Further information: Timeline of computer security hacker history
The subculture around such hackers is termed network hacker subculture, hacker scene, or computer underground. It initially developed in the context of phreaking during the 1960s and the microcomputer BBS scene of the 1980s. It is implicated with 2600: The Hacker Quarterly and the alt.2600 newsgroup.
In 1980, an article in the August issue of Psychology Today (with commentary by Philip Zimbardo) used the term "hacker" in its title: "The Hacker Papers." It was an excerpt from a Stanford Bulletin Board discussion on the addictive nature of computer use. In the 1982 film Tron, Kevin Flynn (Jeff Bridges) describes his intentions to break into ENCOM's computer system, saying "I've been doing a little hacking here." CLU is the software he uses for this. By 1983, hacking in the sense of breaking computer security had already been in use as computer jargon,8 but there was no public awareness about such activities.9 However, the release of the film WarGames that year, featuring a computer intrusion into NORAD, raised the public belief that computer security hackers (especially teenagers) could be a threat to national security. This concern became real when, in the same year, a gang of teenage hackers in Milwaukee, Wisconsin, known as The 414s, broke into computer systems throughout the United States and Canada, including those of Los Alamos National Laboratory, Sloan-Kettering Cancer Center and Security Pacific Bank.10 The case quickly grew media attention,11 and 17-year-old Neal Patrick emerged as the spokesman for the gang, including a cover story in Newsweek entitled "Beware: Hackers at play", with Patrick's photograph on the cover.12 The Newsweek article appears to be the first use of the word hacker by the mainstream media in the pejorative sense.
Pressured by media coverage, congressman Dan Glickman called for an investigation and began work on new laws against computer hacking.1314 Neal Patrick testified before the U.S. House of Representatives on September 26, 1983, about the dangers of computer hacking, and six bills concerning computer crime were introduced in the House that year.15 As a result of these laws against computer criminality, white hat, grey hat and black hat hackers try to distinguish themselves from each other, depending on the legality of their activities. These moral conflicts are expressed in The Mentor's "The Hacker Manifesto", published 1986 in Phrack.
Use of the term hacker meaning computer criminal was also advanced by the title "Stalking the Wily Hacker", an article by Clifford Stoll in the May 1988 issue of the Communications of the ACM. Later that year, the release by Robert Tappan Morris, Jr. of the so-called Morris worm provoked the popular media to spread this usage. The popularity of Stoll's book The Cuckoo's Egg, published one year later, further entrenched the term in the public's consciousness.
In computer security, a hacker is someone who focuses on the security mechanisms of computer and network systems. Hackers can include someone who endeavors to strengthen security mechanisms by exploring their weaknesses and also those who seek to access secure, unauthorized information despite security measures. Nevertheless, parts of the subculture see their aim in correcting security problems and use the word in a positive sense. White hat is the name given to ethical computer hackers, who utilize hacking in a helpful way. White hats are becoming a necessary part of the information security field.16 They operate under a code, which acknowledges that breaking into other people's computers is bad, but that discovering and exploiting security mechanisms and breaking into computers is still an interesting activity that can be done ethically and legally. Accordingly, the term bears strong connotations that are favorable or pejorative, depending on the context.
Subgroups of the computer underground with different attitudes and motives use different terms to demarcate themselves from each other. These classifications are also used to exclude specific groups with whom they do not agree.
Eric S. Raymond, author of The New Hacker's Dictionary, advocates that members of the computer underground should be called crackers. Yet, those people see themselves as hackers and even try to include the views of Raymond in what they see as a wider hacker culture, a view that Raymond has harshly rejected. Instead of a hacker/cracker dichotomy, they emphasize a spectrum of different categories, such as white hat, grey hat, black hat and script kiddie. In contrast to Raymond, they usually reserve the term cracker for more malicious activity.
