Detecting and Preventing Hacking in Homes and Office

Author: Iloka Benneth Chiemelie

Published: 7/1/2014

CHAPTER 1

INTRODUCTION

As Kartik¹noted, internet security is increasingly becoming one of the main issues that worry organizations, companies, systems and individual users. These internet stakeholders are mainly afraid of having their secured documents and information exposed, note to mention having their system being pinned to bugs and worms and as such decrease the quality of performance of such system. The question is how safe are the information contained in this system? Well, the internet world has no direct answer as there are numerous loop holes in the internet world that allow access to information without prior permission. The main concerns are hackers who break into these systems to access this information in an unethical manner, and as such put the users are high risk of both capital and financial losses.

No matter the arguments held against hackers, it would be quite unfair to classify them as the “bad people,” without exploring their background and understanding their purpose. As such, it becomes a necessity in this paper to explore the kinds of hackers that are out there in the internet world and how they break into system and bridge computer security, as well as their main reasons for doing so. Additionally, it would be wonderful to understand how these hackers can be stopped from their malicious activities.

Background of hackers: the types of hackers available in the internet world

There are quite a number of kinds and names used to describe these individuals that possesses exceptional knowledge of the computer and internet security. Whiles different names exist in the form of description of whom a hacker is, a hacker is can be basically classified as a brilliant programmer, a computer criminal a gray hat, or a while hat hacker². The name “brilliant programmer” is used to describe someone who can write codes very fast, and produce programs that are capable of delivering ideas as intended. These kind of people are mainly harmless in the internet world and will not bother about hacking program unless they are asked to do so by their company. When this kind of hackers starts writing their codes, in order to break into the security features of any given program, system, or networks, they are mainly described as “crackers.”

Crackers is the word used to describe those who commit the devilish act of breaking into the security features of software. This kind of individual are driven into this act by either personal interest, some form of curiosity, or paid by the hiring company to crack such network or system. Crackers use different methods and tools in order to break into the security features of a system. Some of the methods adopted by this people include the Trojan Horse, Snooper, Virus, Worm, Port Scanner, Social Engineering, Vulnerability scanner, Exploit, Root Kit, Packet Sniffing, Leet, and many other processes.

Still on understanding that crackers are, a cracker can basically be classified as a white hat or Samurai³ when such person has been hired to undertake the cracking act for legal purposes. This people access systems and networks for the purpose of testing the security of such system, and they are on their own warrior hired to defend the system of their companies by testing the potentials of other crackers unethically accessing such system.

There are other types of cracker that also specialize in commandeering card numbers of others for personal use (Carding), or are interested in encrypting their files and system security for the suspicion of having the privacy terms of such system breached¹.

While there are a number of different hackers as described above, the fact is that no matter what the terms might be or what these individual are capable of doing, the main psychological force driving their decision to undertake such act is “personal satisfaction.”¹ This can be described in the form of curiosity, the personal pride gotten from showing off what they are capable of doing or the pleasure from committing evil acts⁴.

Purpose of study

From the above analysis, it is purely clear that these individuals are capable of doing damages to the internet security of both individual users and companies, and such damages can entail losses in the form of both capital (intellectual properties and personal documents) or financial losses. As such, it is important to understand the factors that make these people do what they do, how they do it and how they can be prevented in order to ensure a more secured internet world that is free of crime or at least exists with lesser crimes.

This is the main purpose of this paper as it seeks to understand the issues of hacking in relation to the influences on both business and individuals and how such issues can be solved in relation to providing the necessary tools for stopping these people from conducting such a demonic breach of privacy and exposing personal information.

Significance of the study

Clearly, the paper is very significant in the sense that it is aimed at preventing breach of information and enhancing the security of internet. Basically, internet technology has now become part of human life as it is increasing being integrated in most technologies available these days such as mobile phones, computer, SMART televisions, cars, and a host of other technologies. As such, it can be seen that such an increase in technological adoption that is being included in the everyday life of human means an increase in security issues and gives hackers the power to access more information as most of the people using these technologies are mare novice of the security issues associated with it. Thus, a paper such as this one, which is designed to understand how these issues can be reduced in order to enhance the security of the internet can easily be viewed as being significant.

