Onderwerp: Vulnerabilites in new laws on computer hacking

It'd be interesting to see if this post gets approved by the moderators of bugtraq.

As all of you know, this forum (bugtraq) is constantly monitored not only by crackers and infosec professionals, but also by government and law-enforcement agencies.

The reason why I'm posting this message is because I'd like to bring attention to the new laws on hacking.

As everyone knows, laws on computer hacking are going tougher. There are however, some negative consequences.

"Advanced societies" are updating computer crime laws faster than the rest of the world. This means that new generations of these more "advanced societies" will have no clue about how remote computer attacks are carried out. Future generations of security
"experts" will be among the most ignorant in the history of computer security.

New generations of teenagers will be scared of doing online exploration. I'm not talking about damaging other companies' computer systems. I'm talking about accessing them illegally *without* revealing private information to the public or harming any data
that has been accessed. To me, there is a big difference between these two types of attacks but I don't think that judges feel the same way. Furthermore, I don't even think that judges understand the difference.

Now, I'm not saying that I support accessing computer systems illegally. All I'm saying is that by implementing very strict laws on "hacking", we will create a generation of ignorant security professionals. I think to myself, how the hell will these "more
advanced societies" protect themselves against cyber attacks in the future?

These new tougher computer laws will, in my opinion, have a tremendous negative impact in the defense of these "advanced societies". It almost feels to me like we're destroying ourselves.

I know what you're thinking. You can learn about security attacks by setting up you're own controlled environment and attacking it yourself. Well, what I say is that this approach *does* certainly make you a better attacker, but nothing can be compared to
attacking systems in real world scenarios.

Now, I personally know many pentesters and I can say that most of them *do* cross the line sometimes when doing online exploration in their own free time. However, these guys would *never* harm anything or leak any sensitive information to the public. Tha
t's because they love what they do, and have very strong ethical values when it comes to privacy.

I would say that most pentesters are "grey hats", rather than "white hats". In fact, I believe that the terms white and black hat are completely artificial because we all have different sides. The human mind is not binary, like black or white, it's someth
ing fuzzy instead, with many layers. The terms white and black hat were, in my opinion, created by business people to point out who the "good guys" and "bad buys" are.

If I was the technical director of a computer security testing company I would try to find pentesters that are not malicious, but that do cross the line sometimes but at the same time, know when it's a good time to stop exploring.

If you hire someone that has never broken into a system, this guy will not be able to produce valuable reports for customers because he will not be able to find vulnerabilities that can't be found running a scanner.

In summary, I'd like governments of the world to rethink their strategy when fighting computer crime. Extremism never worked and never will.

Remember, many of today's script kiddies will be the infosec professionals of tomorrow.

--On Saturday, February 11, 2006 16:35:20 +0000
self-destruction@itsbest.com wrote:

> It'd be interesting to see if this post gets approved by the moderators
> of bugtraq.
>
> As all of you know, this forum (bugtraq) is constantly monitored not only
> by crackers and infosec professionals, but also by government and
> law-enforcement agencies.
>
> The reason why I'm posting this message is because I'd like to bring
> attention to the new laws on hacking.
>
> As everyone knows, laws on computer hacking are going tougher. There are
> however, some negative consequences.
>
> "Advanced societies" are updating computer crime laws faster than the
> rest of the world. This means that new generations of these more
> "advanced societies" will have no clue about how remote computer attacks
> are carried out. Future generations of security "experts" will be among
> the most ignorant in the history of computer security.
>
That's silly. Researchers know full well how to do this without ever
breaking any laws. In fact, most of the best researchers who are finding
the bugs and weaknesses in systems never breakin to any system not owned by
them.

> New generations of teenagers will be scared of doing online exploration.
> I'm not talking about damaging other companies' computer systems. I'm
> talking about accessing them illegally *without* revealing private
> information to the public or harming any data that has been accessed. To
> me, there is a big difference between these two types of attacks but I
> don't think that judges feel the same way. Furthermore, I don't even
> think that judges understand the difference.
>
To me there is not. They're my systems. Stay out, thank you very much.

