Hacker how to define it

In this post, I categorize hackers into three groups that reflect different levels of experience and capabilities.

My objective is not to propagate any stereotypes but merely to create a framework so that we can talk about the other side and their skill levels. This information is provided to facilitate an
understanding of the different types of people who are commonly called hackers.
Security professionals have started using the term cracker to refer to malicious computer hackers.

Unfortunately, the media and general population have given the term hacker a negative connotation, so we use it to describe any person who attempts to access a system through unauthorized channels. This chapter also presents a profile of information security professionals and discusses popular hacker and information security myths.

Categorizing hackers by the technology they deal with can be

 
complicated. Because networking and computing technology is so vast, hackers often specialize in one or a few specific areas.

For example, some focus on a particular operating system (e.g., Unix, Mac OS, Windows), some master the workings of individual applications (e.g., e-mail servers, firewalls, Web servers), and some focus on a particular type of attack, (e.g., denial of service, dial-in penetration, Web hacks).  Still others use social engineering as a way to gain unauthorized access.

There are a few hackers who have mastered more than one of the above issues, but only a select few have a great deal of experience in all topics.
To avoid the intricacies identified above, our characterization of hackers is based only on their overall technical competence and ability to compromise computer technology, networks, protocols, and systems.
For our purposes, we divide hackers into three groups:

first, second, and third tiers.

These tiers form a pyramid in which there are a small number of genius-level hackers (first tier), many more second-tier hackers, and a large population in the third tier. Within our categorization, we discuss their capabilities and motivations.

First-Tier Hackers

First-tier hackers are programmers who have the ability to find unique vulnerabilities in existing software and to create working exploit code.
These hackers, as a whole, are not seeking publicity and are rarely part of front-page news stories.
As a result, they are known only to the security community for the programs they write and the exploits they have uncovered.
First-tier hackers are individuals with a deep understanding of the OSI model and the TCP stack. Coding is more than just a hobby, and they dedicate a great deal of time and energy to it. They are committed to keeping their technical knowledge and skills current.

Not all tier-one hackers are malicious. In fact, some are actively involved in developing technologies that can be used to improve overall network security, such as hackers from the ISS Xforce,
the Bindview Razor Team, and the AXENT SWAT team (AXENT has been purchased by Symantec).
Tier-one hackers can work independently or through a network of hacking teams that run exploits from a variety of locations, making it difficult to trace the activities back to their source.

These teams can be developed in Internet Relay Chat (IRC) channels, in conferences such as DefCon, or in small groups of computer-savvy friends. Often one first-tier hacker creates the
programs and other members of the team run them against target networks.
This creates a reputation for the group rather than a single individual.

Second-Tier Hackers

Hackers in this tier have a technical skill level equivalent to that of system administrators.

Tier-two hackers are far more common than tier-one hackers and may have experience with several operating systems, understand TCP/IP, and know how to exploit several vulnerabilities.
They generally have less depth of knowledge but possibly greater breadth than the first tier.

This level of hacker would be part of a security team in a large organization. Some level of programming or scripting ability is required. For example, they should be able to port a tool from one flavor of Unix to another.
A majority of security consultants fall into this tier. Tier-two hackers have worked with computers for most of their careers and understand how they work.
They have an extensive collection of tools, a reliable methodology, and ability, but they generally rely on other people to identify and code most exploits due to lack of time to specialize in a particular technology.
Tier-two hackers like to play with new tools as soon as they come out and are often beta-testers and parttime developers for freeware and open source security tools.
They can also be found as regular contributors to security mailing lists.

 

Third-Tier Hackers

The lowest and most populated part of the pyramid is the third tier, whose members are commonly referred to as script kiddies. This terminology comes from the fact that members of this tier generally rely on previously coded scripts and prepackaged hacking tools downloaded from the Internet to do their hacking. Script kiddies are usually individuals who are intrigued by the notion of gaining unauthorized access and are open to using untested pieces of code, especially while others (target networks and users) are at risk.
For this reason, tier-three hackers get the least respect but are often the most annoying and dangerous.
Tier-three hackers can cause big problems for large organizations since they are not afraid to run untested scripts against networks without truly understanding what the scripts do and what the
consequences may be. This combination of irresponsible experimentation and incomplete knowledge often leads to disaster, such as the unintended loss of information.
A script or hacking tool can show the effect of a vulnerability on someone's network but should be treated with definitive care. Once a tool is aimed and fired, it will have its effect on the target regardless of the assailant's intention or understanding of how the tool works.
Of course, hackers in this tier are fairly easy to identify and/or catch (as compared with first-tier hackers). In our lab, we have seen hackers attacking our NT honeypot systems by using Unix-specific scripts (trying to NFS mount an NT share). They generally do not attempt to cover their tracks; in fact, they may perform activities that attract attention, such as running port scans against all possible ports, 1 65535. With minimal intrusion detection and monitoring capabilities these attempts can be stopped.
Tier-three hackers generally hack as a hobby and are usually in search of notoriety.
They feel, perhaps from watching movies, that by successfully hacking a system, they will become elite.
This is the attraction in working with a programmer it holds the promise of valuable experience and the fame/infamy script kiddies seek.
Publicity seeking is one of the main reasons why these hackers get caught.
They are so interested in becoming known that they tell everyone about their latest conquest on hacker IRC channels.
Script kiddies do not necessarily have computer-related professions.
In fact, given that they are often the younger people on the Internet, they may still be in high school. They run the code they find on the Internet on their office, home, or school network.

Most large organizations have at least one individual with enough computer knowledge to obtain hacking tools but no authorization to run them.
Curiosity about how the tools work and what information might be obtained leads to an unauthorized security breech.
Tier-three hackers spend their time surfing the Internet in search of the latest and greatest automated hacker tools.
Their tool set is generally entirely downloaded from the Internet as is.
Often they scan the Internet looking for a site susceptible to the latest exploit they have just learned to see if it really works. Tier-three hackers are generally recipients of security mailing lists, though they may not be regular contributors, and are often vocal in hacker IRC channels.