Re: Hacking
Dartboy wrote:If I have someones I.P Address can I hack there computer?
An IP address is similar to a real world address in that your question is like asking "if I have a bank's address can I rob it?" and the answer is: it depends.
The IP address is just a network address to a computer. Usually, you can't compromise the computer without a vulnerability on it.
Quote:This is purely a question out of interest to increase my knowledge of computers, I am not planning to hack anyone or anything, I just read a book where it was done and wodner if that was how it was done in real life and how exactly people hack people.
In the past, hackers were often curious people such as yourself (albeit with much more knowledge on the subject) who hacked for the challenge.
Today, hacking is largely automated and commercial. Within the last 6 years the hacking landscape is now dominated by:
Phishing: this is a social engineering hack where scammers trick people into giving them information (such as their paypal login to use a common example).
Automated Vulnerability Scanning: infected computers now often run programs that attempt to infect random computers. They send the attacks at every IP they can discover and hope that they get through on an unpatched computer (e.g. a computer without much security and that is not updated with the latest security fixes).
Drive by malware install: when there are security bugs in the browsers, attacks will often surface where visiting a page will cause an exploit. The payload is usually just spyware but can be anything if the exploit grants root access.
Data encryption blackmail: here malware is placed on a compromised computer that encrypts the user's files and blackmails them for the key. e.g. "You have two days to send us $100 or we delete all your photos."
There are a lot of other things going on but those are some of the most prevalent. And they are often paired or chained. For example, maybe the browser exploit will do the data blackmail. Or maybe it will install a keystroke logger and do the identity theft fraud gig.
But here's what you really need to know: you can't just hack through anything. No matter how good the hacker they need a hole. In the past everything had a lot of holes and hackers were the curious geeks who knew enough to find them but now all of this is automated and any kid can find the exploits online. They can then try using them (they are called "script kiddies" when they do, as they understand nothing about it but can sometimes hack someone just by copying and pasting a script) but the surface of attack changes with every patch.
So modern hacking means bot nets and a lot of automated attempts to get an old unpatched box every now and then. Because of all boring repetitive work it's no longer the realm of creative curious folk. After all, it's boring to have a script try an exploit over and over on random computers. So now it's dominated by scammers and thieves who do it for money.
contrex wrote:Nobody is going to tell you on here, just like nobody is going to tell you how cars are stolen or how drugs are made. Like, duh.
Why don't you just say you don't know anything about it instead of claiming nobody else will talk about this? This is a legitimate field of study and how computer security experts are born.
"Security through obscurity" doesn't work and just about all the major players in the tech world have long understood this by now.
Responsible disclosure is now the widely accepted practice.
Rockhead wrote:
I'm not the brightest bulb in the box, but what is the point of edumacating or attracting wannabe "hackers"...
Because the information is all out there and pushed out there to help people patch their boxes. And because most of the security experts were wannabe hackers at some time.
I have only once hacked a server that was not mine, but in my youth I was always very curious about it. This led to a lot of knowledge about how to stop it (which is more fun and more challenging since you have to be right all the time and they only have to be right once) and this has served me well in my work.
This kid isn't going to learn exactly how to hack anything here unless we start posting simple exploits and even then it would only work on systems without their updates. Hacking isn't like what most people imagine and just about all the information is out there in simple exploit scripts and proof of concept code.
For any of it to work, the computer can't be patched. And the information is pushed out there to get the security patches. So the only real dangerous information is a zero day exploit. That is, a way to compromise a computer that is published (or used) before any patch is made.
The responsible hackers follow this procedure:
1) Find hole.
2) Notify the vendor (e.g. Microsoft) about the hole
3) Give the vendor a reasonable chance to patch the code
4) Publish the exploit. This often happens with the blessing of the vendor, as the larger ones have learned to credit the security researchers (i.e. hackers).
This is a important field of study and he's not going to become dangerous by learning any of these basics to hacking. All the very explicit detail is already all over the net. Not just in the hacking world but on famous security sites.
Dartboy wrote:Thanks for all the answers, They help me out abit, one more question
Next question :
Can I hack webcams with I.Ps?
Same as the above question. We already asked if you could break into a bank with their street address, now you are asking if you can break into a TV station with theirs.
No. Breaking in requires a hole (like an unlocked door) or brute force (like a dictionary attack). And the thing is, in modern applications if you can get in at all it's considered to have a hole most of the time.
So the basic way to understand this is that you can only get in if they didn't lock the door. Today hacking isn't about picking a target and getting through. That would just be lucky. It usually means scanning random computers and finding one with a door open.
It doesn't take much skill, it just takes an unpatched computer. And computers like that, without security patches, firewalls or whatnot are being hacked within minutes by the big bot nets anyway.
Malicious hacking doesn't usually take much skill. It basically consists of finding a computer without the hole patched. It's not about being good enough to get in (like in the dramatization of hacking), it's about the computer being wide open and finding it.