If you want to learn how to hack, set up your own network, install some
OSes, with various patch levels, and hack away. You can learn everything
you need to know without ever touching a system you do not own. Get your
buddies involved. Hack each other's boxes. But do not hack into systems
that do not belong to you. That *should* be illegal and you *should* be
prosecuted.

> Now, I'm not saying that I support accessing computer systems illegally.

Yes, you are. You're talking about breaking in to systems that you do not
have permission to enter.

> All I'm saying is that by implementing very strict laws on "hacking", we
> will create a generation of ignorant security professionals. I think to
> myself, how the hell will these "more advanced societies" protect
> themselves against cyber attacks in the future?
>
And you're wrong. I don't have to hack into someone else's equipment to
know how to hack into things.

> These new tougher computer laws will, in my opinion, have a tremendous
> negative impact in the defense of these "advanced societies". It almost
> feels to me like we're destroying ourselves.
>
That's because you have tunnel vision. You think the only way to learn to
hack is to attempt to break in to someone else's equipment.

Do locksmiths break in to random houses to learn their craft?

> I know what you're thinking. You can learn about security attacks by
> setting up you're own controlled environment and attacking it yourself.
> Well, what I say is that this approach *does* certainly make you a better
> attacker, but nothing can be compared to attacking systems in real world
> scenarios.
>
> Now, I personally know many pentesters and I can say that most of them
> *do* cross the line sometimes when doing online exploration in their own
> free time. However, these guys would *never* harm anything or leak any
> sensitive information to the public. That's because they love what they
> do, and have very strong ethical values when it comes to privacy.
>
Oh, well that gives me great comfort. Never mind that I can be prosecuted
for the breakin because I've violated a law such as GLB, HIPAA, etc. by
"allowing" a breakin. I'm glad your friends are so "ethical". If you only
think about what's in it for you, you'll always be slanted toward violating
the law. Try thinking about the poor victim whose systems you're breaking
in to. Put yourself in their shoes and ask yourself, how would I feel if I
discovered that someone had entered my systems without my knowledge? Or
bettter yet, how about if I reach in your pocket and take the keys to your
car, take it out for a spin, then return it? Are you OK with that? No
hard feelings?

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/

self-destruction@itsbest.com apparently writes:
>"Advanced societies" are updating computer crime laws faster than the
>rest of the world. This means that new generations of these more
>"advanced societies" will have no clue about how remote computer attacks
>are carried out. Future generations of security "experts" will be among
>the most ignorant in the history of computer security.

This is an interesting assertion: Legislation causes ignorance. I'll get
to that in a moment but let me comment on the "advanced societies"
issue and offer a different perspective.

Advanced societies (as you call them) are the technological and
economical fast-movers; the ones that have invested heavily across
their economies in high tech, which means IT. One way of looking at
the tightening of legislation in those societies is that it is a reaction
to the disproportionate pain that technologically advanced societies
suffer as a consequence of cyber-crime. As a society becomes
increasingly dependent on computing, the cost of protecting those
computers becomes a large item in the "expense" column. So
perhaps you might look at it from this perspective:
The reaction of the technologically advanced societies to cyber-crime
is a harbinger of how EVERY society will react to cyber-crime as they
move up the economic chain. The reason the rest of the world is not
reacting as the advanced societies are is because they can still
afford not to.

Put differently - if you think it's bad (from your perspective) now, you
ain't seen nothin' yet!

>New generations of teenagers will be scared of doing online exploration.

This is a ridiculous assertion - if you were correct that legislation
significantly stifles criminal activity, then the US would be winning
the "War On Drugs" right? After all, drugs are broadly illegal in the
US and - well - are teenagers scared of exploring dope? Hmmm...
Maybe not.

