Curious questions about comptuer hacking

[The_Absolute]

I am not a computer hacker, and have absolutely no idea how to do so. I was wondering just how mathematically mind-boggling that computer hacking is. Don't you have to make extremely complex and fast mental calculations and type in thousands of odd numbers at some kind of prompt? Do you have to be a mathematical genius to understand the basic principles of hacking? Such as someone who has the intelligence and mental quickness almost instantly square-root extremely large-digit numbers (mentally) dozens of times per minute? Does it also take a vast knowledge of electronic engineering to perform? I don't know much about hacking, and have no interest in doing it to anyone. I just know that I get "there has been a recent attack on your computer" icon popup in the bottom right-hand corner of my desktop every half-hour or so. I don't know who is doing it, or why. I do not have any online enemies (that I know of) and I know that it is a "malicious toolkit" that comes from an "FTP".

Every time my computer gets hacked, it costs about $200 minimum to take it to the PC repair shop and get it fixed.

 

[Greg Bernhardt]

Some hackers are geniuses no doubt, but most are "script kiddies". These people primarily wreak havoc on those who leave their computers wide open using programs that target common computer weaknesses.

 

[chiro]

I am not a computer hacker, and have absolutely no idea how to do so. I was wondering just how mathematically mind-boggling that computer hacking is. Don't you have to make extremely complex and fast mental calculations and type in thousands of odd numbers at some kind of prompt? Do you have to be a mathematical genius to understand the basic principles of hacking? Such as someone who has the intelligence and mental quickness almost instantly square-root extremely large-digit numbers (mentally) dozens of times per minute? Does it also take a vast knowledge of electronic engineering to perform? I don't know much about hacking, and have no interest in doing it to anyone. I just know that I get "there has been a recent attack on your computer" icon popup in the bottom right-hand corner of my desktop every half-hour or so. I don't know who is doing it, or why. I do not have any online enemies (that I know of) and I know that it is a "malicious toolkit" that comes from an "FTP".

Every time my computer gets hacked, it costs about $200 minimum to take it to the PC repair shop and get it fixed.

The people that develop the tools from their C/C++ dev-kit are the ones that are able to effectively get into your PC almost any of the time.

The other ones (the ones that Greg mentioned) are just using everyday tools to get into your account.

Having had programming experience I can tell you a few things about how programs work and how you can avoid more nasty surprises.

Basically (in a very big nutshell) this is how the internet works:

You have an address on a very large network. On your address you have a list of ports. Through these ports you can basically talk to other computers via what is known as a protocol. Typically the protocols in use are TCP/IP and UDP (the major ones you will use). I won't discuss things like ATM or some of the other ones because I don't think they will apply to your case.

Essentially what happens is pretty simple. At some level in the protocol (the set of rules in which the information is sent/received and processed from other computers and yourself), there will be varying levels of accepting and rejecting data based on the hardware (ie your network card and modem), the operating system (ie windows) and the application you are using (ie ftp, email, computer game etc).

Based on the configuration of these three things, you effectively control what can happen.

Now the hardware is usually standardized and you get options to do certain things in what is called your driver. If you use something like linux then you can probably modify things but we won't get into this. Basically in most cases you don't want to modify what happens in this level. You might set up things like port-forwarding or something in your router settings for particular programs and some fancy firewall rules (i'll go into this later) but apart from that you should use your operating system to set the restrictions.

Now the operating system manages all packets incoming and outgoing on your computer. It will add them to a protocols stack and the application that is receiving them on a particular port will basically be sent the information and it decides what to do with it.

Here you have a few options:

1. Get a firewall and basically block anything that you don't trust or don't know about.

This happens at the Operating System level. What happens is that a firewall program creates a hook into the OS and basically allows you to accept or deny ANY packet that comes in or goes out.

This is what you most likely want to do. What will happen is that the firewall will start out by asking you what to block and what to accept. You will block what you don't know and accept what you do know.

Now what this means for you is that you will have some coarse level control on your computer. It means that if someone is trying to send you a packet to hack into your computer (possibly something through services host) then you can see that a packet is coming from a specified address and is trying to get directed to that service. You can simply deny it and they won't get access. Simple.

Well the problem with that is that some windows services actually need packets and others don't. In this case you block certain address ranges. For the most part problem solved.

The other part is left to the application. Basically the rule of thumb is Murphy's law here: if it can happen it probably has and will happen again. If an application has the potential to launch "user" code on your account then basically don't trust it.

If something is trying to install itself on your computer don't let it. Most firewalls will also hook the ShellExecute and other executable running addresses so use this feature. If something shoddy looking comes up that you don't know about the answer is simple: don't run it because its probably suss.

