How do people "hack" websites like to shut them down or whatever? Is it as simple as learning C++ and Java? How do people take credit for what they did without being arrested?
Nah, it isn't that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That's a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of "the rest of the fucking owl" here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I'm gonna dumb this down for people like me:
if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn't.
Most software nowadays is incredibly attuned to this so there's truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you "hack" some software, you only need to find out how to use it the wrong way. That's why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.
It's a different skillset, although knowing programming (especially website programming so that's mostly JavaScript for frontend, while backend is commonly JavaScript or Python) can be helpful, having some idea of the type of errors people usually make when programming is the thing that's helpful.
This short version for how what most people call hack websites is that they figure out a security bug somewhere on that server and exploit it to gain access to that computer, and then they can take down the site or modify the contents. Doing this is very specific to the site in question and the vulnerabilities it might have, asking how people do this is kinda like asking how people break into houses, there are a million and one ways to do it and it depends on both the attacker and the target.
However a very common tactic is to point a bunch of computers towards that site so that the amount of traffic is high enough that legitimate users can't get through, that's not hacking the website though, it's the equivalent of calling a phone number nonstop so no one else can reach it, this is called a Denial Of Service (DoS) attack, and it's usually Distributed across several attacking machines as nowadays if a single IP hits you too hard you block it and carry on serving users, which is why this is known as a Distributed DoS or DDoS attack.
Finally, how can people claim to do that with impunity? The short version is they can't. These people usually take pseudonyms so as to not be traceable, and claim authorship under those, not their real names.
1
How do people "hack" websites like to shut them down or whatever? Is it as simple as learning C++ and Java? How do people take credit for what they did without being arrested? | Spyke
4 replies
Nah, it isn't that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That's a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of "the rest of the fucking owl" here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I'm gonna dumb this down for people like me: if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn't.
Most software nowadays is incredibly attuned to this so there's truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you "hack" some software, you only need to find out how to use it the wrong way. That's why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.
Try a beginner CTF like huntress CTF. It will start slow, with basic skills, and slowly build them up.
https://ctf.huntress.com/
It's a different skillset, although knowing programming (especially website programming so that's mostly JavaScript for frontend, while backend is commonly JavaScript or Python) can be helpful, having some idea of the type of errors people usually make when programming is the thing that's helpful.
This short version for how what most people call hack websites is that they figure out a security bug somewhere on that server and exploit it to gain access to that computer, and then they can take down the site or modify the contents. Doing this is very specific to the site in question and the vulnerabilities it might have, asking how people do this is kinda like asking how people break into houses, there are a million and one ways to do it and it depends on both the attacker and the target.
However a very common tactic is to point a bunch of computers towards that site so that the amount of traffic is high enough that legitimate users can't get through, that's not hacking the website though, it's the equivalent of calling a phone number nonstop so no one else can reach it, this is called a Denial Of Service (DoS) attack, and it's usually Distributed across several attacking machines as nowadays if a single IP hits you too hard you block it and carry on serving users, which is why this is known as a Distributed DoS or DDoS attack.
Finally, how can people claim to do that with impunity? The short version is they can't. These people usually take pseudonyms so as to not be traceable, and claim authorship under those, not their real names.