together. It s simply not true. A few are smart, most are average, and some aren t very bright at all, just like the rest of the world. Hackers simply know some facts and processes that other people don t, just like a carpenter, plumber, or electrician. Grimes, R. A. (2017). Hacking the Hacker. Wiley.
COUNTRIES WITH HIGH NUMBER OF HACKERS Brazil Taiwan Russia Turkey US China Source ABC news: https://abcnews.go.com/Technology/slideshow/top-hacking-countries-19844818/image-19845656
THREE OVERALL CATEGORIES OF HACKERS Hackers can be placed into three main categories according to Gold(2011): White Hats promote justice and the common good. Black Hats Famous example perform hacking for the thrill of it and operate based on their own rules and may at times be described as dangerous. Grey Hats View others info, Win contest also known as ethical hackers, are hackers whose standards fall in between that of the white hat and the black hat. Gold, S. (2011). Understanding the hacker psyche. Network Security, 12, 15 17. doi:10.1016/S1353-4858(11)70130-1.
SUB-CATEGORIES OF HACKERS Nine sub-categories of hackers developed by Rogers: Novice (NV) Internals (IN) Virus Writers (VW) Professional Criminal (PC) Political Activists (PA) Cyber-punks (CP) Petty Thieves (PT) Old Guard Hackers (OG) Information Warriors (IW) Rogers, M. (2006). A two-dimensional circumplex approach to the development of a hacker taxonomy. Digital Investigation, 3, 97-102.
TWO DIMENSIONAL LEVEL CIRCUMPLEX OF ROGERS CATEGORIES AGAINST SKILL AND MOTIVATION S. L. N. Hald and J. M. Pedersen, "An updated taxonomy for characterizing hackers according to their threat properties," 2012 14th International Conference on Advanced Communication Technology (ICACT), PyeongChang, 2012, pp. 81-86.
ADDITION OF MOTIVATION AND SKILL LEVEL TO CIRCUMPLEX The previous circumplex adds a E/W axis labeled skill level that starts at the center with low skill level and advances as it moves outward. In addition, four areas of motivation have been added: Revenge, Financial, Curiosity and Notoriety. This results in the following groupings: Revenge: VW and IN with moderate to high skills. Financial: IW, PC and PT with moderate to high skills. Notoriety: CP and PA with moderate to high skills. Curiosity: NV and OG with low to high skills.
UPDATES TO ROGERS CATEGORIES New Categories Script Kiddies Cyber-Punks Insiders Petty Thieves Grey Hats Professional Criminals Hactivists Nation States Roger s Categories Novice Cyber-Punks, Virus Writers Internals Petty Thieves Old Guard Hackers Professional Criminals, Information Warriors Political Activists Information Warriors S. L. N. Hald and J. M. Pedersen, "An updated taxonomy for characterizing hackers according to their threat properties," 2012 14th International Conference on Advanced Communication Technology (ICACT), PyeongChang, 2012, pp. 81-86.
DETAILS OF EACH CATEGORY: SCRIPT KIDDIES Famous example View others info Type Script Kiddies Intent Curiosity, Notoriety Triggers This group does not need any special triggers to execute an attack. Targets are typically chosen at random. Capability-Skills Very low Capability- Resources Very low - Script Kiddies typically work alone and are not dedicated enough to their hacking to have particularly strong or specialized equipment Methods Tools and scripts downloaded for free from the Internet. The tools scan random IP blockson the Internet for weaknesses and allow the Script Kiddies to exploit them as they are found Trends There is more and more money in cyber crime , so even of the amount of tools and scripts available on the Internet for free is ever increasing, the truly disruptive and effective crimeware is only available for money. Therefore, while Script Kiddies can still do a lot of damage to systems with no or low security [23], they are unlikely to do anyserious damage to well-protected systems.
