Inept crackers stung by intended ‘victim’

A small group of inept crackers fell into a trap set by the Honeynet Project, also featured by SecurityFocus, in which the attackers' own clumsy exploit became an ironic means of eavesdropping on their entire plan.

The wannabes, in addition to whacking several hundred machines, were in this case actually cracking a honey pot trap, a bait box set up to attract hack attempts and log information about the methods used to compromise it. Logs are usually diverted to another box, to prevent advanced crackers from finding and deleting them on the target machine.

A bot which the would-be crackers uploaded to the bait system, probably meant to give them permanent ops in an IRC channel which they frequented, logged their channel sessions for the intended 'victim'.

The transcripts of these sessions are a priceless document of the way semi-skilled crackers feel their way clumsily towards their goals. Honeynet re-named the two main crackers "D1ck" and "J4n3", and their crew "K1dd13", to express their contempt for the group's skills.

First we learn that the crew members either foolishly consider themselves to be quite sophisticated, as Honeynet assumes, or, as we suspect, are merely given to bouts of comic self-mockery. In any case, a few minutes' reading reveals that the crew, far from elite, are actually struggling to learn the basics.

Note: We have removed intervening comments in the dialogues for clarity.

:D1ck: i am making a elite archieve of sploits just for k1dd13 members
:D1ck: can u make pass protection on sites?
:J4n3: yeah i can make it password protected
:D1ck: make sure it's leet i dont want any other person other then u me m4ry mi||er and glitchX to have access
:D1ck: hehe
:D1ck: all leet stuff
:J4n3: y0 hooo
:J4n3: ha ha
:J4n3: d0n worry boss
:D1ck: hehehe

Later, crew-member "b0b" expresses considerable interest in learning to code in C. This, he reckons, will make the crew even leeter than it already is.

:b0b :what's vor-ticks-3?
:D1ck :A TROJAN
:D1ck :on receiving a string
:D1ck :on port 80
:D1ck :it opens a bind shell
:D1ck :like on a string 'asad'
:D1ck :it opens port 234323,
:D1ck :or some thing
:D1ck :hehehe
:D1ck :LOL

:b0b :btw, i'm going to be learning C soon too inshallah
:b0b :the[n] we'll have C fights
:b0b :yipeeee
:b0b :i'll insult you in code
:b0b :and once we develop m4d C skillz.. we'll develop D

Talk turns to the construction of a Web site for the crew, and the inevitable 'mission statement'. D1ck waxes political as he proposes the boilerplate:

"K1dd13 came into existance almost a year ago. It was born out of hate and contempt for violence, atrocities and human rights violations against Muslims, specially the affectees in Kashmir. It was precipitated to bring the attention of world leaders and organizations to the issue in cyberspace which is today the leading source of communication."

Other notable moments arrive when D1ck explains to J4n3 how to mount a drive, and again when D1ck and friend "Sp07" endeavour to figure out how to use a network sniffer.

Later, Sp07 asks D1ck "what time is it in pakiland," to which D1ck replies "6 am," suggesting that D1ck either is Pakistani, or has frequent occasion to know the time there. Thus it's hardly surprising when D1ck and J4n3 later muse about taking over Indian networks:

:J4n3: lemme own sum 1nd1an b0x3s and bring more bots :p
:D1ck: oye
:D1ck: scan indian servers for bind
:D1ck: 8.2
:D1ck: and
:D1ck: 8.2.1
:J4n3: am on windows right now
:J4n3: i'll do it later and make a log of it
:D1ck: 0h
:D1ck: okie
:D1ck: kewl

"Often you will see [the crew members] attempting to figure out the most fundamental of Unix skills," Honeynet notes. "And yet, they are still able to compromise or damage a large number of systems."

And that observation, more than any other, is the kernel of this morality tale. Cracking, as we have noted ad nauseum, is hardly brain surgery; so why is it that so many hotshot systems administrators and elite law enforcement authorities find themselves routinely humiliated by such inept Script Kiddies? ®