According to Ralph D. Clifford, a cracker or cracking is to "gain unauthorized access to a computer in order to commit another crime such as destroying information contained in that system."17 These subgroups may also be defined by the legal status of their activities.18
Main article: White hat (computer security)
A white hat hacker breaks security for non-malicious reasons, either to test their own security system, perform penetration tests or vulnerability assessments for a client, or while working for a security company that makes security software. The term is generally synonymous with ethical hacker, and certifications, courseware, classes, and online training covering the diverse arena of ethical hacking have been developed.19
Main article: Black hat (computer security)
A black hat hacker is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" (Moore, 2005).20 The term was coined by Richard Stallman, to contrast the maliciousness of a criminal hacker versus the spirit of playfulness and exploration in hacker culture, or the ethos of the white hat hacker who performs hacking duties to identify places to repair or as a means of legitimate employment.21 Black hat hackers form the stereotypical, illegal hacking groups often portrayed in popular culture, and are "the epitome of all that the public fears in a computer criminal".22
Main article: Grey hat
A grey hat hacker lies between a black hat and a white hat hacker, hacking for ideological reasons.23 A grey hat hacker may surf the Internet and hack into a computer system for the sole purpose of notifying the administrator that their system has a security defect, for example. They may then offer to correct the defect for a fee.24 Grey hat hackers sometimes find the defect in a system and publish the facts to the world instead of a group of people. Even though grey hat hackers may not necessarily perform hacking for their personal gain, unauthorized access to a system can be considered illegal and unethical.
A social status among hackers, elite is used to describe the most skilled. Newly discovered exploits circulate among these hackers. Elite groups such as Masters of Deception conferred a kind of credibility on their members.25
Main article: Script kiddie
A script kiddie (also known as a skid or skiddie) is an unskilled hacker who breaks into computer systems by using automated tools written by others (usually by other black hat hackers), hence the term script (i.e. a computer script that automates the hacking) kiddie (i.e. kid, child an individual lacking knowledge and experience, immature),26 usually with little understanding of the underlying concept.
A neophyte ("newbie", or "noob") is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology and hacking.27
Main article: BlueHat
A blue hat hacker is someone outside computer security consulting firms who is used to bug-test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.282930
Main article: Hacktivist
A hacktivist is a hacker who utilizes technology to publicize a social, ideological, religious or political message.
Hacktivism can be divided into two main groups:
Intelligence agencies and cyberwarfare operatives of nation states.31
Groups of hackers that carry out organized criminal activities for profit.32 Modern-day computer hackers have been compared to the privateers of by-gone days.33 These criminals hold computer systems hostage, demanding large payments from victims to restore access to their own computer systems and data.34 Furthermore, recent ransomware attacks on industries, including energy, food, and transportation, have been blamed on criminal organizations based in or near a state actor – possibly with the country's knowledge and approval.35 Cyber theft and ransomware attacks are now the fastest-growing crimes in the United States.36 Bitcoin and other cryptocurrencies facilitate the extortion of huge ransoms from large companies, hospitals and city governments with little or no chance of being caught.37
Main article: Computer security
Hackers can usually be sorted into two types of attacks: mass attacks and targeted attacks.38 They are sorted into the groups in terms of how they choose their victims and how they act on the attacks.39
A typical approach in an attack on Internet-connected system is:
In order to do so, there are several recurring tools of the trade and techniques used by computer criminals and security experts.
Main article: Exploit (computer security)
A security exploit is a prepared application that takes advantage of a known weakness.41 Common examples of security exploits are SQL injection, cross-site scripting and cross-site request forgery which abuse security holes that may result from substandard programming practice. Other exploits would be able to be used through File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), PHP, SSH, Telnet and some Web pages. These are very common in Web site and Web domain hacking.
Tools and Procedures
Main article: List of computer criminals
Main article: List of hackers
The computer underground55 has produced its own specialized slang, such as 1337speak. Writing software and performing other activities to support these views is referred to as hacktivism. Some consider illegal cracking ethically justified for these goals; a common form is website defacement. The computer underground is frequently compared to the Wild West.56 It is common for hackers to use aliases to conceal their identities.