Let's look at another aspect of that: I know of no society that is
placing serious restrictions on an individual's ability to explore
his/her own systems. I worded that carefully because the DRM
and "Super DMCA" have gotten a lot of press over the implication
that a user might not be able to "explore" data that they bought
and paid for (i.e.: an application or a DVD) but actually the
debate there is whether the user actually owns the data or
merely owns the right to access the data, and that's a contract
law question more than anything else. However, I know of no
advanced society that says I can't buy a bunch of computers and
copies of VMWare or honeyd or whatever and build myself a
lab LAN/WAN and hammer it however I please, destructively
"test" the software on it, etc. Perhaps I might not be motivated
to go to the trouble of setting up my own test LAN, or I might
not have the financial or intellectual resources to do so - but
those are not a result of fear. There is nothing to stop groups
of teen agers (to stick with your example) from playing capture
the flag LAN parties with their own machines, as long as
they're consenting - they're welcome to have at it as long as
their electricity and caffeine supply holds out!!

So - unlike the situation with drugs - there's STILL a perfectly
legitimate avenue for socially sanctioned exploration. And we
have seen that the "War On Drugs" hasn't exactly had a very
great cooling effect on dope use - so I simply can't accept
your assertion that teen agers are somehow going to be
terrified to explore computers.

.... but is that what you're talking about, really? I don't think so.

>I'm not talking about damaging other companies' computer systems. I'm
>talking about accessing them illegally *without* revealing private
>information to the public or harming any data that has been accessed.

*Aha*

So you're talking about "exploring" someone's computer
without their permission.

In virtually every society (not just the advanced ones) that have a
notion of property, there is a notion of property rights. The very
notion of property rights argues that _I_ have the right to control
how _MY_ property is used. In fact, property rights make up
the core of the social contract and the rule of law - i.e.: trespassing
is a very, very old crime. "Exploring" someone's computer without
their permission is a violation of their property rights, pure and
simple. In any society under the rule of law, under virtually any
moral and legal system I have encountered, there are protections
that govern intrusion into another's property.

So, I believe you're being intellectually dishonest calling such
actions "exploring" - "trespassing" might be a better word, as
a starting point for further dialog.

It sounds like you're adopting the position that I've often
heard voiced by trespassers, namely, "I didn't do any
harm" or "I was passing through" etc - which is not a
tenable position in the face of ANY attempt by the property
owner to give notice that intrusion is unwelcome. For
example, in most US States, ignoring a "No Trespassing"
sign is a criminal act. I would argue that there's an exact
mapping between the circumstance of my posting a
"No Trespassing" sign on my property and my installing
a firewall on my Internet connection. It gets more complex
when you consider that in some jurisdictions it is not
even necessary to post a "No Trespassing" sign to
assert your property rights. Indeed, I am not required
to post a "No Stealing" sign on my car when I park
it, NOR am I required to lock it in order to assert the
full protection of the law. This maps exactly to the
situation in which I have an internet connection with
no firewall at all; the fact that I do not have a "No Exploring"
sign is NOT an implicit invitation to explore. Never
mind complex moral philosophies - common courtesy
requires that one ask permission before going where
they are not invited.

> To
>me, there is a big difference between these two types of attacks but I
>don't think that judges feel the same way. Furthermore, I don't even
>think that judges understand the difference.

In most of the "advanced societies" you are referring to, it is not
a judge who makes this determination - it is a jury.

Whether a jury understands or does not understand, or
respects or does not respect, a distinction YOU choose to
make is irrelevant. You are playing self-serving semantic
games. By asserting that you feel there is a difference between
one type of trespassing (the kind you deem harmful) and
another type of trespassing (the kind you deem harmless)
you are creating a distinction of convenience only to yourself.
Does the law recognize such a distinction? I submit to you
that unless the laws recognize "harmless trespass"
versus "harmful trespass" then you are on shaky ground.

Put differently, if you trespass on my property, I do not
have to care about your intent. I merely have to care that
you violated my property rights. Your "I meant no harm"
argument is part of your plea for clemency once you've been
convicted and it's time to pass sentence.

>Now, I'm not saying that I support accessing computer systems illegally.

Actually, you do appear to be saying that. Or, more precisely, you
appear to be saying that by enforcing our existing property rights
over our computers, we (the computer owners of the world) are
going to somehow increase the level of ignorance about computer
security.