Depending on the application you will get to know the capabilities of the protocol by reading the help menu and finding out what the application can and can't do. The more minimal the application the better because it means you can understand and better trust what's going on. If you have a simple FTP client for example, it can probably send files, get files, do some minimal messaging and not much else. It's simple and it's more likely that you can trust any communication using that program than using something more complicated like the windows services host.

2. Create your own applications and be sure that no-one can use backdoors

This is what groups of people work on and it takes a long time to become experienced in this so I think i'll let this one slide ;)

3. Use more secure operating systems/programs

Some operating systems expose more decision making capabilities to the user which means that you as a user can set things to happen or rather not happen. Like 2 this will demand
more experience. It's usually what system admins do for large coorporations: they use
very customizable environments and configure every last thing they can so that only what
they know will get through. Beware though as this is not an easy thing and sometimes the
most complicated configurations can let something slip through.

The above is usually the typical cat and mouse between hackers and sysop's.

Typically you will want to use number 1. A good firewall program that I have used is Kerio Personal Firewall. The one from Norton is good as well. You should definitely google for firewalls and evaluate a lot of them for what they do and don't do.

I hope that you can make sense of this and at least use it as a stepping stone to better secure your PC instead of paying some guy 100 bucks each time to do it for you :)

Matthew

 

[Hurkyl]

Don't you have to make extremely complex and fast mental calculations and type in thousands of odd numbers at some kind of prompt? Do you have to be a mathematical genius to understand the basic principles of hacking? Such as someone who has the intelligence and mental quickness almost instantly square-root extremely large-digit numbers (mentally) dozens of times per minute?

Arithmetic ability has nothing to do with mathematical genius.

 

[michinobu]

I am not a computer hacker, and have absolutely no idea how to do so. I was wondering just how mathematically mind-boggling that computer hacking is. Don't you have to make extremely complex and fast mental calculations and type in thousands of odd numbers at some kind of prompt? Do you have to be a mathematical genius to understand the basic principles of hacking?

If you mean hacking in the media sense, then no. All you need to know is the basics of networking like TCP/IP and etc. It's not really a computer science subject so much as it is IT and Networking.

Such as someone who has the intelligence and mental quickness almost instantly square-root extremely large-digit numbers (mentally) dozens of times per minute? Does it also take a vast knowledge of electronic engineering to perform?

Cryptography, however, is really mathematical. Yet, if you get the basics behind, you can always write a program which will have your computer decipher complicating code in an instant.

I don't know much about hacking, and have no interest in doing it to anyone.

They teach it at some universities. If your college is NSA-certified, then they'll likely teach you how to hack into networks and defend them from hackers. You can get a scholarship for school for such a purpose. If you don't have a NSA-certified school, they do offer cyber-security at the Air Force college. I forget the name of the base it's on, but I picked up a pamphlet for it onetime. However, it was being offered to grad students, and you sound like you're still in high school or something.

I just know that I get "there has been a recent attack on your computer" icon popup in the bottom right-hand corner of my desktop every half-hour or so. I don't know who is doing it, or why. I do not have any online enemies (that I know of) and I know that it is a "malicious toolkit" that comes from an "FTP".

Most likely it's not anyone you know or who knows you, but a porn site you visited one time before.

Every time my computer gets hacked, it costs about $200 minimum to take it to the PC repair shop and get it fixed.

Well, if it costs that much to get it fixed, you'd probably save yourself some money by going to your local bookstore and purchasing a pc-repair book. By educating yourself, you empower yourself. Hacking isn't something that someone on this forum can easily teach you.

 

[CRGreathouse]

Arithmetic ability has nothing to do with mathematical genius.

And mathematical genius has precious little to do with computer hacking, I might add.

 

[michinobu]

And mathematical genius has precious little to do with computer hacking, I might add.

It depends on what you mean by hacking, however. When people think hacking, they think about what's on TV. Like, they think that hackers are some sort of geniuses who can crack passwords and break into bank accounts. Cryptography, which would involve cybersecurity and cyber-espionage (as well as espionage in general), is math-oriented. Your average hacker, having an education explicitly dealing with network security, wouldn't necessarily know a lot about cryptography except what someone else has given them to work with - the application aspect.

 

[turbo]

To the OP - go get AVAST free home edition right away. It is WAY better than NAV MacAfee, etc, and the virus/worm definitions are updated at least daily. In addition, the core program is updated at least monthly, it seems. Those guys are staying ahead of the curve.