Main articles: Hacker conference and Hacker group
The computer underground is supported by regular real-world gatherings called hacker conventions or "hacker cons". These events include SummerCon (Summer), DEF CON, HoHoCon (Christmas), ShmooCon (February), Black Hat Conference, Chaos Communication Congress, AthCon, Hacker Halted, and H.O.P.E. Local Hackfest groups organize and compete to develop their skills to send a team to a prominent convention to compete in group pentesting, exploit and forensics on a larger scale. Hacker groups became popular in the early 1980s, providing access to hacking information and resources and a place to learn from other members. Computer bulletin board systems (BBSs), such as the Utopias, provided platforms for information-sharing via dial-up modem. Hackers could also gain credibility by being affiliated with elite groups.57
Maximum imprisonment is one year or a fine of the fourth category.58
18 U.S.C. § 1030, more commonly known as the Computer Fraud and Abuse Act, prohibits unauthorized access or damage of "protected computers". "Protected computers" are defined in 18 U.S.C. § 1030(e)(2) as:
The maximum imprisonment or fine for violations of the Computer Fraud and Abuse Act depends on the severity of the violation and the offender's history of violations under the Act.
The FBI has demonstrated its ability to recover ransoms paid in cryptocurrency by victims of cybertheft.59
Main category: Hacker magazines
The most notable hacker-oriented print publications are Phrack, Hakin9 and 2600: The Hacker Quarterly. While the information contained in hacker magazines and ezines was often outdated by the time they were published, they enhanced their contributors' reputations by documenting their successes.60
See also: List of fictional hackers
Hackers often show an interest in fictional cyberpunk and cyberculture literature and movies. The adoption of fictional pseudonyms,61 symbols, values and metaphors from these works is very common.62
Gao, Xing (2015). "Information security investment for competitive firms with hacker behavior and security requirements". Annals of Operations Research. 235: 277–300. doi:10.1007/s10479-015-1925-2. S2CID 207085416. /wiki/Doi_(identifier) ↩
Winkler, Ira. Spies Among Us: How to Stop the Spies, Terrorists, Hackers, and Criminals You Don't Even Know You Encounter Every Day. John Wiley & Sons. 2005. pg. 92. ISBN 9780764589904. /wiki/ISBN_(identifier) ↩
Sterling, Bruce (1993). "Part 2(d)". The Hacker Crackdown. McLean, Virginia: IndyPublish.com. p. 61. ISBN 1-4043-0641-2. 1-4043-0641-2 ↩
"The Hacker's Dictionary". Archived from the original on November 8, 2020. Retrieved May 23, 2013. http://jargon-file.org/archive/jargon-1.5.0.dos.txt ↩
Political notes from 2012: September–December Archived December 9, 2012, at the Wayback Machine. stallman.org. http://stallman.org/archives/2012-sep-dec.html#06_December_2012_%28Ecuadorian_white_hat_cracker_freed%29 ↩
Raymond, Eric S. "Jargon File: Cracker". Archived from the original on June 29, 2011. Retrieved May 8, 2010. Coined ca. 1985 by hackers in defense against journalistic misuse of hacker. http://catb.org/jargon/html/C/cracker.html ↩
Yagoda, Ben (March 6, 2014). "A Short History of 'Hack'". The New Yorker. Archived from the original on November 10, 2015. Retrieved June 21, 2019. Although Lifehacker and other neutral or positive applications of the word [hack] are increasingly prominent, the black-hat meaning still prevails among the general public. http://www.newyorker.com/tech/elements/a-short-history-of-hack ↩
