Security industry’s hacker-pimping slammed
By Thomas C Greene in Washington
Posted: 15/07/2002 at 15:48 GMT
I spent three days at H2K2 hoping someone would say something worth mentioning in The Register. Finally, on Sunday, a couple of speakers did just that (on which more tomorrow). Best of all was Gweeds’ savage synopsis of a thing which world + dog has no doubt long entertained as a vague suspicion, namely the way hackers pimp themselves in hopes of getting hired at great expense by security companies, and the way conferences provide fertile soil for the illusory threat exaggeration on which the security industry feeds.
The corporate model whereby hackers gravitate towards corporate greed and away from the liberation of data and private resources developed with public funds was pioneered by ISS, Gweeds noted. Hackers now work to expose security flaws with the specific intention of selling out and obtaining funding to become a security company, he said.
Security lists like BugTraq become the matter for resume stuffing. “Post to BugTraq, become a well-known gadfly on the list, and, like Sir Dystic, get a high-paying job at Microsoft. It’s an interesting progression: post a fix to a bug, work on the resume, release some software and then get offered a good job,” Gweeds noted with sarcasm.
He also mapped out the cyclical food chain whereby hacker sell-outs propagate cyber-crime FUD to feed the propaganda needs of government agencies, which helps to lard agency budgets with public funds, and which in turn helps to enrich the security industry.
“L0pht went in front of Congress and testified at the behest of NIPC and talked about how they could get into any network in the United States. The result is that NIPC got increased funds for cyber-defense and FBI got more funding to fight cyber crime. And now L0pht (@Stake) enjoys federal security auditing contracts,” Gweeds observed.
“They’re making money, sure; but they’re also increasing the reach of the Federal police state at the expense of fellow hackers who are being caught and put in jail.”
Gweeds also believes that the window between when an exploit is developed by the underground and publicly released is shrinking as hackers turned security-knights hasten to pad their resumes with proppies on BugTraq. This may be good for the computing public at large, but when the purpose of hacking is to liberate information which may well be of concern to the public, then it’s just another sell-out.
One of the nastier things a blackhat can do is exploit a company, say, for quick cash, which can be done many ways. Money can be leached from a bank; proprietary information can be sold to a competitor, or sold back to the owner in a simple blackmail scam. These familiar and dark scenarios, along with numerous others, are the ones eagerly propagated by the Feds through the mainsteam press.
Yet one of the best things a blackhat can do is obtain and disseminate information which the public needs to know, e.g., internal memos indicating unsafe products, discrepancies betwen a company’s SEC filing and its own acounts, dirty dealings with local property owners, and a hundred other routine crimes of corporations protected by walls of silence and spin and totalitarian internal rules.
The rush to publish and take credit for discovering and patching a new exploit hobbles the positive efforts of blackhats with a social conscience (though admittedly no one knows how big a category that is).
Finally, Gweeds elaborated the scam of corporate-sponsored security conferences and their role in nourishing the hacking/security/Fed food-chain, the most famous of which is BlackHat, and its handy companion side-show, Defcon.
“BlackHat brings together CEOs and corporate secuity people and government and military people, to tell them why they need to spend money on security services and products.” They then learn about intrusion techniques from hackers who are there essentially to frighten them.
And then, when it’s over, “BlackHat attendees get a free pass to Defcon, a hacker culture freak show, so they can see the people they’re supposed to be afraid of up close and personal,” Gweeds said.
It was a refreshing piece of cynicism well expressed, and for me the highlight of the entire conference. I do hope USA Today caught it. ®