After-School Hacking Special

securitas writes "The NY Times writes about an after-school program that teaches teenagers how to hack, attack and defend systems. There doesn't seem to have been the same uproar as the virus-creation course at the University of Calgary (see previous Slashdot thread), even though the participants in Tiger Team (the name of the program) are younger than the university students."

Comments

Cool Idea

[(54)T-Dub]

Sounds like a very interesting program. If someone is serious about system security, this seems like the best way to learn.

I think the program directors argument should qualm any skeptics.

"Some of them grilled us pretty heavily on the concept of, 'Well, aren't you training hackers?' " he said. "I go, yeah. I have a black belt in martial arts. If I wanted to be a bad guy, I could go and hurt people. But I don't do it. That's not the emphasis of the program."

Re:Cool Idea

[ChrisNowinski]

You don't teach people how to create security systems by teaching them to break into bad systems.

You teach them to comment their code, watch the buffers and never let programs leave the box unless you absolutly have to.

This whole hacker mythology is poor.

Re:Cool Idea

[tomhudson]

... And your first assignment, kids, is to hack into the schoolboard payroll system and give me a raise. First one in gets an "A".

Doesn't matter what the emphasis is from the instructors' point of view, all it takes is one script-kiddie to hack a site, and the teacher (and by extension, the school) are up for both civil lawsuits and criminal liability (contributing to the delinquency of a minor, etc).

Especially since he agreed that he was teaching kids to hack.

Remember, just because you CAN do something (in this case teaching kids to hack) doesn't mean you HAVE to.

Re:Cool Idea

[ceejayoz]

If it's their own code, yes. What these kids are being trained to do is find holes in other peoples' code, so a company can fix the insecurities.

There's a good reason people are getting paid $90,000 a year to hack into computers of big companies, despite your scepticism.

Re:Cool Idea

[ceejayoz]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball. No court would find them responsible, unless the teacher was encouraging activity.

From what the article says, he's strongly encouraging ethical behavior. Personally, I wish I had something like this in high school.

Re:Cool Idea

[FroMan]

In a really simple contrived world maybe.

Explaining a buffer overflow and actaully programming one are two different things. And programming an expliot for one drives the idea home even better.

I'm not saying that they should be trying to hack nsa.gov or something. However, when you actaully have a chance to play with a virus or recent exploit in a controlled environment you will get a better understanding.

That is why folks honeypot and such. They can actually figure out what are the techniques used in the wild and how to defeat those techniques.

Re:Cool Idea

[deke_2503]

I disagree. Ever argued with a not-so-bright programmer about why ANSI C is better than Borland C, or Microsoft C? They don't care, they don't understand, and all your arguments of "It's better because it's...uh...standard!" fall on deaf ears. Or have you tried to convince someone to write standardized HTML so that you don't need IE to render it correctly?

Most people don't care about theoreticals. They care about what they can see and what affects them. If you show them their page in Lynx and Mozilla and Opera, perhaps they will understand the need for standardization. If you show them that no one else can compile their program, they might start writing standardized code.

The point is, people aren't going to understand that they have hackable systems unless you hack them and say, "Look what I found!" By proving the flaws in their systems you inspire them to fix them, creating secure systems.

Like they say, there's no teacher like bad experience.

Re:Cool Idea

[Bodrius]

Of course, if you're teaching programmers that's the way to do it. But programmers are not the ones who deal with security problems every day, SysAdmins do.

Typically a SysAdmin staff does not consist of programmers, and even if they are programmers, their job is not to write the security-intensive code and send the company to bankruptcy while they re-implement the OS, the terminal emulators, the network protocol, etc. Their job is to solve problems using the most efficient solution, and this often includes using other people's already developed, tested, code.

Their job is to install it, configure it, manipulate it and understand at a high level how it works; and when things inevitably go bad, minimize the damage and fix it quickly.

Learning to predict HOW things can go bad would help a lot.

Re:Cool Idea

[tomhudson]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball.</quote>

I don't know where you went to school, but most of my chem classes were equations, and we never did get to try the "crushing head with bowling ball" in physics. Head-crushing was kind of frowned upon, both during and outside of school.

If he was really into encouraging ethical behaviour, he'd first teach them the difference between hackers and crackers.

Then, you've got to keep in mind how insecure most school networks are, and how unsophisticated most adult users at schools are:

Q: What's your password?
A: 'password'/'my name'/'my birthdate'/it's written on the post-it on/under/beside the monitor/keyboard/mouse

Sort of like mixing matches and gasoline. It's not a question of 'if' there's going to be a fire, but 'how badly are you going to get burned'.

Re:Cool Idea

[Bull999999]

http://www.cnn.com/2003/LAW/05/21/ctv.matrix.insan ity/index.html

There's been cases where defense lawyers faulted the movie "Matrix" for murders so I wouldn't be suprised if the lawyers fault teachers for hacking and bombing cases.

Re:Cool Idea

[CrayzyJ]

Mind if I back this up for you, FroMan?

My Prof in Netprog showed us a old version of some crappy software (that has been since been repaired). He then installed the code on a server and proceeded to hack into the machine. Seeing this live demo followed up by code analysis REALLY hit home buffer overruns. I really believe this made me a better programmer.

In this case, we learned to "hack" but there was certainly no harm and no foul. I remember to check/fix overruns, but I would have to check my notes on the steps for hacking it.

Re:Cool Idea

[Scrameustache]

I think the program directors argument should qualm any skeptics.

"Some of them grilled us pretty heavily on the concept of, 'Well, aren't you training hackers?' " he said. "I go, yeah. I have a black belt in martial arts."

And then he opens up a can of serious whup ass and shuts them up!
: )

Hehehe, take THAT skeptics!

Re:Cool Idea

[Bodrius]

Not to mention other activities which just as often don't encourage self-control, such as physically intensive competitive sports.

I think the teacher found a very adequate metaphor: when you teach martial arts you're teaching ways to hurt, and sometimes kill. There is no doubt this sort of knowledge can be misused to hurt people; it was perfected for that purpose.

Yet it is also taught and learned mostly for other reasons: for self-defense, for sportsmanship, for physical and/or psychological self-improvement. Sometimes kids are taught martial arts to (gasp!) teach self-control, responsability and discipline.

Society trusts that kind of training because the ethics and discipline are ingrained in the practical teaching, it's not just a chapter and a lecture in the curriculum. Perhaps a similar approach can be used for something like this.

Re:Cool Idea

[Anonymous Coward]

These lawyers should be ashamed of themselves then. The problem with society is people who refuse to take responsibility for their own actions. Instead of nerfing the world for these morons, they should be laughed at and dealt with appropriately. Perhaps crushing their heads with a bowling ball...

Re:Cool Idea

[deadsaijinx*]

Like the time I stole the magnesium strips from the chem class and lit my dads car on fire. I said it was the chem teachers fault, but NOOOO, somehow it was MY fault. Damn system fails again.

Re:Cool Idea

[JordoCrouse]

Sort of like mixing matches and gasoline. It's not a question of 'if' there's going to be a fire, but 'how badly are you going to get burned'.

You don't seem to have alot of faith in the next generation, or indeed in your fellow human beings. You expound a tired point, which has been used by the less clueful of the world to stop everything from sex ed to skeet shooting.

The point of this class is twofold - first, much like a karate or skeet shooting class, to teach respect and self control for the skills.

Secondly, this class exposes the students to the facts - they learn the facts behind cracker attacks, and what can be done to stop them. Its much easier to make the right decisions when you have the right facts. Otherwise, these kids are going to go out, and experiment on their own - and its much more difficult to tell the difference between right and wrong when you randomly try out root kits that you found on an underground hacker website late at night.

You can't just hide this from people, and hope that it will go away - you will always have hackers, just like you will have always pregenant teenagers. Perhaps with the correct facts, the future crackers of America can make the right decisions. They're going to figure out how to crack your machine anyway - the question is, what color hat do you want them to wear?

Re:Cool Idea

[crazyphilman]

ChrisNowinski said: "You don't teach people how to create security systems by teaching them to break into bad systems.
You teach them to comment their code, watch the buffers and never let programs leave the box unless you absolutly have to.
This whole hacker mythology is poor."

I agree. Instead of teaching people how to hack systems, wouldn't it make more sense to teach them how to set up firewalls properly, restrict setuid, restrict the number of services running, set up a patching strategy, and run an intrusion detection system like PSAD? People interested in programming could take a course focused on verifying user input, and avoiding buffer overruns. That sort of thing would be useful to kids, instead of just making them unemployable.

And, this WILL make it hard for them to get a job. Who on earth is going to want to hire a kid who already has experience hacking? Imagine what the legal staff would say, the kind of liability the company would be up against if he or she decided to have a little fun using his work PC, especially when the company KNEW he was a hacker and gave him net access anyway!

I think that every HR Drone who sees a resume from one of these kids is going to at least briefly envision the following exchange taking place:

Lawyer: "So, you knew that Joey was a hacker -- it's right here in his resume. You knew that, correct?"

HR Drone: "That is correct."

Lawyer: "But you hired him anyway. And, you gave him access to the net, Visual Basic development tools, and access to your servers."

HR Drone: "Well, he WAS a developer..."

Lawyer: "Yes, but also a hacker."

HR Drone: "Yes."

Lawyer: (voice rising, Perry Mason style): "So, you KNEW he was a hacker, and you gave him everything he would need to do whatever he might want to do -- including take down Wall Street's trading systems for two whole days?"

HR Drone: "God, when you put it THAT way, you make it sound like it was our fault or something!"

Lawyer: "Perhaps it is. Your hacker cost Wall Street tens of millions of dollars in lost trades. Maybe if you'd have hired someone who HADN'T expressed an interest in hacking, we wouldn't be in this courtroom in the first place. You DID have other applicants, I assume?"