See the 1981 version of the Jargon File Archived April 2, 2018, at the Wayback Machine, entry "hacker", last meaning. http://www.catb.org/jargon/oldversions/jarg1-81-MM-DD.txt ↩
"Computer hacking: Where did it begin and how did it grow?". WindowSecurity.com. October 16, 2002. Archived from the original on January 16, 2013. Retrieved September 6, 2015. http://www.windowsecurity.com/whitepapers/Computer_hacking_Where_did_it_begin_and_how_did_it_grow_.html ↩
Elmer-DeWitt, Philip (August 29, 1983). "The 414 Gang Strikes Again". Time. p. 75. Archived from the original on December 2, 2007. https://web.archive.org/web/20071202043840/http://www.time.com/time/magazine/article/0,9171,949797,00.html ↩
"Beware: Hackers at play". Newsweek. September 5, 1983. pp. 42–46, 48. ↩
"Timeline: The U.S. Government and Cybersecurity". Washington Post. May 16, 2003. Archived from the original on November 16, 2018. Retrieved April 14, 2006. https://www.washingtonpost.com/wp-dyn/articles/A50606-2002Jun26.html ↩
Bailey, David (April 1984). "Attacks on Computers: Congressional Hearings and Pending Legislation". 1984 IEEE Symposium on Security and Privacy. Oakland, CA, USA: IEEE. pp. 180–186. doi:10.1109/SP.1984.10012. ISBN 978-0-8186-0532-1. S2CID 15187375. Archived from the original on June 24, 2024. Retrieved July 21, 2023. 978-0-8186-0532-1 ↩
Caldwell, Tracey (July 22, 2011). "Ethical hackers: putting on the white hat". Network Security. 2011 (7): 10–13. doi:10.1016/s1353-4858(11)70075-7. /wiki/Doi_(identifier) ↩
Clifford, D. (2011). Cybercrime: The Investigation, Prosecution and Defense of a Computer-Related Crime. Durham, North Carolina: Carolina Academic Press. ISBN 978-1594608537. 978-1594608537 ↩
Wilhelm, Douglas (2010). "2". Professional Penetration Testing. Syngress Press. p. 503. ISBN 978-1-59749-425-0. 978-1-59749-425-0 ↩
Moore, Robert (2005). Cybercrime: Investigating High Technology Computer Crime. Matthew Bender & Company. p. 258. ISBN 1-59345-303-5.Robert Moore 1-59345-303-5 ↩
O'Brien, James; Marakas, George (2011). Management Information Systems. New York, NY: McGraw-Hill/ Irwin. pp. 536–537. ISBN 978-0-07-752217-9. 978-0-07-752217-9 ↩
Moore, Robert (2006). Cybercrime: Investigating High-Technology Computer Crime (1st ed.). Cincinnati, Ohio: Anderson Publishing. ISBN 978-1-59345-303-9. 978-1-59345-303-9 ↩
Okpa, John Thompson; Ugwuoke, Christopher Uchechukwu; Ajah, Benjamin Okorie; Eshioste, Emmanuel; Igbe, Joseph Egidi; Ajor, Ogar James; Okoi, Ofem, Nnana; Eteng, Mary Juachi; Nnamani, Rebecca Ginikanwa (September 5, 2022). "Cyberspace, Black-Hat Hacking and Economic Sustainability of Corporate Organizations in Cross-River State, Nigeria". SAGE Open. 12 (3): 215824402211227. doi:10.1177/21582440221122739. ISSN 2158-2440. S2CID 252096635.{{cite journal}}: CS1 maint: multiple names: authors list (link) https://doi.org/10.1177%2F21582440221122739 ↩
Thomas, Douglas (2002). Hacker Culture. University of Minnesota Press. ISBN 978-0-8166-3346-3. 978-0-8166-3346-3 ↩
Andress, Mandy; Cox, Phil; Tittel, Ed – (2001). CIW Security Professional. New York, NY: Wiley. p. 638. ISBN 0-7645-4822-0. 0-7645-4822-0 ↩
"Blue hat hacker Definition". PC Magazine Encyclopedia. Archived from the original on March 8, 2013. Retrieved May 31, 2010. A security professional invited by Microsoft to find vulnerabilities in Windows. https://web.archive.org/web/20130308110959/http://www.pcmag.com/encyclopedia_term/0%2C2542%2Ct%3Dblue+hat+hacker%26i%3D56321%2C00.asp ↩
Fried, Ina (June 15, 2005). "Blue Hat summit meant to reveal ways of the other side". Microsoft meets the hackers. CNET News. Archived from the original on December 3, 2013. Retrieved May 31, 2010. /wiki/Ina_Fried ↩