Research question

In order to ensure that this paper is capable of meeting the set objective, a number of questions will be asked as the guideline form which the overall paper will be developed and these questions include:

1.      Who are hackers and why do they hack?

2.      What are the security threats that these people pose? And

3.      How can these people be stopped?

Organization of study

Based on the above analysis, it can easily be seen that this paper will include a high volume of information and variables which will be used to define the background for understanding the concepts being reviewed and on that ground, the paper will be designed in a definitive approach as described below.

The first section is the introduction, which presents a background understanding of the concepts being study and how the paper will be undertake. This section as defines the research objectives as well as the research questions that will be used to tackle these objectives.

The second section is the review of literature which is the section in which relevant theories that presently exist in relation to the research topic is being touched. The importance of this section is that it will be presented a detailed and practical understanding of the threats of hackers and how to stop them, as well as serve as the background from which the primary research will be conducted in order to understand if what is applicable in the literatures are actually obtainable in practice.

The third section is the research methodology, which defines the approaches that will be adopted in the primary research. Primary research is considered important in this paper because it will present a current view from IT personnel, companies and internet users about the threats of hackers and how such threats can be aborted.

The fourth section is the data analysis, which is the section in which the gathered data from the primary research will be analysed in order to highlight main findings from such data. Following this section is the fifth and last chapter for this paper, and it is the discussion of finding, which is the section in which the findings from both the primary and secondary research are discussed in order to define links between what is obtainable in literatures and what is obtainable in real-life. Following the chapter five is the conclusion, list of references and appendix.

Limitation of the study

The main limitation of this study comes in the form of the “study scope.” This is because the scope is too narrow in the sense that it only focuses on understanding the threats hackers and how to prevent them. Even without hackers, there are still a number of security issues and just preventing hackers doesn’t necessary guarantee a secured internet world and this becomes a limitation in the terms that applicability is not a guarantee of the expected outcome – internet security.

In other words, the quality of this paper can further be enhanced by expanding the understanding of security issues to other areas besides the hackers and as such present a broader views of security issues in the internet world and how these issues can be handled. This will help increase the possibility of achieving the expected outcome in the form of preventing bridge of internet security.

CHAPTER 2

LITERATURE REVIEW

With a background understanding of who a hacker is, how and why they hack, and the types of hackers presented in the introductory chapter, this chapter will focus on understanding some of the common hacks and how to prevent hacking in both home and office internets and computer systems.

Understanding common hacks

From their experience of working with leading enterprise clients in different ranges of regulated industries that include financial services, governments and pharmaceuticals, the IBM Rational® technical team⁵ has made identifications and studied the 12ost common hacks, and they are as discussed below.

