Attacks on passwords

Many computers or operating systems come with a preset superuser account and password. In many cases, several passwords are used for various superuser functions. The superuser may have a password to create accounts, a different password to control network functionality, another to conduct or access nightly backups, and so on. For a cracker, logging on to a system as the superuser is possibly the best way to collect data or to do damage. If the superuser has not changed an operating system’s preprogrammed password, the network is vulnerable to attack. Most crackers know these passwords, and their first attempt to break into a network is simply to try them. If an attacker cannot log on as the superuser, the next best thing might be to figure out the user name and password of a regular user.

It used to be standard practice in most colleges and universities, and in some commercial companies, to assign every student or employee an account with a user name and an initial password the same as the user name. Everyone was instructed to log on and change the password, but often, hackers and crackers logged on before legitimate users had a chance. In other cases, some people never actually used their accounts. Either way, intruders were able to gain access.

This "user name as password” system is still used on many campuses and corporate settings to this day. If the password of a particular user name is not the user name itself, crackers may try to guess the correct password. Guessing a password might be easy for an insider (such as a fellow employee), who probably knows everyone’s user name. It's common for people to use a spouse‘s name or a birthday as a password. Others write down their passwords, and a quick search of desk might yield the valuable information.

Some systems have a guest account, with a user name of ”guest” and a password of ”guest. ” But even if the intruder is not very good at guessing passwords, applications are available that automate exhaustive password searches. These applications, called password cracking software, are made by a variety of people for various reasons – some legitimate and others not so legitimate. To use one of these tools, the intruder needs access to your computer (network access may be sufficient).

Once connected, the hacker simply runs the password’s cracking application. If the password is weak, within minutes the hacker will have privileged access. One of a popular application is known as “l0phtCrack”. This application is designed to allow system administrators to test the passwords in use by their users. The idea is that if a sys admin can crack a password, so can crackers.

UNIT 8

Ex.1. Read and translate the text.

Hackers as social phenomenon in modern digital world

In computing, the term “hacker” denotes any highly skilled computer expert. Depending on the field of computing it has slightly different meanings, and in some contexts has controversial moral and ethical connotations¹. In its original sense, the term refers to a person in any of the communities and hacker subcultures:

- Hacker culture, an idea derived² from a community of enthusiast computer programmers and systems designers, in the 1960s around the Massachusetts Institute of Technology's (MIT's) Tech Model Railroad Club (TMRC) and MIT Artificial Intelligence Laboratory. The hobbyist home computing community focused on hardware in the late 1970s (e.g. the Homebrew Computer Club) and on video game software, software cracking, the demoscene in 1980s/1990s.

- Hacker (computer security). People involved with circumvention³ of computer security. This primarily concerns unauthorized remote computer break-ins via communication networks such as the Internet (Black hats), but also includes those who debug⁴ or fix security problems (White hats), and the morally ambiguous⁵ Grey hats.

Grey hats are hackers who are neither good nor bad. They sell both fixes and exploits. They mostly do it for personal gain and are usually associated with black hat hackers.

Black hats are hackers who use their knowledge for bad use. Going into people’s computers intrusions all with malicious intent for exploiting or stealing data.

White hats are great hackers employed with the efforts of keeping data safe from other hackers by looking for loopholes⁶ and hackable⁷ area. These types of hackers get a lot of money and no jail time due to contracts with the company which hired them and the police. They are more like cyber security guards but in the hacker world they are snitches⁸.

Today, mainstream usage of "hacker" mostly refers to computer criminals, due to the mass media usage of the word since the 1980s. This includes what hacker slang calls "script kiddies"⁹– people breaking into computers using programs written by others, with very little knowledge about the way they work. This usage has become so predominant that the general public is unaware that different meanings exist. While the self-designation¹⁰ of hobbyists as hackers is acknowledged by all three kinds of hackers, and the computer security hackers accept all uses of the word, people from the programmer subculture emphasize¹¹ the difference between the two by calling security breakers "crackers" (analogous to a safecracker).

Currently, "hacker" is used in two main conflicting ways:

- as someone who is able to subvert¹²computer security; if doing so for malicious purposes, the person can also be called a cracker.

- an adherent of the technology and programming subculture.

In the media, a “hacker” is in most cases a computer intruder or criminal. (For example, "An Internet 'hacker' broke through state government security systems in March.") In the computing community, the primary meaning is a complimentary description for a particularly brilliant programmer or technical expert. (For example, "Linus Torvalds, the creator of Linux, is considered to be a hacker.") A large segment of the technical community insists that this is the "correct" usage of the word.

The mainstream media's current usage of the term may be traced back to the early 1980s. When the term was introduced to wider society by the mainstream media in 1983, even those in the computer community referred to computer intrusion as "hacking", although not as the only use of that word. In reaction to the increasing media use of the term exclusively with the criminal connotation, the computer community began to differentiate their terminology. Alternative terms such as "cracker" were coined¹³ in an effort to distinguish between those adhering to the historical use of the term "hack" within the programmer community and those performing computer break-ins. Further terms such as "black hat", "white hat" and "gray hat" developed when laws against breaking into computers came into effect, to distinguish criminal activities from those which were legal.

