Massive cyber-attacks such as the one that hit Canada's National Research Council can be prevented by knowing how attacks are executed and acting accordingly

Cyber-attacks are going to increase with the growth of networked health care, virtual currencies and emerging technologies, according to Bloomberg.

Like Us on Facebook

But by knowing the steps cyber-criminals use, most attacks can be prevented, said security consultant Geoffrey Vaughan, an ethical hacker.

Ethical hackers are computer and network specialists who attack a defensive cyber system on behalf its owners to look for weaknesses a malicious hacker can take advantage of.

Hacking is complex process but can be broken down into six key steps, Vaughan told CTV News.

First, the hacker performs passive then active reconnaissance.

The hacker won't visit the target site when doing passive reconnaissance. Instead, he'll visit Facebook, Google and other websites to gather as much information as he can about the target. He'll also try to figure out who the contact of the website administor is in the domain name organization.

The cyber criminal then launches his active reconnaissance where he visits every webpage of the target to collect more data.

When a hacker does active reconnaissance, he'll look like a regular user but the usage will be abnormal, Vaughan said.

At that point, the hacker has done nothing wrong, but the strange usage is the first clue to a site administrator that something strange is happening.

The hacker will start analyzing possible weaknesses. These weaknesses include what kind of server the target is running and what ports are available. He will then solicit information from the servers.

Vaughan said proper configurations of servers can prevent them from revealing information.

Third, the hackers will search for loopholes or try to uncover anything outdated in the system they're trying to break into.

The actual attack happens in the next step when the criminals bypass what Vaughan calls the "trust barrier" and enter the system.

In the fifth step, the hacker promotes his privileges on the server to gain access to all of the information on the system.

The last step is to steal all the needed information.

"Any formal hacker would go through a more established methodology like this one," said Vaughan.

As for the attack on the NRC, Voughan is curious about how much data was mined by the hackers before the site was closed down.

"If they breach the trust barrier into the network ... it's impossible to know with 100 percent assurance you have removed the threat so the best way is to start over," he said.

TagsChinese hackers, hacker, hackers, internet security, servers, Ethics, Tech, technology, technology news, information technology, information gathering