[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[infowar.de] heftige Kritik an der US-Hacker-Szene: "Ihr helft dem FBI!"
Infowar.de, http://userpage.fu-berlin.de/~bendrath/liste.html
-------------------------------------------------------------
Ein interessanter Artikel ueber die Konferenz "Hackers on Planet Earth
2002" (H2K2), die am Wochenende hier in NYC stattgefunden hat, und den
Ausverkauf der Hacker-Szene an die Industrie und das FBI. Ich war auch
dort und fand es teilweise interessant, teilweise langweilig, aber vor
allem unterhaltsam (besonders die Keynote Speech von Jello Biafra
(frueher Saenger der Punk-Band Dead Kennedys) und das Panel "Social
Engineering", in der Emmanuel Goldstein (Herausgeber von "2600 -the
Hackers Quarterly und Co-Organisator der Konferenz) live vorfuehrte, wie
man Leute am Telefon so beschwatzt, dass sie einem Passwoerter und
Kreditkartnenummern geben. Die Stimmung war insgesamt eher Anti-FBI,
aber dies ist in der Hacker-Szene sicherlich ein unreflektierter Habitus
- ueber die konkreten (und nicht intendierten) Auswirkungen ihres
Handelns machen sich viele keine Gedanken. Die Kritik in diesem Artikel
ist sicherlich ueberzogen, aber auf jeden Fall einer Diskussion wert.
RB
http://www.theregister.co.uk/content/55/26198.html
Security industry's hacker-pimping slammed
By Thomas C Greene in Washington
Posted: 15/07/2002 at 15:48 GMT
I spent three days at H2K2 hoping someone would say something worth
mentioning in The Register. Finally, on Sunday, a couple of speakers
did just that (on which more tomorrow). Best of all was Gweeds' savage
synopsis of a thing which world + dog has no doubt long entertained as
a vague suspicion, namely the way hackers pimp themselves in hopes of
getting hired at great expense by security companies, and the way
conferences provide fertile soil for the illusory threat exaggeration
on which the security industry feeds.
The corporate model whereby hackers gravitate towards corporate greed
and away from the liberation of data and private resources developed
with public funds was pioneered by ISS, Gweeds noted. Hackers now work
to expose security flaws with the specific intention of selling out
and obtaining funding to become a security company, he said.
Security lists like BugTraq become the matter for resume stuffing.
"Post to BugTraq, become a well-known gadfly on the list, and, like
Sir Dystic, get a high-paying job at Microsoft. It's an interesting
progression: post a fix to a bug, work on the resume, release some
software and then get offered a good job," Gweeds noted with sarcasm.
He also mapped out the cyclical food chain whereby hacker sell-outs
propagate cyber-crime FUD to feed the propaganda needs of government
agencies, which helps to lard agency budgets with public funds, and
which in turn helps to enrich the security industry.
"L0pht went in front of Congress and testified at the behest of NIPC
and talked about how they could get into any network in the United
States. The result is that NIPC got increased funds for cyber-defense
and FBI got more funding to fight cyber crime. And now L0pht (@Stake)
enjoys federal security auditing contracts," Gweeds observed.
"They're making money, sure; but they're also increasing the reach of
the Federal police state at the expense of fellow hackers who are
being caught and put in jail."
Gweeds also believes that the window between when an exploit is
developed by the underground and publicly released is shrinking as
hackers turned security-knights hasten to pad their resumes with
proppies on BugTraq. This may be good for the computing public at
large, but when the purpose of hacking is to liberate information
which may well be of concern to the public, then it's just another
sell-out.
One of the nastier things a blackhat can do is exploit a company, say,
for quick cash, which can be done many ways. Money can be leached from
a bank; proprietary information can be sold to a competitor, or sold
back to the owner in a simple blackmail scam. These familiar and dark
scenarios, along with numerous others, are the ones eagerly propagated
by the Feds through the mainsteam press.
Yet one of the best things a blackhat can do is obtain and disseminate
information which the public needs to know, e.g., internal memos
indicating unsafe products, discrepancies betwen a company's SEC
filing and its own acounts, dirty dealings with local property owners,
and a hundred other routine crimes of corporations protected by walls
of silence and spin and totalitarian internal rules.
The rush to publish and take credit for discovering and patching a new
exploit hobbles the positive efforts of blackhats with a social
conscience (though admittedly no one knows how big a category that
is).
Finally, Gweeds elaborated the scam of corporate-sponsored security
conferences and their role in nourishing the hacking/security/Fed
food-chain, the most famous of which is BlackHat, and its handy
companion side-show, Defcon.
"BlackHat brings together CEOs and corporate secuity people and
government and military people, to tell them why they need to spend
money on security services and products." They then learn about
intrusion techniques from hackers who are there essentially to
frighten them.
And then, when it's over, "BlackHat attendees get a free pass to
Defcon, a hacker culture freak show, so they can see the people
they're supposed to be afraid of up close and personal," Gweeds said.
It was a refreshing piece of cynicism well expressed, and for me the
highlight of the entire conference. I do hope USA Today caught it.
---------------------------------------------------------------
Liste verlassen:
Mail an infowar -
de-request -!
- infopeace -
de mit "unsubscribe" im Text.