Slashdot Mirror
Moronic Hacking Contest Ends In Free-For-All
atomgiant writes "ZDNet is running an interesting article about the KDWorks hacking contest that has gone bad, or good, depending on your perspective. Entertaining read in any event." I think that Bruce Schneier has said it best on the value of contests such as this one. That the registration server was compromised I think is a telling comment on the value of whole site security.
Click here or here.
It's a silly idea all together, hacking, but I guess it must be better than girls/sunlight.
:)
Any hackers who get busted deserve what they get for being dumb enough to show.
I recall a sherrif's dept. sending out letters to people with outstanding warrants exclaiming that they had one a prize and had to go to a certain address to claim it. Needless to say, the cops had a field day arresting all sorts of people, who were actually dumb enough to buy the ploy.
Just rememebr, if you're doing illegal things, there's always a chance you'll get caught. The best thing to do is just not get caught
Linux is dead.
LU
Maybe I'll start my own hacking contest. I give the winner a billion dollars. I'll setup 2 computers, one connected to the 'net, completely open and unpatched. It'll physically sit on top of the "secure" box, which won't be connected, or even turned on. When the "winner" tries to claim his prize, I'll simply state that he hacked the "decoy", and the real server was untouched. Sounds about as fair as this one.
Heh, in my experience, it's quite to the contrary. Anyone with half a brain turns off nearly all, if not all services to stop script kiddies like you =]
"And you have to ask yourself who will have a Web server running with this small amount of services activated? Nobody."
Please. What they're basically complaining about is that the web server they were supposed to be attacking was too secure, and not easy enough to get into. If it serves up web pages, it's a web server, whether or not the admin has opened all the ports you're used to exploiting.
'Course, the fact that there was a honeypot elsewhere on the network seems a bit shifty...
It seems a little ambiguous - if you are invited to hack, is that a crime?
Granted, there are some thresholds never to be crossed. "Sure, you can shoot me, you won't get in trouble" etc.
Nonetheless, I'd be sure to get written permission from the hackee.
***
This is my Sig. This is my Glock, this is my Walther, and this is my Beretta.
Any questions?
I think that contests, when done properly, can't prove security but it certainly can certainly prove a point. I doubt we'll ever see a proof that factoring numbers must be complex, but the RSA challenge proves that, well, anyone who has the technology would rather keep it than the money. Hrm. Well, at least that means a script kiddie or casual hacker can't factor very large numbers, eh?
-bugg
Actually Korea has done a great deal in getting you online. The majority of the RAM used on computers now a days originate from Korea. Samsung is a Korean company. In addition, Korea is getting up there in terms of semiconductor manufacturing..
_______________________________
"I'm not Conceited...I'm just a realist..."
They have this law, called entrapment, that says people can't be baited into committing crimes. You should look into it, might interest you.
Finally, math books without any of that base 6 crap in them.
Well, the contest was for hackers and not crackers. Crackers got the registration machine, but since the "contest" machine had an open invitation to break in, there was nothing illegal about it.
Remember, the class requirements for the Cracker class has the ethical alignment of Chaotic as a requirement. Hackers can have any Ethical Alignments. The White Hat Cracker class has a Chaotic Good alignment requirement. Since they asked people to hack the box it would be very within the Lawful alignments, Lawful Evil in partiular since the money is a self motivational goal. A Lawful Good Hacker would submit a resume so that he can properly lock down the registration computer.
Did I mention the GNU Hacker Prestige class? Must have a Lawful alignment, otherwise the whole bit about licencing wouldn't have any meaning to them. BSD Hackers are closer to True Neutral, since they don't care what is done as long as they get credit.
--Shemnon
which addresses some of Schneier's criticisms.
Instead of a limited time frame, it lasts as long as the product is used.
Instead of the unrealistic conditions of a contest, there's enough information that talented people can spend their time studying security rather than doing reverse engineering.
One of the reasons for mostly-trusting OpenBSD or PGP is that they're the outcome of what amounts to multi-year cracking contests. With enough of the right eyeballs, even security bugs can be shallow.
Ok, take for granted that not everyone here goes to Freshmeat everyday (as is always the constant source of bickering when a new kernel is released), but I've seen an ever growing trend where someone just scans down to the SecurityFocus links on Freshmeat, and then posts them here as original stories. Please stop doing that. That is all.
If there was a "-1 Not Funny", that'd be my most used mod.
At the risk of sounding like an insensitive racist jerk, what, exactly, has the US contributed positively to the net?
Uhhh... other than inventing the damn thing?
Do you have Linux and a DotPal? Click here now!
This reminds me of my old boss that was taking karate lessons. He went up to a geek I worked with and asked him to "try to kick me as hard as you can". He hadn't even finished the sentence when Ken slammed him in the jewels so hard that my boss threw up. All he kept saying was "But I wasn't ready!"
Best Windows Freeware
entrapment only applies to LAW ENFORCEMENT.
there is no crime commited here because the people were allowed to.
Entrapment only applies when a law enforcement official gets you to commit a crime that you wouldnt without them badgering you.
So since its not a crime to hack into something you have permission to, and they are not police/FBI/etc there is no entrapment
... no FTP/SSH (how do you update files on the server)... That isn't real world
No, that is real world, or would be if the "world" was properly administered. You are making a false assumption that ftp/ssh has to be universally open, this is wrong. These ports may, and should, only be opened to certain IP ranges. For example, the companies internal subnet, admin's home IP, etc.
FWIW, they went apeshit over StarCraft, which provided revenues for other projects like Diablo II and WarCraft III.
This cracked me up. The article says that the honeypot server would start a tracing program as soon as it detected anyone trying to connect to it and that (emphasis mine):
:)
"Then the tracking software analyses all the activities of the intruder (including hacking method, all the ISP used, IP address, even what the hackers punched on his keyboard) to trace down the original location of the intruder."
