A bit on hacking

In this article, I will tell you a few things about the world in which hackers live, with the hope that the information might guide you in the manner in which you access the Internet. A version of this article appeared in the 16 January 2012 issue of Daily Trust, but cyber-security problems have become […]

In this article, I will tell you a few things about the world in which hackers live, with the hope that the information might guide you in the manner in which you access the Internet. A version of this article appeared in the 16 January 2012 issue of Daily Trust, but cyber-security problems have become more prevalent and vicious since then, warranting a rerun of the original article, albeit with some updates on a few bits of information that have become available since the original article was published.
Why hack? There are a few reasons: 1) to cheat (as in video games), or to extort or steal what belongs to others (such as money in the bank), 2) to impress or gain respect among peers, 3) for the fun, thrill, and excitement, 4) to demonstrate proof-of-concept, 5) to punish (retribution), 6) to intimidate or frighten and/or warn of one’s ability to do mischief, 7) to set oneself free or beat a security system.
As much as we hate to admit it, hackers have a couple of interesting qualities. They tend to be tolerant, they share information, they are persistent, they will literally dig through trash, and they often use “handles” to deceive authorities in order to protect themselves.
A few hacking activities
The following are some of the things that hackers do, which form the basis of cyber-insecurity:
Phish a device: Hackers can connect to a loosely controlled wireless network (hot spot) via your smart phone, spoof the domain name server (DNS) entry for the gateway of their target application (such as facebook.com), and then host their own version (of facebook.com). Ominous? Yes. Possible? Yes. I have discussed “war-driving” before in this column; it pertains to Google sending out its people to drive streets for the purpose of tapping into unsecured networks to secretly obtain people’s information. Circumvent a home digital security system: A hacker’s basic knowledge of electronic circuitry coupled with the knowledge that many home security systems make use of magnetic field detection can go a long way to help a hacker disarm security systems.
“Jailbreak” a smart phone device: With this skill, a hacker can break into a phone system and install otherwise forbidden third-party applications. For some devices, such as iPhone, the only legitimate way to install apps is through the Apple marketplace. Apple is notorious for overly protecting its devices, taking extreme measures such as voiding phone warranties to prevent consumers from unlocking their iPhones. Hackers can gain some independence from Apple by employing a third-party application manager software (in the spirit of Cydia) to install any app. Jailbreaking is a hacker’s first step toward unlocking an iPhone so that it can be used anywhere in the world.
Deploy an AP cloning attack: A hacker can use an AP to copy, via suitable system calls, the SSID of a network and take control of the entire traffic into the network. This allows the hacker to replace the contents of the web pages in a non-secure environment. One can obviously accomplish just about any kind of mischief with this power.  
Build their own GSM tower: For under $1600, hackers could actually use a programmable software radio to build a full GSM cell phone tower that would fit into a portable bag! The system will be capable of operating with commercial phones. This allows hackers to capture phones and phone identities. Among other things, hackers can send an SMS to any phones in their target network and do virtually anything they want to do.
Turn into a domain administrator: Instead of a local administrator, a hacker can become a domain administrator (DA) on Microsoft-based networked PCs. The DAs are those with all the power to manipulate a server. Hackers can do this with a few lines of code in a batch file.
Send spam: Unsecured computers are susceptible to spam, in which system resources (disk space, bandwidth, processing power, etc.) are hijacked, usually for malicious purposes. Attacked computers are sometimes referred to as zombies or bots, and a group of them as botnets. The botnets are used for routing traffic to hide the identities of the perpetrators (called bot herders). Stealing of passwords and the creation of distributed denial of service attacks from infected machines are common. The Internet relay chat (IRC) protocol that was developed to enable us to chat over TCP/IP networks (on which the Internet is based) also makes the creation of botnets ever so easy. For example, the IRC scripting language enables raw socket connections (allowing access to packet headers), scanning of open ports in servers, flooding of servers with requests, sending more than one identical connection to the same IRC server (cloning), using other peoples’ computers as a gateway to an IRC server, and the use of timers for repeated execution of commands at specified time intervals. Self-replicating tools (worms) can be created with the help of the IRC scripting language. The internet “mailman,” or the simple mail transfer protocol (SMTP), offers no security and your e-mail can be intercepted and altered en-route. Moreover, e-mail headers (which contain the origin of sender and the route of travel) can be easily forged!
With more ICT in governance in Nigeria, the introduction of ATMs into the banking system, and more extensive use of online banking, the need for more stringent cybersecurity measures has never been greater.