Hacker's Perspective (Offensive)
How They Hack
Crackers can use automated vulnerability scanners to probe networks known to have high-bandwidth Net connections, such as those at colleges and government institutions. Administrators at the University of California at Santa Barbara have confirmed that a computer in their network was used in the attack on Yahoo, and Stanford officials say a router in their system was among those used to target eBay (EBAY).
 
Millions of people now have cable modems or DSL Internet service, which means their computers are on the Internet 24 hours a day. And that means that any of these computers could be used in a Yahoo-style attack. A vandal could use the Internet to secretly install a hostile program on many home computers. Then with a typed command, he can have these machines bury a major Web site in data packets. So computer system crackers now hammer away at home machines with high-speed Web links, hoping to subvert them. John Johnson of Bell Atlantic - Verizon, which sells home DSL service, says his firm monitors data traffic in an effort to spot and block cracker activity.
 
The assaults that battered Yahoo! and eBay and a variety of major sites were brutally simple. There are programs that fire off streams of data packets like water from a fire hose. Just a few such streams would clobber a typical Web site, but the major outfits like Yahoo have multiple connections to the biggest Internet backbones. To swamp them with traffic, you need a multitude of high-speed data streams from a host of computers.
 
It's possible that a disgruntled technician at a large corporation could pull off such a stunt, using computers scattered around the company. But many experts fear that the attacking computers are located in many different organizations, and linked by one common trait - lousy Internet security.
 
For instance, in the recent attacks, the offensive program conceals itself. Every packet of data on the Internet comes with an address that's supposed to tell where it originated. In principle, the attacking computers should have been quickly identified and silenced. But a clever programmer can replace the real packet address with a fake one, making it nearly impossible to trace the source of the data. Thus a disgruntled employee could send a flood of anonymous nastiness from one his company's servers.
 
Phase I
  1. Acquire a Target
  2. Probe and Gather Information - Once a target is established, the hacker will acquire as much information as possible about the site. Tactics used include contacting the domain register, performing a ping sweep of the network, or even gathering information from an e-mail return header.
  3. Social Engineering - Calling the company directly to try to gather more information. Examples include: a) Calling employees within the company to inquire about the names of the IT staff or the software/hardware used at the company. b) Calling the help desk of the target company and saying, "Hello, I lost my password, can you reset to XXX?" c) Posing as a contractor or vendor and saying, "Yes, I work for Dell, can you direct me to your NOC."
  4. Research Findings - Once the hacker has gathered as much information as possible, they'll research their findings by visiting various web sites, chat groups, and IRC servers to gather more information and narrow down the possible entry points.
  5. Gain Initial Access - The hacker can visit sites such as rootshell.com that have libraries of pre-written hacks for various systems.
Phase II
  1. Escalate Privileges
  2. Remove Evidence
  3. Install back-doors
  4. Penetrate further into network escalating privileges and erasing tracks
In phase two, the hacker is basically covering his tracks and eliminating all signs of penetration.
 
Denial of Service (DoS) Attacks
On the Internet, a denial of service attack is an incident in which a user or organization is deprived of the services of a resource they would normally expect to have. Typically, the loss of service is the inability of a particular network service, such as e-mail, to be available or the temporary loss of all network connectivity and services. In the worst cases, for example, a Web site accessed by millions of people can occasionally be forced to temporarily cease operation. A denial of service attack can also destroy programming and files in a computer system. Although usually intentional and malicious, a denial of service attack can sometimes happen accidentally. A denial of service attack is a type of security breach to a computer system that does not usually result in the theft of information or other security loss. However, these attacks can cost the target person or company a great deal of time and money.