[ISN] Security industry's hacker-pimping slammed

From: InfoSec News (isnat_private)
Date: Wed Jul 17 2002 - 06:56:17 PDT

  • Next message: InfoSec News: "[ISN] FDIC faulted for weak IT security"

    [From the sounds of Greene's article, H2K2 was a bust. I am glad I
    didn't go, and when you are finished reading this article, read Gweeds
    gets killed, Greene is probably wishing he didn't write the first one.
    Gweeds gets killed - http://www.theregister.co.uk/content/55/26202.html ]
    By Thomas C Greene in Washington
    Posted: 15/07/2002 at 15:48 GMT
    I spent three days at H2K2 hoping someone would say something worth
    mentioning in The Register. Finally, on Sunday, a couple of speakers
    did just that (on which more tomorrow). Best of all was Gweeds' savage
    synopsis of a thing which world + dog has no doubt long entertained as
    a vague suspicion, namely the way hackers pimp themselves in hopes of
    getting hired at great expense by security companies, and the way
    conferences provide fertile soil for the illusory threat exaggeration
    on which the security industry feeds.
    The corporate model whereby hackers gravitate towards corporate greed
    and away from the liberation of data and private resources developed
    with public funds was pioneered by ISS, Gweeds noted. Hackers now work
    to expose security flaws with the specific intention of selling out
    and obtaining funding to become a security company, he said.
    Security lists like BugTraq become the matter for resume stuffing.  
    "Post to BugTraq, become a well-known gadfly on the list, and, like
    Sir Dystic, get a high-paying job at Microsoft. It's an interesting
    progression: post a fix to a bug, work on the resume, release some
    software and then get offered a good job," Gweeds noted with sarcasm.
    He also mapped out the cyclical food chain whereby hacker sell-outs
    propagate cyber-crime FUD to feed the propaganda needs of government
    agencies, which helps to lard agency budgets with public funds, and
    which in turn helps to enrich the security industry.
    "L0pht went in front of Congress and testified at the behest of NIPC
    and talked about how they could get into any network in the United
    States. The result is that NIPC got increased funds for cyber-defense
    and FBI got more funding to fight cyber crime. And now L0pht (@Stake)  
    enjoys federal security auditing contracts," Gweeds observed.
    "They're making money, sure; but they're also increasing the reach of
    the Federal police state at the expense of fellow hackers who are
    being caught and put in jail."
    Gweeds also believes that the window between when an exploit is
    developed by the underground and publicly released is shrinking as
    hackers turned security-knights hasten to pad their resumes with
    proppies on BugTraq. This may be good for the computing public at
    large, but when the purpose of hacking is to liberate information
    which may well be of concern to the public, then it's just another
    One of the nastier things a blackhat can do is exploit a company, say,
    for quick cash, which can be done many ways. Money can be leached from
    a bank; proprietary information can be sold to a competitor, or sold
    back to the owner in a simple blackmail scam. These familiar and dark
    scenarios, along with numerous others, are the ones eagerly propagated
    by the Feds through the mainsteam press.
    Yet one of the best things a blackhat can do is obtain and disseminate
    information which the public needs to know, e.g., internal memos
    indicating unsafe products, discrepancies betwen a company's SEC
    filing and its own acounts, dirty dealings with local property owners,
    and a hundred other routine crimes of corporations protected by walls
    of silence and spin and totalitarian internal rules.
    The rush to publish and take credit for discovering and patching a new
    exploit hobbles the positive efforts of blackhats with a social
    conscience (though admittedly no one knows how big a category that
    Finally, Gweeds elaborated the scam of corporate-sponsored security
    conferences and their role in nourishing the hacking/security/Fed
    food-chain, the most famous of which is BlackHat, and its handy
    companion side-show, Defcon.
    "BlackHat brings together CEOs and corporate secuity people and
    government and military people, to tell them why they need to spend
    money on security services and products." They then learn about
    intrusion techniques from hackers who are there essentially to
    frighten them.
    And then, when it's over, "BlackHat attendees get a free pass to
    Defcon, a hacker culture freak show, so they can see the people
    they're supposed to be afraid of up close and personal," Gweeds said.
    It was a refreshing piece of cynicism well expressed, and for me the
    highlight of the entire conference. I do hope USA Today caught it.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Wed Jul 17 2002 - 09:57:01 PDT