The funny thing about hackers, is that originally, the word “hacker” was just a slang term for programmer. People that broke into systems were knows a “crackers”, like safe crackers. Yet another example of language and culture being distorted by ignorance (like the word “meme”, which, for me, is another source of irritation).

I digress. This article is about those who intentionally break into computers. I shall stoop to the whims of modern culture and use the word “hacker” to refer to such individuals.

There are several motivations for hacking, but the most common, by far,  is not as most people would assume it to be. Most people view hackers as individual miscreants trying to break into people’s computers in order to get into bank details or shopping accounts. This is not the case. This sort of activity is way too labour intensive and getting a successful hack doesn’t guarantee that the user will use the required services or keep those details on their computer. It may take hours, days, weeks to break into a person’s computer. It’s not worth the potential payoff, or lack thereof. There are easier ways to get money out of people using computers, such as phishing or plain old scamming.

The most common reason to hack a computer is to get control over the computer itself. Once control has been acquired, the computer is then used as a bot for other nefarious activities, such as: spamming; denial of service attacks and as a drone to find potential exploits in other computers. The computer becomes part of a bot net, consisting of thousands of similarly acquired computers for coordinated campaigns against other targets. These hackers, really don’t give a damn about the bank details stored on your computer or the cookies that allow them to get into your Amazon account and order themselves a nice big 60″ TV. Such hacks are totally automated. For this reason, they also mostly target servers rather than home or office computers. Workstations and home PCs have an irritating habit of being switched off for hours at a time, so they don’t make good targets for this kind of activity.

Unlike the movies, where a single malcontent uses some geeky illegal tools to illicitly gain access to a computer in minutes, real hackers do nothing of the sort. Real hackers write programs, viruses and Trojans. These programs run through various known exploits, either targeting a single computer with many different potential exploits or thousands of computers looking for just one. When a potential target is found, the IP address and the nature of the vulnerability is sent to other programs which probe more deeply. The cycle repeats until the intervention of a real person is required. The whole process can take months and very often will do, for good reason. If a vulnerability is found, the last thing the hacker wants is for the administrator or user to be made aware of the exact nature of the exploit. Most systems will flush their log files after a few months, and once the log files have gone, there is no way of finding out how the hacker got in. The administrator may clean up the mess left by the hacker, but as soon as they have, the hacker is back and doing it again.

These sorts of hackers work in organised teams, where each hacker does what he (or she) is able to do. As exploits are found, they are passed on to the appropriate team member, who attempts to gain further control. This could be Windows Terminal Services, Linux SSH, Postfix Mail… whatever service has been compromised, they will have specialists who know how to quickly utilise the broken service. After gaining entry, the first thing the hacker will do is ensure that they can get back in. This normally involves installing back doors or creating secret accounts, just in case the wily admin notices the security breach and closes the hole. Such back doors can either be simply new accounts added to the system or specialist pieces of software clandestinely dropped into a website (or if security is really lax, the system itself in the form of a new service).

The second most common reason for hacking is, believe it or not, for fun. The challenge of breaking into a computer, simply because it’s there. The modern day, high tech equivalent of petty teenage crime. Where adolescents go through the psychological phase of testing the boundaries. This may, or may not be accompanied by acts of vandalism, but ultimately is more of a nuisance than a real threat. They could also be perceived as a blessing in disguise, exposing security flaws without too much damage.

Gaining access to a computer in order to get information, is actually incredibly rare, unless you’re someone important and your computer contains information that would be extremely valuable in the wrong hands. This seems to be common image of the hacker, but such true hackers are very highly skilled and exceptionally rare. Additionally, those who are that skilled are more likely going to be gainfully employed for their knowledge, either as security experts or as, what are known as, white hat hackers. These white hat hackers are employed to test cyber security as part of a penetration testing company.

In summary, for most people using their home computers, laptops and phones, hacking isn’t a real threat (so long as reasonable precautions have been made, ie. a firewall and anti-virus software). Over 99.99% of hacking attempts are performed by programs and need prolonged internet connection on the same IP address.

So, what’s the biggest vulnerability to your computer security?