|
|
Blackhat :
A black-hat is a term in computing for someone who compromises the security of a system without permission from an authorized party, usually with the intent of accessing computers connected to the network (the somewhat similar activity of defeating copy prevention devices in software — which may or may not be legal depending on the laws of the given country — is actually software cracking).
The term cracker was coined by Richard Stallman to provide an alternative to using the existing word hacker for this meaning.[1] Use of the term "cracker" is mostly limited (as is "black hat" to some areas of the computer and security field and even there is considered controversial. A definition of a group that calls themselves hackers refers to "a group that consists of skilled computer enthusiasts". The other, and more common usage, refers to those who attempt to gain unauthorized access to computer systems. Many members of the first group attempt to convince people that intruders should be called crackers rather than hackers, but the common usage remains ingrained.
Originally, all people with a high level of skills at computing were known as "hackers". Over time, the distinction between those perceived to use such skills with social responsibility and those who used them maliciously or criminally, became perceived as an important divide. Two terminologies developed: the former became known as "hackers" or (within the computer security industry) as white hats, and the latter as "crackers" or "black hats". The general public tends to use the term "hackers" for both types, a source of some conflict when the word is perceived to be used incorrectly. In computer jargon the meaning of "hacker" can be much broader.
Usually, a black hat is a person who uses their knowledge of vulnerabilities and exploits for private gain, rather than revealing them either to the general public or the manufacturer for correction. Many black hats promote individual freedom and accessibility over privacy and security[citation needed]. Black hats may seek to expand holes in systems; any attempts made to patch software are generally done to prevent others from also compromising a system they have already obtained secure control over. A black hat hacker may have access to 0-day exploits (private software that exploits security vulnerabilities; 0-day exploits have not been distributed to the public). In the most extreme cases, black hats may work to cause damage maliciously, and/or make threats to do so as blackmail.
Techniques for breaking into systems can involve advanced programming skills and social engineering, but more commonly will simply be the use of semi-automatic software, developed by others — often without understanding how the software itself works. Crackers who rely on the latter technique are often referred to as script kiddies. Common software weaknesses exploited include buffer overflow, integer overflow, memory corruption, format string attacks, race conditions, cross-site scripting, cross-site request forgery, code injection and SQL injection bugs.
The reference to colored hats comes from Hollywood’s use of hats in old black-and-white Western movies to help an audience differentiate between the good guys (white hats) and the bad guys (black hats).[citation needed] The 'hat' terms do not fall under common use. Even inside the computing field they are very controversial.
Hackeri foarte cunoscuti :
* Mark Zbikowski — In his senior year at Roeper, c. 1973/4, Zbikowski became known as one of the earliest computer crackers, after cracking the security system on Wayne State University's MTS (Michigan Terminal Service, developed at University of Michigan) mainframe for his own amusement. According to Zbikowski, when he offered to show the university how to fix the security leak, university officials threatened prosecution and offered him a job during the same meeting.
* Jonathan James (also known as c0mrade) made unauthorized copies of software controlling the International Space Station's life sustaining elements, and intercepted thousands of electronic messages relating to U.S. nuclear activities from the Department of Defense. Sentenced at age 16, he was the youngest cybercriminal ever incarcerated in the United States.
* Mark Abene (also known as Phiber Optik) — Inspired thousands of teenagers around the country to "study" the internal workings of the United States phone system. One of the founders of the Masters of Deception group.
* Dark Avenger — Bulgarian virus writer that popularized polymorphic code in 1992 as a means to circumvent the type of pattern recognition used by Anti-virus software, and nowadays also intrusion detection systems.
* Markus Hess — A West German, he hacked into United States Military sites and collected information for the KGB; he was eventually tracked down by Clifford Stoll.
* Adrian Lamo — Lamo surrendered to federal authorities in 2003 after a brief manhunt, and was charged with nontechnical but surprisingly successful intrusions into computer systems at Microsoft, The New York Times, Lexis-Nexis, MCI WorldCom, SBC, Yahoo!, and others. His methods were controversial, and his full-disclosure-by-media practices led some to assert that he was publicity-motivated.
* Vladimir Levin — This mathematician allegedly masterminded the Russian hacker gang that tricked Citibank's computers into spitting out $10 million. To this day, the method used is unknown.
* Kevin Mitnick — Held in jail without bail for a long period of time. Inspired the Free Kevin movement. Once "the most wanted man in cyberspace", Mitnick went on to be a prolific public speaker, author, and media personality. Mitnick Security Consulting, LLC is a full-service information security consulting firm.
* Robert Tappan Morris — In 1988 while a Cornell University graduate student was the writer of the first worm, Morris Worm, which used buffer overflows to propagate.
* Nahshon Even-Chaim (also known as Phoenix) — Leading member of Australian hacking group The Realm. Targeted US defense and nuclear research computer systems in late 1980s until his capture by Australian Federal Police in 1990. He and fellow Realm members Electron and Nom were the world's first computer intruders prosecuted based on evidence gathered from remote computer intercept.
