It stands all of five inches tall, yet the object immediately catches my eye. Perched sentry-like atop a computer monitor, the ebony and silver Borg looks out across the room, its plastic eyes frozen in an eternal, sinister gaze. To those unfamiliar with the cult that is Star Trek, the Borg are a race of alien invaders that have combined their mammalian flesh with mechanized servos and circuitry. The ultimate bad-ass dudes of the Star Trek universe, their corporate mission statement ominously proclaims “Resistance is futile.”
The Borg figurine is particularly fitting given that it sits atop the personal computer of another high-tech invader of sorts – one who, for this article at least, goes by the name of Wolfman. As a hacker, the Wolfman comes highly recommended via the Internet chat room circuit. He’s quite proficient at electronically snooping just about anywhere, and by his own admission there are more than few people who’d love to wring his neck if his cover is ever blown.
Given his technical prowess and his penchant for eavesdropping, Wolfman is the scourge of individuals and companies alike. He boasts that he can read just about anybody’s e-mail, and can change the graphic content on a corporate website. He can even engage in some highly unauthorized data-mining, if need be. What’s more, he usually comes and goes undetected. Have modem, will trespass.
This particular evening, the Wolfman is wired. It’s 10:15 on a humid night in August and we’re halfway through a two-hour caffeine jag at a Toronto Starbucks. About 6′-2″ with short jet black hair, the Wolfman is a surprisingly muscular twentysomething, given his sedentary pursuits. Nary a pocket protector or taped pair of eyeglasses in sight. Instead, he is decked out in a shiny pair of Doc Marten boots, faded blue jeans and a bright orange T-shirt bearing the Kraft logo, altered to read Krap. Several cappuccinos later, during which the Wolfman lays down the ground rules for his participation in this article, we head back to his apartment, and to the room he refers to as “mission control”. It contains a Pentium computer, high-speed modem, two telephones, scanner, color printer, three-foot stack of technical papers and a battle-weary laptop bandaged with duct tape. Oh yes, there’s also a poster of a voluptuous Pamela Anderson in her movie role as Barb Wire.
I’m offered a seat and a handful of Doritos. Gearing up for a clandestine hacking run, the Wolfman looms over his PC, his face bathed in the monitor’s faint cobalt glow. He logs on to the Internet and starts pounding away at the keyboard at a shockingly fast rate, whistling “It’s Off To Work We Go” as he starts hacking into the system of a large Toronto-based financial services company. Why? “Just look at their ad campaign – nauseating,” he growls.
Soon his PC is engaging in electronic chit-chat with the victim’s computer several miles across the city.
“Are we in yet?” I ask.
“Patience, Grasshopper, patience.”
A few minutes and a few failed attempts later, the Wolfman exclaims, “B-I-N-G-O, and Bingo was his name-o! We’re in.”
“Was it difficult?”
“Piece of cake.”
“Wasn’t there a firewall?”
“Firewall? Puh-lease! Just because your car has an air bag does that mean you’re going to survive a head-on collision with a dump truck? Let’s get serious here.”
And he does. “You see, the thing is, there are plenty of programs on the Internet that will enable you to bring someone’s server down or will enable you to send mail from someone else’s server,” says Wolfman. “The design of the Internet itself inherently has tons of problems. Tons. And don’t let anyone bullshit you: every time a new technology comes out – a new firewall, a new operating system, a new Internet service – more holes are discovered.”
He offers the example of Hot Mail, a free e-mail service available on the World Wide Web. This summer, somebody discovered a way to retrieve users’ passwords from the Hot Mail server. The problem was fixed, but the system was cracked again. In fact, every time it was patched someone found another way to crack it. Wolfman says he was able to delve into Hot Mail at will, and found, well, some pretty hot mail. E-mail messages ranged from detailed business strategies to torrid love letters. “Man, it’s amazing the kind of heavy-duty stuff that’s floating around out there,” he says, pointing into his monitor as if it were a portal into another world (which, in a way, it is). “You know, if I were a prick, I could really ruin somebody’s career if I wanted to.”
As he pecks away, he explains that a lot of hacking simply centres around confusing the server into thinking that the hacker is an administrator. Wolfman jumps into action by dropping a few ‘ping bombs’. “This slows the server down to a halt,” he explains. “If the server isn’t ping-bomb-proof, it will reboot and – presto! – you’re not even asked to authenticate yourself.” Dropping a ping bomb is remarkably easy. Wolfman demonstrates by typing ‘PING’ at the command prompt, followed by a space and then the name of a server.