HR Drone: "We had over 100."

Lawyer: "But you chose the hacker."

HR Drone: "Yes."

Lawyer: "No further questions."

The above fantasy would scare any HR Droid senseless. And, you just KNOW it's the first thing they'll think of when they see a resume from one of these kids.

Re:Cool Idea

[BasicOp]

This idea is only useful if students are actually learning how to solve problems. The best way to learn is to have a plan.

Too many times people with an interest in hacking get together for the sake of "learning" but there is no focus. It becomes random experimentation with no order or direction.

A group like this should compare what they are doing to government or corporate standards for security. Such standards can be found on the CIA website, and guidelines for DCOM security are considered an industry standard.

Hacker meetups such as 2600 can be a great thing, but if there is no focus then it becomes a waste of time.

I would like to see a focus group like this fix more things than it breaks. Is that too much to ask?

Re:Cool Idea

[randombit]

I don't know where you went to school, but most of my chem classes were equations (responding to other poster saying chem classes taught how to make explosives)

Yeah, so were mine. You ever read about 'exothermic' reactions? Or maybe hear anything about oxidizers? With a half-way decent chemistry book, you can make some fairly powerful explosives, easy. And, like another poster, I also ripped off Mg strips from my HS chem lab. :)

Re:Cool Idea

[tomhudson]

And you (perhaps purposefully) miss my point entirely. Schools have the weakest network security going. Don't like a teacher? Dump some porn into their folders and rat 'em out. Don't like your grades - change your marks. Don't like another student - ditto. Erase/modify lesson plans.

<quote>you will always have hackers, just like you will have always (sic) pregenant (sic) teenagers</quote> - and your point is? Sure' we'll always have kids screwing around, that doesn't mean we encourage it on school grounds.

If they want to crack machines/have sex/do drugs/whatever, let them do it from home, same as every previous generation. And when I catch them trying to access my boxes from their home accounts, I can complain to their isp and get them shut down, or (since most of them will be running winbloze) crack them back.

Re:Cool Idea

[Ryan Amos]

Yes, but any security professional worth his salt knows how to hack. You have to know how to break the system in order to fix it. This includes probing your own code for holes; Microsoft could use people like this to just sit there and pick away at IIS (or some such server software) and find the holes before the software is released. This way nobody else finds them first. Of course, the potential for abuse is high, especially among high school kids, who have no fear of breaking the law, so I don't know that this is the appropriate place to do it. You've got to make sure the students are mature enough to handle the material before you teach it to them.

(And before you slashdot youngins chime in, yes, you may be ethical, but I doubt most of your classmates would be. And it's oh so tempting for a geek to show off how he can hack stuff because other people think it's cool..)

Re:Cool Idea

[tomhudson]

Sure. Potassium permangenate, rusty iron filings, etc., were all fun ... but most was about calculating just how much energy we'd get out, and the products of the reaction.

Safety was emphasized.

None of this "take a pickup truck full of fertilizer, an oil tank full of diesel, mix in a cement truck, and park in front of a building" shit, or the computer equivelant - cracking.

And definitely no crushing of skulls with bowling balls in physics. English lit, maybe ... :-)

Re:Cool Idea

[tomhudson]

You have to know how to break the system in order to fix it</quote>

Actually, that's not quite true. If you've learned how to write good code, and you review someone else's, and it looks like something the dog barfed out, you'll recognize that, because it "just looks bad".

You'll be suspicious, you'll want to replace obscure/unclear/weird code with clean code. You won't have to test the existing code for buffer overflows, for example, or freeing objects multiple times, because your rewrite won't include these errors anyway (you do test for null pointers, malloc returns, etc., don't you)?

Back on-topic: this course isn't for training "security professionals" - the teachers' own words are that he's teaching high-school students how to "hack". Teaching them how to code properly would eliminate most security holes down the road, but that's not seen as "cool", and requires a lifetime of coding, and a certain mind-set, which you won't find among the script kiddie set anyway, nor among those who think "teaching kids how to hack" (in the cracker sense) is good.

Re:Cool Idea

[TedCheshireAcad]

What would this interview look like with a smart/tech-savvy HR Drone?

HR Drone: "So I see you've done an after school program on hacking"

Kid: "Yes, that's correct. I am a security expert because of it."

HR Drone: "...So you're a tool"

Kid: "Well actually sir, I am trying to be a security professional."

HR Drone: "...So you're a tool"

Kid: "In this program, sir, we learned the most advanced techniques for securing today's modern computer systems."

HR Drone: "So you've mastered Windows Update?"

Kid: (blushes and stares at feet) "...yeah"

Re:Cool Idea

[Anonymous Coward]

yeah right if they are dumb enough to post on thier resumes that they are 7337 haxors then they deserve to not be hired

Re:Cool Idea

[Exiler]

MOST schools have the weakest network security around (I've had that discussion here several times before) but do you think a school with a program like that is going to have stupid network admins like almost all the other schools?

Re:Cool Idea

[tomhudson]

As I pointed out, it's not just the admins, its the users as well. But, yes, any school that can't even make the distinction between hackers and crackers is most definitely going to have stupid network admins.

Don't forget that this program is not a core requirement, so it will receive even less funding/less qualified teachers than language or math courses, which are already underfunded.

Re:Cool Idea

[ceejayoz]

Safety's being emphasized in this class, too - they're hacking on a closed network, agree to an honor code, and are likely very closely watched by the security expert running the course. They're being taught ethical hacking - cracking a system to demonstrate to a client the vulnerabilities.

If you're teaching, say, a criminology course, you're going to teach how to do a crime right. That doesn't mean the students are going to all run off and commit felonies - it means they're going to understand the thinking of those they're going up against.

As for the crushing of the skull - F = m * a. :-p

Re:Cool Idea

[DA_MAN_DA_MYTH]

Instead of teaching people how to hack systems, wouldn't it make more sense to teach them how to set up firewalls properly, restrict setuid, restrict the number of services running, set up a patching strategy, and run an intrusion detection system like PSAD?

That's a good idea however, why do we know how to do those things in the first place. By teaching people how to hack, you teach them how to creatively think.

Think about it, who could design a better safe, a safe cracker who's been doing it forever and knows different methods of breaking in. Or someone who was taught how to make the last theoritical uncrackable safe?

Re:Cool Idea

[tomhudson]

Comparing a high school class on "ethical hacking" to a criminology course is like comparing apples and oranges.

As far as agreeing to an honour code, minors aren't exactly liable for breaching their word or some so-called "honour code". You gonna mark them down? Fail them? They'll just go into the system and change their marks back. And then dump some kiddie porn on the instructors' drive. And unless the instructor is teaching one-on-one (and not even then - let's face it, everyone's vulnerable to social engineering or has to take a leak at some point) there's no way he/she is going to be able "closely watch" everyone. He or she will check the logs? Nope, a good crack will point the finger elsewhere. Even a lame crack will be able to claim that it must have been someone else, and they're pointing the finger at him/her.

What separates ethical from non-ethical hackers isn't knowledge, it's maturity, liability and intent. These kids don't have the first, are seriously lacking in the second, and the third is exceptionally open to peer pressure, manipulation, etc, because of the first two lacks.

How long before someone "opens" the network to the world? Piece of cat5 hidden behind a desk, a wap, a laptop, usb card writer, external drive, whatever, to take the day's lessons home?

Re:Cool Idea

[crazyphilman]

Knowing how to secure a system and knowing how to attack one are not the same thing. You can consider case histories and factual accounts of prior incidents to try and see how a system is going to be attacked, and work that information into a new design. Naturally, you would want to consider hacking techniques in a course on security, but I think it's a question of focus. This course seems to focus on hacking, rather than the other side of the coin, system security. I think it's foolish to approach the subject -- especially with adolescents -- in this manner.

Re:Cool Idea

[crazyphilman]

Ha! That one was funnier than mine. Kudos.

Re:Cool Idea

[(54)T-Dub]

To reiterate my point made above, what about the martial arts analogy? When I was in junior high I knew a kid who could do some serious damage to an adult because he was a 3rd degree brown belt. Yet did he was also a very well rounded kid who would never resort to violence. Just because you teach someone powerful tools, doesn't guarantee that it will backfire in your face.

Re:Cool Idea

[Anonymous Coward]

"If he was really into encouraging ethical behaviour, he'd first teach them the difference between hackers and crackers. "

Wow, how many times have I seen this type of argument? Hacker vs Cracker. To the ordinary joe user there's only 'hackers', and seeing that most joe users favourite key combination is 'ctrl-alt-del' do you REALLY think that they'll ever make a distinction between the two? Personally I think a hacker is a hacker is a hacker. There's good ones and bad ones, of course, but this shit about the terminology of differentiating the two is just silly. What do you call 'good cops' vs 'bad cops'?

Re:Cool Idea

[tomhudson]

Again, the martial arts analogy doesn't apply here. There is no centuries-old culture backing up training hacking, as there is in the martial arts, there is no "spiritual" side to hacking, as there is in the martial arts, and the martial arts were designed for defense, whereas cracking emphasizes offensive skills.

Re:Cool Idea

[tomhudson]

Hacker vs Cracker. To the ordinary joe user there's only 'hackers', ...</quote>

We're talking about someone who claims to be teaching kids how to hack, when he's acknowledged that it's really cracking. If he won't take the time to get the terminology right, what else is he slacking on?

It might be ok for joe public, but there is a difference between the two. If you're going to teach a course, at least get it right, especially since, by imparting a bit of the history of the terms, you can demonstrate how errors by hackers (people who enjoy writing code) allow others to be crackers (people who enjoy exploiting the errors of hackers). The two are distinct, but definitely related, and by upgrading the code-hacker skillsets, we deprive crackers.

