Criminology 1500 words Assignment
Sharonhy
BRD205_ComputerHacking_Wilson.pdf
A History of Computer Hacking (Naughty, Naughty Computer)
Dr Michael Wilson BRD205 Crime Through the Ages
Lecture Outline
1. Computers, Hacking, and Cybersecurity
2. Cracking the Data Encryption Standard
3. A History of Computer Hacking and the Internet (1950s-2010s)
4. Case Studies: Learning from History?
What is a Computer? (1)
• Computer – an electronic device for storing and processing data, typically in binary form, according to instructions given to it in a variable program
• Binary Logic/ Boolean Algebra • Binary Digits/ Bits
(0 = FALSE; 1 = TRUE)
• Logic Gates/ Operations (NOT, AND, OR)
• Transistors – electrically controlled switches • 2 Electrodes (Input; Output)
• 1 Semiconductor
• Bits and Bytes (e.g., 01001101) • Byte = 8 Bits (256 possible states)
• Kilobyte = 1024 bytes/ 8000 bits
• Megabyte = 1,024 Kilobytes/ 1,048,576 bytes/ 8,000,000 bits
Colossal Mark 2 Computer (1944) First Electronic/ Programmable Computer
I am able to record this lecture by using a computer with an Intel Core i7 Processor, which has
~1,750,000,000 transistors performing millions of instructions (bits of data) per second…
What is a Computer? (2)
• Central Processing Unit – electronic circuitry that executes instructions (from a computer program)
• Control Unit – a unit that tells the ALU/ Memory how to respond to the instructions that have been sent to the processor.
• Arithmetic Logic Units (ALUs) – Computational circuits (logic gates) that perform arithmetic and logic instructions (translates inputs to outputs)
• e.g. Add/ subtract values
• e.g. Activate another transistor if 2 other transistors (e.g. ‘AND’) are active
• RAM/ Computer Memory – Storage for the outputs of ALUs that use ‘registers’ constituted by ‘latch’ circuits
• Computer Programs – a series of instructions for translating inputs into outputs to allow humans to perform tasks (e.g. Microsoft Office allows us to write documents).
An ‘AND’ logic gate with 2 inputs and 1 output
A RAM stick can store large values by placing registers within circuit matrices
What is Computer Hacking?
• “[T]he unauthorised access and subsequent use of other people’s computer systems” (Taylor, 1999, xi)
• “A hack involves the modification or alteration of computer hardware or software to enable technology to be used in a new way, whether for legitimate or illegitimate purposes” (Holt et al., 2015, p. 35)
• Not necessarily illegal behaviour
• Similar to engineering, involves creativity/ craftiness (i.e., is a science & art)
(Holt et al., 2015)
A Crash Course in Cybersecurity
• Cybersecurity – the state of computer systems being free from cyber threats
• Attacks – Malicious actions by adversaries targeting a device/ network
• Weaknesses – Weaknesses are generic types of mistakes that occur frequently in
code (i.e. bugs)
• Vulnerability – The concrete realisation of a weakness
• Zero Day – A vulnerability that is unknown to a user/ administrator
• Interception – Where data is successfully extracted by an adversary
• Authenticity – A status assigned to users to confirm their identities and control access
to devices/ networks
• Data at rest – data stored on device
• Data in transit – data moving across network
The Criminalisation of Hacking
Criminal Code (Cth)Criminal Code (WA)
Wall, D. (2001). Crime and the Internet. London: Routledge.
Cyber-trespass Cyber-deceptions and thefts Cyber-pornography Cyber-violence
Crossing boundaries into other people’s property
and/or causing damage, e.g. hacking, defacement, viruses
Stealing (money, property), e.g. credit card fraud, intellectual property
violations (i.e. “piracy”)
Breaching laws on obscenity and decency
Doing psychological harm to or inciting physical harm against others, thereby
breaching laws relating to the protection of the
person, e.g. hate speech, stalking
Categories of Cybercrime
• Computed-enabled crimes/ Computer-dependent crimes (Furnell, 2002, p. 22; Lilley, 2002, p. 24)
Illegalities following Computer Intrusion*
Theft of computer resources
• Using the resources of hacked system, such as the storage of illegal materials
Theft of proprietary/ confidential information
• Stealing or copying information, such as theft of software, business secrets, personal information, etc.