Table 1: Twelve most common hacks

TYPES OF HACK	PURPOSE OF HACK	HOW IT IS DONE
Cookie poisoning	The main purpose is for identity theft and hijacking of session.	Most of the web application make use of cookies in saving their information such as the username and password or a timestamp on the client’s computer. However, these cookies are not always cryptographically secure and it makes it easier for hackers to modify them and configure the application to change their value – as such “poisoning” the cookies. The end product is that these hackers can then access to the user’s account and use it to make fraudulent transactions like purchasing and money transfer.
Manipulation of hidden fields	E-shoplifting	Usually, retailers in the e-commerce world make use of hidden fields in saving the sessions of customers, and as such eliminating the need for maintaining a complex database on the side of the server. Such fields are also used by retailers in storing merchandise prices. Hackers can view source codes on protected sites, and find the hidden field, then alter prices. The company might not detect such changes and as such shift the hacker’s commodity at an altered price and possibly send a rebate.
Parameter tampering	Fraud	Most of the application ignore the need to confirm the correctness of common gateway interface (CGI) parameters that are embedded in the hyperlinks contained in such application, and so makes it easier for hackers to be able to alter these parameter. This might be beneficial to the hacker in a number of ways like allowing the hacker to secure a credit card with US$500,000 limit, skip the login screen in website or gain access to orders and information about the customers.
Buffer overflow	Service denial	Through the exploitation of flaw in a web form, hackers can overload a given server with excess information and this will mean that such server will crash and shift down from the website.
Cross-site scripting	Hijacking / identity theft	It is possible for hackers to inject malicious codes into a website, with such codes performing like if it is form the targeted site. This gives the attackers full access to the retrieved pages and can even send them data from the page.
Exploitation of backdoor and debug options	Trespassing	Developers usually embed debug options in their codes in order to test the site before it is being put online. If developer forget to close this security holes, it becomes quite easier for hackers to freely access information from such sites
Forceful browsing	Breaking and entering	Hackers can subvert how an application flows and access information and components that should have been inaccessible such as log files, source codes and admin facilities.
HTTP response splitting	Phishing, identity theft and e-graffiti	The Web cache can be poisoned by hackers both at the site and in the intermediate system, which will make it possible for these hackers to change the Web pages in the cache and perform numerous attacks against the users of such sites. Additionally, this gives the hacker a higher ability to making their activities secret.
Stealth / Trojan horse	Malicious damage	Hackers can have dangerous command concealed in a program and send  it to a the intended target, with such commands being unleashed in the intended site and causing numerous damages to that particular site.
Exploitation of third-party micro-configuration	Malicious damages	Hackers usually pay visit to public sites and post vulnerabilities and patches in such sites. This will then be used to make the site’s database unusable and create a new database for the site.
Exploitation of known vulnerabilities	Taking full control of the site	Some web technologies have inbuilt weaknesses that persistent hackers can exploit. A good instance is that hacker can command an entire site by knowing how to access the administration password through Microsoft® Active Server Page (ASP) technology.
Exploitation of XML and Web services vulnerabilities	Malicious damages	Some embedded and external infrastructures and protocols that support XML-based applications might usher in vulnerabilities to the infrastructureof a site, its protocols and content.  Additionally, some types of attacks—including entity expansion, XPath injection, structured query language (SQL) injection in XQuery, and various denial-of-service attacks—exploit XML’s flexibility and richness to inflict major damage on all of these elements.

Source as adapted from: IBM Rational® technical team⁵

Basically, the notions presented in the above analysis is that there are quite a number of hacks that have been attempted and is still in attempts in the internet world, and most of these hacks are designed to access private information and also use the accessed information for negative purpose. This puts both companies and individuals at high risk because this information such as identity theft can be used to make purchases on the name of the innocent owner, and as such accumulate debts for the owner. It can also be used to make a website or database in active and potentially bring to stealth the business operations of companies especially in cases where these companies maintain high presence online. As such, it is very important to combat this individuals by understanding how such activities can be reduced and potentially stopped because hacking if well implemented, have the potential of bring an economy to a standstill and causing psychological damages and death in cases where the information of an innocent user has been used for malicious purpose, making such user liable to incurring the damages cause by such activity.

Understanding how to prevent hacking

There are quite a number of techniques and methods adopted in reducing the negative influence of hackers and their malicious software, and such techniques have been developed by different companies. These companies are different in their understanding and idea of what is the weakest points in a given network and how such weaknesses should be protected against hacker. Basically, the only solution for protecting systems against hackers is through software – which is program that is designed to stop the hackers from having access to secured information. Each of these software have their own negatives and positives, and some of the tools used to reduce the negative influence of hackers on a system’s security are as discussed below.

Intrusion Detection System (IDS)

This is a system designed to keep a close record of network traffic for suspicious activities and alter the system or network administrator (Passive IDS), or in some cases block the IP address of the suspicious user from accessing the network (Active IDS). Numerous strategies exist for the detection of suspicious IP address having access into the network; and this means that this system comes in different varieties and detection methods. Some are networking based (NIDS), and some are host based (HIDS). Still on that hand, some are based on the signature of known threats, or by comparing traffic pattern with the baseline while also looking for some abnormalities in the traffic⁶. The weakness of this tool comes in the associated bottle neck formed on the monitored point.

Most of the companies and individuals alike have made use of this method to handle issues with infected computer and with hackers. In handling hacking, most of the companies and individuals make use of the IDS system in protection of their network. The counter effects from this system are being used up till this moment to determine how hackers penetrate a network or computer. This also include the use of Trojan horse, port and vulnerability scanning, packet sniffing, and other common hacks that have been discussed earlier.