But that was the point in one of my earlier posts - teach people to write better code. By showing them the dif. between good and bad code, you also are showing them how bad code can be exploited.

Re:Cool Idea

[Xabraxas]

Actually, hacking a system is the best way to learn about security. I bought the book "Maximum Linux Security" and it describes how to exploit certain services and why it works. They even give you the tools to do it. Then they describe how to secure it. The best part is trying to hack something you've thoroughly secured and finding that you actually did in fact secure it. Honestly I don't know how else you could secure something if you don't know the weaknesses. Getting your hands dirty is really the only way to really learn anything. Of course this should be done on a closed system only but I think that's obvious enough.

Re:Cool Idea

[Xabraxas]

My best friend is a sysadmin for my old high school and they have the most advanced, and secured networks I've ever seen. They also have a similar program at that school. They started it when I was still there but as I remember you had to write an essay to be reviewed by the teacher to get into the class. They only picked about 7 kids to be in the class and they would help maintain the network and were given special priviledges. My friend was in that class and learned a lot of sneaky things. The funny thing is that none of them ever did anything devious. In fact that experience is what lead him back there to become the sysadmin for the school.

Re:Cool Idea

[crazyphilman]

But, see, what I'm getting at is that although some hacking techniques have to be considered, the FOCUS of the course should be on methods for securing systems, and the lions share of the material should involve security techniques that have been proven in the field. This course seems to focus mostly on system cracking, not on the security-related material that would be of use to a sysadmin.

Another issue is that this course is for adolescents, who have neither the maturity nor the common sense an older practitioner would possess. I wonder just how wise it is to present a young person with so much rope suitable for hanging himself!

Re:Cool Idea

[atr-isf]

crazyphilman writes:
Instead of teaching people how to hack systems, wouldn't it make more sense to teach them how to set up firewalls properly, restrict setuid, restrict the number of services running [...]. That sort of thing would be useful to kids, instead of just making them unemployable.

The Tiger Team program does both. In a "capture the flag" environment, both teams have to install, harden, and monitor their own systems as well as probe the other team's systems. Vulnerability analysis, penetration testing, or whatever term you want to use for "ethical hacking," is a major component of any good risk assessment strategy.

As for unemployable, think again! Not only do information security companies hire people who have these skills and experience, but many industries that are required to conduct risk assessments by law and regulation (such as the banking industry) are actively seeking such people as well.

This is not to say that Tiger Team "graduates" are ready for this sort of work. They have simply taken the first step on the road. To flog my martial arts analogy, they will have graduated to yellow belt.

Andy Robinson
Information Security Foundation
www.isfound.org

Re:Cool Idea

[Cynikal]

"And, you gave him access to the net, Visual Basic development tools"

hehehe, im sorry, thats just funny... h4x0rz wreaking havoc with winsock.ocx

Re:Cool Idea

[crazyphilman]

Thanks, that's what I was going for. At least the joke wasn't wasted... ;)

Re:Cool Idea

[crazyphilman]

The way you describe it, it actually sounds quite attractive and a great idea for training security staff. But I felt that the way it was originally described to me focused way too much on the hacking aspect, which I would think would turn off your average suit. "Hacker" is such a dirty word these days; it doesn't seem all that safe to use it. Just recently, someone I know almost got into some serious trouble because a clueless manager overheard him talking about enjoying the hacking simulator in the new Matrix game! It took a bit of explanation to calm everyone down. ;)

I totally "get" the usefulness of the tiger-team approach, I just think it's a little dangerous to spin it as hacker training, especially in an article that is going to be read by the clueless.

Having said that, I think maybe I would like to modify part of my position, i.e. the part where I said that people shouldn't learn hacking skills but rather should focus on system hardening. Now that you mention it, I can see the usefulness of teams taking turns attacking and defending. In fact it sounds like a blast, besides being very informative.

Still, there's GOT to be a better way to spin this to the media. People are bound to react badly, don't you think? I don't have a lot of faith in people suddenly developing open minds... :)

Re:Cool Idea

[atr-isf]

crazyphilman writes: Still, there's GOT to be a better way to spin this to the media. People are bound to react badly, don't you think? I don't have a lot of faith in people suddenly developing open minds... :)

You're absolutely right. But for better or worse, I don't have editorial control of what the media says about this program. If I did, would you trust anything I said (not that you do now, but hypothetically speaking :-)?

On the one hand people will react badly when they see "hacker school." On the other hand, the very controversy surrounding the word "hacker" (or even whether it's the right word) brings public attention to the issue of information security and initiates an open dialog. The mission of the ISF is to raise public awareness of INFOSEC issues, so from that standpoint we've succeeded.

I just hope that our good deed will go unpunished.

Andy

Re:Cool Idea

[enomar]

The point is, people aren't going to understand that they have hackable systems unless you hack them and say, "Look what I found!" By proving the flaws in their systems you inspire them to fix them, creating secure systems.

True, if you can get past the psychology of it all. Most programmers hate to find errors in their code. They will go to great lengths to show how the error is irrelevant or justifiable. I've actually had web programmers tell me that they didn't check for null values on less than 5 parameters because the project timeline was too short.

Re:Cool Idea

[Chrisodeo]

You're all forgetting the psychological aspect of what would become of hacking should this program be implemented in all schools. If it was, I doubt that hacking ability in general would still be frowned upon or shunned. In truth, it might actually be revered. Not only that, but since it would be a common thing to learn, we'd get less of those who choose to abuse this ability. It's the whole 'swearing around children' argument all over again.

Re:Cool Idea

[crazyphilman]

That's true; it's probably a good thing that this brings the issue into the view of a larger number of people. And, it's also true that the media don't often present things in the best or even most accurate light. I was rabidly misquoted in a major magazine article once, over a tattoo of a company logo I had placed on my arm. During the interview, I had told the reporter that I felt that since the company was going to be my one and only dot-com job, the tattoo would make an interesting souvenier to tell my grandchildren about. The reporter turned around and fabricated a quote about my not really knowing why I got the tattoo, I just got it, making me look like a total idiot. I vowed never to speak to a reporter again (and so far, knock on wood, I've managed to avoid them). As far as the tattoo goes, I got sick of explaining it to people and having them say, "Oh, I read about you -- you're that tattoo guy". So I had it covered up with a Japanese dragon a month or two ago, and no one bothers me anymore. ;)

Good luck with everything. You seem like a pretty okay guy.

Re:Cool Idea

[(54)T-Dub]

Ok, replace martial arts with say, boxing. It is a more modern art of fighting that doesn't have a spiritual aspect, it also is more of an offensive skill than a defensive skill. Would you say that kids should not be taught how to box?

For that matter, what about the ROTC or the junior police forces. Again skills are taught that could be used for unscrupulous purposes, yet there are a set of morals included with the training. The idea being that if you build the set of morals in concert with the skills, the student will use those skills in a positive way.

Re:Cool Idea

[tomhudson]

Actually, I don't consider boxing a sport. Consider, if 2 people engaged in this "sport" in any other venue than a boxing ring, one or both would be charged with assault. Besides, partaking of a sporting activity should leave you in better health, not brain-damaged.

What next - wife-beaters claiming they were "just boxing"?

Re:Cool Idea

[valdis]

I agree. Instead of teaching people how to hack systems, wouldn't it make more sense to teach them how to set up firewalls properly, restrict setuid, restrict the number of services running, set up a patching strategy, and run an intrusion detection system like PSAD? People interested in programming could take a course focused on verifying user input, and avoiding buffer overruns. That sort of thing would be useful to kids, instead of just making them unemployable.

On the flip side, across the hall I've got a loaner box from Vendor X. Said box would be classified by most people as a "computer appliance" - it has one main function, but also has an Ethernet interface whos sole purpose is to provide a remote management function. Now tell me - how do I evaluate said box to see whether it meets our security standards unless I have at least a half a clue about how to hack said box?

Go back and look at the recent Hotmail/MSN password change debacle. Very likely, all set up by people with good sysadmin skills, but nobody with any pen-test skills looked at it before it went live. As a result, some guy who does have skills in that area found a big gaping hole in under 5 minutes.

Think of the embarassment they'd have saved themselves if they'd hired one graduate from a class like this.....

Now ask yourself - is your shop going to be next?

(Oh.. and that box? I haven't totally broken it yet. But the first hour or so of testing found a number of things that don't give me warm and fuzzies...)

Re:Cool Idea

[theLOUDroom]

I don't know where you went to school, but most of my chem classes were equations, and we never did get to try the "crushing head with bowling ball" in physics. Head-crushing was kind of frowned upon, both during and outside of school.

Man you lost out. My chem prof used to blow something up ever friday. It was great! Somehow he managed to make it relevant to the lesson every week too.
It kept attendence up too.

Re:Cool Idea

[Bandman]

>there is no "spiritual" side to hacking, as there is in the martial arts

I know several individuals who would disagree strongly with you on that.


>the martial arts were designed for defense, whereas cracking emphasizes offensive skills.

Where as network intrusion detection and hardening are designed for what?

Re:Cool Idea

[crazyphilman]

Well, as I've said to a couple of other guys here, I'm starting to warm to the idea. I think I can see the utility in performing a penetration test (besides, it's SO much fun saying that -- "Penetration test" -- it's hard to do it without smiling) on a new server. Also, one of the people involved with the program said that really, over half of the material is about defence, not hacking (the kids apparently play capture the flag, sometimes attacking, sometimes defending). So a lot of my misgivings are settling down.

So, let's say I'm starting to see the light. ;)

Re:Cool Idea

[tomhudson]

Parent poster:

>Quoting me: there is no "spiritual" side to hacking, as there is in the martial arts

>Replies: I know several individuals who would disagree strongly with you on that.

