Background Information
Hacking appeared nearly as soon as computers became accessible to the general public. In the 1980s, people began to experiment with the capabilities of these systems. Even then, companies began to leverage hackers’ expertise by hiring them to develop security countermeasures (Holt & Bossler, 2020). It was quickly discovered that this technology can be used to obtain data illegally, especially credit card numbers and similar information.
In the late 1990s, wire transfers became a prominent issue that drew a new wave of attention to hackers, while viruses began spreading through networks (Holt & Bossler, 2020). Identity theft, extortion, and other problems led to the rise of cybersecurity firms. Social engineering also started to gain traction due to employees’ lack of knowledge regarding hackers’ pathways, leading to the largest breaches in history in the late 2000s (Holt & Bossler, 2020). Modern digital crimes are more sophisticated than ever due to a continuous arms race between security systems and criminals.
Similarly, phreaking was a major problem during the development of long-distance communication lines. The first incidents occurred in the 1960s, when telephony became available to the general public but remained widely inaccessible due to its high costs (Holt & Bossler, 2020). At that time, prototypes of telephone line equipment were developed, and in the early 1970s, they evolved into a tool called the Blue Box that controlled the network (Gehl & Lawson, 2022).
This notion caused panic among operators, whose losses due to phishing grew rapidly. Eventually, this system-exploitation format became obsolete in 1983, as companies began to improve their protective measures (Gehl & Lawson, 2022). However, many phreakers switched to using personal computers for a similar goal.
Malicious Actors’ Motivation, Purpose, and Methods
Hackers are often motivated by greed, entertainment, or political views. Nowadays, many such incidents occur because businesses store digital information that can be used to blackmail them or sell to competitors. It is worth mentioning that experimentation and the desire to be the first to breach a protected network are among the primary reasons for hacking (Holt & Bossler, 2020).
The purpose of such actions is often either revenge or personal gain. These criminals’ methods are highly diverse and include social engineering, exploitation of vulnerabilities, viruses, phishing, packet sniffing, and similar tactics (Holt & Bossler, 2020). In the United States, there are severe hacking consequences stemming from the Counterfeit Access Device and Computer Fraud and Abuse Act, which is now covered by many policies (Holt & Bossler, 2020). Punishments can range from up to 20 years in prison if U.S. government systems are targeted, to up to 10 years if private entities are extorted using such methods.
Among recent notable hacking incidents, one stands out due to its cause. An attack on HBGary in 2011 provides an example of activists’ actions against a firm whose Chief Executive Officer, Aaron Barr, attracted unwanted attention (Dorter, 2023). The motivation was to mock the organization due to its leader’s unsubstantiated claims and his desire to become famous by capitalizing on sensationalism. This business was targeted by Anonymous, whose members brought its website down, gained root access to all data, and posted it online to laugh at this cybersecurity firm’s inadequacy.
In turn, phreakers were not striving for goals akin to those of many modern-day hackers. It was a hobby for many technology enthusiasts who wanted to connect with others rather than do damage to the system. They have built a community around this idea, where the inherent competitiveness of its members led to the desire to outdo others (Gehl & Lawson, 2022). Therefore, their main purpose was to understand the system underlying telephony. These individuals primarily relied on devices that controlled the frequencies of telephone tones to activate particular network paths (Gehl & Lawson, 2022).
When phreaking became widespread, it attracted law enforcement’s attention. However, the firms themselves rapidly shut it down, resulting in no notable punishments for phreakers except for Dresler, who was arrested for 5 years for fraud (Gehl & Lawson, 2022; Kressin, 2023). The situation with Dresler, who used the Blue Box to call the Vatican, arose out of curiosity about technology and only furthered people’s interest in the subject.
Tools and Vulnerabilities Used by Hackers
In the aforementioned incident, hackers exploited the company’s poor database protection. An SQL injection attack was carried out against HBGary’s servers, allowing Anonymous to gain complete control over the firm’s digital space and to obtain all data stored online (Hofesh, 2022). The exploited vulnerability lay in the company’s content management system (CMS). It was susceptible to input injections, allowing users to modify its database without authorization (Hofesh, 2022). SQL statements that go through such CMSs are processed with admin rights, which HBGary did not account for.
Tools and Vulnerabilities Used by Phreakers
As mentioned above, phreakers used the Blue Box, a device that modified tones sent to a telephone company’s central system. Dressler invented this tool alongside other phreakers and used a 2600Hz whistling sound to convince the system that the call had either been successfully paid for or ended (Kressin, 2023). He exploited this vulnerability through different devices by comprehending how the company’s devices communicated their status.
Types of Hackers
These criminals can be divided into categories based on the intent of their actions. These individuals can pursue financial gain, political activism, system testing, revenge, or entertainment (Holt & Bossler, 2020). The first type often targets protected data to force firms to pay hackers to prevent leaks or sell that information to competitors. The second group is more nuanced, as these individuals often target data systems of organizations whose actions they deem detestable or oppose their worldview (Holt & Bossler, 2020).
Furthermore, some cybersecurity agencies hire such people to test the systems they create. Personal vendetta is also a common cause of such criminal acts, often committed by disgruntled employees against their employers (Holt & Bossler, 2020). Finally, some hackers seek exploits, bring down websites, or share private data publicly to cause chaos.
Cybersecurity Tips
An organization can protect its confidential information by understanding the types of vulnerabilities in its systems. Malware programs, such as trojans and key-loggers, are a common type of attack that can be prevented by keeping software and hardware up to date and using an antivirus solution (Holt & Bossler, 2020). Employees who can access their firm’s internal network must also learn to recognize hackers’ attempts to obtain sensitive data. Since requesting a password is easier than breaking encryption, people must understand that sharing such information is strictly prohibited without following cybersecurity protocols (Gehl & Lawson, 2022).
Training courses on social engineering and how to resist it are highly recommended for all companies with a digital environment that provides private access. Finally, databases can also be targeted by malicious actors. To protect them, a firm must use a trusted provider for its digital storage and rely on IT specialists to structure queries so they do not lead to illicit manipulation (Hofesh, 2022). Businesses that follow these tips can minimize their risks of being targeted by most such criminals.
References
Dorter, Ş. S. (2023). A for Anonymous V for viral: Analyzing online activism through carnivalesque and politics of spectacle. RumeliDE Journal of Language and Literature Studies, (37), 1131-1143.
Gehl, R. W., & Lawson, S. T. (2022). Social engineering: How crowdmasters, phreaks, hackers, and trolls created a new form of manipulative communication. MIT Press.
Hofesh, B. (2022). SQL injection attack: How it works, examples, and prevention. Bright Security.
Holt, T. J., & Bossler, A. M. (2020). The Palgrave Handbook of International Cybercrime and Cyberdeviance. Palgrave Macmillan.
Kressin, J. (2023). Hall of Fame: Captain Crunch. Search Guard.