What is Ethical Hacking and Types of Hackers? Free Essay Example

Introduction

After the computers and smart devices become more and more common, lots of our daily activities are undertaking on computers or smart devices. The method of banking turns from queuing in front of the teller desk to few taps on the smart devices. The way we contact our family or friends get more efficiency with instant calls, online messages or video chat replace with dialog phone calls or letters. Technology changing our living style in 21st century, it makes our life easier, more convenient but also more vulnerable.

We can write
your paper for you

100% original

24/7 service

50+ subjects

Order Now

Privacy, security and identification become the most concern topic on Internet which come with the efficiency of Internet. A low level technical knowledge teenage can break into victim’s computer and exposure the victim’s privacy. A skilled hacker can compromise a enterprise’s computer, cause the secret business data leaks to competitors for financial gain. In order to prevent or mitigate this types of damage, ethical hacking play the important roles contribute the effort on defending.

Type of hackers (Candice Lanier, 2018)

White Hat

White Hat hacker is also called ethical hacker, who use their skills and knowledge to defend individuals, business or government’s system or network free of attack. Ethical hackers not only find out the vulnerabilities that hacker would use for attacking, they also help improving the security level of target system, also educate people how to secure themself online.

Black Hat

Black Hat hacker is the typical malicious hacker who will compromise systems or network with purposes or even just for fun.

Black Hat hackers are skilled computer users who use known or unknown exploitation, vulnerabilities to breach individual or even government system. The major difference between White Hat hacker and Black Hat hacker is permission. White Hat hackers testing target system or network environment with permission what Black Hat hackers do not have.

Grey Hat

Grey Hat hackers are doing the mix of White Hat and Black Hat. They might hack a system and tell the owner what vulnerabilities they found (White Hat behaviour) or they also could just publicize those vulnerabilities (Black Hat behavior). A better example will be a White Hat is doing network defencing work during day time, and he also hack some other system for purpose.

Script Kiddie

As the technology grow rapidly, the skill requirement for hacking is not much needed as before. A normal computer user can download hacking tool online and watch the demonstration online and apply them in real life. Script Kiddie is a group of low skilled computer users want to perform hacking for fun and not willing to progress their skill.

Hacktivist

Hacktivist is a group of different level skill computer users, who use hacking for what they think is right. The famous hacker group “anonymous” is the typical Hacktivist group. The group members from all over the world and use hacking as weapon to right what they think is wrong. They don’t choose particular target but events help them define the target. It is hard to say whether they are good or bad but what they do is illegal.

State Sponsored Hacker

State Sponsored Hacker is a group of very skilled computer professionals hired by the government. They attack target according to the order from the employer. This type of hackers have the most resources and technology for their activities. The famous former CIA officer Edward Snowden disclosed that US government intercepting the whole world’s information (Ewen MacAskill and Alex Hern, 2018). This happens to all other countries as well.

Malicious Insider

This is the disgruntled employees, they either hired by the business competitors or not happy about what their organization operate. They can easily access to the internal network, and just need to plant or plug the malware to the network then can compromise the network, steal information or damage servers.

Financial Damage caused by Hacker

“Creeper” (Kaspersky, 2019), the world’s first computer virus created in 1971 for testing purpose. It was used to testify if the program can self-replicating with the message “I’M THE CREEPER. CATCH ME IF YOU CAN!”. In the early age of computer virus, the computer virus creators’ intention was to proof their ability or play jokes to the world. The famous worm “ILOVEYOU” written by Microsoft Visual Basic Script infected one tenth computers worldwide in 2000 (KeriLynn Engel, 2019). Even the creator claimed the worm leaked by accident but it still caused estimate about 15 billion dollars monetary damage. The below is the chart shows the financial damage by cyber crime from 2001 to 2017 (statista, July 2018).

As we can see, the financial damage by the cyber crime in 2017 was almost 80 times than in 2001 up to 1418.7 million dollars. It was predicted there will be about $6 trillion dollar damage annually by cyber crime by 2021 (Cybersecurity Ventures, 2017). Cybercrime becomes more and more crucial topic and there is a way to prevent or mitigate it which is ethical hacking.

Purpose of Ethical Hacking

Ethical hacking is a procedure what a group of security professionals try to break into target system in order to determine the weakness of the target system (OpenCampus, 2019). Ethical hackers are hired by organization, use predefined methodologies testing the particular targets with target’s permission. The advantage of ethical hackers than organization information security officers are: they will try to compromise the system with the techniques the hackers will normally use. This will help simulating what if the real attack occurs, the result will indicate the vulnerabilities that the target system has. With the report, organization information security officers can either patch up or fix up mos of the problem that enhance the security level of the organization. World known organization Facebook fined £500,000 in 2018 for two breaches of the Data Protection Act 1998 which 50 million users’ information accessed by hackers. (Alex Hern and David Pegg, 2018). And it could get even worse if Facebook found to breach the General Data Protection Regulation (GDPR) in the European Union, the maximum fine of $1.63 billion dollars (Arjun Kharpal, 2018). With proper ethical hacking, which might prevent this happen again.