However, since network news use of the term pertained¹⁴ primarily to the criminal activities despite this attempt by the technical community to preserve and distinguish the original meaning, the mainstream media and general public continue to describe computer criminals with all levels of technical sophistication as "hackers" and do not generally make use of the word in any of its non-criminal connotations. Members of the media sometimes seem unaware¹⁵ of the distinction, grouping legitimate "hackers" such as Linus Torvalds and Steve Wozniak along with criminal "crackers".

As a result of this difference, the definition is the subject of heated controversy. Many advocate¹⁶ using the more recent and nuanced alternate terms when describing criminals and others who negatively take advantage of security flaws in software and hardware. Others prefer to follow common popular usage, arguing that the positive form is confusing and unlikely to become widespread in the general public. A minority still use the term in both original senses despite the controversy, leaving context to clarify¹⁷ (or leave ambiguous) which meaning is intended.

However, the positive definition of hacker was widely used as the predominant form for many years before the negative definition was popularized. Now, however, many software designers in different industries prefer not to be referred to as 'Hacker' as the word “hack” holds a negative denotation¹⁸ in many of those industries.

A possible middle ground position has been suggested, based on the observation that "hacking" describes a collection of skills and tools which are used by hackers of both descriptions for different reasons. The analogy is made to locksmithing¹⁹, specifically picking locks, which is a skill which can be used for good or evil. Sometimes, hacker also is simply used synonymous to geek²⁰. A true hacker is not a group person. He's a person who loves to stay up all night, he and the machine in a love-hate relationship... They're kids who tended to be brilliant but not very interested in conventional goals… It's a term of derision and also the ultimate compliment."

Fred Shapiro thinks that "the common theory that 'hacker' originally was a benign term²¹ and the malicious connotations of the word were a later perversion²² is untrue." He found out that the malicious connotations were present at MIT in 1963 already (quoting The Tech, an MIT student newspaper) and then referred to unauthorized users of the telephone network, that is, the phreaker²³ movement that developed into the computer security hacker subculture of today.

NOTES

1. connotation – дополнительное значение слова (положительное или отрицательное)

2. derive – извлечь, произойти, вывести (из чего-либо)

3. circumvention – обман, уловка, обход (закона, правила)

4. debug – отлаживать, удалять баги (из программы)

5. ambiguous – двусмысленный, сомнительный, неясный, неоднозначный

6. loophole – лазейка (в программе)

7. hackable – уязвимый для хакеров

8. snitch – доносчик, осведомитель

9. script kiddy – хакер – дилетант

10. self-designation – самоназвание

11.emphasize–выделять, делать акцент

12.subvert – свергать, низвергать, разрушать

13.coin – отчеканить, оттиснуть, (зд.) создать новое понятие, слово

14.pertain – принадлежать, относиться, подлежать

15.unaware – не знающий, не осознающий, не подозревающий

16.advocate – отстаивать, защищать, поддерживать

17.clarify – освещать, разъяснять

18.denotation – значение (слова, понятия)

19.locksmithing – слесарные работы (по вскрыванию замков)

20.geek – зануда, умник, чудак

21. benign term – безобидный, (безвредный) термин

22. perversion – искажение, ложное толкование

23. phreaker (или phreak)– телефонный мошенник

Ex.2 Find English equivalents in the text.

Первоначальный смысл; злодейское намерение; удаленный взлом компьютера; субкультура программистов; уровень технического совершенствования; члены компьютерного сообщества; вскрывание замков; отношения любви-ненависти.

Ex.3. Match pairs of synonyms in the columns below.

1. controversial

2. distinguish

3. confuse

4. adherent

5. collection

6. jargon

7. goal

8. resent

9. variety

10. derision

A. member

B. rebel

C. mockery

D. purpose

E. multitude

F. debatable

G. differentiate

H. set

I. mix

J. slang

Ex.4. Learn the following expressions by heart.

To focus on computer hardware; to insist on terms; to prefer to (do smth); to be introduced to; to follow the instructions; to be based on; to be widely used; to be involved in (smth); to acknowledge the fact; to argue with smb; to advocate the movement; to emphasize on smth; to refer to; to suggest the idea; to clarify the meaning.

Ex.5. Make up a sentence with each of the expressions from Ex.4:

e.g. Our company has always been focusing on the quality of our software.

Ex.6. Give explanation to the following expressions. Use dictionary, if necessary:

e.g. computer intrusion – the penetration into a computer or computer system by means of special software for mostly offensive objectives.

1. debug the system –

2. white hat hacker –

3. black hat hacker –

4. gray hat hacker –

5. self-designation –

6. locksmithing –

7. script kiddy –

8. snitch –

9. phreaker –

10. movement of people –

Ex.7. Answer the questions.

1. How did the hacker subculture appear?

2. Why does the word Hacker have negative connotation?

3. What are the other terms for a Hacker and why have they been made up?

4. What is hacking compared to in the text? And why?

5. What is your opinion about hackers? Express it in 3-4 sentences.

6. Would you like to be a hacker yourself? Why?

7. Was this text useful for you? Why?

Ex.8. Translate the following text.