THE HACKER’S ARSENAL
As it turns out, there’s no shortage of software that can aid the hacker. Wolfman says that if a certain (name withheld) package for Windows NT is successfully applied and a few other conditions are present, it could give the hacker access to the administrator account, which would then enable him to do just about anything he wanted on the server. “Hacking isn’t cut and dried – you don’t just go and hack in,” he says. “You find different situations that exist and you apply different solutions. You have to assess every situation differently. It’s a lot like fishing, really.”
As for such roadblocks as passwords, Wolfman chuckles. “You wouldn’t believe how many people have a password that’s the name of a car or a sports team,” he says. “That’s living dangerously. I have a dictionary runner that can run over 100,000 words. If the password is a recognized English word, it will be identified.”
Believe it or not, when stymied for a password, Wolfman sometimes resorts to a surprisingly low-tech solution. He simply phones the company pretending to be an employee locked out of the system. Talk about the silver platter treatment: after saying a few well-chosen words, a valid password is invariably presented to him over the phone.
Once he’s into the financial services site, we get an eyeful of an endless stream of names and numbers. But there are no X-Files revelations about Area 51 to be found here. In fact, all the data looks meaningless, although I’d wager that at least a portion of it was valuable to somebody.
So why go to all this trouble? The Wolfman has stated emphatically that he’s not into hacking for the money. I ask him what the deal is. “Is this the high-tech equivalent of mountain climbing – you hack into a site because it’s there?”
He looks at me as though struck by a revelation. “Yeah, I’d say it’s pretty much like that.”
To put me at ease, Wolfman reiterates that he’s an ethical hacker, not “one of those idiots” who likes to destroy somebody’s hard drive with a virus just for kicks. “Those guys are just vandals,” he says. “Thugs! Heathens! Where’s the skill in what they do? Besides, I don’t want to end up with a record.”
Nevertheless, Wolfman has just breached a company’s database, committing an invasion of privacy to be sure. “So what?” he says. “I figure that if I’m smart enough to get in, why should that be a crime?”
That opinion is widely held by the Wolfman’s hacker ‘brethren’. To find out a little more about what motivates them, let us briefly leave the Wolfman’s lair . . .
Evergreen and Titan
Evergreen, a hacker based in the Ottawa area, says he only uses his talents for pirating software. Indeed, Evergreen estimates he has pirated well over $10,000 worth of software and upgrades.
“I guarantee that if you name a software product, I’ll be able to find it on the Internet. The extent of piracy is far greater than what people can conceive. There are web sites with the sole purpose of being a distribution point for software. I had a copy of Windows 98 three weeks before it was officially released,” he claims.
Other than piracy, Evergreen uses his hacking talents as a way of playing practical jokes. “One time, a friend and I were able to change an Internet service provider’s web page,” he says. “We just put two 1’s after every dollar sign, so if the real price was $29, we made it $1,129. And it (the inflated price list) stayed that way for four days.”
Still, Evergreen says he draws the line at theft or more serious forms of vandalism. “I never got into cracking a bank’s system because it was so totally illegal,” he says. “But I could have. I remember coming across a credit card generator which would generate valid credit card numbers and expiry dates. I could’ve gone on a major shopping spree.”
Titan, a 15-year-old New Jersey hacker, uses his hacking talents as a means to further his computer education. “The reason I break in is to learn more about the current system – about how a network is being run and how the computer operates,” says Titan. “As corny as it sounds, I do what I do because I love computers.”
Titan, who describes himself as a “normal kid”, typically spends five hours a day hacking. The time commitment is worth it because “my hacking today is what will make me money in the future with a job,” he says. “It’s people like us that allow computers to be more and more secure. We find the holes; we tell them; they fix the holes; and then we do it again.”
Alas, there is a decidedly dark side to hacking – not all hackers pose as small a threat as Titan and Evergreen. And there is no shortage of technology that can help an aspiring anarchist from wreaking havoc. If you want to see something really scary, pay a visit to the hacker’s home page ( www.hackershomepage.com.). This on-line catalogue hawks everything a hacker needs to inflict mayhem. A handheld Disk Eraser (US$10) promises to “screw up all types of computer disks”. A Long Range Computer Zapper (US$150) will “remotely destroy floppy disks, hard disks, microprocessor chips, etc. from a range of up to 50 yards”. Most disturbing of all is the Tempest/Van Eck System Monitor (US$1,900). This gadget is claimed to allow the hacker to “remotely monitor computer, ATM, TV and all CRT displays using a TV or multisync monitor within a range of one kilometer. It will capture everything that is typed onto the display including passwords. It can be powered by batteries, thus making it portable. For example, you can be sitting in your car while viewing what someone in their house is typing onto their computer.”