Systems sabotage, alteration and destruction
• Causing damage to a systems’ operations such as the erasing or altering of personal information
Website defacement and spoofing
• Altering contents of a website or creating a “fake” website
Denial of service attacks*
• Preventing a user or owner access to services available on their system
Distribution of malicious software
• Malicious code which disrupts or damages computer data, such as viruses or ransomware
Online social practice
Licit opportunities Illicit opportunities
Electronic business Research and development; production; distribution; marketing and sales
Theft of trade secrets; disruption of online selling systems; fraudulent use of credit cards
Political purposes Inform and consult citizens; recruiting for political parties; organizing campaigns
Sabotage and defacement of official websites; instigating hate campaigns; use by terrorist groups
Leisure and cultural consumption
Movies and music; celebrity gossip; online video gaming
Distribution of obscene imagery; audio, movie, and software piracy
Social media platforms and the
“Internet of Things”
Use of fitness bands, smartwatches, kitchen gadgets, etc.
Hacking; data breeches; malware; cyber attacks; snooping
The “Dark Web” Political activists avoiding surveillance; persons wanting to maintain privacy
Contraband; illicit content; discussion of illegal matters
Technology and Licit/ Illicit Opportunities
Typologies of Computer Hackers
• Hacker typologies
o Black/ Grey/ White Hat Hackers
o State/ non-State actors
o Red Teams
o Script Kiddies
• Offenders are generally young and male
• Older ‘hackers’ tend to enter industry (i.e. cybersecurity professionals)
• Previously there was a financial barrier (middle class offenders), however this is gradually disappearing
Methods of Computer Hacking
1. Shoulder Surfing/ Theft – the process through which an adversary uses
physical surveillance or theft to gain access to a computer system;
2. Social Engineering – the process through which an adversary uses
interpersonal manipulation gain access to a computer system;
3. Cryptanalysis – the process through which encrypted data is cracked (i.e.,
decrypted) to gain access to data in transit and/or data at rest;
• Content Analysis – break classical encryption by analysing the frequency of letters/ symbols
• Brute-Force Attacks – try as many options as possible (although unlikely with 256-bit encryption)
• Mathematical Analysis – attempt to ‘crack’ algorithms (ciphers) used to encrypt/ decrypt communications (various techniques)
• Side-Channel Attacks – target the protocol (i.e., the system used to encrypt data) rather than crack the key
4. Payload Attacks (Trojans) – the process of installing malware on a device
• Remote Access Tools - Installing malware within applications to enable end-point identification
• Ransomware Attacks – Installing malware that encrypts the contents of a users’ device (demand payment to decrypt)
