Feeds

Security industry's hacker-pimping slammed

Somebody had to say it

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

I spent three days at H2K2 hoping someone would say something worth mentioning in The Register. Finally, on Sunday, a couple of speakers did just that (on which more tomorrow). Best of all was Gweeds' savage synopsis of a thing which world + dog has no doubt long entertained as a vague suspicion, namely the way hackers pimp themselves in hopes of getting hired at great expense by security companies, and the way conferences provide fertile soil for the illusory threat exaggeration on which the security industry feeds.

The corporate model whereby hackers gravitate towards corporate greed and away from the liberation of data and private resources developed with public funds was pioneered by ISS, Gweeds noted. Hackers now work to expose security flaws with the specific intention of selling out and obtaining funding to become a security company, he said.

Security lists like BugTraq become the matter for resume stuffing. "Post to BugTraq, become a well-known gadfly on the list, and, like Sir Dystic, get a high-paying job at Microsoft. It's an interesting progression: post a fix to a bug, work on the resume, release some software and then get offered a good job," Gweeds noted with sarcasm.

He also mapped out the cyclical food chain whereby hacker sell-outs propagate cyber-crime FUD to feed the propaganda needs of government agencies, which helps to lard agency budgets with public funds, and which in turn helps to enrich the security industry.

"L0pht went in front of Congress and testified at the behest of NIPC and talked about how they could get into any network in the United States. The result is that NIPC got increased funds for cyber-defense and FBI got more funding to fight cyber crime. And now L0pht (@Stake) enjoys federal security auditing contracts," Gweeds observed.

"They're making money, sure; but they're also increasing the reach of the Federal police state at the expense of fellow hackers who are being caught and put in jail."

Gweeds also believes that the window between when an exploit is developed by the underground and publicly released is shrinking as hackers turned security-knights hasten to pad their resumes with proppies on BugTraq. This may be good for the computing public at large, but when the purpose of hacking is to liberate information which may well be of concern to the public, then it's just another sell-out.

One of the nastier things a blackhat can do is exploit a company, say, for quick cash, which can be done many ways. Money can be leached from a bank; proprietary information can be sold to a competitor, or sold back to the owner in a simple blackmail scam. These familiar and dark scenarios, along with numerous others, are the ones eagerly propagated by the Feds through the mainsteam press.

Yet one of the best things a blackhat can do is obtain and disseminate information which the public needs to know, e.g., internal memos indicating unsafe products, discrepancies betwen a company's SEC filing and its own acounts, dirty dealings with local property owners, and a hundred other routine crimes of corporations protected by walls of silence and spin and totalitarian internal rules.

The rush to publish and take credit for discovering and patching a new exploit hobbles the positive efforts of blackhats with a social conscience (though admittedly no one knows how big a category that is).

Finally, Gweeds elaborated the scam of corporate-sponsored security conferences and their role in nourishing the hacking/security/Fed food-chain, the most famous of which is BlackHat, and its handy companion side-show, Defcon.

"BlackHat brings together CEOs and corporate secuity people and government and military people, to tell them why they need to spend money on security services and products." They then learn about intrusion techniques from hackers who are there essentially to frighten them.

And then, when it's over, "BlackHat attendees get a free pass to Defcon, a hacker culture freak show, so they can see the people they're supposed to be afraid of up close and personal," Gweeds said.

It was a refreshing piece of cynicism well expressed, and for me the highlight of the entire conference. I do hope USA Today caught it. ®

Related Stories

'Hacker' security biz built on FBI snitches
Gweeds gets killed

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.