2KKUU7ita

32
Part I: Building the Foundation for Ethical Hacking
Hacking in the name of liberty?
Many hackers exhibit behaviors that contradict
their stated purposes — that is, they fight for
civil liberties and want to be left alone, while
at the same time, they love prying into the business
of others and controlling them in any way
possible. Many hackers call themselves civil
libertarians and claim to support the principles
of personal privacy and freedom. However,
they contradict their words by intruding on the
privacy and property of others. They often steal
the property and violate the rights of others, but
are willing to go to great lengths to get their
Whether or not they want to, most executives now have to deal with all
the state, federal, and international laws and regulations that require notifications
of breaches or suspected breaches of sensitive information. This
applies to external hacks, internal breaches, and even something as seemingly
benign as a lost mobile device or backup tapes. Appendix A contains
URLs to the sites giving information security and privacy laws and regulations
that may affect your business.
Planning and Performing Attacks
Attack styles vary widely:
own rights back from anyone who threatens
them. It’s live and let live gone awry.
The case involving copyrighted materials and
the Recording Industry Association of America
(RIAA) is a classic example. Hackers have gone
to great lengths to prove a point, from defacing
the websites of organizations that support
copyrights to illegally sharing music by using
otherwise legal mediums like Kazaa, Gnutella,
and Morpheus. Go figure.
✓ Some hackers prepare far in advance of an attack. They gather small
bits of information and methodically carry out their hacks, as I outline in
Chapter 4. These hackers are the most difficult to track.
✓ Other hackers — usually the inexperienced script kiddies — act before
they think through the consequences. Such hackers may try, for example,
to telnet directly into an organization’s router without hiding their identities.
Other hackers may try to launch a DoS attack against a Microsoft
Exchange server without first determining the version of Exchange or the
patches that are installed. These hackers usually are caught.
✓ Malicious users are all over the map. Some can be quite savvy based
on their knowledge of the network and of how IT operates inside the
organization. Others go poking and prodding around into systems they
shouldn’t be in — or shouldn’t have had access to in the first place —
and often do stupid things that lead security or network administrators
back to them.