That's a ridiculous position!

>All I'm saying is that by implementing very strict laws on "hacking", we
>will create a generation of ignorant security professionals. I think to
>myself, how the hell will these "more advanced societies" protect
>themselves against cyber attacks in the future?

Those more "advanced societies" will protect themselves
quite well, for a number of reasons. First off, because they
have more at stake, they will be obligated to (waste) invest
more time preparing to stave off trespassers. As your stake
increases your motivation to preserve it increases accordingly.
This is part of the tyranny of the cyber-criminal: the cost they
force the innocent to incur is disproportionate. An E-banking
company may spend hundreds of thousands of dollars to
build a defensible network whereas my grandmother might
begrudge $19.95 for an antivirus package. Disproportionate
spending will result in, unfortunately, a disproprtionate demand
for defensive expertise.

What does that mean? That means you'll be dealing with
guys like me. Folks from an engineering/system design/
architecture background, who treat this "cyber-crime" as
a serious problem that can be managed effectively using
engineering and design disciplines. Security is nothing
more than extending a failure analysis forward into a
predictive failure analysis model (formally or ad hoc) and
checking your implementations against past experiences
of failure. This is exactly the same design discipline that
civil engineers use when they build bridges: they
understand that a bridge will be exposed to wind, rain,
corrosives dropped on the road surface, vibration, metal
fatigue, etc. These failure paradigms are extrapolated from
past experience and taxonomized as aspects of a discipline.
You will not find a bridge designer who has not heard of
the Tacoma Narrows Bridge or metal fatigue or rust-oleum
(or stainless steel, for that matter!). Software is only on
the verge of becoming an engineering discipline, but
eventually, I hope, you will not find a designer of mission
critical software who does not know what a buffer overflow
is, or who does not understand component testing.

So, as much as you may not like it, there are plenty of
folks out there who understand that software security is a
design and architecture issue - not a process of slapping
band-aids on bad code until it's, well, bad code covered
with band-aids. What you'll find is that engineers who
understand engineering discipline find bug-hunting to be
an utterly boring process; well-designed and implemented
systems don't need "pen testers" - they cross-check
themselves. The only reason the industry is in the
horrible condition it's in today is because the vast
majority of code that's been fielded to date is crap. That
will have to change. And when it does, "pen testers"
will become peons in the quality assurance department.

>These new tougher computer laws will, in my opinion, have a tremendous
>negative impact in the defense of these "advanced societies". It almost
>feels to me like we're destroying ourselves.

I think you're kidding yourself.

>I know what you're thinking. You can learn about security attacks by
>setting up you're own controlled environment and attacking it yourself.
>Well, what I say is that this approach *does* certainly make you a
>better attacker, but nothing can be compared to attacking systems in
>real world scenarios.

Who cares if someone is a good attacker?

Let me try that differently. What is a "good attacker"? (By good
I assume you mean "skilled") A skilled attacker is someone
who has internalized a set of failure analysis of past failures, and
can forward-project those failures (using imagination) and
hypothesize instances of those failures into the future. Put
concretely - a skilled attacker understands that there are
buffer overruns, and has a good grasp of where they usually
occur, and laboriously examines software to see if the usual
bugs are in the usual places. This is a process that, if the
code was developed under a design discipline, would be
replaced trivially with a process of code-review and unit
testing (a little design modularization wouldn't hurt, either!).

But it's not actually rocket science or even interesting.
What's so skilled about sitting with some commercial
app and single-stepping until you get to a place where
it does network I/O, then reviewing the surrounding code
to see if there's a memory size error? (Hi, David!) Maybe
YOU think that's security wizardry but, to me, that's
the most boring clunch-work on earth. It's only interesting
because right now there's a shockingly huge amount of
bad code being sold and the target space for the
"hit space bar all night, find a bug, and pimp a
vulnerability" crowd to play with.

