Based on everything we know, this truly seems to be the golden age of Hacking. To sum
things up, it is a great time to be a hacker. Because there are so many possible systems
to break into and most of them have such weak security, attackers can pick and choose
which machines to go after. To make matters worse, most companies have insufficient
information or resources to track these attackers, so even if they are detected, their
chances of getting caught are slim. No one polices the Internet, and in terms of
knowledge and experience, attackers have the upper hand. Not only is it a good time to
be a hacker, but it is a good time to be a security professional. There is plenty of work
and a whole lot of challenges ahead.
A recent and well-known example of hacking attacks happened in February of 2000.
Several large sites on the Internet were attacked within in a short period of time. The
type of attack was a distributed Denial of Service attack in which company websites
became unreachable to legitimate users. These attacks will be discussed in detail in
Chapter 6, “Denial of Service Attacks.” From a business perspective, this had a large
impact on the victim companies. For one company, an online bookstore, the attack
resulted in lost revenue—not only did the company lose sales, but it lost customers.
Let’s look at an example. If a customer, intending to buy something online, tries to
connect to a company’s web site at 10:00 p.m. and the web browser displays the
message “Website Unavailable,” he might try back at 10:45 p.m. When the customer
tries again at 11:30 p.m. and still receives the same message, more than likely, the
customer will go to a competitor to buy the product. With the amount of competition on
the Internet, if a customer cannot access a site in a matter of seconds, he will quickly
give up and go to a different site.
Ironically, companies were so afraid of the Y2K problem that they dumped large sums of
money into fixing it. In several cases, it seemed like a waste because the problem was
overestimated and hyped by the media. Now there is a problem far worse, but companies
are looking the other way. They do not want to invest the money.
There are several reasons why so many companies are vulnerable, but one of the main
reasons is lack of awareness. Companies have not realized and still do not realize the
threat. One of my goals in writing this book is to make people aware of the threat and
the tools that exist to protect their sites. Ignorance is deadly, but knowledge is power. If
an attacker breaks into your house with an arsenal of guns and you have no weapons,
you cannot defend yourself. On the other hand, if you are properly trained on weapons
and know the limitations of the weapons the intruder is using, you have an upper hand.
This is the exact purpose of this book. Giving IT professionals the tools and techniques
attackers use to break into sites, equips them with the proper defenses.