When anti-virus software detects the presence of a given virus or an intruder in a system, the suspected file will be analysed and presented to the user. Actions such as disassembly, macro-scanning, and code analysis are normally undertaken in order to eliminate the virus or disconnect the intruder, but this depends on the type of file⁷.

Check site

One of the most common methods used to gain access to users information comes in the form of phishing, in which the hacker programs a site to look exactly like the original website but hosted in a different domain name. As such, it is important that users always take extra time to review the domain name that they are accessing and ensure that such domain names are actually the original network and not phishing site. The modern application now involved verification with HTTP which is used to replace the HTP platform as a more secured internet access unit.

Summary

The underlying element from the above analysis is that a number of ways exist in relation to how hackers try to access information about internet users independently and for malicious purposes. Additionally, it is important to understand that such scope might continue to expand as time goes on because the objective of any hacker is to make such activities secretive. The fact however is that a number of solutions exist for case and these solutions have been tested overtime and proven to be capable of stopping such activities, and this means that security is more enhanced in the internet world if users are willing to adopt these measure in order to stop the hackers from accessing their information.

CHAPTER 3

MYTHOLOGY

Introduction

In this chapter, the method to be adopted for primary research will be discussed. This will include the data gathering format, data coding and analysis format as well as the format for prove of hypotheses. This section will contain an explanation of all necessary tools that will be adopted for the primary research.

Questionnaire design

The questionnaire for this research was designed by following guidelines from other related researches previous conducted (the questionnaire is available in appendix 1). A pilot test was conducted by distributing the designed questionnaire to online users via FreeSurveyOnline.com. The pilot test was conducted in order to test whether the choice of online survey will be right for this research in terms of data quantity and quality. Survey was chosen as the preferred data gathering method because it can easily be read and generalized, and it incorporates studies that are based on present situations (Churchill and Iacobucci, 2005). Surveys also provide researchers with the opportunity to access high variables (Ma, 2007). Additionally, surveys are convenient, fast and a cost effective data gathering method (Zikmund, 1999). It also reduced the biases associated with other form of data gathering such as interview. In order to determine the right sample size for this research, Roscoe’s Rule of Thumb (Roscoe, 1975; cited in Sekaran (2003)) was utilized as the guiding criterion. The rule states that the sample size must be bigger than the sample components by a high margin.

Measurement

A self-addressed questionnaire was adopted in the research, and responders were to answer the questionnaire by choosing between either agreeing or disagreeing with the statement contained in the questionnaire. The 2-point scale rating method was chosen on the notion that the responders are familiar with issues to be discussed.

Data collection

The data was collected in the school on different occasions for a period of one week. The collection period could actually be reduced to within few days, but the reason why it was undertaken in a period of one week is that some collected data where deemed insufficient and extra data correction were required to meet the standards. The total number of responders for this survey is 30.

Respondents’ profile

The responders for this study are made up of students and staffs. The students are chosen on the bases that they are studying IT or computer related courses while the staffs are choosing on the ground that they work within the IT department. Such a criterion for choosing responders was developed to ensure that the responders to this question clearly understand the topic of discussion and have the right knowledge towards contributing to the research process..

Data analysis and coding

The data was electronically coded with IBM SPSS data analyzer. SPSS data analyser is a statistical tool that has been used for numerous years and is widely adopted a means of data analysis. The benefit is that it presents a clear understanding of situation at hand by analysing issues individually and defining the best approaches to be adopted in the discussion of findings from research.

Ethical considerations

In the course of gathering and analysing the data, numerous ethical issues were reoccurring. Primary research has been characterized with numerous ethical issues, and the reason is because some researchers are always trying to ensure that gathered data and finding from analysis meet their set objectives. However, this was not applicable in this paper. Some of the ethical issues encountered and addressed are:

Proposing answers for responders – since this is a face-to-face survey, responders who had issues with the questionnaire asked questions. During the course of addressing responders’ questions, the interviewer might directly or indirectly influence their answers by focusing more on the negative or positive influence of the answer. In order to eliminate such ethical issue, the interviewers were trained on ensuring that they don’t deviate from the focus of the questionnaire and don’t interfere with the responders’ choice by either directly or indirectly convincing them to present a particular answer through their explanation of the questions.

