Hacking

This chapter provides a comprehensive overview of the strategies employed by illicit computer hackers to compromise security. Rather than a monolithic activity, hacking is presented as a constellation of techniques ranging from the discovery of software vulnerabilities to the theft of computational resources. The authors emphasize that while many hackers are motivated by curiosity or skill-building, the criminal element poses significant risks to businesses, governments, and individuals in an increasingly digitized society.

The paper categorizes common illicit activities into several key areas:

• Vulnerability Exploitation: Hackers hunt for bugs or design flaws in software and hardware. These vulnerabilities are often sold on black or grey markets, with 'zero-day' exploits—those unknown to vendors—commanding the highest prices.
• Unauthorized Access and Data Breaches: By gaining 'ownership' of systems through social engineering or technical exploits, hackers can steal sensitive proprietary or personal data, often leading to massive financial and reputational damage.
• Resource Theft and Sabotage: Beyond data, hackers steal processing power for cryptocurrency mining or bandwidth for denial-of-service (DDoS) attacks. They may also alter system logs to evade detection or sabotage critical infrastructure.
• Malware and Automation: The development of worms, Trojan horses, and botnets has allowed hackers to automate attacks. The availability of user-friendly hacking tools has 'democratized' these capabilities, enabling even novice users to launch sophisticated cyber-attacks.

Legal systems have struggled to keep pace with the rapid evolution of hacking. Early attempts to apply traditional laws regarding trespass and theft often failed, leading to the creation of specific legislation like the US Computer Fraud and Abuse Act (CFAA) and the UK Computer Misuse Act (CMA). However, these laws face significant criticism. Critics argue that enforcement is inconsistent, prosecutions are rare, and the laws often fail to act as effective deterrents. Furthermore, the transnational nature of the internet creates 'regulatory arbitrage,' where hackers operate from jurisdictions with lax enforcement, necessitating international agreements like the Budapest Convention to harmonize global responses.

• Zero-day: A vulnerability or exploit that is unknown to the software vendor, leaving no time or available patch to fix the security hole before it is used in an attack.
• Social Engineering: A non-technical hacking strategy that uses deception, such as phishing or manipulation, to trick individuals into revealing sensitive information or granting system access.
• Botnet: A network of compromised computers ('zombies') controlled by a 'botherder' to perform coordinated malicious tasks, such as DDoS attacks or cryptocurrency mining.
• Buffer Overflow: A specific technical exploit where a program is forced to accept more data than its memory buffer can hold, allowing the attacker to overwrite adjacent memory and execute malicious code.
• Regulatory Arbitrage: The practice of exploiting differences between legal or regulatory regimes across different countries to avoid criminal sanctions.