5. SQL Injections – the process of injecting computer code into a system to change its internal architecture (and thus functions)
(Sending plaintext)
E7 86 5B FC D8 A6 69 E1 B1 92 B9 5A 02 02 F2 A2 63 2D D0 41 50 C5 36 A9 DF F2 29 E5 A8 EB E6 33 BB 14 10 CB C9 39 D9 63 44 C5 65 4C FF 67 0C 7A 00 49 CC 88 54 78 3D 15 E3 0B 12 43 59 0F C5 AE 56 EC 2C 83 22 B5 3A 62 68 7E 37 39 6C C0 C7 FB 96 AF 68 1A 28 1B 03 D6 C6 00 E4 DE AF BE 4F 79 97 3D 56 05 33 D5 73 05 F9 40 0C 3A CF 38 9E 98 2E 45 3A 97 56 8A B4 3E 74 82 AE 7A 01 EF 9C 66 C7 2F D1 8D 4A 77 FE 7F 42 45 F6 86 A4 C7 DE 68 24 78 D3 17 73 1A 34 A9 9E 5E 98 40 73 1D 89 9C 1E 6E D8 9D CE D1 1E C7 74 60 75 96 0F 96 4D DE 61 D6 B0 5D 47 3C 7D DB 85 C8 86 18 F2 09 F6 65 BB AC D5 FC 42 7D 16 98 3D DC 67 89 96 86 F2 F5 F4 81 60 B2 25 2C 94 BD 14 71 B3 67 22 DA C4 A6 14 C9 58 C3 33 D5 CC 90 AE 12 1B 63 55 0F 74 EB 4C 4A 68 6D 95 7D 82 07 6D DC 03 37 5C 91 65 52 2F 2B 5E 77 50 F8 6F 7F 61 2A 17 D8 3A 9D 5D AF 66 86 F2 EB 0F 2D 0B 55 05 6C 6A 48 39 BD 68 41 E2 2D 6B FC FC B6 C2 CE 41 8A 9D 2B 27 0B 8F 10 81 E8 F9 96 FA 39 A7 03 8D A0 57 CC 14 9D 28 D4 29 79 67 69 E8 21 E5 D0 F5 82 90 CB EF A7 70 8F 7B B4 BE 4B 21 36 1D 64 5B 64 B6 9D E5 02 6D FB 4B 83 6D 90 78 E3 2A 42 9C 04 3A 3D 47 20 CA D1 F6 84 1D 3B 7E E8 FD 04 D8 6E AC 48 3B A7 4C 40 F1 0E D1 4B 73 B2 01 8F 39 BB BC 51 33 DF B1 9C BC 15 26 32 D7 BF 52 8B E4 77 8C BA 8F 50 93 E6 3E 62 3E 1C F2 AE BD 2A 75 AB 91 40 5A 11 54 7B 01 62 D4 1C 58 5F 1A BE 89 AB A5 F9 D0 DC 66 09 B1 57 13 D1 0C 31 F3 61 E7 93 55 37 B3 01 8E F4 87 E2 EC C4 52 F6 AD 78 76 E4 7F 09 58 63 34 2B F4 0E C0 9A 6A 08 AB 2F A3 6E CE 82 63 AC 14 CF DA 3B 8D E0 1A 5D 63 95 F2 10 57 16 F6 94 0B 5D E9 D1 4B 6C 14 6D 5F 3E C4 8D 80 2C 39 73 10 62 BB 14 10 CB C9 39 D9 63 DC 7F 79 AC 4B 7E 42 98 AA B3 F6 EC 56 56 6F 15 5A 2B 5D 41 FF A8 76 3F C8 ED EF 6A 0D 67 64 FF 57 88 C9 73 2C 5C 2A D2 25 4C 89 6B 0F CB 34 29 3F A4 0C F4 4B 5D 1D 0F DE C8 41 65 C7 70 11 BB EA 63 C4 FC C3 5E 65 BC 9C 42 8F E5 C2 02 65 3D 9A ED 09 51 8E 3E 71 85 F1 B7 C4 DE 74 DE 8F 14 F7 11 69 82 AC FF A1 75 E0 FA 65 CB 9F E9 C9 B0 4E 86 C0 AA ED 3F 15 AD FC 38 78 7C 70 3A B8 90 B4 70 A1 00 59 6F F0 7F B6 CD 67 37 D4 84 3F 9E 88 C7 76 1C 0C EB 73 96 F6 52 D4 22 05 EC E1 B8 81 E8 F9 96 FA 39 A7 03 AF 51 8C 51 FB C7 DE 02 22 BF AE 7C D8 A5 FD FA 91 56 FF E0 76 82 5B AA 02 00 3B 5F 67 91 92 84 4B 83 6D 90 78 E3 2A 42 5F 73 E7 E7 56 8A 9C 65 95 75 68 61 F5 54 89 86 49 C3 9A 14 2E C8 B7 DD 6F AA 11 DF 81 3A F0 C5 F3 47 1B F8 F6 BF 4B DC B4 70 A1 00 59 6F F0 7F 51 95 39 5F 73 3A 5E 3E 81 55 06 36 2F A5 30 D8 0B E1 3F 2F 44 E2 D6 E3 DD 8B 6D 01 49 C2 65 F2 64 1E BB 7D A3 E2 12 51 4B 83 6D 90 78 E3 2A 42 61 D8 A5 84 47 E5 F3 32 67 AE BF EF 0D 06 CC 4E 28 5C 59 64 6E A0 58 B7 E8 BE C4 21 B4 64 2C C8 6A 90 4D A6 BC 38 02 5D 3B BB CD CB 74 83 CD 04 95 3F 74 A1 BD 91 83 54 33 57 B0 57 F4 52 43 D7 66 86 F2 EB 0F 2D 0B 55 05 6C 6A 48 39 