Manipulation of data - the gathered data re really hefty and not all people approached had intension of complying. As such, there was also a temptation of the interviewer to fill the unanswered questionnaires or manipulate the gathered data to ensure favourable findings. However, the research have been trained numerously on the importance of ensuring reliability by keeping data genuine and the influence of manipulated data on the quality of a research. As such, none of these unethical practices was conducted in this research.  

CHAPTER 4

DATA ANALYSIS

Introduction

In this chapter, the focus will be to analyse the data gathered from the research process. As shown earlier in the chapter three, it was made known that thee primary research will be conducted in the school and it data will be gathered from students an IT staffs. Following this set guideline the data was gathered and this section is an analysis of the gathered data.

Reliability of gathered data

Case Processing Summary
		N	%
Cases	Valid	30	100.0
	Excludeda	0	.0
	Total	30	100.0
a. Listwise deletion based on all variables in the procedure.

Reliability Statistics
Cronbach's Alpha	N of Items
.035	12

Before proceeding with any analysis, the first step will be to understand the level of reliability of gathered data. In order to be considered reliable, data gathered in primary research must meet or exceed the value of 0.50, in which the higher the value, then the higher the level of reliability. For this paper the reliability is below this figure but this doesn’t mean that the data is not reliable. This is because the reliability of data in SPSS is hugely influenced by the volume of data in which the higher the volume, the higher the possibility of the data becoming reliable.  In order to prove the statement to be correct, the table below is an illustration of the statistical analysis of the variables used in this paper and it can be seen that each of the variable have 30 responders, which is the figure used to represents the response volume as discussed earlier in the responders’ profile.

Statistics
		Hacking is a serious issue	I have been subjected to hacking	Hacking leads to lose of information	Hacking leads to identity theft	Hacking leads to lose of cash through online systems	There is a growing increase in hacking related activities	Hackers can actually be tracked	Virus and malware detectors help stop hacking	HTTPS gives better security against hackers	Checking the originality of website is important to stop hacking
N	Valid	30	30	30	30	30	30	30	30	30	30
	Missing	0	0	0	0	0	0	0	0	0	0

Descriptive statistics

Demographic data

From the demographic data analysis, it can be seen that most of the responders are male, and also students. However, it should not be used to oversee the fact that there are also staffs and female responders. The fact that the responders are both staffs and students means that the quality of the research is enhanced in the sense that it creates the right atmosphere to combing classroom teachings with real life experiences in contributing to the research questions.

Hacking related issued

Hacking is a serious issue
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	30	100.0	100.0	100.0

I have been subjected to hacking
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	13	43.3	43.3	43.3
	2.00	17	56.7	56.7	100.0
	Total	30	100.0	100.0

Hacking leads to lose of information
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	30	100.0	100.0	100.0

Hacking leads to identity theft
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	30	100.0	100.0	100.0

Hacking leads to lose of cash through online systems
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	30	100.0	100.0	100.0

There is a growing increase in hacking related activities
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	11	36.7	36.7	36.7
	2.00	19	63.3	63.3	100.0
	Total	30	100.0	100.0

Basically, the underlying notion studied in the above analysis is the ideas as conceptualized in the review of literature. The findings reveal that hacking is a very serious user with some of the responders agreeing that they have been subjected to hacking in the past. Such an experience positions then well to understand the issues related to hacking and how it can be solved. From the analysis, the issues linked to hacking include loss of information, financial losses, and identity theft. The worrying side of the above analysis is that there is an increase in the level of hacking and this is can be attributed to an increase in the adoption of computer as discussed earlier in the literature review.