They really, really, really need to get a life :-)

Re:Cool Idea

[(54)T-Dub]

The same could be said of martial arts though. I admit that boxing may have been a bad analogy, but you didn't respond to my other two: ROTC & Junior Policeman's league

Re:Cool Idea

[tomhudson]

Didn't respond to the other 2 because I've got other things on my mind that take precedence (one of my dogs is sick, so I had to bring both the Newfie and the St-Bernard to the office today).

I've had the newf for 10 years, so I wanted to keep an eye on him. He seems better today, but last night I thought he was going to kick the bucket.

Re:Cool Idea

[(54)T-Dub]

I'm glad to hear he is doing better. I hope he pulls through.

Re:Cool Idea

[tomhudson]

Thanks. He's doing a lot better today, though he still tires easily :-) I think I found the problem - a bad batch of dog food :-(

Wonder if anyone's done a formal study of the history of dogs in hi-tech environments? Seems that most of the books I've seen, you know the biz has gone corporate when the hounds are banished.

Re:Cool Idea

[Anonymous Coward]

Dude.... You're paranoid.

You have too little faith in the youth of today. Many are stupid crackheads, but many are more mature than the average adult.

Re:Cool Idea

[tomhudson]

An AC wrote:

Dude.... You're paranoid. You have too little faith in the youth of today. Many are stupid crackheads, but many are more mature than the average adult.

And then you get the ones that are smart but not mature ... how my stating that you can't rely solely on kids' sense of ethics translates into paranoia is beyond me.

Kids are people, too. Which means they can lie, cheat, steal, and in general fuck up, just (usually) not as badly as adults, because they don't have complete and unfettered access to the same things adults have.

But if I'm paranoid, why don't you post under your real name (like I do), and, while you're at it, give us all your passwords?

I'm lazy

[Anonymous Coward]

Can someone post the google link?

Yeah!

[grub]

Yeah! Finally we after-schooler AD&Ders have a group nerdier than us to beat up!

Re:Yeah!

[Flabby Boohoo]

Don't get your hopes up... you AD&D'ers are still the nerdiest. Most hackers don't think they are a level 27 Paladin. :-)

Re:Yeah!

[Lord_Slepnir]

You call yourselves nerds and you're only using AD&D? You're barely worthy of the title. Us TRUE nerds switched to 3rd Edition long ago. Oh no...OH NO *Beaten to death by horde chanting "THAC0 FOREVER"*

Re:Yeah!

[zootread]

Yeah! Finally we after-schooler AD&Ders have a group nerdier than us to beat up!

Uh, sorry.. I was an after-school hacker, and I'm sure I could kick your ass. That and all the ladies loved me cause I hacked their computer assignments so they didn't have to do them. Guess I wasn't a white hat, though.. True, those white hats are pansy-ass bitches.

Re:Yeah!

[geekoid]

We always have had a group to beat up: Marching Band.

Re:Yeah!

[jimand]

read this and -then- make fun of Marching Band.

"60 hours of rehearsal per minute of performance."

Re:Yeah!

[micromoog]

My God, they're even nerdier than I ever imagined!

Re:Yeah!

[zootread]

oh god.. this is what the worlds needs more of... teenage pissing

that and people lacking a sense of humour?

Re:Yeah!

[the gnat]

Percent of marching band members in my college who were female: 50%

Percent of CS majors in my college who were female: about 5%

Any questions?

Re:Yeah!

[andrewski]

THAC0 is for the tots. Real gamers use the old AD&D, 1st ed. rules and EASE OF PLAY BE DAMNED!

Re:Yeah!

[Anonymous Coward]

Yeah, cause it not like the music doesn't change. You are playing the same notes that millions have played for a hundred years. Yet you still need to have the sheet music on your clarinet so you don't fuck it up. That is the stupidest thing about marching band.

Re:Yeah!

[Anonymous Coward]

Hell, yeah! Cause there's nothing like having a bunch of players waiting while the dungeon master works up a spreadsheet of monsters/treasure. Said players eventually go out to watch Army Of Darkness rather than watch "Dungeon Master Accounting" in action. :)

Re:Yeah!

[Anonymous Coward]

Hey buddy, keep your weird perversions out of this topic! Sicko!

Re:Yeah!

[Dr. Photo]

You call yourselves nerds and you're only using AD&D? You're barely worthy of the title. Us TRUE nerds switched to 3rd Edition long ago. Oh no...OH NO *Beaten to death by horde chanting "THAC0 FOREVER"*

Piffle. You can easily get 10 hits in while they're busy crunching those numbers. "Gee, do I add or subtract AC from THAC0 to get..." [BIFF!] [THWACK!] [SPLAT!]

(It's no wonder that a combat round in AD&D was a full minute long!)

Re:Yeah!

[Clockwurk]

Is that you R Kelly??

Re:Yeah!

[drinkypoo]

Actually, I just switched over to playing neverwinter nights, which is kind of like 3rd edition D&D. I just wish you could have a single map have multiple overlapping elevations :(

mmmm yea

[nege]

I would have loved to go to a highschool offering programs like this. It really would have given me something to do other than being a marching band dork. On the other hand, band was one giant orgy, so maybe its best that I stayed away from computers at that point in my life.

And one time... in band camp... we hacked the white house and asked GWB if he was out of TP.

Now that....

[Chris_Stankowitz]

Now that all the other social issues that teens face have all been meet head-on and dealt with, its good to see us turning our attention to more meaty topics.

Little Johny: Hey, Jimmy try this script out. First one is free tell your friends.

Re:Now that....

[Anonymous Coward]

Topeka, KS -- Student Suspended Over Suspected Use of PHP

Could be useful

[paranode]

If you educate talented kids on how to defend systems you could produce some very valuable assets to the future security community. Learning how to hack goes hand in hand with learning security because you need to have the same level of knowledge as the hackers (preferably better). If they can see the profit potential of using this knowledge for good then they will probably be swayed from the dark side.

After taking a similar class

[billstr78]

After learning how to break systems fom a prominate IDS designer, I can honestly say that I will design much more secure systems myself. Becuase of my age, I don't feel the need to go out and try what we learned on real systems to see if I can cause havoc.
However, I wonder why the adults behind this "after school program" think that kids will have the same degree of responsibility that university students do when learning these things. What is to keep them from going out and writing viruses, unleasing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

Re:After taking a similar class

[Anti Frozt]

An interesting point. With University students, namely engineers, they are required to take at least one, sometimes several ethics courses designed to encourage responsible practices later on in their careers.

Hopefully, something similar will be put in place for these highschool students, though it may not be as effective due to the generally lower level of maturity.

Re:After taking a similar class

[Drakonian]

It's good to know you considered it useful. I've been completely amazed at the uproar over U of C's virus course. (I'm considering taking it but it doesn't fit into my schedule well. :( ) All these threats like "don't apply for a job here if you took the course". And beautiful circular arguments like "Only bad programmers write viruses so if you take the course you are a bad programmer". Very interesting.

Re:After taking a similar class

[Neil Watson]

I was watching a documentary about teenagers on TLC or Discovery a few months back. They had studies that suggested the part of the brain enables you to predict the consequences of your actions may not develope until the end of puberty . Thus teenagers may be irresponsible becuase their brains are wired that way.

Re:After taking a similar class

[leighton]

I doubt that ethics courses will really help all that much. As a medical researcher, I've been forced to sit through any number of such classes. I don't think any of them taught me anything I didn't already know, except how to comply with innumerable arcane Federal regulations (which is useful, but isn't really the same as ethics anyway). Most of the ethics components offered useful advice like "Don't lie to your patients." (I never would've thought of that, and now that you've told us, I'm sure all the immoral people out there will immediately stop doing it!) When instructors tried to present more complicated ethical issues, they usually could not adequately defend their "answers," and were viciously beset from all sides by doctors (and occasionally techs like me) who actually understood the moral complexities of the situations the ethicists were talking about.

I think such classes are basically there to help stave off lawsuits; they allow you to say "Hey, we tried, we gave him ethics training; if he violates it, that's HIS responsibility." It gets rid of the (usually bullshit) argument that the kid simply didn't know it's wrong.

Re:After taking a similar class

[TrekkieGod]

Becuase of my age, I don't feel the need to go out and try what we learned on real systems to see if I can cause havoc.

So you're saying that it's your belief that older man cannot be unethical?

However, I wonder why the adults behind this "after school program" think that kids will have the same degree of responsibility that university students do when learning these things. What is to keep them from going out and writing viruses, unleasing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

Same thing that keeps you from causing lots of trouble: a strong sense of ethics that outweighs the curiosity. Well...maybe fear of punishment as well.

I think the way they're doing it provides both deterrents. They have law enforcement agents as speakers to remind the kids of the consequences of their actions. They also have the class in the form of a competition which helps them satisfy their hacking urges against equally smart opponents.

I really don't think that you get increased ethical values with age. You need to be taught those by your family. On the flip side, I don't think you can use the age of a teenager as excuse for irresponsible actions.

Re:After taking a similar class

[EinarH]

What is to keep them from going out and writing viruses, unleashing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

The same thing that keeps 18-20 years old men fresh out of the military from creating havoc with a weapon: Ethics.

Most modern civilised societies today train *thousands* of young men to kill, wound, stab and inflict damage on others. Despite this, rarely does it happen that these people use their skills after-hours in an inappropriate way. Of course there are exceptions, for example people with mental illness etc.

Personally, I have a fully automatic rifle with XXX numbers of shoots stored in my home provided to me by the government. I could easily create a mess with this weapon, or with a shotgun or a pistol I own privately. Despite this I don't.

As long as the individuals/persons that are taught these skills are enough mature and they are taught ethics and the difference between right and wrong I don't se the problem.
After all: Deep inside, most people are good.

