[iwar] [fc:Security.industry's.hacker-pipming.slammed]

From: Fred Cohen (fc@all.net)
Date: 2002-07-15 12:04:12
Next message: Fred Cohen: "[iwar] House OKs life sentences for hackers (fwd)"
Previous message: Fred Cohen: "[iwar] [fc:Hacker.Group.Targets.Countries.That.Censor.Internet]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200207151904.g6FJ4Cv07767@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Mon, 15 Jul 2002 12:04:12 -0700 (PDT)
Subject: [iwar] [fc:Security.industry's.hacker-pipming.slammed]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

Security industry's hacker-pipming slammed
By Thomas C Greene in Washington
Posted: 15/07/2002 at 15:48 GMT

I spent three days at H2K2 hoping someone would say something worth
mentioning in The Register. Finally, on Sunday, a couple of speakers did
just that (on which more tomorrow). Best of all was Gweeds' savage synopsis
of a thing which world + dog has no doubt long entertained as a vague
suspicion, namely the way hackers pimp themselves in hopes of getting hired
at great expense by security companies, and the way conferences provide
fertile soil for the illusory threat exaggeration on which the security
industry feeds.

The corporate model whereby hackers gravitate towards corporate greed and
away from the liberation of data and private resources developed with public
funds was pioneered by ISS, Gweds noted. Hackers now work to expose security
flaws with the specific intention of selling out and obtaining funding to
become a security company, he said.

Security lists like BugTraq become the matter for resume stuffing. "Post to
BugTraq, become a well-known gadfly on the list, and, like Sir Dystic, get a
high-paying job at Microsoft. It's an interesting progression: post a fix to
a bug, work on the resume, release some software and then get offered a good
job," Gweeds noted with sarcasm.

He also mapped out the cyclical food chain whereby hacker sell-outs
propagate cyber-crime FUD to feed the propaganda needs of government
agencies, which helps to lard agency budgets with public funds, and which in
turn helps to enrich the security industry.

"L0pht went in front of Congress and testified at the behest of NIPC and
talked about how they could get into any network in the United States. The
result is that NIPC got increased funds for cyber-defense and FBI got more
funding to fight cyber crime. And now L0pht (@Stake) enjoys federal security
auditing contracts," Gweeds observed.

"They're making money, sure; but they're also increasing the reach of the
Federal police state at the expense of fellow hackers who are being caught
and put in jail."

Gweeds also believes that the window between when an exploit is developed by
the underground and publicly released is shrinking as hackers turned
security-knights hasten to pad their resumes with proppies on BugTraq. This
may be good for the computing public at large, but when the purpose of
hacking is to liberate information which may well be of concern to the
public, then it's just another sell-out.

One of the nastier things a blackhat can do is exploit a company, say, for
quick cash, which can be done many ways. Money can be leached from a bank;
proprietary information can be sold to a competitor, or sold back to the
owner in a simple blackmail scam. These familiar and dark scenarios, along
with numerous others, are the ones eagerly propagated by the Feds through
the mainsteam press.

Yet one of the best things a blackhat can do is obtain and disseminate
information which the public needs to know, e.g., internal memos indicating
unsafe products, discrepancies betwen a company's SEC filing and its own
acounts, dirty dealings with local property owners, and a hundred other
routine crimes of corporations protected by walls of silence and spin and
totalitarian internal rules.

The rush to publish and take credit for discovering and patching a new
exploit hobbles the positive efforts of blackhats with a social conscience
(though admittedly no one knows how big a category that is).

Finally, Gweeds elaborated the scam of corporate-sponsored security
conferences and their role in nourishing the hacking/security/Fed
food-chain, the most famous of which is BlackHat, and its handy companion
side-show, Defcon.

"BlackHat brings together CEOs and corporate secuity people and government
and military people, to tell them why they need to spend money on security
services and products." They then learn about intrusion techniques from
hackers who are there essentially to frighten them.

And then, when it's over, "BlackHat attendees get a free pass to Defcon, a
hacker culture freak show, so they can see the people they're supposed to be
afraid of up close and personal," Gweeds said.

It was a refreshing piece of cynicism well expressed, and for me the
highlight of the entire conference. I do hope USA Today caught it. Ž

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Save on REALTOR Fees
http://us.click.yahoo.com/Xw80LD/h1ZEAA/Ey.GAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] House OKs life sentences for hackers (fwd)"
Previous message: Fred Cohen: "[iwar] [fc:Hacker.Group.Targets.Countries.That.Censor.Internet]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2002-10-01 06:44:31 PDT