by MK

Created on: May 13, 2008

Do we need a hacker to help us catch other hackers? No, I don't think we do. What we do need though is someone with the similar skill set as that of a hacker.

That isn't easily found today as it takes an impressive level of skill to successfully hack a server or application. The process involves finding a weakness to exploit, getting around all the security controls, gaining access, covering your tracks and then leaving with no evidence of having been there or done anything. It involves considerable expertise including, but not limited to, network infrastructure, server management and application behavior.

Some hackers work alone whereas others work in teams, combining their respective knowledge and skills. Some act maliciously. Others do it to impress their peers, prove their capability on a dare or even as a personal challenge. Whatever their methods, motivations and goals, catching them takes a lot of time, effort and skill.

Catching a hacker means working from the target machine backward. It involves knowing enough about all the devices between the target and the source machine to extract clues that might lead you to the person who launched the attack. Of course by the time you get to him, he might have moved on to his next target. Or you might have found a decoy machine running code with no one there.

Today, programming skills are not even a pre-requisite to hacking. Hackers can download scripts to launch attacks. These types of hackers are known as script kiddies. They usually depend on tools readily available to exploit an inherent weakness. They're usually mentored by experienced hackers who show them how to get around security implementations. But what resources are there available to the guy trying to catch the hacker? Not as many as there are to the hacker. It is far more difficult for the good guy than it is for the bad guy.

Catching a hacker in the act means having to figure out how to safe your data and at the same time collect enough data to persecute the hacker. It's an expertise in itself. It might involve shutting down the system. The hacker's IP address will need to be figured out and where the attack is originating from.

It doesn't take a hacker to catch a hacker but one will need to have compatible skill levels and be able to think like one. It will be also far more difficult being the good guy than the bad guy in terms of where you can go to for support if you get stuck and don't know how to move on. It's not fair but that is the bottom line.

Learn more about this author, MK.
Click here to send this author comments or questions.