DETAILS OF EACH CATEGORY: CYBER-PUNKS Type Cyber-Punks Intent Notoriety (with the occasional financial or vindictive intent). Triggers This group does not need any special triggers to execute an attack, however higher profile targets (e.g. military or government targets) are more likely to attract attention from Cyber-Punks. Capability-Skills Medium skill level. Typically a generalist level of knowledge in both software and hardware as well as programming skills. Capability- Resources Cyber-Punks may have acquired some inexpensive specialized equipment, and may partake in information sharing in specialized hacking forums on the Internet or be members of hacking groups. Methods Cyber-punks may use tools downloaded from the Internet which they modify to suit their purpose. For financial support, some are engaged in credit card number theft and telecommunications fraud Trends The fame and notoriety of successful cyberpunks like Kevin Mitnick and more recently George Hotz (a.k.a. GeoHot) is the hacker equivalent to the American Dream. When popular media shows a hacker attention, or even when popular hacker movies premiere in the cinemas, there is a surge in the activity of Cyber-Punks
DETAILS OF EACH CATEGORY: INSIDERS Famous example Win contest Type Insiders Intent Revenge, Financial Triggers Negative work-related event [14]. The target of an Insider attack is usually the workplace or former workplace of the attacker. Capability-Skills Since Insiders per definition are attacking systems they have inside information about and usually extensive specialized knowledge of, their attack skills should be considered high. Capability- Resources While Insiders usually work alone, they have physical and privileged digital access to the system, and for an attack that amounts to a considerable resource. Methods Insiders have three main avenues of attack: Sabotage, theft of intellectual property, and fraud. In all of these attacks, the Insider abuses his or her position of trust to commit the attack. Trends The amount of Insider attacks compared to incidents performed by outsiders is in decline. According to [25] 21 % of attacks are caused by Insiders. About one third of the respondents viewed the Insider attacks to be more costly than outsider breach, compared to 25% in 2010. 22% of the Insider attacks were executed using hacker scripts and tools.
DETAILS OF EACH CATEGORY: PETTY THIEVES Famous example View others info Type Petty Thieves Intent Curiosity, Notoriety Triggers This group does not need a special trigger, however they are attracted to high-security targets. They prefer targets they consider challenging to attack or which they perceive contain information they are interested in obtaining, which may be sensitive in nature Capability-Skills Medium skills. The Petty Thieves typically Skills move into the cyber domain since their traditional targets move there. They learn the specific skills needed to execute their attacks successfully, but they do not have any interest in the technology in and of itself Capability- Resources Petty Thieves are usually not interested in Resources gaining notoriety - on the contrary since that may prove detrimental to their work [4], so they are usually not active members of hacking communities. Since they resort to petty theft, they are not expected to have many monetary resources available, however they may have specialized equipment necessary to work their trade. Methods Spam, credit card scams, identity theft, using crimeware or homemade scripts and tools. Trends Petty theft is still very much alive on the Internet [12], and the attack vectors have not changed radically over the last few years. It has become more accessible for the nontechnical Petty Thief, though, with the introduction of professional easy-to-use crimeware availability.
DETAILS OF EACH CATEGORY: GREY HATS Famous example View others info Type Grey-Hats Intent Curiosity, Notoriety Triggers This group does not need a special trigger, however they are attracted to high-security targets. They prefer targets they consider challenging to attack or which they perceive contain information they are interested in obtaining, which may be sensitive in nature Capability-Skills High skills, often including very specialized skills within computer and network security. Capability- Resources While Grey Hats tend to work alone, they also typically engage in heavy knowledge exchange and build upon the equally specialized tools of their peers [4]. Famous example Hack database Methods Grey Hats may exploit more or less known vulnerabilities or even develop new O-day attacks to gain access to their target systems. Usually they will do little or no damage to the system, even though they may steal and publicize choice bits of data and information. Trends While this category of hackers usually do not do major damage, the recent example of the Wikileaks whistleblower, Bradley Manning, proves, that this is not always the case [26].
DETAILS OF EACH CATEGORY: PROFESSIONAL CRIMINALS Famous example Win contest Type Professional Criminals Intent Financial Triggers No triggers needed. Professional Criminals are just that - professional. They analyze rewards versus risks before they attack, and they are not expected to attack targets without a viable business case. Capability-Skills Very high, including specialized skills within computer security, crimeware, and the sectors of society where they do their business. Capability- Resources The Professional Criminals work together inan organized fashion mimicking legitimate business. This includes structured enterprises and supply chains with each part of the chain having whatever specialized skills and equipment needed. They can be expected to have access to large amounts of money and be willing to invest them if the business case is sound. Methods Professional Criminals employ a plethora of methods, and they develop continually. Favoured attack vectors are phishing, spam, botnets, Man-in-the-Browser and key loggers Trends The use of botnets to steal financial information (e.g. credit card numbers or online banking details) is on the rise [27] as well as corporate espionage and identity theft [28]. Likewise, the Professional Criminals are exploring new attack vectors by targeting mobile devices [29] and using cloud technology to perform their illegal activities.