>Now, I personally know many pentesters and I can say that most of them
>*do* cross the line sometimes when doing online exploration in their own
>free time. However, these guys would *never* harm anything or leak any
>sensitive information to the public. That's because they love what they
>do, and have very strong ethical values when it comes to privacy.

Your understanding of ethics appears to be shakier than
your understanding of software engineering.

You're trying to excuse the trespasser that "never harms anything"
from having done wrong, but you cannot do that because you never
asked the victim's opinion. Indeed, the very fact that the victim
may have already gone to expense to try to prevent the trespass
merely means that the trespasser has added insult to injury! The
trespasser is still morally culpable.

Suppose a property owner has a 250 acre property they want to
keep private. After all, it's theirs, they have the right to want to keep
it private, and they want to enjoy it without having strangers wandering
about in their land. So our property owner spends $400 on 500 "No
Trespassing" signs and nails and spends 2 days nailing signs to
trees around the perimeter of their property. Now, a stranger
comes along, ignores the signs, becomes a trespasser, and leaves.
Has the property owner been wronged? Absolutely. Whether the
trespasser "never harmed anything" or not, they ignored the
property owner's moral rights, and additionally the property owner
has now spent 2 days nailing and $400 on signs - and it was
wasted. Obviously, you can't assign the entire cost of the signs
and the wasted time to a single trespasser, but it's certainly
insult to injury. The trespasser has no moral right to claim that
their assessment of "not harming anything" superceeds the
property owner's -- after all, by placing "No Trespassing" signs,
the property owner has explicitly informed the trespasser that
trespass in and of itself is harmful. This is why trespassing is a
crime, and aggravated trespass is a felony (aggravated
trespass would be if the trespasser decided to tear down a
few of the signs, just to show that stupid land-owner that he
"knows better" and "means no harm")

Obviously, you can map these values to IP networks - the
fact that a system has ANY form of security enabled AT ALL
is analogous to a "No Trespassing" sign. Though I question
the moral underpinnings of an Internet society in which the
prospective victim has to put a "NO STEALING" sign on
their car and a "NO RAPING" sign on their backside and
a "NO SPYING" sign in their window, and a "NO WIRETAPPING"
sign on their phone, etc.

In other words, in the real world, property rights are an
ingrained concept in virtually all societies. The movement of
"advanced societies" to tighted up cybercrime laws is
simply a reflection of those advanced societies rationally
extending the moral values of property rights into cyber-space.

The view you espouse, in which you arrogate to yourself
the right to decide what constitutes harmless trespass
versus harmful trespass -- that's a view that probably will
not last very long, IF IT EVER EXISTED AT ALL. Let me be
frank with you, since you seem to want to be an apologist
for the cyber-trespasser: the fact that $6 billion annually is
spent on firewalls, IDS, antispyware, antivirus, vulnerability
management, etc -- is a VERY LOUD STATEMENT that
society as a whole DOES NOT APPROVE OF CYBER
TRESPASSING. On the internet, virtually every tree has a
"No trespassing" sign nailed to it. You choose to pretend
not to see it at your own risk.

>I would say that most pentesters are "grey hats", rather than "white
>hats".

I agree with you. I would say that most pentesters are
failed security analysts who do not understand engineering
discipline and have chosen to engage in the war of band-aids
instead of learning how to build correct systems. And then
there are the pentesters who really are cybertrespassers
at heart, who have found a financial and moral justification
for doing something for money that they'd otherwise do
anyhow, for free, in the wee hours of the night.

Put differently: either way you slice it, pentesters aren't
worth a bucket of warm spit as far as I am concerned.

>In fact, I believe that the terms white and black hat are completely artificial because we all have different sides. The human
>mind is not binary, like black or white, it's something fuzzy instead,
>with many layers. The terms white and black hat were, in my opinion,
>created by business people to point out who the "good guys" and "bad
>buys" are.

I belive that you are seeing to create moral ambiguity because
if you don't have that ethical grey area to work in, you've lost
your playground.

You're right, though - black/white hat is probably poor
terminology. As a property owner (both in the real world
and in cyberspace) there are only two kinds of people on
my land:
- Invited Guests
- Trespassers
There is no room there for moral ambiguity.