It's better that they acquire these skills in a way that gives someone the possibility to correct bad behaviour right then. And besides that it gives them something they can put on their CV and use to get a white-hat job.
This is a clear example of a case where the positive effects out-weights the negative.

Re:After taking a similar class

[TrekkieGod]

How'd this documentary explain the existence of so many responsible teenagers? There are a lot of kids who never got in any serious trouble, are good students, etc.

Re:After taking a similar class

[Neil Watson]

I believe the point was that most teenagers act irresponsible at least some of the time. If you never did anything out of line when you were a teenager then I think you were in the minority.

Re:After taking a similar class

[TrekkieGod]

My engineering ethics professor told us that when we get our first job, we shouldn't try to impress them by "volunteering to all sorts of activities when they are proposed. Instead, don't do any work that's not specifically assigned to you, because the moment you show them that you're competent with other duties, they'll start assigning them to you and you'll never get any free time."

Granted...that wasn't part of his actual lecture, it was during his Pre-Lecture Ramblings(tm). Still, I didn't think it was very ethical.

Even stranger...it's one of only three things I remember from that class. No comment on the other two (they're not ethically related either).

Re:After taking a similar class

[Anonymous Coward]

"Personally, I have a fully automatic rifle with XXX numbers of shoots stored in my home provided to me by the government." Hummmm... are you Swiss by any chance? or from Israel? Most governments do not trust it's citizens with automatic weapons, not even it's "Citizen Soldiers"

Re:After taking a similar class

[Bodrius]

Most adults act irresponsibly at least some of the time.

If you never did anything out of the line after your second decade of life, then I think you're in the minority.

Re:After taking a similar class

[billstr78]

Most people are good. But teenagers typically don't fully comprehend the impact of thier actions. Also the gun analogy is not a valid one. In order to "create a mess" with your firearms, you would have to witness the horror caused by your actions and have a high probability of being caught.
Cracking computer systems is much different. You can do it from the comfort and privacy of your own home. You don't see the greif your actions causes others. It is traditionally much more difficult to get caught.
I see that they are doing everything they can to discourage deviant behaviour, but they cannot prevent it and as someone said earlier, if they enable these kids with the skills necessary, a chain of responsibility is created and lawsuits will propogate up the chain stopping at the organization with the most money.

Re:After taking a similar class

[TrekkieGod]

I believe the point was that most teenagers act irresponsible at least some of the time.

Yeah, but in my opinion, I figure that if that were due to actual phisiological differences you'd have a much smaller minority of kids that were aware of consequences. And I think there are too many "good kids" to set them out as outliers. Rather, although most teenagers do some things wrong from time to time, I think there is a small minority of kids that, for example, get in trouble with the law, or do things that threaten their lives.

That indicates to me that most teenagers can predict consequences to their actions. They just decide that they can take some consequences (such as the risk of being caught and scolded by your parents for doing something they told you not to) while others are not acceptable (like going to jail for something).

If you never did anything out of line when you were a teenager then I think you were in the minority.

Actually, I think I do more things out of line now than when I was a teenager--I figure I can get away with it. :)

Re:After taking a similar class

[insanecarbonbasedlif]

After all: Deep inside, most people are good.

Hmmm. Naw. Most people aren't *good*, they are *not that bad*... consider:
How many people do you know who have told a lie? For personal gain?
How many people do you know who took some money (even a very small amount of money) that didn't belong to them?
How many kids do you know who got into fights over toys when they had a toy themselves?

Now, how many do you know who didn't do any of these things?

I've got to say, from personal experience, none... best case - not many.

Society and ethics instilled in impressionable minds is what keeps people good. What these kids do with their new found hacking knowledge totally depends on whether or not they feel compelled to follow the rules. Most will, some won't. We're all bad, just some act out more than others...

Re:After taking a similar class

[usotsuki]

BAH!!! I had a full awareness of right and wrong at 3. Excuses, damn excuses. Fsck the Discovery Channel!

-uso.
-1 Flamebait

Re:After taking a similar class

[recursiv]

I don't think this example has anything to do with ethics. What your professor was advocating was just a way of approaching a job which to me, sounds neither right nor wrong.

For example an unethical behavior might be agreeing to do the proposed activity without intending to do it.

The root of "volunteering" is voluntary. That means it is one's own choice to do it or not. Strictly optional. How could *not* volunteering be unethical? One could easily volunteer oneself into a black hole of unending projects. Not volunteering for projects you don't have time for is just common sense.

Re:After taking a similar class

[TrekkieGod]

well...I managed to mess up the retelling of the story. There was a connotation of "try to look as incompetent as you can without getting fired" in it.

Re:After taking a similar class

[jafac]

Too bad they don't teach MBA's ethics.

Re:After taking a similar class

[AT]

"don't apply for a job here if you took the course"

If thats their attitude, you probably don't want to work there anyways. I can't imagine what they expect you to do; build a virus at work and unleash it on the workplace? Thats a simple question of ethics.

Re:After taking a similar class

[Nick_dm]

I'm not so sure, I heard about this (from my mum who saw the documentary) and its certainly something I'd agree with. I'm 19 going on 20, at university so I know plenty of people in the 18-22 bracket, but I have younger siblings and I'm pretty good friends with some of their friends in the 16-18. I always feel there's a bit of a difference in behavior when it comes to making decisions.

Perhaps one key point is that my mum mentioned was that they were less talking about a lack of responsibility, but rather a weakness in teenagers risk assesment. So it makes more of a difference in spur of the moment decisions, when you are making a quick judgement and can't think everything through. Certainly I was a fairly respnonsible (boring? :) at 15-17, but in hindsight this wasn't just due to me always being capable of making the right choice, it was partly because I was naturally a little held back/cautious and would think things over more than some people. If I'd been asked to make an important decision quickly though I'd probably be quite likely to screw up.

With regards to the hacking thing, I think if the course is done well then the age of the students shouldn't be too much of a problem, as they will be educated about why they shouldn't abuse what they are learning, so they will then be less likely to make a spur of the moment decision if any oportunity presents itself as they have a bit of conditioning on how to deal with it.

Re:After taking a similar class

[Xabraxas]

So a person is bad if they're done one bad thing and a million good things? People make mistakes, that doesn't make them bad people. Bad people for the most part were bad kids and good kids for the most part become good people. I think it's just the typical, ignorant "kids are stupid" line of thought that's getting everyone in an uproar. I've done worse things as an adult than a child. As I stated earlier in this thread, there is a similar program that has been going on for years at the high school I went to and nothing bad has come from it. A teacher that knows enough to teach that class knows enough to teach only those who will act responsibly.

Re:After taking a similar class

[TravisHarjew]

For every Joker, there's a Batman, for every "kid" that uses his knowledge of computers to create viruses, there will be another person that will just as easily be able to stop that virus. We can't worry about small problems that may slightly harm the great outcomes of teaching students something that they hopefully use for good and not evil....well, you know what I'm trying to say.

Re:After taking a similar class

[marko123]

After all: Deep inside, most people are good.

and warm.

I heard that the website advertising the course..

[Idimmu Xul]

didn't have any spinny flaming skulls on it, and their wasnt a single biohazard sign anywhere! :(

I severely doubt it's integrity and capability with regard to teaching me the kiddie skillz I need to get by on IRC nowadays!

- DemonShadowHa>0rSpawnNeo

--------------- THERE IS NO SPOON
--------------- HACK THE MPAA RIAA AND AA

The Hacking After-School Special

[Anonymous Coward]

Timmy: Hi Susie!

Susie: Hi Timmy! Wanna go get a malted milk?

Timmy: Nah, I've got something keener to do.

Susie: What then?

Timmy: I don't think you would get it.

Susie: Come on! We're best friends, right?

Timmy: OK then. I'm gonna go home and hack.

Susie: (pause) Gosh Timmy! You shouldn't hack!

Timmy: Why not?

Susie: Hackers are theives and cost lots of folks money! They're akin to a device that breaks the lock on your house!

Timmy: Aw shucks, you're so old fashioned. I gotta go, see you tomorrow.

[ Susie walks away sadly. ]

[ The next day... ]

Teacher: Rodney?

Rodney: Here.

Teacher: Susie?

Susie (sadly): Here.

Teacher: Timmy?

[ silence ]

Teacher: Susie, do you know where Timmy is?

Susie: I sure do, Mrs. Martin. He went to jail.

[ murmurs from the classmates ]

Susie: He was downloadin' music and stuff, and he got caught. He's really in a darn pickle now.

Teacher: Class, let this be a lesson to you all. Good kids don't hack. If somebody asks you to hack, just say, "I don't hack. That's whack."

Re:The Hacking After-School Special

[paranode]

Susie: He was downloadin' music and stuff, and he got caught. He's really in a darn pickle now.

If downloading music and stuff is hacking then I don't think we have much to worry about teaching kids to hack. Even your mom is a hacker!

Re:The Hacking After-School Special

[xScruffx]

"I don't hack. That's whack."

Now THAT is a t-shirt waiting to happen. Perhaps the back could have a good old "Just say n0."

xScruffx

Re:The Hacking After-School Special

[Anonymous Coward]

LOL that sonds like a show that we have here in PBS (houston) the bad guy of the show is named "hacker" and he gos around doing all sort of bad tings, and the who point of the story is that hackers are bad, I think i am going to write PBS and tell them to take that crap off the tv. giving hackers bad names.

Re:The Hacking After-School Special

[ihummel]

A minor going to jail for downloading music? That could only happen within a fifty-mile radius of RIAA headquarters.

The real hack is that...

[L. VeGas]

NY Times was hoaxed. A yet-to-be-identified prankster took a script for Mary Kate and Ashley action cartoon about an evil-kids hacker school, and submitted it to the Times as a press release.

And now the story is being spread as true!