Also, go to Steve Gibson's site, perform some security evaluations on your PC, and educate yourself on the things you can do on your end to stay safe.
http://www.grc.com/intro.htm

 

[The_Absolute]

My I.Q. is 89, and my math level is barley at a 6th grade level. I don't think I have the intelligence to comprehend the MIT and genius level math that is demanded for understanding the basics of computer science and hacking.

 

[x3qt0r]

IQ levels are overrated.
And never underestimate yourself.

 

[HallsofIvy]

My I.Q. is 89, and my math level is barley

Ah too much beer! Me too!

at a 6th grade level. I don't think I have the intelligence to comprehend the MIT and genius level math that is demanded for understanding the basics of computer science and hacking.

 

[x3qt0r]

rofl :D

 

[The_Absolute]

I am 21 years old but have the mental age of about 15 at most. I do not think I am intellectually capable of comprehending the extremely advanced and difficult math that goes with computer hacking and advanced computer science. My intelligence is going to have a profound effect on my life success and independent living abilities for the rest of my life and there is absolutely nothing I can do about it.

I apologize for my typo mispelling of the word barely.

A few other hypothetical questions though, would I receive a long federal prison sentence for hacking into a private myspace profile of someone I used to know just so I can view it? Would I need an idiot savant to hack into it?

 

[Borek]

I just know that I get "there has been a recent attack on your computer" icon popup in the bottom right-hand corner of my desktop every half-hour or so. I don't know who is doing it, or why.

That usually means that some script has been probing ports on your computer. There are plenty of such scripts and you don't need more knowledge then average computer user to use them. They send data packets to random IP addresses looking for computers that will answer in a way that suggests computer is not protected.

Note that as long as you get this kind of message it usually means that the attack has been detected by fire wall or antivirus software and you are on the safe side. Problem is when the port probing was accepted as normal activity while in reality it wasn't. In most cases you will not get warning then.

 

[turbo]

Again, Steve Gibson's site (grc.com) has excellent tools to test for open ports and weaknesses in your firewall. You can learn a lot (or a little if that's all you want) about security from his site.

 

[harborsparrow]

I have had really good luck with the following simple strategy:

1) start with a clean install of Windows
2) avoid Microsoft email clients; use Thunderbird email instead
3) avoid browsing the web with Internet Explorer; use Firefox instead
4) run the Windows Firewall
5) get Windows updates regularly
6) back up any data that I'm unwilling to lose
7) don't put data on my computer that would cause a big problem if it got stolen
4) don't bother running virus software; the cure is worse than the disease

I am a programmer who knows A LOT about computers and networking, and this simple strategy has worked for me for many years. Keeps life simple too.

 

[The_Absolute]

I have had really good luck with the following simple strategy:

1) start with a clean install of Windows
2) avoid Microsoft email clients; use Thunderbird email instead
3) avoid browsing the web with Internet Explorer; use Firefox instead
4) run the Windows Firewall
5) get Windows updates regularly
6) back up any data that I'm unwilling to lose
7) don't put data on my computer that would cause a big problem if it got stolen
4) don't bother running virus software; the cure is worse than the disease

I am a programmer who knows A LOT about computers and networking, and this simple strategy has worked for me for many years. Keeps life simple too.

Firefox is better than IE? Does it have less security holes? Doesn't it run and load pages faster? Is Firefox really popular?

 

[Pythagorean]

Firefox is better than IE? Does it have less security holes? Doesn't it run and load pages faster? Is Firefox really popular?

Firefox > IE

 

[Borek]

Firefox is better than IE?

Depends on whom you ask.

Does it have less security holes?

Even if not, it is less often targeted - for at least three reasons. First, IE is still more popular, so attacking IE users you have more potential victims. Second - those installing Firefox are obviously more computer savvy and their computers more likely to be defended. Third - average time between security hole is discovered and secuity hole is removed is several times shorter for Firefox (that's information Junior gave me seing what I am typing about).

Is Firefox really popular?

Percentages from my server December logs:

MSIE 7.x 32.4%
Firefox 3.x 23.8%
MSIE 6.x 19.8%
Firefox 2.x 6.06%

(out of 730 khits). Could be my sites visitors stats are skewed.

 

[harborsparrow]

Firefox does not run ActiveX controls (DLL's) on your computer; it cannot run them, and they are one of the big security holes in IE. Same for the email clients. Email was never designed nor intended to allow programs to run on your computer without your permission; Microsoft's Outlook and Outlook Express (and Exchange) made a misguided design decision sometimes to "save the user from having to click" before an attached program could run--major mistake.

You CAN run a bad program in Firefox (as Javascript, for example) but the odds are much smaller.