DETAILS OF EACH CATEGORY: HACKTIVISTS Type Hacktivists Intent Notoriety, Revenge. Hacktivist groups are per definition ideologically motivated, though some groups lean heavily towards being motivated by the fame. This is especially true for some of the newer, high-profile groups, who admit to "doing it for the lulz". [30] suggests that their motivation may be similar to that of the character "The Joker" in the Batman movie "The Dark Knight" they simply enjoy watching the world bum. Triggers Any real or perceived insult to their ideology. Capability-Skills While the skill levels of Hacktivist groups vary widely, they tend to have a number of core members with high technical skills. Some Hacktivist groups, most famously "Anonymous", arrange hacking schools for their newer members to increase the level of skill among them [11]. Capability-Resources While the monetary resources may be limited,some Hacktivist groups have a huge amount of members and followers. They can be expected to have access to much specialized and even potentially sensitive or restricted information [insider threat study] as well as the manpower to execute devastating DDoS attacks using only volunteer participants. Lately this includes physical-world participation as well. Famous example Hack database Methods Hacktivists favour exploiting common (known) vulnerabilities (e.g. SQL Injection or Buffer Overflow vulnerabilities) to gain access to sensitive data which are then publicized. [31], [32]. Another preferred method is (D)DoS attacks r331, r341. Trends Hacktivism becomes more and more mainstream [35] but wanders on the knife's edge between civil disobedience and outright terrorism. Recently, it has gained new legitimacy in the western world by being combined with legal demonstrations such as "Occupy Wall Street" - in e.g. China, nationalistic hackers have been celebrated by the general populace for years [36].
DETAILS OF EACH CATEGORY: NATION STATES Famous example Win contest Type Nation States Intent Revenge, Financial. The former is in this motivation context understood as a general term for aggression. The Nation State in question may be aggressor. Triggers Typically, Nation States attacks are triggered by geo-political conflict. Capability-Skills Nation States may have access to the Skills competencies and the knowledge of an entire nation. Even if this may be a truth with modifications, Nation State actors can always be considered to have very high skills. Capability- Resources A Nation State typically have access to more funds, better equipment, and more thorough intelligence than any other group of attackers. Their resources are vast. Methods While Nation States behave differently and often act very covertly on the Internet, there are a few common characteristics. First of all, they target resources of national impact, e.g. critical infrastructure [17], [18]. Methodologies vary, but they often combine social engineering techniques and spearphishing with more or less sophisticated troians D81, D91 Trends Nation States are becoming more prominent on the Internet with many countries establishing cyber commands [15], [16]. Aggression levels are high, especially between the East, led by China, and the West, led by the US - there have even been talk of new Cold War in the cyber domain [37], [38].
FIVE MAJOR VALUES THAT SOME HACKERS POSSESS The following five values were ascertained from a European study: Creativity & Innovation Curiosity Individual Autonomy & Liberty Community Development Social Development This study focuses on hacktivists (hackers who further social or political ends and makers (hackers developing novel uses for technology). Dizon, M. A. (2017) A Socio-Legal Study of Hacking: Breaking and Remaking Law and Technology, N.Y.: Routledge.
CREATIVITY & INNOVATION Many hackers perceive that hacking is an application of creativity to a computer environment. Often times the value is shared among groups of hackers and innovative techniques are highly praised. Groups can use their platforms to learn and share. Doing the same thing over and over again is not highly valued. Dizon(2017)
CURIOSITY Closely related to innovation. It is different from innovation in that it does not have a definite end goal or product. Curiosity is the basis for experimentation and the exploration of new ideas. Involves a sense of play. Gatherings of hackers involve a community of curiosity seekers and playmakers. Curiosity keeps hackers current with trends in society. Dizon(2017)
INDIVIDUAL AUTONOMY AND LIBERTY This is often mostly highly ranked as it allows for all of the activities to occur in hacking such as exploring, breaking and learning. Some hackers have mentioned autonomy and freedom from technology; recognizing the potential dangers to society from computerization. Allows individuals to have power and it balances the symmetry of power between organizations and individuals. Even at hacking retreats much of the time is spent alone working on individual projects. Dizon(2017)
COMMUNITY DEVELOPMENT Again hackers try to strike a balance between individuality and participation in groups. Hacker camps are a place where people can share, meet friends, learn new techniques, technologies and collaborate. Hackers can be very social and engage in activities that could be described as party like. Most attendees act as participant and volunteers to create and host the event. Dizon(2017)
SOCIAL DEVELOPMENT Want to develop a better understanding of how the world operates and its social systems. Often times information is disseminated to the greater community informing them of important security topics. Again, a balance is struck between individual autonomy and independence versus belonging to a greater community. Hacking is not perceived as only a technical activity. Dizon(2017)
HACKERS: IN THEIR OWN WORDS A study [1] was done to examine the motivations of hackers. In this study 54 Israeli hackers were interviewed and a qualitative structured methodology based upon grounded theory was applied to their answers. The following slides present a selected summary of their quoted responses. [1] Turgeman-Goldschmidt, O. (2005). Hackers Accounts: Hacking as a Social Entertainment.Social Science Computer Review,23(1), 8 23. https://doi.org/10.1177/0894439304271529
HACKERS: IN THEIR OWN WORDS Fun, Thrill, and Excitement It s juicy. It s so seductive. You come and knock on the door and it s not that they don t answer, it s like you have a tiny window, and they tell you who you are. It s stimulating, and it overtakes you. You just can t have just a little of it. You have to know as much as possible, as fast as possible. (Ran) Cracking software gives you a sensation of thrill, fun, and adrenaline. (Gad) It drew me because it was so sexy: exciting, dynamic, mysterious, and sexy. (Ido)
HACKERS: IN THEIR OWN WORDS Curiosity for Its Own Sake I said to myself, there has to be a way to reach these [pay-per-minute] telephone numbers for free, to listen for free. What happened [was] that I read and learned everything I could about the 056 services. I collected every article, as if it were sacred, I collected brick after brick. Until one day I sat at home and managed to hook up [to a pay-per-minute service] for free, step after step until I learned how to do it. That s how I got into hacking and phreaking.