Type of Ethical Hacking

Web Application Hacking (OpenCampus, 2019)

Web application is the bridge between the Internet users and the web server. The web page normally is in HTML form and generated by the web server, it presented to the online users through Hypertext Transfer Protocol (HTTP). The hacking can begins with the either the client side vulnerabilities or the server side and launch the attack. The common methodologies of web application hackings are: parameter tampering, unvalidated inputs and directory traversal attack.

Parameter tampering is like using different parameter when the data transferring between the website and clients. In this order to activate SQL injection attack or XSS attack. This method is similar to the unvalidated inputs attack. When the client enter unvalidated data and aim for buffer overflow or system crash or any type of web server malfunctioning.

System Hacking (OpenCampus, 2019)

It is the typical hacking that the public can think of. Hack particular system with known password, brute force or any method for accessing to the system. And then escalating privileges, means level up the hacker’s right to root user or administrator level which allow them to execute program. And then the hacker will download the Trojan he need to create the tunnel that allow the hacker to get into the system again in the future. The final purpose of this attack maybe copying files, deleting files, destruct system or financial gain like get into victim’s online bank account or credit card.

Web Server Hacking (OpenCampus, 2019)

Web server used to host website running under different type of operating system. The operating system can be Windows, Linux or OS X and also connect to a database used for connect to websites. There are few types of database: Oracle, MySQL, DB2 and etc. Because the web server has multiple functionalities, which could have different vulnerabilities or exploitations. There are few kinds of attack could happen on web server:

DOS attack, the method of this attack is sending a big volume of service requests to the web server. The amount of request is more than either the web server can handle or the bandwidth can load. In this case, the web server will not respond to any other legitimate user anymore

Website Defacement, it is similar to the unvalidated input attack. Once the hacker finds the input fields with no error handling function, the hacker will enter the database command or script to gain information from the database

Directory Traversal attack, it is when the hacker get to the web server’s root directory from the website or application. Once the hacker get beyond web root directory and able to execute OS commands. This will led the hacker to the web server operating system information. That will get more information than just on the surface of the web application.

Misconfiguration attack, when the web server administrator not disable the unnecessary services. It might leave the exploitation of the service for the hacker to attack. Same as if the web server administrator leave the default setting, which might allow the hacker to check the default password or use tools to crack the password, thus get access into the web server.

Phishing Attack, links in the phishing email or malicious websites could make the users believe that is legitimate website and give out their personal information. And the malicious website will forward the victim’s information to the hacker.

Hacking Wireless Networks (OpenCampus, 2019)

While every home has WIFI nowaday, hack is easy to find lots of target around him. There are few types of attack related to WIFI attack: Evil Twin attack, the attacker would set up a wireless access point near the target network. The attacker’s wifi name SSID set to the same as the victim’s one. Once anyone try to connect to the attacker’s wifi and they will give out the proper login information

Jamming Signals, this type of attack is similar to the DDos attack which will bring down the victim’s Wifi network instead of using it. This is called creating noise. It can be physically jamming or service jamming. Physical one is using a physical device that generate signals that interfere or cover victim’s Wifi signal. Which disable the victim for connecting to their Wifi. The services method is like sends large amount of service request to the Wifi provider router which is more than it can handle. Thus stop the router respond to the legitimate users.

Social Engineering (OpenCampus, 2019)

Social Engineering is convincing victim to give out their sensitive personal information, which hacker taking advantage of basic human nature of trust. There are three types of social engineering:

1. Human-based
2. Mobile-based
3. Computer-based

There are lots way of social engineering can used physically by human error: Impersonation, tailgating, piggybacking, dumpster diving, eavesdropping and shoulder surfing.

The Mobile-based and Computer-based is like chatting with the victim and earn trust from the victim, develop the relationship with the victim then thus exploit their relationship like some secret information.

Penetration Testing Approaches (INFOSEC, 2019)

White box testing

White box hacking is simulating a hacking happen inside the organization. In this testing type, the ethical hacker will get organization’s internal information as a normal employee, like computer login account, email, wifi password and etc. Then the ethical hackers use the known information for hacking. This type of hacking is to test whether the internal employee could use the vulnerabilities to escalate privileges and access to the data they not supposed to.

Black box testing

As the name black, the ethical hacker will not given any internal information of the target organization. This is simulating the outside world hackers attacking who only has the target but nothing else. In this testing, which could find out if there is any firewall vulnerabilities, website exploitation or anything exists which allow the hackers get access to the target organization internal network.