Okay, thanks ZDNet. Did they tell you that, or did you just make that insanity up on your own? You get kudos either for gullibility or imagination, depending. So basically, they're trying to suggest that this program not only traces the hacker (ooh, it logs IP addys!), but then automatically hacks the hacker's machine to install a keystroke logger.
Each day you learn something new. Then something comes along so stupid it damages the brain cells that managed to learn that new thing. But at least I laughed.
The enemies of Democracy are
"As entrants were required to enter personal details together with some form of identification--such as a passport or social security number--in the event that they won the competition, some are worried that their privacy has been compromised."
Doesn't anyone else just find that line HILLAIROUS!? I mean, c'mon... if anyone should be familiar with the vuneralbilities of a web server, and personal information found on said web server, it should be a bunch of "hackers". This is so stupid, I can't even believe it. It has to be a hoax...
Jason
He's totally creeping out the Great One, eh...
I had a job interview a few months ago. I went there for the interview on time, I entered the Office, nobody was in there, so I looked around to find a few servers and some of them where powered on and logged on. So I sat down and waited until a guy arrived 10 minutes later.
:)
When I asked them why they used Solaris as there servers, they told me that it was more secure than Windows and Linux
...It's not ZDnet.com. Look at the web address - the domain is zdnet.com.com
zdnet.com - 128.11.45.117
zdnet.com.com - 64.124.237.140
I don't have time to investigate further, but could it be that the article itself is a hack? Or does zdnet own the com.com domain?
But tell me why do I always get to hear /after/ such a "swift ordeal" on slashdot. Isn't there somesort of website that announces these kinds of contests way-back --infront-- or whatever?
Yes, I know that there's nothing new about exploiting another machine that's been hooked up by a company that's in desperate need of some cheap advertising (though some press-agencies seem to disagree), but $till I would be happy to be informed in front, if you know what I mean;
It plagues my mind sometimes to hear these things afterwards, it's a bad trend. I'm not the only one: some people are even writing basic scripts that r00t any vulnareble machine in case there's a contest running on it, they leave subtle hints inside their scripts so the people who had their contest machine r00ted know who to send the pricemoney to, you all know who I'am talking about!
Some police departments do this. They send packets to peopel with warrants claiming they have won some sort of prize, like a Hawiian vacation or something. They then arrest them when they show up and their identity is confirmed. Apparently, it works fairly well.
Master: Do you see the candle on the table, you must put it out using only your energy. Student: What energy master? Master: Do you not feel the energy within me? You must learn to use that for yourself. Student: I think I understand master. Student grabs the master and slings him ontop of the table and the candle falls to the floor. Master: Get out of my class!
A real webserver usually runs a couple of different dynamic page scripts (Perl, PHP, ASP, whatever). And they are usually the key point to break in.
From: ""±èÅÂæ""
To: ""bcw@rave.ch""
Subject: KDWORKS Notice mail
Date: Mon, 27 May 2002 03:18:31 +0900
Hi!
We will wire your prize as soon as we get your bank account information.
we need;
1) bank account number
2) bank routing number
3) Name on the account
4) Name of COuntry where the bank resides.
If you have any question or concern, please let us know.
Have a great day!
"And you have to ask yourself who will have a Web server running with this small amount of services activated? Nobody."
Nice try, but from outside the firewall, that's exactly how many servers will look. Segregating different unctions to different places is definiely part of a strategy.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Not to be too political here, but let's at least look at things reasonably. The context of that quote was Gore talking about legislation that he spearheaded to fund the creation of the Internet. Neither that quote, or any other, can be interpreted by any but the most die hard conservative as Gore claiming to have invented the Internet. It is, however, a fact that Gore did take initiative in legislation to create the Internet.
When you take things out of context, you can prove almost any point. As the old saying goes, the devil can quote scripture to suit his means (or something like that...)
That's because we need the bandwidth to send out all of our spam. And let the script kiddiez r00t boxes. And steal movies and music from P2P networks. Oh yeah...we use it to play games and read Slashdot too. =)
Voyeurweb (porn), one of the most heavily used sites (in visitors and bandwidth usage) on the 'Net, has been using thttpd v2.20x for a long time...
Netcraft search results for Voyeurweb
The development of BSD unix (in California, of course) and it's widespread distribution to other universities and research centers that ultimately made IP and TCP the "standard". Microsoft's TCP/IP code was originally based on the free BSD Unix code, as was Sun's (both have re-written most or all of their TCP/IP code since, but they did both ship BSD-derived code for years).
Similarily, while the HTTP protocol, a text-only viewer and original server were developed at CERN, it was NCSA (University of Illinois) that developed the Mosaic web browser and NCSA web server. Both Netscape and Microsoft's IE were based on the Mosaic code (recent versions of IE, like 5.5 which I just tested, still credit the University of Illinois in their Help->About Internet Explorer menu). In all likelyhood, you're using IE to view this message, so if you are just click on that menu to see a credit for a quick reality check that code you're using to access the net originated in Illinois. Since you're reading this one slashdot, the server that sent it to you was Apache, which was also originally based on the web server from Illinois (named apache due to a large number of patched to NCSA's server, "A Patchy" server).
There's just two little examples. Of course, if the question was really what has Korea contributed to the internet's infrastructure... well, that's a good question?
PJRC: Electronic Projects, 8051 Microcontroller Tools
Two things:
As a 21 year old guy, you should have noticed the quoted around the word "hacker", denoting irony.
You're way too touchy for a 21 year old person. Truly sad.
oops...
cat $previous_message | sed -e 's/quoted/quotes/g'