* Kevin Poulsen — In 1990 Poulsen took over all telephone lines going into Los Angeles area radio station KIIS-FM to win an automobile in a call-in contest. Poulsen went on to a career in journalism, including several years as editorial director at SecurityFocus.
* David L. Smith — In 1999 Smith launched the Melissa Worm, causing $80 million dollars worth of damage to businesses. Originally sentenced to 40 years, he eventually served only 20 months when he agreed to work undercover for the FBI.
* Frank Lebron flooded many large P2P networks with trojans, viruses, and worms. Arrested and charged by the FBI.
WhiteHat :
A white hat hacker, also rendered as ethical hacker, is, in the realm of information technology, a person who is ethically opposed to the abuse of computer systems. Realization that the Internet now represents human voices from around the world has made the defense of its integrity an important pastime for many. A white hat generally focuses on securing IT systems, whereas a black hat (the opposite) would like to break into them — but this is a simplification as a black hat would wish to secure his own machine, and a white hat may have no issues breaking into it in the course of his or her activities.
Terminology
The term white hat hacker is also often used to describe those who attempt to break into systems or networks in order to help the owners of the system by making them aware of security flaws, or to perform some other altruistic activity. Many such people are employed by computer security companies; these professionals are sometimes called sneakers. Groups of these people are often called tiger teams.
The primary difference between white and black hat hackers is that a white hat hacker claims to observe the hacker ethic. Like black hats, white hats are often intimately familiar with the internal details of security systems, and can delve into obscure machine code when needed to find a solution to a tricky problem.
An example of a hack: Microsoft Windows ships with the ability to use cryptographic libraries built into the operating system. When shipped overseas this feature becomes nearly useless as the operating system will refuse to load cryptographic libraries that haven't been signed by Microsoft, and Microsoft will not sign a library unless the U.S. government authorizes it for export. This allows the U.S. government to maintain some perceived level of control over the use of strong cryptography beyond its borders.
While hunting through the symbol table of a beta release of Windows, a couple of overseas hackers managed to find a second signing key in the Microsoft binaries. That is, without disabling the libraries that are included with Windows (even overseas), these individuals learned of a way to trick the operating system into loading a library that hadn't been signed by Microsoft, thus enabling the functionality which had been lost to non-U.S. users.
Whether this is good or bad may depend on whether one respects the letter of the law, but is considered by some in the computing community to be a white hat type of activity. Some use the term grey hat or (very rarely) brown hat to describe someone on the borderline between black and white.
[edit] SEO
In recent years the terms white hat and black hat have been applied to the Search Engine Optimization (SEO) industry. Black hat SEO tactics, also called spamdexing, attempt to unfairly redirect search results to particular target pages, whereas white hat methods are generally approved by the search engines.
Cativa experti in securitate cunoscuti :
* Fyodor — Author of the open source Nmap Security Scanner, web site Insecure.Org, co-author of hacking novel How to Own A Continent, and founding member of the Honeynet Project.
* Mark Russinovich - Expert on Windows architecture and programming; noted for identifying the limited differences between Windows NT Server and Workstation, and discovering the 2005 Sony Rootkit software
* Johan "Julf" Helsingius — Operated the world's most popular anonymous remailer, the Penet remailer (called penet.fi), until he closed up shop in September 1996.
* Kevin Mitnick — A former blackhat computer criminal who now (since his release from prison in 2000) speaks, consults, and authors books about social engineering and network security.
* Tsutomu Shimomura — Shimomura helped catch Kevin Mitnick, the United States' most infamous computer intruder, in early 1994. He is the co-author of a book about the Mitnick case, Takedown: The Pursuit and Capture of Kevin Mitnick, America's Most Wanted Computer Outlaw-By the Man Who Did It (ISBN 0-7868-8913-6).
* Solar Designer — Founder of the Openwall Project.
* Michał Zalewski (lcamtuf) — Prominent security researcher and author of Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks (ISBN 1-59327-046-1).
* H. D. Moore - Author of the Metasploit penetration testing tool
* Stuart Thomas - Author of the V for Victory Pro bono public information security blog
GreyHat [Intre BlackHat si WhiteHat] :
A grey hat (or, in American english, gray hat) in the computer security community, refers to a skilled hacker who sometimes acts legally, sometimes in good will, and sometimes not. They are a hybrid between white and black hat hackers. They usually do not hack for personal gain or have malicious intentions, but may or may not occasionally commit crimes during the course of their technological exploits.
One reason a grey hat might consider himself to be grey might be to disambiguate from the other two extremes: black and white. It might be a little misleading to say that grey hat hackers do not hack for personal gain. While they do not necessarily hack for malicious purposes, grey hats do hack for a reason, a reason which more often than not remains undisclosed. A grey hat will not necessarily notify the sys admin of a penetrated system of their penetration. Such a hacker will prefer anonymity at almost all cost, carrying out their penetration undetected and then exiting said system undetected with minimal damages. Consequently, grey hat penetrations of systems tend to be for far more passive activities such as testing, monitoring, or less destructive forms of data transfer and retrieval.
A person who breaks into a computer system and simply puts their name there while doing no damage can also be classified as a grey hat.
#Sursa : http://wikipedia.org
|
|