BD 68 41 9B 45 2C B7 F5 27 60 46 91 FA 68 E4 4A 29 DF 43 1F AA DD 8F A6 59 95 A7 B1 57 45 E9 4F CC 5E B3 FA BA 3D F0 84 E4 05 80 82 54 7B 1E F9 09 77 01 47 94 92 A9 1E 10 2D EE 1C 68 59 82 8E 06 22 BA 4F F2 E2 6D 71 B8 EF B6 29 04 78 2A D3 5E 2F BB F3 5A CD 57 CD 22 BC 46 89 5D 36 BA AD 49 FB 8F 93 8B AD 91 AB 58 1F 88 F4 81 60 B2 25 2C 94 BD 14 71 B3 67 22 DA C4 A6 14 C9 58 C3 33 D5 CC 90 AE 12 1B 63 55 0F 74 EB 4C 4A 68 6D 95 7D 82 07 6D DC 03 37 5C 91 65 52 2F 2B 5E 77 50 F8 6F 7F 61 2A 17 D8 3A 9D 5D AF 66 86 F2 EB 0F 2D 0B 55 05 6C 6A 48 39 BD 68 41 E2 2D 6B FC FC B6 C2 CE 41 8A 9D 2B 27 0B 8F 10 81 E8 F9 96 FA 39 A7 03 8D A0 57 CC 14 9D 28 D4 29 79 67 69 E8 21 E5 D0 F5 82 90 CB EF A7 70 8F 7B B4 BE 4B 21 36 1D 64 5B 64 B6 9D E5 02 6D FB 4B 83 6D 90 78 E3 2A 42 9C 04 3A 3D 47 20 CA D1 F6 84 1D 3B 7E E8 FD 04 D8 6E AC 48 3B A7 4C 40 F1 0E D1 4B 73 B2 01 8F 28 5C 59 64 6E A0 58 B7 E8 BE C4 21 B4 64 2C C8 73 1C 7D 89 48 74 DD 67 16 A5 0C B9 D8 82 E3 FD 28 0A F8 1E 82 5B 0B D2 49 C3 9A 14 2E C8 B7 DD FC DA 99 D8 47 35 B1 E1 7D 37 D5 09 E6 60 BE 48 11 62 05 CE A9 50 DE 9C 6D 90 E2 35 4D BC 8C 2C F6 24 82 A3 8F D2 74 90 F2 91 69 C4 73 0A EB E2 A5 2A D5 53 ED F3 AF 7F 4C 28 E5 4E DC 8A 0D AE AF E0 7D C7 DA 44 35 67 91 56 FF E0 76 82 5B AA 4B 14 FE CA CC 51 43 87
e.g., Let’s crack the Data Encryption Standard…
DES 05 06 01 03 -- -- -- --
Origins of ‘Hacker’ Label (1950/60s)
• Originated in the world of computer programming, within MIT’s Tech Model Railroad Club
• It was initially a positive label “used to describe someone who was highly skilled in developing creative, elegant and effective solutions to computing problems” (Yar & Steinmetz, 2019)
Massachusetts Institute of Technology
• Internet basics • A “network of networks” (Castells, 2002)
• Connections made between nodes
• Information and communication technologies (ICTs) have been in existence for decades
• Development heavily influenced by the military
• The development of the Semi-Autonomous Ground Environment (SAGE) system
• Emerged over concerns of domestic bomber strikes
• Helped lay the foundation of computer networking
• The U.S. military’s Defense Advanced Research Projects Agency (DARPA) • Resulted in the Advanced Research Projects Agency Network (ARPANET)
Vint Cerf (1943-Present)
Bob Kahn (1938-Present)
Origins of the Internet (1960/70s)
• ARPANET
• Created to ensure resilient and secure communications within the military during the Cold War era
• Allowed communications to be broken into “packets”
• A catalyst for both hardware and code
• Early 1970s • Electronic mail applications
• An “inter-net” of networks such as the JANET and the NSFNET
Origins of the Internet (1960/70s)
Evolution of The Hacker Ethic (1970s)
• ‘Hackers’ were said to form a community with its own clearly defined ‘ethic’, one closely associated with the social and political values of the 1960s’ and the 1970s’ counter-culture and protest movements.