HACKERS: IN THEIR OWN WORDS Computer Virtuosity They thought I couldn t do it, but I could. . . . The thing about computers is that I can do anything. (Gil) My friend said that if I crack this, I m the greatest [referring to a protected software]. It s also about competing with someone on the other side. He programmed something, and I m showing him that what he did is breakable. It s like a drug. (Shai)
HACKERS: IN THEIR OWN WORDS Economic Accounts It s as if the big companies and their stuck-up lawyers think that computing belongs to them, and they can retail it with price stickers, as if it were boxes of laundry soap! But pricing information is like trying to price air or price dreams. (p. 85) Note: In the present study, except for one individual, none of the interviewees had a significant economic interest.
HACKERS: IN THEIR OWN WORDS Deterrent Factor - The deterrent factor consists of two components that determine the probability of committing an offense: the probability of being caught and the severity of the punishment I stopped using pbx because I thought that there was a good chance I d get caught. It s very dangerous, they can catch you. You [have to] give out your name, your phone number [to do business].
HACKERS: IN THEIR OWN WORDS Lack of Malicious or Harmful Intentions A person that enters always closes up. You shouldn t cause damage, even by mistake. Peeping isn t editing you don t change the files, just download them and read them off your computer. This is allowed and even desired because that s how you gather information and learn. You re doing something forbidden, but you re not disturbing anyone.
HACKERS: IN THEIR OWN WORDS Intangible Offenses The term theft has no meaning in cyberspace. I can create the same car for myself, but that s not theft. I m not taking a CD off the shelf so someone else can t buy it. I create a copy of it.
HACKERS: IN THEIR OWN WORDS Nosy Curiosity and Voyeurism I don t have respect for privacy or confidentiality. If I can enter, it s not private. It s about being intrigued, going around the system, curiosity. I m very nosy. When I was younger, 15 or 16, I would peep into people s windows with binoculars. It happens that I get turned on by a target and break in out of curiosity. I m willing that others do the same to me. I don t respect privacy. They don t even know about it, so no one gets hurt. Perhaps if they knew, they would have [been hurt]. When I break into someone s web site, I can do a lot of damage, but I don t. When there s information that intrigues me, I might do illegal things.
HACKERS: IN THEIR OWN WORDS Revenge I did it because he pissed me off. I decided to get revenge. I was kicked out of school, and she was mailed a CD bought with a stolen Visa card and had some trouble because of that. Serves her right.
HACKERS: IN THEIR OWN WORDS Ease of Execution The most accessible and easy to break into were the academic institutions and everything that s connected to them. You break in, and you don t even know to whom it belongs . . . . Wow, what an idiot is this system manager, he could have easily closed this hole. (Yoram)
INTEGRATED THEORY TO EXPLAIN HACKER BEHAVIOR Xu et al. [1] proposed a model that integrates Social Learning Theory, Routine Activity Theory and Situational Activity Theory to explain hacker behavior. Social Learning Theory Popularized by Albert Bandura supports the idea that people learn from each other and often times model or imitate others. Routine Activity Theory Supports the idea that if an individual is motivated and lacks a guardian they will likely engage in criminal activity. Situational Activity Theory Posits the idea that an individual has a moral lexicon and interacts with their specific environmental circumstances. [1] Xu, Z., Hu, Q., & Zhang, C. (2013). Why computer talents become computer hackers. Communications of the ACM, 58(4), 64-74.
XU et al INTEGRATED THEORY TO EXPLAIN HACKER BEHAVIOR Social Learning Theory Routine Activity Theory Situational Activity Theory
McBRAYER STUDY EXAMINING MOTIVATION AND DEMOGRAPHICS OF COMPUTER DEVIANTS 120 subjects completed an anonymous, self report questionnaire. Subjects were computer deviants from targeted websites. Questionnaire measured computer deviance, motivational factors, and demographics of each subject. McBrayer, J.C. (2014). Exploiting the digital frontier: Hacker typology and motivation.
