Perimeter

10/29/2014
02:12 PM
John Trobough
John Trobough
Commentary
100%
0%

Infographic: The Many Faces of Todays Hackers

How many of these hacker personas are you dueling with in your organization?

Almost every day, we hear about a new security breach, but who’s behind these attacks? Whether you’re dealing with the “professional mercenary,” the “cyber warrior” or the “malicious insider,” cyberhackers come in many shapes and sizes. They have access to a varying set of resources and utilize a broad range of attacks to steal valuable information or cause business disruption. As a result, it’s crucial that organizations understand the motivations, sophistication, and potential impacts of hackers.
 
As part of National Cyber Security Awareness Month, Narus, a cyber security data analytics company, developed an infographic to give organizations a better understanding of today’s hackers -- from the general types of hackers that enterprises often face to the types of attacks they’re most likely to deploy. No enterprise can guarantee 100% security across all parts of the business. There are too many gaps at the perimeter, and sadly hackers have all the time they need to work around defenses and exploit these gaps.

Who are the hacker personas you are battling? Let's chat about them in the comments.

Click here for a larger image.

John Trobough is the President and CEO of Narus. He brings more than 20 years of operations and international experience in the telecommunications and mobile software industries to the company. He is leading the Narus team to establish its cyber innovation presence in Silicon ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
11/4/2014 | 3:12:49 PM
Re: The Cracker
@savoiadilucania  

Hmm, you raise a good point - I should have chosen my wording more carefully.  That said (and I say this as someone who was born before 1980 and got involved in tech thanks to these individuals), I still think the overall attitude of this group doesn't fit the infographic presented, and is also an often under-acknowledged and too loosely labeled body of people.  Look at me, I should know better and even I lumped everyone together without noting that the labels themselves are NOT synonymous with "criminal" necessarily :-) It's actually the cutting edge attitude that I personally love about the tech underground, hackers/crackers/makers alike.  But I stand corrected, regardless - how would you add to the infographic such that it more closely represents the full ecosystem of cyber criminals across the spectrum?
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
11/4/2014 | 3:12:49 PM
Re: The Cracker
@savoiadilucania  

Hmm, you raise a good point - I should have chosen my wording more carefully.  That said (and I say this as someone who was born before 1980 and got involved in tech thanks to these individuals), I still think the overall attitude of this group doesn't fit the infographic presented, and is also an often under-acknowledged and too loosely labeled body of people.  Look at me, I should know better and even I lumped everyone together without noting that the labels themselves are NOT synonymous with "criminal" necessarily :-) It's actually the cutting edge attitude that I personally love about the tech underground, hackers/crackers/makers alike.  But I stand corrected, regardless - how would you add to the infographic such that it more closely represents the full ecosystem of cyber criminals across the spectrum?
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
11/4/2014 | 2:08:55 PM
Re: Great List!
@RobertMcDougal: "The Cyber Warrior on this infographic is the representation of the state actors such as the Chinese and Russians.  The connotation of the name 'Cyber Warriror' just doesn't seem to fit to me...".

Fully agree! The "warrior" term is played out, even in the context of soldiers. It seems these adversaries would be most appropriately labeled "Nation State Actors".
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
11/4/2014 | 2:06:26 PM
Re: The Cracker
@ChristianBryant: "In fact, there are dozens of labels, including packet monkey, toolkit newbies, phreaks, cyber-punks - you name it; the key is, they all share a similar anarchistic/chaotic approach to the hack. They most likely have no interest in money, politics, social reform or what have you - they are simply there to seek, break in and destroy."

As a member of the early underground New York City telephony "phreak" scene, I can tell you we never had anarchistic, chaotic, or even antagonistic intentions behind our actions. We were simply looking for creative outlets for our technical aptitude. And we liked calling our friends for free.

 
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
10/31/2014 | 5:57:31 PM
Re: The Cracker
@Robert McDougal - Script kiddies are a subset, certainly, but that is why I discuss the wide range of skills and intelligence.  In fact, there are dozens of labels, including packet monkey, toolkit newbies, phreaks, cyber-punks - you name it; the key is, they all share a similar anarchistic/chaotic approach to the hack.  They most likely have no interest in money, politics, social reform or what have you - they are simply there to seek, break in and destroy.  It's my differentiation from the classes noted in the article.  The cockroaches of the cyber crime underground, if you will.  There you go:  Cyber Roaches
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
10/31/2014 | 5:26:23 PM
Re: The Cracker
This sounds alot like my definition of a script kiddie.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
10/31/2014 | 5:24:56 PM
Great List!
This is a fabulous infographic, but I take exception with one name on the list.  The Cyber Warrior on this infographic is the representation of the state actors such as the Chinese and Russians.  The connotation of the name 'Cyber Warriror' just doesn't seem to fit to me.  I think maybe they should have called that group 'Cyber Soldiers' or 'Cyber Spies'.  I don't know, maybe it's just me, what does everyone else think?
JohnTrobough
50%
50%
JohnTrobough,
User Rank: Author
10/31/2014 | 12:49:38 PM
Re: Hacker motivations
Thanks! It impacts mitigation strategy by making sure you design controls which account for different variables and analytics that detect behavior faster - behavior often being an indicator of intent. A better understanding will allow you to take better and more relevant action.
JohnTrobough
50%
50%
JohnTrobough,
User Rank: Author
10/31/2014 | 12:47:59 PM
Re: Accidental Hackers
Do you mean employees accidentally creating noise by circumventing controls? That certainly is a very common security concern and it can violate policies. Even worse, such a person may be flagged as an intruder or unauthorized user ­ needlessly tying up much needed security time and resources. However, as this particular infographic is designed to frame up deliberate and targeted hacking efforts we didn't include it within this infographic. You raise a great point though and perhaps we can explore the impact of non-unauthorized non-malicious employee activity on security teams in future infographics!
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
10/31/2014 | 11:52:35 AM
The Cracker
I've not put the level of detail deserving into the below, or done justice to the label "cracker" but feel free to add to this.  While governments and big business deal with the infographic personas, there is a persona that exists who essentially created the world of hackers, crackers and cyber criminals in general.  Like the common burglar, bank robber and jewel thief, and like the graffiti tagger and angry mob, crackers cover a wide scope of destructive activity that can either result in theft of or destruction of property, physical and digital.  The profile below is quickly written but could be expanded.  I would argue this is the largest group and that over time, the most successful.  More likely to never be discovered are the crimes of the average cracker, IMHO.  

Characteristics:
Widely variable technical toolset
No ethical or moral compass; completely disassociated from human values
Intelligence ranging from genius to single-minded focus
Happy to work solo or in gangs
Eager to outdo fellow crackers and push the envelope
Has no computing preferences; can crack and exploit vulnerabilities using almost any technology, even low-tech
Spends extraordinary amounts of time online, typically anonymous or aliased, and is very social
Typically aware of exploits as soon as they are published or first discussed online and ready to try them

Modus Operandi:
Social and organizational casing, network reconnaissance, wireless and network sniffing, penetration testing, reverse engineering, brute force attacks, etc. In other words, every existing security exploitation tool and methodology, and the constant creation of new ones.

Preferred Targets:
Everything that is "secured" from a locked door, to dongled software, to an NSA database
Page 1 / 2   >   >>
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.