Markoff, John (October 17, 2005). "At Microsoft, Interlopers Sound Off on Security". The New York Times. Archived from the original on December 19, 2014. Retrieved May 31, 2010. /wiki/John_Markoff ↩
Chabrow, Eric (February 25, 2012). "7 Levels of Hackers: Applying An Ancient Chinese Lesson: Know Your Enemies". GovInfo Security. Archived from the original on December 31, 2018. Retrieved February 27, 2012. https://www.govinfosecurity.com/blogs.php?postID=1206&rf=2012-02-27-eg ↩
Egloff, Florian. Cybersecurity and the Age of Privateering. In: Understanding Cyber Conflict: Fourteen Analogies, Chapter 14, George Perkovich and Ariel E. Levite, Eds., Georgetown University Press, 2017. https://carnegieendowment.org/files/GUP_Perkovich_Levite_UnderstandingCyberConflict_Ch14.pdf ↩
Tidy, Joe. Ransomware: Should paying hacker ransoms be illegal? Archived May 21, 2021, at the Wayback Machine BBC 20 May 2021. https://www.bbc.com/news/technology-57173096 ↩
Morrison, Sara. What you need to know about ransomware and the future of cyberattacks Archived June 19, 2021, at the Wayback Machine. Vox, Jun 16, 2021. https://www.vox.com/recode/22527272/ransomware-cyberattacks-bitcoin-explained ↩
Abigail Summerville, Protect against the Fastest-Growing Crime: Cyber Attacks Archived June 23, 2021, at the Wayback Machine, CNBC (July 25, 2017). https://www.cnbc.com/2017/07/25/stay-protected-from-the-uss-fastest-growing-crime-cyber-attacks.html ↩
Myre, Greg. How Bitcoin Has Fueled Ransomware Attacks. Archived June 19, 2021, at the Wayback Machine NPR, June 10, 2021. https://www.npr.org/2021/06/10/1004874311/how-bitcoin-has-fueled-ransomware-attacks ↩
Dey, Debabrata; Lahiri, Atanu; Zhang, Guoying (2011). "Hacker Behavior, Network Effects, and the Security Software Market". SSRN Electronic Journal. doi:10.2139/ssrn.1838656. ISSN 1556-5068. https://dx.doi.org/10.2139/ssrn.1838656 ↩
Gupta, Ajay; Klavinsky, Thomas and Laliberte, Scott (March 15, 2002) Security Through Penetration Testing: Internet Penetration Archived July 3, 2019, at the Wayback Machine. informit.com http://www.informit.com/articles/article.aspx?p=25916 ↩
Rodriguez, Chris; Martinez, Richard. "The Growing Hacking Threat to Websites: An Ongoing Commitment to Web Application Security" (PDF). Frost & Sullivan. Retrieved August 13, 2013. https://www.htbridge.com/publication/the_growing_hacking_threat_to_websites.pdf ↩
Kerner, Sean Michael. "Sentry MBA Uses Credential Stuffing To Hack Sites." Eweek (2016): 8. Academic Search Complete. Web. 7 Feb. 2017. ↩
Weir, Matt, Sudhir Aggarwal, Breno de Medeiros, Bill Glodek. 2009. "Password Cracking Using Probabilistic Context-Free Grammars". 2009 30th IEEE Symposium on Security and Privacy: 391-405. ↩
Thompson, Samuel T. C. "Helping The Hacker? Library Information, Security, And Social Engineering." Information Technology & Libraries 25.4 (2006): 222-225. Academic Search Complete. Web. 7 Feb. 2017. ↩
Press, EC-Council (2011). Penetration Testing: Procedures & Methodologies. Clifton, NY: CENGAGE Learning. ISBN 978-1435483675. 978-1435483675 ↩
"DEF CON III Archives - Susan Thunder Keynote". DEF CON. Archived from the original on April 20, 2019. Retrieved August 12, 2017. https://www.defcon.org/html/defcon-3/defcon-3.html ↩
Hafner, Katie (August 1995). "Kevin Mitnick, unplugged". Esquire. 124 (2): 80. Archived from the original on May 15, 2019. Retrieved August 13, 2017. http://www.tomandmaria.com/ST297/Readings/mitnick%20esquire.htm ↩
"Gary McKinnon extradition ruling due by 16 October". BBC News. September 6, 2012. Archived from the original on August 7, 2019. Retrieved September 25, 2012. https://www.bbc.co.uk/news/uk-19506090 ↩