A FEW PARTING WORDS
It’s now about 3:30 a.m. and the Wolfman still has a few hours of hacking left before calling it a night. But despite the caffeine coursing through my veins, I’m ready to pack it To be sure, spending the evening and the wee hours of the morning with him has proven to be an education. For one thing, I now look upon an e-mail message as more of a postcard rather than a sealed, first-class letter. Who knows how many eyes have read the thing by the time it’s gone from point A to point B?
Yet, even though the Wolfman seems relatively harmless, given his technical proficiency, I feel a tad queasy that he has in his possession my phone number, fax number and e-mail address. “I suppose you could really do a number on me if you wanted to,” I say only half-jokingly as we bid farewell.
He flashes a cocky smile. “No, no, not you,” he says. “There are bigger fish to fry; and there’s a lot more fish that deserve to be fried.”
We both chuckle, though my laugh is tinged with nervousness. The Wolfman and I share little in common, but I can’t help liking the guy. As a journalist, I’m partial to someone who gives me pithy quotes. And he has a zest for what he does that would be admirable were he not treading in forbidden territory. That’s one of the troubles with hackers: they are passionate about what they do. All the more reason to prepare our defences well against them, for unlike the Wolfman, many are motivated by the darker forces of greed or malice, and when combined with passion, that can produce a dangerously potent mixture.
Outside, the night is eerily quiet. I glance up at the full moon and hear a distant baying. I hurry to my car and lock myself in, knowing full well that tonight the Wolfman is on the prowl.
The High Price of Hacking
PULLQUOTE: “Fluid and ever-changing, ‘virtual crime’ may prove to be the most serious challenge facing Canadian law enforcement today” Criminal Intelligence Service Canada
If anything, hacking has proven to be a multi-billion dollar headache for business. According to Dataquest, corporate America alone spent more than $6 billion on network security last year. In March 1996, a survey of 400 companies and institutions by the FBI revealed more than 40% reported breaches. Worse yet, 30% of those break-ins involved the Internet, and occurred even though a firewall was in place.
Ernst & Young’s recently released 1998 Global Information Security Survey (CIO Canada, Sept., pg. 53) notes that 58% of Canadian respondents (high-level IT personnel) indicated that information security risks have increased over the past year, a 10% increase over 1997. Part of the reason for the jump is that more companies are embracing the Internet.
While there are many benefits in going online, there are numerous hazards as well, such as the company not knowing who is connected to its systems. This makes for an ideal setting for a wide range of trespassers, ranging from curious teenagers to disgruntled employees and even to spies working for the competition. Once any of these people breach a network, they can easily plant a virus, steal data and even sabotage operations.
In August, the annual report by the Criminal Intelligence Service Canada (CISC) noted: “Fluid and ever-changing, ‘virtual crime’ may prove to be the most serious challenge facing Canadian law enforcement today.” CISC (an umbrella organization comprising the RCMP, Ontario and Quebec Provincial Police and more than 100 municipal and regional police forces) noted that with the explosive growth of electronic commerce and electronic technology, “criminals have become expert users of the Internet”.
Indeed, the hacker who calls himself Evergreen knows of businesses that have “recruited” hackers through news groups to hack into the competition’s system and look at their databases. “Industrial espionage is way more extensive than people know,” he says. “Go on a newsgroup and ask if someone out there wants to make a quick $10,000 and you’ll get replies within minutes.”
What’s the real cost of computer crime? It’s in the billions to be sure, although no one really knows for sure. The vast majority of breaches go undetected, and according to one RCMP spokesman, it’s estimated that less than 10% of attacks are actually reported to the authorities. Most companies would prefer to take their financial lumps rather than endure embarrassing publicity.
What can be done? Doug McPhie, Ernst &Young’s national director of information systems, recommends companies use a “security architecture that gives them the confidence to operate in the unknown”. Sound advice, except that this is a whole lot easier said than done.
Unfortunately, no solution is 100% hacker-proof says Bruce Schneier, author of E-Mail Security (John Wiley & Sons, 1995). “There’s absolutely no such thing as total security – it’s just too hard to achieve,” he says.
Schneier says computers and networks could be made far more secure “but this would greatly hinder their usability”. A Toronto CIO agrees. “I liken [implementing a foolproof computer security system] to the Cone of Silence routine from the old TV show Get Smart,” he says. The Cone of Silence was a transparent plastic shell that would enclose secret agent Maxwell Smart and the Chief when they needed to have a top-secret conversation. It was bug-proof to be sure, but the cone prevented Smart and the Chief from having a coherent conversation.
The power of hackers may be somewhat diminished when the next generation Internet is launched. In the meantime, says Schneier, “we’re going to endure short-term pain for long term gain – and believe me, there’s a lot more short-term pain to come.”
