Power Hacker 2003/Power_Hacker_2003.iso/E-zine/Magazines/hir/hir8/hir8-5.txt

Text File | 2002-05-27 | 3.8 KB | 72 lines

Data Externalization in the Eyes of a Hacker

By Frogman



    Winn Schwartau spoke at the Def Con 6.0 conference in Las Vegas
in the Summer of 1998.  He also wrote the ground breaking book
Information Warfare, the second edition of which was released in 1996.
In his book grew the unclassified world's view of Information Warfare
and the three class breakdown of types.  Class 1 is personal warfare.
Class 2 is corporate.  Class 3 is global.  In each of these is a
particular phenomenon known as data externalization.  What this means
is that we have reached the point where accumulated knowledge exists
in a larger volume outside of our collective human minds than in.  The
number of books, manuals, recordings and other media add up to more
data than our own brains holdings.  This is a very scary, albeit
necessary, consequence of our current proliferation of information
systems.  To the enterprising hacker this provides both a distinct
advantage and disadvantage.

    Of the advantages, we can look at quite a few.  There are many
public and semi-public databases available for searching through
personal information.  This information is not exactly sensitive, but
can be used to steal an identity, aid guessing weak passwords,
compromise communication patterns, and a host of other, formerly more
difficult practices.  These databases can be grep'd and a nice precis
built.  Family history, employment records, legal records and other
types of data can also be found and compiled.  Using this information
in a Class 1 attack as a part of a larger Class 2 attack, a list of
corporate employees can be built.  This list can be expanded and
branched to give address, background, and personality profiles.  This
gives rise to identity theft, social engineering, and strait hacking.
The attacker can use the likely weak security held by a sub-
contractor's employees to access the communication network to the
larger corporation.  This is essentially piggy-backing into the
firewall from the identity of a trusted host.  The advantages to
social engineering are obvious, calling into a company, and asking
questions that lead to known data, from what should be a blind start.
The hacker can also use this data to bug an employee's home, and
communications equipment.  A cellular phone can easily have it's ESN
copied, and with a scanner and filtering software, a tail can listen
in on cellular conversations.  A laptop with a cellular modem suffers
the same attack.  The tail may not be necessary, if the attacker can
plant a mole or maybe a filter in the computers of the company
servicing the phone.  This would also break several security methods
used in PCS.

    Hopefully those advantages to the hacker are clear as to how an
unimportant Class 1 attack on an executive who works for Acme
Specialty Gaskets could be a role in the attack on Boeing and their
latest, greatest air superiority fighter, signaling the specter of a
Class 3 attack.

    The disadvantages include an added ease for being tracked, the
looming prospect of beefed security, and competition.  In most major
computing systems there are auditing systems.  Records are kept and
examined.  The use of an unexpected auditing system can pose an
extreme threat to the anonymity of a hacker.  A passive sniffer, or
even an inductive sniffer can be used by the hacker for a distinct
advantage, but the security office can place these type of monitors on
their own lines and have an invisible eye on the communications
systems.  The ease in which a database can be broken into will quickly
spread across the underground, and thus the security level will
eventually be brought into shape.

    These small insights are not the only prospects for a hack to
employ on their quest.  Those with malicious intent can easily bring
into fruition an underground TRW type of service for sale to the
highest bidding Info. Warrior.