"Community Memory: Precedents in Social Media and Movements". Computer History Museum. February 23, 2016. Archived from the original on July 3, 2019. Retrieved August 13, 2017. http://www.computerhistory.org/atchm/community-memory-precedents-in-social-media-and-movements/ ↩
"Kevin Mitnick sentenced to nearly four years in prison; computer hacker ordered to pay restitution ..." (Press release). United States Attorney's Office, Central District of California. August 9, 1999. Archived from the original on September 26, 2009. Retrieved April 10, 2010. https://web.archive.org/web/20090926231348/http://www.usdoj.gov/criminal/cybercrime/mitnick.htm ↩
Holt, Thomas J.; Schel, Bernadette Hlubik (2010). Corporate Hacking and Technology-Driven Crime: Social Dynamics and Implications. IGI Global. p. 146. ISBN 9781616928056. 9781616928056 ↩
"British teenager who 'cyber-terrorised' US intelligence officials gets two years detention Archived June 14, 2018, at the Wayback Machine". The Independent. 21 April 2018. https://www.independent.co.uk/news/uk/british-teen-hacker-kane-gamble-us-intelligence-officials-jailed-cia-fbi-a8315126.html ↩
"British teen Kane Gamble accessed accounts of top US intelligence and security officials Archived June 21, 2018, at the Wayback Machine". Deutsche Welle. 21 January 2018. http://www.dw.com/en/british-teen-kane-gamble-accessed-accounts-of-top-us-intelligence-and-security-officials/a-42230614 ↩
"Kane Gamble: Teenager with autism on Leicestershire housing estate took classified information by fooling people into thinking he was FBI boss Archived July 19, 2019, at the Wayback Machine". The Independent. 21 January 2018. https://www.independent.co.uk/news/uk/crime/us-intelligence-cia-fbi-american-government-john-brennan-mark-giuliano-crackas-with-attitude-latest-a8170561.html ↩
Jordan, Tim; Taylor, Paul A. (2004). Hacktivism and Cyberwars. Routledge. pp. 133–134. ISBN 978-0-415-26003-9. Wild West imagery has permeated discussions of cybercultures. 978-0-415-26003-9 ↩
Thomas, Douglas (2003). Hacker Culture. University of Minnesota Press. p. 90. ISBN 978-0-8166-3346-3. 978-0-8166-3346-3 ↩
Artikel 138ab Archived February 2, 2015, at the Wayback Machine. Wetboek van Strafrecht, December 27, 2012 http://wetten.overheid.nl/BWBR0001854/TweedeBoek/TitelV/Artikel138ab/geldigheidsdatum_27-12-2012 ↩
Nakashima, Ellen. Feds recover more than $2 million in ransomware payments from Colonial Pipeline hackers. Archived June 19, 2021, at the Wayback Machine Washington Post, June 7, 2021. https://www.washingtonpost.com/business/2021/06/07/colonial-pipeline-ransomware-payment-recovered/ ↩
Swabey, Pete (February 27, 2013). "Data leaked by Anonymous appears to reveal Bank of America's hacker profiling operation". Information Age. Archived from the original on April 19, 2016. Retrieved February 21, 2014. http://www.information-age.com/it-management/risk-and-compliance/123456840/data-leaked-by-anonymous-appears-to-reveal-bank-of-america-s-hacker-profiling-operation ↩
"Hackers and Viruses: Questions and Answers". Scienzagiovane. University of Bologna. November 12, 2012. Archived from the original on June 10, 2016. Retrieved February 21, 2014. http://www.scienzagiovane.unibo.it/English/hackers/6-faq.html ↩
Staples, Brent (May 11, 2003). "A Prince of Cyberpunk Fiction Moves Into the Mainstream". The New York Times. Archived from the original on October 13, 2016. Retrieved February 20, 2017. Mr. Gibson's novels and short stories are worshiped by hackers https://www.nytimes.com/2003/05/11/opinion/editorial-observer-a-prince-of-cyberpunk-fiction-moves-into-the-mainstream.html ↩