The Golden Age of Hacking

Based on everything we know, this truly seems to be the golden age of hacking.

To sum things up, it is a great time to be a hacker. Because there are so many

possible systems to break into and most of them have such weak security,

attackers can pick and choose which machines to go after. To make matters

worse, most companies have insufficient

information or resources to track these attackers, so even if they are detected,

their chances of getting caught are slim. No one polices the Internet, and in terms of

knowledge and experience, attackers have the upper hand. Not only is it a good

time to be a hacker, but it is a good time to be a security professional. There is

plenty of work and a whole lot of challenges ahead.

A recent and well-known example of hacking attacks happened in February of 2000.

Several large sites on the Internet were attacked within in a short period of time. The

type of attack was a distributed Denial of Service attack in which company web sites

became unreachable to legitimate users. From a business perspective, this had a large

impact on the victim companies. For one company, an online bookstore, the attack

resulted in lost revenue—not only did the company lose sales, but it lost customers.

Let’s look at an example. If a customer, intending to buy something online, tries to

connect to a company’s web site at 10:00 p.m. and the web browser displays the

message “Web Site Unavailable,” he might try back at 10:45 p.m. When the customer

tries again at 11:30 p.m. and still receives the same message, more than likely, the

customer will go to a competitor to buy the product. With the amount of competition on

the Internet, if a customer cannot access a site in a matter of seconds, he will quickly

give up and go to a different site.

Ironically, companies were so afraid of the Y2K problem that they dumped large sums of

money into fixing it. In several cases, it seemed like a waste because the problem was

overestimated and hyped by the media. Now there is a problem far worse, but companies

are looking the other way. They do not want to invest the money.

There are several reasons why so many companies are vulnerable, but one of the main

reasons is lack of awareness. Companies have not realized and still do not realize the

threat. One of my goals in writing this book is to make people aware of the threat and

the tools that exist to protect their sites. Ignorance is deadly, but knowledge is power. If

an attacker breaks into your house with an arsenal of guns and you have no weapons,

you cannot defend yourself. On the other hand, if you are properly trained on weapons

and know the limitations of the weapons the intruder is using, you have an upper hand.

Giving IT professionals the tools and techniques attackers use to break into sites, equips them with the proper defenses.