>If I was the technical director of a computer security testing company I
>would try to find pentesters that are not malicious, but that do cross
>the line sometimes but at the same time, know when it's a good time to
>stop exploring.

I am glad you are not the technical director of a computer
security testing company then. In fact, I hope you are not
employed in the field of computer security at all, if you
would be trying to recruit, as professionals, people who
"cross the line." In fact I am extremely glad that you're
also not the director of a day-care facility, and that you
don't want to hire employees that "occasionally grope
the children" (but not TOO much!) or that you aren't the
director of a bank, who'd want to hire tellers that
"only occasionally pocket (small denomination) bills."

>If you hire someone that has never broken into a system, this guy will
>not be able to produce valuable reports for customers because he will
>not be able to find vulnerabilities that can't be found running a
>scanner.

If you're trying to understand the security properties of a
system by breaking into it, you not producing valuable
reports, anyhow. All you are doing is telling them where
to put the next band-aid.

>In summary, I'd like governments of the world to rethink their strategy
>when fighting computer crime. Extremism never worked and never will.

In summary; the views you expressed typify, to me, the negative
effect of accepting a moral grey area into our profession. You speak
of ethics and, in the next breath, you show that you don't even know
what ethics ARE. You speak of learning, and, in the next breath, you
show that you don't understand how to apply learning in a disciplined
and predictable manner.

>Remember, many of today's script kiddies will be the infosec
>professionals of tomorrow.

Ironically, I am the person who first coined the expression
"script kiddie" (back in 1994 I think it was...) - but I originally
used the term not to apply to the ankle-biter cybercriminals,
I was using the term "script kiddy" to describe the first-generation
security auditors! Back in the early 90's, when the "big 6"
first got into the security audit game, they used to send these
ignorami right out of college, with checklists, who'd go around
customer sites looking to see if the /etc/passwd file on
Windows machines had the correct permissions - and they'd
write a report saying that the "passwd file is missing!"

In the sense that I originally coined the expression "script
kiddy" I was referring to those of you who now proudly call
yourselves "pentesters"

Ironic, huh?

mjr.

On Saturday 11 February 2006 17:35, self-destruction@itsbest.com wrote:

I think I have found some holes in your way of thinking, so I'll try to=20
penetrate them. :-)

> "Advanced societies" are updating computer crime laws faster than the
> rest of the world. This means that new generations of these more
> "advanced societies" will have no clue about how remote computer attacks
> are carried out. Future generations of security "experts" will be among
> the most ignorant in the history of computer security.

Actually - not. I'm sorry, but there's really no such thing as Certified=20
Computer Security Expert, or Diploma Network Penetrator. The technology is=
=20
advancing so fast that you can't make any reasonable education system that=
=20
wouldn't become obsolete in a matter of just a few years. You have to be=20
able to do a lot of self-education in order to stay on top. This is not=20
true for security experts only, but for IT experts in general. It all=20
comes down to how much effort you put in your own education and you will=20
either float on or near the top, or you'll drown. There's already an army=20
of IT experts that sank to the bottom and their knowledge is pretty much=20
obsolete, as are their skills. I see them around, zombies, sucking away=20
money and valuable time from their customers. =20

> New generations of teenagers will be scared of doing online exploration.

You're underestimating teenagers. :-)=20

> Now, I'm not saying that I support accessing computer systems illegally.
> All I'm saying is that by implementing very strict laws on "hacking", we
> will create a generation of ignorant security professionals. I think to

Security is, IMHO, a two-way game. While it is "good training" to try to=20
get into someone's system, and while there is a lot to learn from that=20
experience, you can get results from controlled events. If you're security=
=20
expert, you'll find funding for a lab, and even better, you will get=20
permission from some company to try to break into their network. There's=20
no real difference between going in illegaly and with permission. The=20
system is the same, but one way is more ethical than the other.=20

Want a good training? Set-up a war game, get you and few buddies on one=20
side, and some more buddies on the other side, get two computers, and try=20
to break in each other's computer and steal data. This way, you can learn=20
how to break in and how to protect at the same time. And, it's legal. :-)

> myself, how the hell will these "more advanced societies" protect
> themselves against cyber attacks in the future?

