Hacking & Hackers

Hacking refers to activities that seek to compromise digital devices, such as computers, smartphones, tablets, and even entire networks. In other words, hacking is identifying weakness in computer systems or networks to exploit its weaknesses to gain access. Businesses need to protect themselves against such attacks.

Hacking is typically technical but hackers can also use social engineering to trick the user into clicking on a malicious attachment or providing personal data. Besides social engineering, common hacking techniques include:

Botnets
Browser hijacks
Denial of service (DDoS) attacks
Ransomware
Rootkits
Trojans
Viruses
Worms

We have described about most of these techniques in this post.

Hackers are usually skilled computer programmers with knowledge of computer security.

Note: Hacking is illegal. The only purpose of hacking is to secure networks, and think like a hacker to be able to secure networks.

Motives and Goals

There are five main motivations and goals for hackers today:

Financial gain: It is most common motivation for hacking. This hacking seeks Victim financial information. The victim can be an individual, a company, an organization or a government. This type of hacking usually involves the following cyber attacks:

Phishing
Social engineering
Password cracking
Keyloggers & other malware

Gaining street cred and burnishing victim’s reputation.
Corporate espionage: One company’s hackers seek to steal information on a competitor’s products and services. A company could try to break into a competitor’s network or database to steal confidential information, business plans, communications, and financial data.
Espionage / counterintelligence / sabotage / counter-sabotage operations between countries, governments, political parties and terrorist organizations: For example, foreign hackers could leak internal government documents and communications to the public.
Ego Hacking: Hackers like to break into websites, computers, and systems simply to prove that they can.

Types of Hackers According to the Intent of Their Actions

Black hat hacker: He/she is a person that does so for stealing something valuable or other malicious reasons. This hacker can have any of the five motives mentioned in the previous section. These hackers are also called cracker. In fact, cracker is a hacker that becomes expert at accessing password-protected computers, files, and networks.
White hat hacker: This hacker tries to improve the security of an organization’s security systems by finding vulnerable flaws so that he/she can prevents identity theft or other cyber-crimes. Some organizations and almost all governments try to hire these types of hackers. These hackers are also called ethical Hacker. In fact, Ethical hackers are experts who work in agreement with organizations in order to uncover security vulnerabilities.
Gray hat hacker: These hackers use their skills to break into systems and networks without permission but instead of wreaking criminal havoc, they might report their discovery to the target owner. It can be said that this hacker has the same motive as the white hat hackers, but he/she uses the methods of black hat hackers. That is why he/she is called the gray hat. In other words, this hacker breaks into computer systems without authority with a view to identify weaknesses and reveal them to the system owner. Anyway, the difference between a grey hat hacker and an ethical hacker, however, is that grey hats don’t have permission to do this ahead of time.
Blue Hat Hackers: Theses hackers look for loopholes that can be exploited and try to close these gaps. These hackers usually operate independently and are not hired by any company, organization or government.
Red Hat Hackers: These hackers are often on the level of hacking government agencies, top-secret information hubs, and generally anything that falls under the category of sensitive information.
Script kiddies: A non-skilled person who uses scripts, malware, exploits, and other hacking tools developed by others to attack an endpoint or network.
Hacktivist: A hacker who use hacking to send social, religious, and political, etc. messages. Hacktivism, a combination of the words “hacker” and “activism”. For example, a hacktivist group might seek to disrupt financial networks used by terrorists. Anyway, Hacktivism is illegal.
Phreaker: A hacker who identifies and exploits weaknesses in telephones instead of computers.
Elite Hackers: These are the privileged and aristocratic class of hackers. Newly discovered exploits will circulate among these hackers.

Ethical Hacking

Hacking can lead to loss of business for organizations that deal in finance. Ethical hacking puts them a step ahead of the cyber criminals. It requires becoming a near-expert in several different technologies and platforms, as well as an intrinsic desire to see if something can be broken into past the normally presented boundaries.

Ethical hackers must abide by the following rules.

Get written permission from the owner of the computer system and/or computer network before hacking.
Protect the privacy of the organization been hacked.
Transparently report all the identified weaknesses in the computer system to the organization.
Inform hardware and software vendors of the identified weaknesses.

Ethical Hacking sometimes called as Penetration Testing.

Source: guru99.com

5 top Ethical Hacking Courses and Certifications

Certified Ethical Hacker: The EC-Council’s Certificate Ethical Hacker (CEH) is easily the oldest and most popular penetration course and The official course, which can be taken online or with a live in-person instructor, contains 18 different subject domains including traditional hacking subjects, plus modules on malware, wireless, cloud and mobile platforms. The full remote course includes six months of access to the online Cyber Range iLab, which will allow students to practice over 100 hacking skills. Sitting for the CEH certification requires taking an official course or, if self-study, proof of two years of relevant experience or education. It contains 125 multiple-choice questions with a four-hour time limit. Taking the exam requires accepting the EC-Council’s Code of Ethics, which was one of the first required codes of ethics required of computer security test takers. The courseware and testing is routinely updated.
SANS GPEN: SysAdmin, Networking, and Security (SANS) Institute is a highly respected training organization, and anything they teach along with their certifications are greatly respected by IT security practitioners. The official course for the GPEN, SEC560 (Network Penetration Testing and Ethical Hacking) can be taken online or live in-person. The GPEN exam has 115 questions, a three-hour time limit, and requires a 74 percent score to pass. No specific training is required for any GIAC exam. The GPEN is covered on GIAC’s general code of ethics, which they take very seriously.
Offensive Security Certified Professional: The Offensive Security Certified Professional (OSCP) course and certification has gained a well-earned reputation for toughness with a very hands-on learning structure and exam. The official online, self-paced training course is called Penetration Testing with Kali Linux and includes 30 days of lab access. Because it relies on Kali Linux, participants need to have a basic understanding of how to use Linux, bash shells and scripts. The OSCP is known for pushing its students and exam takers harder than other pen testing paths.
Foundstone Ultimate Hacking: McAfee’s Foundstone business unit was one of the first hands-on penetration testing courses available. Today, Foundstone offers a host of training options well beyond just pen testing, including forensics and incident response. Additionally, Foundstone offers training in hacking internet of things (IoT), firmware, industrial control security systems, Bluetooth and RFID. Foundstone instructors are often real-life pen testers and security consultants.
CREST: CREST’s mission is to educate and certify quality pen testers. All CREST-approved exams have been reviewed and approved by the UK’s Government Communication Headquarters (GCHQ), which is analogous to the United States’ NSA. CREST’s basic pen testing exam is known as the CREST Registered Tester (or CRT), and there are exams for web and infrastructure pen testers. Exams and costs vary by country. CREST test takers must review and acknowledge the CREST Code of Conduct. The Offensive Security OSCP certification can be used to obtain the CRT.

This section is abbreviated from csoonline.com

Ethical Hacking Jobs

Ethical hacking is maturing. Today, Employers are looking for the complete professional hacker — both in practice and the toolsets they use.

Better toolkits: Penetration or vulnerability testing software has always been a part of the ethical hacker’s toolkit.
Picture, Slide deck and Video: Today, senior management wants slide decks, videos or animations of how particular hacks were performed in their environment. They use it not only to sell other senior managers on particular defenses but also as part of employee education.
Risk management: Professional penetration testers must work with IT management to identify the biggest and most likely threats. Penetration testers are now part of the risk management team, helping to efficiently reduce risk even more so than just pure vulnerabilities.

This section is abbreviated from csoonline.com