In this blog post, we’ll examine how hacking occurs in the digital age—where computers and networks have become essential foundations of daily life—and how security technologies have evolved to counter it.
In modern society, where nearly all work and communication rely on computers and networks, the issues of hacking and security have become critically important. Hacking no longer merely infringes on privacy; it can cause significant economic damage and has even led to national-level security crises, such as the July 7, 2009, DDoS attack targeting South Korea. However, while computers have become so ubiquitous that they are essential to nearly everyone, it is true that hacking techniques remain unfamiliar to the general public. Consequently, hackers are sometimes viewed as individuals with extraordinary abilities, and it is easy to feel helpless and powerless when targeted by their attacks. Yet, this fear can be attributed in large part to a lack of understanding of hacking techniques.
Methods of hacking include “system hacking,” which involves directly accessing a target computer to gain control, and “network hacking,” which exploits vulnerabilities in a network to gain access; however, these classifications are not officially standardized by academia but rather distinctions that hackers and security professionals have used for convenience. Recently, methods that exploit security vulnerabilities in wireless communications—such as through fake Wi-Fi networks—have also been used. Denial-of-Service (DoS) attacks, which aim to disrupt a service, are sometimes classified separately due to the specific nature of their objective. The type and quality of information that can be obtained also vary depending on the method used.
First, a prime example of system hacking is the “buffer overflow” technique—one of the most classic methods that helps illustrate the fundamental concepts of hacking. This method disrupts a program’s normal operation—or, in some cases, forces it to perform actions intended by the attacker—by writing data beyond the boundaries of the memory area used by the program. To illustrate the mechanism simply, it is akin to a programmer placing a 1-liter cup on a table and pouring 100 liters of water into it. The table on which the cup rests can be viewed as memory; 99 liters of water would overflow, completely soaking the table. If a cell phone were placed on the table, it might be damaged. In other words, parts of the program that were not intended to be affected are impacted, causing it to malfunction contrary to the developer’s original intent. An attacker who accurately understands the memory structure and program behavior can exploit this vulnerability to perform actions of their choosing. In the past, a common goal for attackers was to open a command prompt with administrative privileges; if such an attack succeeded, they could gain extensive control over the computer. A command prompt with administrative privileges is extremely dangerous, as it allows for a wide range of actions—from deleting or exfiltrating files to executing programs the user did not intend to run or disrupting system operations. In other words, exploiting such system vulnerabilities to gain administrative privileges enables the attacker to perform a vast array of actions on the affected computer. Since this technique becomes a very powerful attack method if successful, preventing it is primarily the responsibility of program developers. Users should, whenever possible, avoid running programs with administrator privileges and instead utilize the protective features of the operating system and security software to block unauthorized access.
A backdoor is not so much a hacking technique as it is, quite literally, a program or feature installed by an attacker to allow them to gain access secretly and illegally—that is, through a “back door.” You may recall a time in middle school when, in a computer lab connected to the school’s internal network, you secretly installed a backdoor program on one computer and then opened a suspicious website or launched a game on another computer to play a prank on the friend sitting at that station. In the past, such backdoor programs were commonly installed via suspicious links or attachments in spam emails, and once executed, they could grant the attacker a high level of privileges. Occasionally, when you suspect hacking or malware infection, you might try to terminate the process and delete the related files—but you’ve likely experienced situations where the process restarts no matter how many times you terminate it, or the files refuse to be deleted. This is because the attacker has designed the program to prevent it from being easily terminated or deleted. Therefore, you should be careful not to carelessly click on links or run attachments in spam emails or messages from unknown sources.
Fortunately, while such system-level attacks can be devastating when they occur, they often face various constraints because attackers typically need direct access to the target computer or must identify and exploit specific system vulnerabilities. In contrast, network-based hacking attempts to gain access by exploiting network connections. Common methods include intercepting packets—that is, data transmitted over the network—and IP spoofing. Interception, as the term suggests, involves intercepting information intended for someone else midway through transmission. You probably wouldn’t feel very good if your mother secretly read a message you were sending to your girlfriend. Similarly, monitoring the path along which packets are transmitted creates the possibility of intercepting data. However, if the data is strongly encrypted, the attacker cannot read the contents even if they intercept it, which significantly reduces the effectiveness of the attack. In today’s web communications, the technology formerly known as SSL has evolved into TLS (Transport Layer Security), which enhances security by encrypting communication content and authenticating the identity of the remote server. IP spoofing can cause even more serious problems; imagine a scenario where a hacker impersonates your girlfriend and sends a message breaking up with you. This is possible by analyzing the structure of the packet and manipulating elements such as the source IP address contained in the header. Since it is difficult to completely prevent packets from being transmitted over the network, extra caution is required, particularly in financial transactions and critical communications. However, with the advancement of encryption and authentication technologies today, methods that verify the identity of the communication partner through certificates and cryptographic authentication—rather than simply checking the source IP address—are now used. The public certificate system, which was once widely used in South Korea’s online environment, has since been abolished, and various private and public electronic signature and authentication methods are now in use. While public-key cryptography technologies such as RSA remain a crucial cryptographic foundation, the transition to post-quantum cryptography (PQC) is currently being treated as a critical security challenge due to the risk that public-key cryptosystems like RSA could be compromised if sufficiently powerful quantum computers emerge.
Another type of hacking attack, the Denial of Service (DoS) attack, is fundamentally aimed at preventing the normal use of servers or network services; however, recalling the large-scale DDoS attack that occurred on July 7, 2009, illustrates just how significant the repercussions can be. A DDoS is a type of DoS attack in which a large volume of requests or data is sent simultaneously from multiple infected computers—known as zombie PCs or botnets—to disrupt the normal operation of the target server and network. To explain this more systematically, consider what would happen to traffic conditions if every resident of Seoul took to the roads in their cars at the same time. Before launching such an attack, an attacker may distribute malware to plant malicious programs on many people’s computers or other internet-connected devices. Computers with these programs installed become “zombie PCs” that act on the attacker’s commands, and at a predetermined time or upon receiving a command, multiple devices simultaneously send requests to the target server. In addition, there are various DoS attack patterns depending on their purpose and method, and security experts are continuously developing new technologies to defend against them.
Furthermore, hackers’ attack techniques that exploit vulnerabilities in systems and networks are constantly evolving. Since increasing security levels can reduce user convenience, maintaining an appropriate level of security while considering user convenience remains a key challenge for security experts. In the United States, the approach of compensating for damages after a security incident has evolved alongside various security policies designed to prevent such incidents. In South Korea as well, the focus in the past was on preventing incidents in advance, leading to the widespread use of complex and inconvenient procedures such as ActiveX installation. However, this environment has changed significantly due to advancements in web standards and various authentication technologies. Ultimately, the key is not to choose between convenience and security, but to find the right balance between the two. If one accurately understands the principles behind hacking attacks, better solutions will naturally become apparent. A hacker’s attack is by no means an unstoppable disaster; rather, it is a fierce battle of wits between the sword and the shield, in which attack and defense techniques constantly clash and evolve.