Barbarians ante portas!=20

Having less strict law doesn't give you real advantage, it just makes you=20
sleep better at night. And, if you're up to penetration, there's no law to=
=20
stop you.=20

And then some - laws can be avoided by using means that are not under the=20
control of your country - having a shell account in some third world,=20
barbarian country, for example. ;-) While it is not easy to hide your=20
mischief in your country, if you go international there's another layer of=
=20
(ironically - law system) protection, or at least - time advantage.

> These new tougher computer laws will, in my opinion, have a tremendous
> negative impact in the defense of these "advanced societies". It almost
> feels to me like we're destroying ourselves.

It is illegal to chop off someone's head because of drug dealing in the=20
western world. Or, if you steal, you know you aren't going to have your=20
right fist cut off. These are different laws around the globe, but drug=20
dealers and thieves are just as common.=20
And advanced (or so called) societies do understand implications, but you=20
have to justify the costs. Is it better to loosen the law to allow some=20
teenagers to sneak in corporations and potentially make huge damages, in=20
hope that they will one day protect the country from cyberbarbarians? Or,=20
do you just encourage them to switch to the dark side?=20

If you tighten the law, you're protecting companies and other individuals=20
from a mischief and crime, and save money. But, will that kids of today be=
=20
able to defend our gates in the future?=20

> with many layers. The terms white and black hat were, in my opinion,
> created by business people to point out who the "good guys" and "bad
> buys" are.

And we should stick to that. There's one good reason, you know: public=20
image. Remember the times when a word hacker meant just a computer geek,=20
some nuts that tinker with the computer all the time and produces strange=20
and interesting phenomena on them? Today, if you tell someone that you're=20
hacker, there's a chance that they will ask you have you ever been in jail=
=20
before, and what big military installation have you broken into? Some=20
might even ask you "how do you hack the planet?"

People (like, umm, non IT people, and then some IT people?) do need a way=20
to distinguish good guys from bad guys, or they would be lost and couldn't=
=20
know whom to trust. You can call them white hats, black hats, or hackers=20
and crackers, western angels and bad barbarians (yup, pun intended).. it=20
doesn't really matter, as long as there's someting general population can=20
understand and stick with. We need this differentiation more than they do,=
=20
it affects our jobs and our abilities.=20

> If you hire someone that has never broken into a system, this guy will
> not be able to produce valuable reports for customers because he will
> not be able to find vulnerabilities that can't be found running a
> scanner.

I remember times when I knew absolutely nothing about computers. It was=20
more than 20 years ago. Ahh, these were innocent times... :-)
There was no Internet, no networks. We have tinkered with game savefiles in=
=20
order to make more money or increase life count. Today, the only thing I=20
might find useful might be putting more money in the savefile. I'm pretty=20
obsolete in that manner. But, over time, I have acquired other skills,=20
some of them even useful!=20

If you have a guy who is ready to learn, let him. Nobody was security=20
expert in mother's womb. If you're employer, you have to find some legal=20
means to let him play. Having a customer that will allow you to do=20
penetration testing is a good start. If you're hot for that, you might=20
make a good offer for your client and get their permission easily. ;-)=20

Or, you might hire real expert. But then, you have another set of problems.=
=20
Can you trust him? In fact, could you trust anyone? How can you control=20
him? Could you make him move in direction you want him to go, or do you=20
have to let him do his way and hope for the best?

> In summary, I'd like governments of the world to rethink their strategy
> when fighting computer crime. Extremism never worked and never will.

Neither does anarchy, you know.=20

> Remember, many of today's script kiddies will be the infosec
> professionals of tomorrow.

Remember, kids are not really afraid of breaking laws, in fact they see it=
=20
as another challenge. :-)

=2D-=20
Radoslav Dejanovi=C4=87
Operacijski sustavi d.o.o.
http://www.opsus.hr