• Though the term ‘hacker ethic’ was originally coined by Steven Levy in his 1984 work Hackers: Heroes of the Computer Revolution, it has endured in the discourse about hackers and hacker culture over time.
1. Right to freely exchange knowledge
2. A belief in science and technology to enhance lives
3. A distrust of authority (political, military and corporate)
4. Resistance to mainstream conventional lifestyles
5. A belief in meritocratic forms of social organization (Levy, 1984; Taylor, 1999: 24–6; Thomas, 2002)
Steven Levy (1951-Present)
Hacker Subcultures and The Hacker Manifesto (1980s)
By 1990: • U.S. authorities release ARPANET to civilian control
• Development of the web browser
WorldWideWeb (1990) NetScape Navigator (1994) Internet Explorer (1995)
Commercialisation of the Internet (1990s)
The Internet, Corporatism, and Hacktivism (1990/2000/2010s)
• Mass consumption of personal computers
• The Internet as a social and commercial space:
• First commercial internet browsers Netscape Navigator (1994), Internet Explorer (1995)
• Bulletin Board Systems (BBS) (1990s)
• Web forums (1990s-2000s)
• Social media (2000/ 2010s)
• Conflict over how to preserve the hacker ethic: Corporatism vs. Hacktivism
• Corporatism - aging ‘hackers’ entering computer security industry, including past cybercriminals
• Hacktivism – the use of ‘hacking’ for political pursuits (e.g. Crypto-Anarchism)
Heartland Payment Systems Hack (2007)
• In January 2009, 160 million credit and debit card details were extracted from the Heartland Payment Systems Company.
• The company serviced 100,000 other companies, processing their customer’s payment details;
• A team of hackers, including Albert Gonzalez, used an SQL injection to inject malicious code that intercepted payment details that were not encrypted (i.e., transited in plaintext);
• The data was then sent to an encrypted/ anonymous web hosting service in an attempt to mask their actions;
• The unauthored access caused over $300 million in financial harm to business/ individuals;
• Gonzalez was sentenced to 20 years in prison by a US Federal Court in Boston, Massachusetts ;
• Two citizens of Russia (Vladimir Drinkman and Dmitriy Smilianets) plead guilty in 2013, sentenced to 12 and 4 years respectively. Albert Gonzalez
Sony PlayStation Network Hack (2011)
• In April 2011, 102 million user records were extracted from the Sony PlayStation Network (personal information, login credentials; 24,000 credit card details)
• The hack was a response to Sony’s civil litigation against American man George Hotz for jailbreaking his PlayStation 3
• A vulnerability was found on the PSN web page login and password reset pages; the hackers were able to exploit this vulnerability via the same SQL injection as Heartland to extract data in much the same way:
• Personal information and credentials were being stored as unsecure ciphertext (i.e. easy to decrypt)
• However, most credit cards were safely encrypted during transit (unlike Heartland)
• Sony took the network offline to prevent further data being extracted, costing $171 million in lost revenue and damages;
• Lulzsec left a file on the servers named “Anonymous” with the text “We are Legion”. Three Spanish men and two American men were arrested for the hack;
• Sony’s response:
• Now stores all customer data in secure ciphertext
• Sony now runs a ‘bug bounty’ program Lulzsec Logo
Recap of Themes
1. ‘Computer hacking’ includes a diverse group of behaviours that may be pursued for either legal or illegal purposes (or ethical/ unethical);
2. Good cybersecurity practices are essential, as data breaches can cause significant social and financial harm;
3. The history of computer hacking is bound-up in political struggles and attempts by law enforcement to adapt to advances in technology.
