Catapults and Grappling Hooks: The Tools and Techniques of Information Warfare

For years, "hackers" have broken into computer systems, and now an entire industry is dedicated to computer network security. Both hackers and computer security professionals have developed software tools for either breaking into systems or identifying potential security problems within computer networks. This software can be found on compromised systems as well as within the toolkits of legitimate "tiger" teams that operate with the consent of the network owners. This paper describes some of the current techniques and tools employed by the hacker underground in breaching the security of networked computers, focusing primarily on UNIX®-based hosts connected to TCP/IP networks. As organizations become increasingly dependent on computer network technology, they also become increasingly vulnerable to losses, of both financial resources and reputation, resulting from security breaches within their computer and communications infrastructure. Many of the federally funded organizations dedicated to computer security issues were formed in response to attacks on computer systems. One of the first groups, Carnegie Mellon University's Computer Emergency Response Team (CERT[1]), was formed following an incident in which thousands of computers connected to the Internet were broken into and many disabled. This was the result of a self-replicating computer program, developed by Robert T. Morris at Cornell University, commonly referred to as the "Internet Worm."[2,3] Computer security has become a serious issue. The media have reported a substantial number of recent attacks on high profile sites, and the number of reported security-related incidents is on the rise. In 1996 the United States Department of Defense (DoD) reported an estimate of 250 000 attacks per year on its computer system and stated that the rate of attack is increasing by 100 percent annually.[4] Page 1 of 11 Catapults and grappling hooks: The tools and techniques of information warfare 8/25/01