Re:The real hack is that...

[bricriu]

Interesting? Was this mis-modded? Or did the mods take their "gullible pills" today, washed down by a healthy dose of "Haha Jasyon Blair!" juice?

http://www.centralmaine.com/news/stories/030113eth icalh.shtml
http://www.isfound.org/tiger-team.html

Re:The real hack is that...

[MrEd]

It's not the first time that's happened...

Re:The real hack is that...

[drinkypoo]

Actually, that's a brilliant idea for a made for tv movie. Tons of geeks want to pork that pair so it would be watched by more than enough dorks to make up for the girls who would ditch it because of the computing content. Plus it couldn't hurt to have those two do some wild computer shit even with the cheesy hollywood sfx interfaces, because it might lead some very young girls toward the dark side^W^Wcomputer industry when they "grow up".

Muahaha.

Re:The real hack is that...

[m0rphm0nkey]

I taught a highschool sumerclass on basic pc construction and networking that included learning to hit cancel to get past the win98 network login. Be afraid...be very afraid.

Are there morals taught as well??

[mustangsal66]

It's great to teach others, but without the background, or the teaching of consequenses (I can't spell worth a damn), that could bite the school in the arse.

Re:Are there morals taught as well??

[geekoid]

doesn't that go with writing? science? Archery? etc...

I mean if we didn't teach kids to read and right we could control them better.

Re:Are there morals taught as well??

[EvanED]

If you would have RTFA instead of blindly commented on asmething that is clearly stated, you would have seen the paragraph
"The students are getting a good dose of ethics along with some sobering words about legal repercussions. Scheduled guest speakers include a lawyer and a police officer, and Mr. Robinson is hoping to recruit a speaker from the Federal Bureau of Investigation."
near the bottom.

So does this mean?

[Tebriel]

We'll soon see an ABC Afterschool Special about hacking? That'd be hilarious!

Re:So does this mean?

[Tebriel]

Damn!! Missed it by that much!

oh come on

[Anonymous Coward]

it's the nytimes like you can believe anything they say...

quick ticket to Guatanamo

[d_strand]

for their own sake I hope none of these kids or teachers has any family from, ever visited or bought a ticket to, ever browsed a website from, ever borrowed a book about, ever read an unofficial news article about or ever in any way whatsoever has had any connection to, the middle east (except for israel of course).

:-)

Hmmm... Old-School Mindset

[Trent Polack]

I'm still of the mindset that the best way for high school kids to learn things is on their own. No matter what, throughout high school, the most I learned was all on my own time. I didn't have ANY courses in my school about anything related to computers (except a "typing" class), so, in an effort to actually try and challenge myself, I ordered a few books off of Amazon.com, and taught myself C++. And, I think that if I had access to a class that simply taught C++ with proprietary textbooks and software, I wouldn't have appreciated the experience nearly as much.

Re:Hmmm... Old-School Mindset

[tomhudson]

(except a "typing" class) </quote>

... that's waht all the guys did in my old school too (typing instructor was also girls' gym teacher, all the guys thought she was hot, none of the girls could get into the class, since we scarfed all the places).

Now if the stupid school could make the difference between hackers and crackers ...yeah, like that's ever going to happen - sigh - :-(

Re:Hmmm... Old-School Mindset

[DMDx86]

Exactly right! High School is depressing to me because I'm not learning anything by going to school seven hours a day with some boneheaded Education major "teaching" a class.

My school has an AP Computer Science class. The textbook is the most pitiful book I have ever read. Its written by some idiot named Schram. It was often wrong and it was hard to read (because he obviously doesnt know what he is talking about).

Crappy books and teachers are a major problem with public school. Something needs to be done.

Re:Hmmm... Old-School Mindset

[EvanED]

Oooo, "C++ For You++"? All the people who I've talked to with APCS used that book. I hated that damn thing.... And of course the APCS curriculum is many years out of date; not one program I turned in didn't use the deprecated include style. And when created, the STL hadn't been standardized, so instead of learning vector, list, stack, queue, string, etc., we had to use AP versions of the above (apvector, apstack...). Which meant I took a semester corse in college that was essentially a repeat of the second half of the AP course but with the STL...

Re:Hmmm... Old-School Mindset

[Anonymous Coward]

I wish all these self-taught hackers would stop spouting how people should just pick stuff up on their own. Granted, HS (and some of college) was pointless filler aimed at the lowest common denominator, but you need to realize that most people have more interesting things to do in their spare time than read up computer languages. Come to think of it, maybe I should stop reading /.

Re:Hmmm... Old-School Mindset

[thebatlab]

That is so true especially in small towns like where I grew up. We didn't have access to a lot of materials. The curriculum pretty much stayed fixed. We had a programming class in QBASIC when I was in gr. 8 I think but then our 'computer science' class became simply a typing class.

It's too bad b/c I know that myself and a couple others were quite interested in computers. The environment just didn't foster it. I continued learning on my own while others just let it fade into the background and the world may have missed out on some great hackers.

Re:Hmmm... Old-School Mindset

[Anonymous Coward]

High school isn't meant to teach anything, it provides an avenue for kids to learn social skills.

Re:Hmmm... Old-School Mindset

[Anonymous Coward]

dude - your high school is named "george bush high school" !!!

Re:Hmmm... Old-School Mindset

[fjaffe]

That is why the ISF program is very heavy on lab work. We try to keep the classes to 30 minutes each, and give them bibliographies and practical exercises.

Re:Hmmm... Old-School Mindset

[Trent Polack]

I'm sure you had a *very* busy high-school schedule that kept you busy from actually learning something. And, as for me, I was rather active in high-school, in sports and such, and I was still able to "read up on computer languages".

Of course, I guess asking people to actually have the initiative to pick up stuff on their own is old-fashioned too. Why actually work to learn something, when we can have others do the work for us?

By the way, I was rather active in high school, sports, dances, clubs, etc., and I always had excess amounts of time to do other things (such as read up on computer languages). Contrary to popular belief, a high-schooler's schedule really isn't that packed with important things.

Think I'm too old to know all this? Well, I graduated from high school 2 weeks ago.

Re:Hmmm... Old-School Mindset

[DMDx86]

Yes, and he even dropped by for a visit. This is Bush Sr., btw.

Re:Hmmm... Old-School Mindset

[DMDx86]

Then why do they make it look like I am actually supposed to be learning something in this hellhole?

Re:Hmmm... Old-School Mindset

[DMDx86]

Well next year they (the College Board) are changing the language to Java.

Re:Hmmm... Old-School Mindset

[EvanED]

Yeah, I know. This is I'm sure why they didn't rewrite the C++ curriculum to teach the STL. (Actually a lot of universities are changing with them, and at least a couple have named the AP change as part of the reason for the timing.)

Re:Hmmm... Old-School Mindset

[Anonymous Coward]

me thinks thou dost protesteth too much.... :)

Poor buggers...

[Some Bitch]

...in school and already being turned into fully fledged FTGs (Furry Toothed Geeks).
Watch this get shut down the instant some newly initiiated script kiddie hacks the school computer systems and defaces their website... The web's greatest game is free again, www.planetarion.com to sign up!

Re:Poor buggers...

[Some Bitch]

Oh arse, I should really learn to proof read :(

Wow

[stratjakt]

Tiger team.

Anyone else see visions of the football team, glee club and chess team in an ad-hoc alliance, beating the living shit out of the "tiger team"?

Re:Wow

[Anonymous Coward]

I certainly hope so!

Re:Wow

[stanmann]

Anyone else have visions of the football team, glee club and chess team mysteriously flunking all their classes?

Re:Wow

[PetWolverine]

Well, I don't think it would take any hacking to make that the case for the football team. Maybe the glee club and chess team are a different matter.

Re:Wow

[kurosawdust]

Anyone else see visions of the football team, glee club and chess team in an ad-hoc alliance, beating the living shit out of the "tiger team"?

Yeah, but it was immediately followed by a vision in which the football team beats the shit out of the glee club and chess team so they dont tell anyone about their ad-hoc alliance.

Dandy.

[leighton]

The more people who know this, the better. If system defense becomes general knowledge, presumably the number of effective crack attempts, etc., will go down. Moreover, if people know how to take advantage of security holes, maybe Microsoft et al. will learn to take security more seriously--there would just be too many people who could put pressure on them.

(Of course, everyone should learn how to use their computer to do simple things first, but that's another story.)

Im curious where they get their teachers....

[Brushfireb]

I'm curious where they get their teachers. In order to make this program worthwhile (IE - the kids learn something about security), you would need someone with some significant experience and knowledge.

I know that I was in high school a few years ago, the head netadmin/sysadmin was worse than pitiful, a MS Certification only type of person. The only systems he ever hacked into were those in a computer game. Granted, I did go to private HS, and IT was not at the top of their budget priorities.

Regardless, it brings up a good point of having competent people teaching these types of classes, and how difficult it is for schools feeling the budget crunch to find competency.

Re:Im curious where they get their teachers....

[DMDx86]

Its a struggle in general with public schools to get competent teachers teaching *ANY* course. Colleges are just chruning out these Education majors who have little knowledge about the classes they are teaching.

Re:Im curious where they get their teachers....

[ceejayoz]

Hey... there's a link to an article there for a reason...

Mr. Robinson, 38, who runs a small information security company... ...he created a nonprofit organization, the Information Security Foundation, dedicated to educating the public about information security...

Re:Im curious where they get their teachers....

[rpillala]

I have to agree about education degrees; teaching is more difficult than the schooling you have to undergo to get there. With most jobs the schooling is harder. That's my impression anyway, I haven't worked all the jobs. My education classes didn't do much for me in the way of being a teacher.

