• PC World
• »Security

Hackers and members of the Internet security industry, like workers in other specialty trades, have their own form of shop talk. The following is an abbreviated list of catch phrases and euphemisms used by hackers and security professionals.

Back Orifice: A tool written by the well-known hacking group Cult of the Dead Cow to provide a simple yet powerful way for hackers to control a computer from afar. The latest version, Back Orifice 2000, can be used to take over virtually any Windows PC. But first the hacker must trick the PC's user into accepting a Trojan horse, a program that appears benign but actually contains a hidden Back Orifice server. Once Back Orifice is installed, a hacker can do a range of things, from pranks such as changing the look of your screen to more serious breaches such as stealing your passwords.

black hat: If you think of www as the wild, wild west, then you can guess on which side of the law the black hat hacker operates. Black hat hackers (aka "crackers") steal data or damage systems. The most dangerous black hats are able to remain undetected for years, secretly monitoring a victim's PC for whatever nefarious purpose they have in mind.

buffer overflow: A common and easy-to-exploit vulnerability on many operating systems. Applications and operating systems store commands in short-term memory, called buffer memory. If the OS or program isn't properly coded, hackers can freeze or crash a computer by sending a specially created command that is much longer than the OS or program can handle. Windows 95 was vulnerable to many kinds of buffer overflow attacks launched over the Internet. Today, such attacks against a single computer are rare, though sometimes a hacker can slow down a large Web site with a buffer overflow.

cracker: Another term for black hat hackers, who operate with criminal or malicious intent.

denial-of-service attack: A way to slow down the performance of a Web site by repeatedly and rapidly requesting information from the site's server, preventing the server from focusing on its normal operations and blocking other users from accessing the site. In the past, a hacker would launch this attack over the Internet from a single computer.

distributed denial-of-service attack: In 1998, a group of hackers created a program that allows one hacker to launch a massive, coordinated attack from thousands of "zombie computers" that the hacker has taken control of remotely. These DDoS attacks have brought down giant Web sites such as Yahoo and eTrade. But with new detection software and special training, network administrators of large companies usually can stop even a large DDoS attack in its tracks.

exploit: Shorthand for any vulnerability in an operating system or application that opens a system to a hacker's attack. New exploits are constantly being uncovered. Each time a new OS or large application is released, hackers and security professionals start working to expose its security flaws. News of new exploits spreads on mailing lists from organizations such as CERT, BugTraq, and in Microsoft's security bulletins. In nearly all instances, software makers provide patches to protect against exploits. Many hack attacks occur using well-known exploits for which patches are already widely available, and often succeed because system administrators and computer users fail to install the patches.

firewall: A software program that prevents intruders from entering a computer or network from the Internet. Anything entering or leaving a system protected by a firewall is examined to see if it violates the system's security standards. A firewall can also be set to prevent unauthorized data, such as a company's proprietary information, from being sent out over the Internet from a user's computer.

hacktivism: Hacktivism is hacking for a cause. Social or political activism combines with hacking techniques--hackers who use their skills to make a statement, or activists who learn hacking skills specifically to take their message to the Web and reach a larger audience. Hacktivists might deface child pornography Web sites, or post messages about policies or governments they oppose. Political hacks have been targeted against the governments of India, Israel, China, and the United States, among other countries.

intrusion detection system: A burglar alarm for a computer or network that tells an administrator when an intruder might be trying to gain access to the system. Intrusion detection systems go one step further than firewalls: They can determine exactly what kind of attack is being launched, and can alert administrators to enact appropriate countermeasures. They also give administrators data to help them track any intruders who successfully enter a system.

root: This term is adopted from the world of UNIX systems, where the user who has the highest privileges on a UNIX machine is given the log-in name "ROOT." Hackers use the term to describe obtaining total control over a system. The term is used both as a verb ("I rooted that FBI box") and as a noun ("I got root on that NSA machine").

script kiddie: An inexperienced hacker who uses prewritten applications (available as downloads from the Internet) to launch certain types of attacks, such as Web-page defacements or denial-of-service attacks. More experienced hackers tend to disdain script kiddies, because the script kiddies often don't understand the technology behind the attacks they launch.

Trojan horse: A Trojan horse is an application designed to perform an illicit or malicious action, but is disguised as a more benign program. Often arriving via e-mail as an attachment, Trojans are far more sophisticated than viruses or worms, and often allow a hacker unlimited access to a compromised machine. Three of the most common Trojan horses are Back Orifice, NetBus, and SubSeven.

white hat: A hacker who is motivated to explore systems for intellectual curiosity, rather than for malicious or criminal intent. White hat hackers oppose doing damage to systems, stealing data, or interrupting service to a Web site. But their activities may be illegal if they explore systems they aren't authorized to enter. White hats can also unintentionally damage or delete data. Many white hat hackers work as well-paid security consultants, programmers, and network administrators.

• See more like this:
• hack,
• hacker,
• hacking,
• security,
• trojan horse,
• firewall,
• back orifice,
• virus,
• glossary,
• trojan,
• buffer overflow,
• hack