A Day in the Life of Joe Hacker

His name is Hacker. He breaks into computer networks. He trades information for profit and popularity. Like a graffiti artist, his fame comes from his targets.

Jul 22, 2003

By Greg Richburg, MCSE
Netricks, Inc.

His name is Hacker. He breaks into computer networks. He trades information for profit and popularity. Like a graffiti artist, his fame comes from his targets.

How did you meet Hacker?

Through a lab experiment, while working on a case study about the patterns and lifestyles of hackers. The best way to get inside the mind of a hacker is to find one at work. I established a network test environment on a DSL line and purposely left several openings for an attack.

What do you mean an attack?

Contrary to what people think, hackers do not break into systems for malicious intent. The majority of hacking is conducted out of curiosity and for trade. An attack, simply put, is a breach in a network from an uninvited source. Hackers look for systems that are easily compromised, systems that have something interesting to offer or systems that are left open to use for trading. The latter is what I had to offer.

Did Hacker break into your network?

Yes. I installed a basic Windows 2000 server and left port 21, 23 and 80 open. Network engineers or techies know that leaving those open is taboo. It is like leaving your keys in your car and the door open. It is only a matter of time before your car gets stolen.

I watched the system everyday for activity. On the 10th day I was discovered by a simple port scan. Port scanners are free and easily obtainable. Once Hacker found the open ports my system was his playground. He then uploaded a remote access program and took control of my system.

What did he do once he had control?

With remote access control, he then browsed my directories, looking for any interesting information. He didn’t anything; he didn’t maliciously try to damage the system. Instead, he tightened up the security by closing the open ports that he came through, created some hidden directories and then began to upload information to my system.

For 18 hours, files of all kinds were uploaded to my server. I discovered 30 of my 36 free gigabytes of hard drive space were filled up. There were mp3 files, games, movies, software applications and even some adult content. I discovered his name by a few files that he left. Hackers like to be recognized for their handiwork.

Why would he upload information to your system?

His business is trade. A day and a half after the uploading session, I watched my system intently. All of a sudden, a foreign IP address logged into my server. But this person was downloading. Then another logged in, and another, and another, and another. Within ten minutes, there were 23 people logged into my server downloading all the goodies that Hacker left behind. My system was being used as a conduit.

So what did you do to stop it?

I terminated the file transfer services, uninstalled the remote access program and installed a firewall. I then conducted an IP trace on Hacker. I traced him all the way to Lyon, France.

What can be learned from your experience?

Proper network setup can save you lots of trouble, time and money. Firewalls, experienced engineers and network management are all very important when setting up a secure environment. There are many ways to circumnavigate security.

Is your system safe?

Greg Richburg a Microsoft Certified Systems Engineer and the owner of Netricks, Inc. a network consulting, web design and hosting company located in Fresno. Visit Netricks at www.netricks.com.