But there's something else. There's no parallel in hacking I don't think, but what I teach has little to do with what I learned in college, and I'm a math teacher who was a math major. Teaching (at least in Maryland these days) is becoming more about tests and accountability than about the discipline you thought you were going to further. Take these questions from the "Algebra and Data Analysis" test that supposedly goes with Algebra I for an example.

As long as no one in a higher level of education gets hold of this and starts making it a part of No Child Left Behind these kids might accomplish something.

Ravi

Re:Im curious where they get their teachers....

[st0rmshad0w]

Granted, I did go to private HS, and IT was not at the top of their budget priorities.

IT is most definately NOT at the top of pulbic school priorities either. Having seen what passes for IT in this town I wonder if attempting to use it is actually crippling students' education.

Re:Im curious where they get their teachers....

[fjaffe]

Right now, the teachers are volunteers from local companies, with Security job responsibilities or working for a computer security company.

You can get some more details at www.isfound.org

Re:Im curious where they get their teachers....

[Phantasmo]

God, I have never, EVER had a computer teacher who knew what they were talking about. From computer science to the Cisco Networking Academy, they seemed like little more than babysitters.

Teacher: "Hm.. that method used to take an integer, but then we DID just upgrade JBuilder.. maybe they changed something."
Me: "Actually, the newer version of JBuilder uses the same JDK as the version we were using before."
Teacher: "... I don't follow you. Hey, let's check the Borland website!"
Me: "Whatever."
and then I prompty close JBuilder, reload Vim and get back to work.

It's probably for the best, anyway - your average comp-sci classroom ends up working like Extreme Programming.

Re:Im curious where they get their teachers....

[Tyrdium]

It's not the top priority of private schools, either. I go to a private school, and our IT guy knows jack. One of the juniors hacked the printer to say different messages, and it took the guy hours, including calls to HP tech support, to get the thing fixed. Our computer lab is a bunch of 133 MHz Pentiums, most of which don't work (could have something to do with the fact that he's trying to run Windows 2000 on them). I'm positive he doesn't have any kind of computer certification. He can't even maintain a file server well. It took him over a week to discover the 100 MB+ folder containing Risk II that was accessed very frequently, even though other teachers had noticed people playing the (pirated) game...

Great Idea.

[twitter]

Everyone has lots to learn and the instructors here know it. This is not how things have worked elsewhere. At least that's how I've heard some "computer" classes go here in Baton Rouge high schools. The kids are banging around with Slackware and Gentoo, while the teachers try to master Front Page. None of those cluefull kids bother with the class. Other programs, such as the one at Baton Rouge High, let the students loose on a BSD network and let them do what they please. If the program listens to their students, they might all learn something.

We can then hope that industry picks these students up and listens to them. Some companies won't like what the clueful have to say about their software. But every other company in the world needs to hear it.

Scenes from www.whiteshouse.gov

[hndrcks]

Ari Fleischer (holding hands over ears): "What's that horrible noise?"

Server Tech : "I don't know, sir! It started about 3:15 pm - right after school got out..."

Webserver: "We're gonna ZOOM, ZOOM, ZOOMA, ZOOM..."

Re:Scenes from www.whiteshouse.gov

[FroMan]

unknown host www.whiteshouse.gov

Re:Scenes from www.whiteshouse.gov

[Anonymous Coward]

it was a Freudian slip. fuckin' honkies running the joint.

Re:Scenes from www.whiteshouse.gov

[Anonymous Coward]

Jes' whut do ya think that dubya stands fer, boy? Shore as hell ain't Wisconsin!

Re:Scenes from www.whiteshouse.gov

[kryliss]

You're showing your age with ZOOM ZOOM ZOOMA ZOOM :)

Re:Scenes from www.whiteshouse.gov

[Anonymous Coward]

Contact... it's the answer... to the question... why does everything happen?... three... two... one... Contact!

Re:mmmm yea

[Anonymous Coward]

On the other hand, band was one giant orgy

Were you boys all playing the skin flute?

Remeber when hacker was a good word?

[thbigr]

*sigh*

I can remeber when I used to say I was a hacker and that was a good thing. That was back when hacker was closer to the dictionary, a hacker or hack was someone who worked long hours.

This grumpy old man moment was brought to you by...

Re:Remeber when hacker was a good word?

[Anonymous Coward]

Ya, right back when "lawyer" was a respected profession...

Wait, wait, wait...

[nametaken]

Wasn't everyone throwing a fit about N.Korea doing this, in a slashdot article this week?

Re:Wait, wait, wait...

[Anonymous Coward]

But, N. Korea is an "Axis of Evil" ;)

Re:Wait, wait, wait...

[Johnny5000]

that's because the entire country is filled with evil people.

every last citizen- evil to the core.

great but....

[danoatvulaw]

this program sounds great, teaching kids about security and all, but it would seem to open the school up to potential liabiltiy should one of their students get caught hacking the wrong person's computer. you gotta wonder how closely these kids are screened, or at very least their temperments - potentially training the next set of black hats could be a disaster. it would be a great start for people to learn if they want to get into the security business, but what a shit storm will result if these kids take it too far.

just my thoughts...

Re:great but....

[fjaffe]

This is why the course includes several sessions on ethics, legal issues, and all the students had to sign an extensive security policy governing what they can do.

Any hacking behavior outside of the labs results in immediate expulsion from the program.

MOD PARENT UP! ...among other things...

[bhtooefr]

That is so hilarious! Unfortunately, when a computer gets involved, people actually do freak. Try here for supposedly true examples. When I opened a PC in front of a teacher, though, she FREAKED OUT BIG TIME. I got her to back off, but still...

Careful who you hire to teach

[goldspider]

There are plenty of people (and dare I say many of them read and post on this very site) with the expertise to teach this kind of material, but who believe that an insecure system is an open invitation to wreak havoc on it. Hiring a responsible teacher is equally, if not more, important than making sure that the right messages are part of the cirriculum.

Re:Careful who you hire to teach

[PetWolverine]

RTFA! They got Kevin Mitnick to teach the course, so it's all good.

Nothing to worry about, the kids are in good hands.

Kids these days

[harley_frog]

I just wished they had a program like this when I was in high school. To think of all the hours wasted studying, taking the SAT and ACT, all the years of college gone to waste when I could have learned to hack corporate servers as part of an after school vo-tech course.

mopping up the sarcasism

this is very good

[newsdee]

I can relate to this from personal experience.

During my high school years, I had been banned for a time from using computers at the school library, only because of my programming knowledge was superior to that of the teacher of Computer class (this was 1994 - the guy even thought the Net was an useless fad!). Rumor must have spread that I could hack a machine by looking at it, or something of the sort, since they didn't want me near a two-meter radius of any terminal. At first I didn't give a damn since I limited my computer stuff to home and that class...

However at some point the professor hired some "security expert" consultant to assess threats to the network, and my name appeared on top of a list of people who allegedly had "hacking tools" in their network space. This was too much (I only used it for school papers, and I could prove it) and I had to go to the professor and threaten to sue for libel. Of course I didn't had to go so far, since the professor apologized, removed my name for the list, and restored my normal access to the library computers. Since then I didn't have any problems (even the librarians asked for help afterwards).

What the moral of this story? Ignorant professors == bad news. If kids are smart enough to want to learn hacking, or programming, then they should allow their creativity to be expressed. Or else you will fall into idiotic situations like what I have lived.

PS: As a matter the fact the professor, much to his credit, at some point offered to create a "Linux club" (1995). However, the college grad supposed to sponsor the club dissapeared after the first meeting... so we never had anything... :-( [we theorized that he learned afterwards that Linux was Haxx0r material, so he banned it, but we'll never know for sure :-) ].

Re:this is very good

[Mitchell Mebane]

What the moral of this story? Ignorant professors == bad news. If kids are smart enough to want to learn hacking, or programming, then they should allow their creativity to be expressed. Or else you will fall into idiotic situations like what I have lived.

I would like to take this a bit farther, and say "Ignorant politicians == bad news." Actually, even worse news, because the average politician has the power to affect far more lives than the average professor.

Re:this is very good

[andrewski]

In the same year I was a junior. I was taking Pascal on the Macs, and went from Pascal class to English, which was held that day in the computer lab for "paper writing time." The teacher made an announcement to the class, that we had the District Technology Liason or some such shit who wanted to make an announcement to us. I listened in horror as she said that the computers featured a new, unbreakable, security system. Since I used lab time to do my programming homework, as I did my own word processing at home, I thought I was doomed. She then, to my exquisite delight, challenged any 'hackers' to break the security. So, I simply opened the binary of the security program, extension, preferences file, and everything else 'suspicious,' zeroed them out, saved, and was ready to go when my clueless English teacher saw my pascal disk just sitting on the desk. He flipped his lid, saying he 'knew I was a hacker,' and sent me to the principal's office. I waited in the waiting room for like 15 minutes, and in comes Mom and my principal (whom I used to play handball with at the club regularly, so he was my buddy), along with the English teacher and the IT drone. The teacher and the IT lady then proceed to tell the principal that I had done 'thousands of dollars' of damage, and that they wanted to ban me from the lab. I responded directly to my mom and principal that the IT lady had challenged the class to hack the new security, and I simply took her up on that challenge. She admitted as much, and the principal dismissed me and laid into the IT lady. Mom and I had a good laugh about that one.

You should've joined the "spelling club".

[Anonymous Coward]

The word is "there", not "their". Let's review...

• There signifies location/existence. - "I fucked your mother over there."
• Their is the third-person plural posessive (along the lines of my, your, his, hers). - "They all blew their loads in your mom's skanky twat."
• They're is a contraction of "they are". - "I'd take a turn using your mom, but they're using all her available holes."

Let's put it all together now... " They're shoving their cocks in your mom over there, in the alley."

Seriously, this shit isn't that fucking hard. Why don't you try paying a bit of attention to the language we've all agreed on, you fucking retard?