Grey box testing

This approach is mixed with black box and white box testing. The tester will be provided with limited information about the target organization. This is simulating the outsider attack as well as black box testing. Which we can consider as employee’s friend or organization’s business competitor attack. Which is also intend to find out any exploitation that hackers can get into the internal network.

Ethical Hacking Procedures (Harpreet Passi, 2018)

Agreement phase

Before the ethical hacking or penetration testing, between the ethical hacker and the client would need to set the detail agreement about the testing. It would include what methodologies going to use, the target of testing, which type of testing, the time / place for testing, any backup plan if the testing cause any damage to the client company. And agreement is the major difference between ethical hacker and black hat hacker, permission is the first priority for ethical hacking.

Planning and reconnaissance

At this stage, the ethical hacker will gather the related information given by the client according to the testing type. Information like IP addresses, servers information, network topology, username, password or etc. After that, ethical hacker need to plan for the whole ethical hacking procedures with details. Normally ethical hacker would spend most of the time for planning, the more detail the plan the easier or safer the ethical hacking will be.

Scanning

This phase is where the ethical hacker launches the testing. The target for the scanning includes: ports, devices, network, operation systems. All this scanning used to identify the vulnerabilities.

Gaining access

Once the ethical hacker find the vulnerabilities, the next step is aiming for access to the target. System, firewall, secured zone, server or any devices can help ethical hacker get access to the target network would be used. The ethical hacker need to try and find the big vulnerability that enough for him to get access to the real target.

Maintain access

After the ethical hacker get access to the target system, it need to maintain the access even after the target system rebooted. Trojan or remain open port or any other methods would help maintain the access.

Exploitation

For ethical hacker, they will record down the exploitation which could damage the target system. For real hacker, they will launch the attack from here.

Evidence collection and report generation

The ethical hacker will collect all the information about: vulnerabilities, how hacker can use the information for attack. And also what impact could happen if it really get attack.

Conclusion

For all the above information, we realise the importance of ethical hacking. As the technology rapidly grow, ethical hacking play the more critical role in society. It also create more related jobs in the market.

Reference

1. Kaspersky, 2019, “A Brief History of Computer Viruses & What the Future Holds”. Retrieved [08/May/2019] from: https://www.kaspersky.com/resource-center/threats/a-brief-history-of-computer-viruses-and-what-the-future-holds
2. Statista, July 2018, “Amount of monetary damage caused by reported cyber crime to the IC3 from 2001 to 2017”, Retrieved [08/May/2019] from: https://www.statista.com/statistics/267132/total-damage-caused-by-by-cyber-crime-in-the-us/
3. KeriLynn Engel, Feb 2019, “Which Computer Viruses Caused The Most Damage Around The World?”, Retrieved [08/May/2019] from: https://www.whoishostingthis.com/blog/2015/06/01/8-worst-viruses/
4. Cybersecurity Ventures, Oct 2017, “Cybercrime Damages $6 Trillion By 2021”, Retrieved [08/May/2019]
5. OpenCampus, 2018, “Who is an ethical hacker? ”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/who-is-ethical-hacker
6. Alex Hern and David Pegg, 11 July 2018, “Facebook fined for data breaches in Cambridge Analytica scandal”, Retrieved [08/May/2019] from: https://www.theguardian.com/technology/2018/jul/11/facebook-fined-for-data-breaches-in-cambridge-analytica-scandal
7. Arjun Kharpal, 2 Oct 2018, “Facebook could face up to $1.6 billion in fines over data breach as regulators eye formal probe”, Retrieved [08/May/2019] from: https://www.cnbc.com/2018/10/02/facebook-data-breach-social-network-could-face-eu-fine.html
8. Candice Lanier, 13 July 2018, “The Types of Hackers & Why They Hack”, Retrieved [08/May/2019] from: https://www.bleepingcomputer.com/news/security/the-types-of-hackers-and-why-they-hack/
9. Ewen MacAskill and Alex Hern, 4 June 2018, “Edward Snowden: ‘The people are still powerless, but now they’re aware’”, Retrieved [08/May/2019] from: https://www.theguardian.com/us-news/2018/jun/04/edward-snowden-people-still-powerless-but-aware
10. OpenCampus, 2019, “Web Application Hacking”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/web-application-and-its-types-of-attacks
11. OpenCampus, 2019, “System hacking”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/goals-of-system-hacking
12. OpenCampus, 2019, “Web server hacking”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/web-server-and-its-types-of-attacks
13. OpenCampus, 2019, “Wifi hacking”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/wi-fi-attacks
14. OpenCampus, 2019, “Social Engineering”, Retrieved [08/May/2019] from: https://www.greycampus.com/opencampus/ethical-hacking/social-engineering-and-its-attacks
15. OpenCampus, 2019, “Penetration Testing”, Retrieved [08/May/2019] from: https://www.greycampus.com/blog/information-security/penetration-testing-step-by-step-guide-stages-methods-and-application