Solutions for hacking related issues

Hackers can actually be tracked
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	22	73.3	73.3	73.3
	2.00	8	26.7	26.7	100.0
	Total	30	100.0	100.0

Virus and malware detectors help stop hacking
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	30	100.0	100.0	100.0

HTTPS gives better security against hackers
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	24	80.0	80.0	80.0
	2.00	6	20.0	20.0	100.0
	Total	30	100.0	100.0

Checking the originality of website is important to stop hacking
		Frequency	Percent	Valid Percent	Cumulative Percent
Valid	1.00	21	70.0	70.0	70.0
	2.00	9	30.0	30.0	100.0
	Total	30	100.0	100.0

In order to understand the solutions for solving hacking related issues, the first step was taken to understand whether hacker can actually be traced. Most the responders think so but other still feel that it is not possible. On a realistic ground, these two answers are correct in the sense that some responders can be traced while others cannot. All depends on the level of hacking skill and the system hacked into. Still on the note of understanding the best approaches to stop hacking, it was noted that the responders think that hacking can actually be stopped by taking extra time to understand the authenticity of the website being visited, adopted HTTPS browsing platform and installing virus as well as anti-malware detector to deter the hackers from penetrating into the system.

CONCLUSION

With the increase in computer adoption, a number of issues have been noted to influence the computer experience for both individuals and corporations negatively. These issues are centred on the underlying fact that the internet world is too broad and as such it makes some people invincible. However, the level of visibility is not the issue; the main issue is the level of security. As such, this is the main reason why this paper was developed, in order to understand the security issues associated within the internet world in terms of hacking related issues.

Findings from both the theoretical review and primary research shows that hacking is a serious issue and should be seriously handled in the organization. The reason is because when hackers access a given system, they can rip the information contained in the system and as such it can lead to financial losses as well as lose of vital information for both individuals and corporations. On that note, it becomes very important to understand ways in which these issues can be stopped in order to provide a more secured internet environment.

Both the theoretical review and the primary research made identification of numerous ways that hacking can actually be prevented or at least reduced, and tis comes in the form of installing viruses and other hacking detectors in the system, as well as making sure that the website being visited is genuine and adopting HTTPS instead of HTTP. In conclusion, it can then be stated that hacking is a serious issue in both organizations and for individuals, but it can be prevented with the right approaches.

Appendix

Questionnaire used for study

Description and instructions: This is a simple research conducted to understand the security issues that hacker pose in our system and to underline the best approaches to limit such issues.
Status in school?	Student	IT staff
Gender	Male	Female
QUESTIONS
Security issues of hacking			1= Yes	2 =NO
Hacking is a serious issue
I have been subjected to hacking
Hacking leads to lose of information
Hacking leads to identity theft
Hacking leads to lose of cash through online systems
There is a growing increase in hacking related activities
Solutions for stopping hacking
Hackers can actually be tracked
Virus and malware detectors help stop hacking
HTTPS gives better security against hackers
Checking the originality of website is important to stop hacking

References

[¹] Radcliff, Deborah, Jan, 1999. Internet Security News: [ISN] Hackers for Hire. [Online] Available at: http://www.landfield.com/isn/mailarchive/1999/Jan/0053.html (March 29, 2004)

[²] Wikipedia, The Free Encyclopedia, March, 2004. [Online] Available at:http://en.wikipedia.org/wiki/Hacker (March 29, 2004)

[³] Riley, James, 2001. Industry looks to get hacked to bits. [Online] Available at: http://www.consensus.com.au/ITWritersAwards/ITWarchive/ITWentries01/itw01f-jr-ih36.htm (March 29, 2004)

[⁴] Kapica, Jack, March, 2004. Globetechnology: The syntax of Viruses. [Online] Available at: http://www.globetechnology.com/servlet/story/RTGAM.20040304.gtkapicamar 4/BNStory/Technology/ (March 29, 2004)

[⁵] Internet and Network Security, 2004. Introduction to Intrusion Detection Systems (IDS) [Online] Available at: http://netsecurity.about.com/cs/hackertools/a/aa030504_2.htm (March 29, 2004)

[⁶] Internet and Network Security, 2004. Hacker tools – Utilities used by hackers, crackers &phreaks. [Online] Available at: http://netsecurity.about.com/cs/hackertools/ (March 29, 2004)

[⁷] Panda Software, 2004. Panda Software – About. [Online] Available at: http://us.pandasoftware.com/about/press/viewNews.aspx?noticia=4842 (March 11, 2004)

[⁸] Platform Logic, 2004. SoBigF: Intrusion Prevention. [Online] Available at: http://www.platformlogic.com/solutions/mydoom.asp (March 29, 2004)