Re:You should've joined the "spelling club".

[Anonymous Coward]

Hehe. And here I started reading your post thinking it was the usual spelling nazi tripe. Thanks for spicing it up a little!

Re:You should've joined the "spelling club".

[Anonymous Coward]

YHBT, HAND

Re:You should've joined the "spelling club".

[evil_toy_maker]

HAHAHAHA! Right On!

(From the grammer Nazi, herself)

Re:You should've joined the "spelling club".

[Anonymous Coward]

(From the grammer Nazi, herself)

Obviously she's not also the spelling Nazi - The word is grammar

Us and Them guessing game

[zptdooda]

This sounds like the North Korean story from a few days ago, so here are lines from both stories and you can guess which article the students are from:

- "White-hat Hackers" or "Cyber terrorists"
- "hunger stricken" or "fortified with pizza"
- "another weapon" or "band of pickpockets"
- "creating mischief" or "training hackers"

Not a fair comparison, I know. All of the above is out of context.

When will people ever learn...

[Robin Edman]

... what a hacker is: http://catb.org/~esr/faqs/hacker-howto.html

Re:When will people ever learn...

[Anonymous Coward]

They only definitive definition for a word is its acceptance by the public who uses it. ESR can say "hacker" means anything he wants, till he's blue in the face. Doesn't make it so though..

Re:When will people ever learn...

[Anonymous Coward]

Maybe, but I've heard that 5% of all Linux users identify themselves as hackers in that sense, including Torvalds himself. That's quite many.

Re:When will people ever learn...

[SN74S181]

5% of the 2% of the computer-using public who use Linux don't really form any sort of a majority. Certainly not enough to define language standards.

study skillz

[danpot55]

if i had a class where i was incuraged to wright code at a young age, dayum! ~you know how dangerous would i be now? :-

Will Never Take Off

[Emperor Tiberius]

This idea is a clever one but will never take off. From what I've heard of Mr. Robinson's company he lacks the expertise in some of the "higher-level" blackhat ideas. I doubt his kids will be able to do much, except maybe bypass a HTaccess file or play script kiddy. If you really wish to teach "hacking" you need experience in the "darkside" as well as the white. Get inside the box, perhaps?

Re:Will Never Take Off

[atr-isf]

Emperor Tiberius writes: From what I've heard of Mr. Robinson's company he lacks the expertise in some of the "higher-level" blackhat ideas

You may be right. Even after 19 years as an IT professional and 13 years as an INFOSEC professional, I remain humble about my capabilities. Both my professional career and martial arts training have taught me that no matter how much you know, there is always at least that much left to learn.

Your comment, though, presupposes that the goal is to generate "high level" blackhats in a 7 week course. I don't care if we generate any blackhats. In fact, the purpose of the Tiger Team program is to identify young people interested in INFOSEC and get them started on an INFOSEC career path. The "capture the flag" aspect makes it fun--but the real core of the course is ethics, teamwork, documentation, responsibility, and the other attributes that separate a legitimate INFOSEC professional from anyone else with INFOSEC pretensions.

In that regard, I and the other ISF (www.isfound.org) instructors definitely have the standing and qualifications to help these young people.

And in closing--it already has taken off!

Andy Robinson President, Chairman Information Security Foundation www.isfound.org

Music Videos too?

[Nick Driver]

Back when I was a youngster and the very first ABC Afterschool Specials were being aired... for 'commercials' we had such wonderful gems as: "Conjunction Junction What's Your Function", "I'm Only a Bill", and "Lollie Lollie Lollie Get Your Adverbs Here".

What cute little music videos will the new generation bring? Perhaps something along the lines of "Rootkit Randy Goes to Jail", "Virus Vinny He's Such a Ninny" and "You Can't Ride A Trojan Horse" (sung to the tune of Eagles' "You Can't Hide Your Lyin Eyes")???

Re:Music Videos too?

[jimand]

ah, yes, the Schoolhouse Rock series. 30th anniversary set available here

Bad for Microsoft

[axxackall]

Some companies [Microsoft] won't like what the clueful have to say about their software. But every other company in the world needs to hear it.

Good. The more such hacking and virus writing schools will be around the world the less chances Windows will have to survive on the market.

All other OS vendors (including/especially OS teams) are adapting quickly (Apple even abandoned their old crap in a favor of BSD), while Microsoft still sticks to the old mix of DOS and VMS.

Of course the law also will catch up, but that would be really slow. Especially counting the fact that Internet is already international, while the law is not. So, until the law will work we have to live in the anarchy and chaos of hackers, virus writers and, of course, spammers (BTW, not spammer courses around yet?).

I would say, every bad enough guy kills at least two Windows installations: one s/he works on, the other he cracks. The more bad guys the less Windows market share.

I never thought about cyber-bad guys in so good sense. Usually I have to defeat them and thus I hate them. But now I think different (TM).

Does anyone find that I am wrong here?

Re:mmmm yea

[dustmote]

Good lord, was everyone's band experience like this? I wonder what the demographic overlap is that causes high school marching bands to always turn into oversexed free-for-alls. Not that I minded that, of course. :)

There also seems to be an obsession with Monty Python humor in marching bands. Hmmm...

Learning Dangerous Skills

[jamesmartinluther]

While many adults want to shelter our children from anything that may harm them, I would advocate teaching children (at an appropriate age) how to responsibly make use of dangerous tools. These would include using a firearm, various contact sports, martial arts, chemistry, computer security, and so on. Of course, there are morons who will mis-apply their karate or hacking skill, but then there will be many more trained peers to counter them.

If everyone is equally stronger and more knowledgable, the entire system is stronger. The world cannot be populated with softies who leave security to the "experts".

- James

Re:Learning Dangerous Skills

[andrewski]

The majority of safe firearms users that I have known have used used weapons since the single digit years. I started when I was five. I would consider myself anal retentive in the first degree about gun safety. Most of the unsafe gun users I have seen are not lifelong shooters.

Not to say that there aren't exceptions, but early training and the beating / dressing down I got when I accidentally pointed my pellet gun at my Grandfather's leg were the best things I could have gotten.

Re:Learning Dangerous Skills

[marko123]

When I was a kid, I crawled over tips looking for stuff to smash, blow up and set fire to. I'd break shit for fun, and be home in time for dinner, by riding my bike at break-neck speed without a helmet on, carrying a bunch of shit I hadn't smashed yet in both arms to do it all again in the backyard after dinner.

I grew up into a spineless computer programmer.

Your point was?

You think you're old?

[geekoid]

I remember when being a hacker involved a tree and an axe.

Re:You think you're old?

[Anonymous Coward]

An AXE? Bah! You kids had it easy! In my day, all we had were pointy rocks... AND WE LIKED IT!

Re:You think you're old?

[Humpinate]

LOL Oh my GOD, that's funny....

(falls on floor, stops laughing when hip makes funny snapping noise)

Uh-Ohh..........

sure thing!

[Anonymous Coward]

here you go

Re:sure thing!

[jbeamon]

Thanks. This helps. ;-)

OMFG! joo == teh fuckin l33t, baby!

[Anonymous Coward]

you haxored their assignements? l33t!!! i'll bet you get hella chixors!

black hat haxors are so fucking cool i just pissored my pantsors!

New York BEHIND-THE Times

[Anonymous Coward]

Quote: "Somebody who was sort of the Elite Hackzor"

Uhh, I think he meant haxor. I guess this interview was conducted over the phone. I know fact checkers are not computer people... but why not let a computer person read the article before printing it? What not-so-benign mistakes are being slipped into your governmental overlords' newspaper diets?

Re:New York BEHIND-THE Times

[generic-man]

"Hackzor" is every bit as literate as "Haxor," "hax0r," "h4xx0r!!!!!!!!!!!11111" or however else you want to put it.

The New York Times shouldn't be criticized for misspelling something that isn't a word. You should read their style guide on "Elite Speech" to find out more.

Example sentence: "Liqu-one-d l-three-fourd is an one-three-threet hackzor who prides himself on his large collection of 'wares,' or illegally obtained software."

Re:New York BEHIND-THE Times

[usotsuki]

The proper term, de-leeted, is "leet haxor", but I use "elite hackster" as well :)

-uso.

Re:New York BEHIND-THE Times

[Anonymous Coward]

I would be interested to see the appropriate entry in their styleguide, but 'haxor' is very much a word with spelling to be respected because its origin is a strictly text-based one. It's not like people went around saying 'haxor' conversationally before first seeing it used on the internet or at least in textual form. Its coinage is intimately tied to its spelling, and that should be respected. The spelling came before the chiken, if you get my drift.

Hacking in the media

[Anonymous Coward]

I absolutely hate the word "hacking" when used in the media. Its my experience that the people who use the word usually dont know what they're talking about. The person teaching this course is a security analyst, so Im somewhat skeptical of his knowledge in the subject. I work in a wireless information networks lab where most of the people here have hundreds of patents under their belts and too many PhDs to count. Its funny how the people here (one who actually was a founder of the sparc linux project) dont consider themselves "hackers" and when asked what one is the common response is "its a buzz word to discern people with and without a clue".

I have the strong suspision that all this after school program is doing is showing kids how to play with libpcap based programs and how to use nmap. If thats what qualifies a person to be a "hacker" then we're all in trouble.

Re:Hacking in the media

[atr-isf]

I absolutely hate the word "hacking" when used in the media

I read the MIT Hacker's Dictionary before many people posting in SlashDot were born. The fact is that "hacker" and "hacking" have had a pejorative connotation for a long time. I remember the University of Maine operations manager calling me a "hacker" (in a disparaging tone) in 1980 when I first exploited a race condition to break out of the limited student shell into "full CMS" (the humor here will only be apparent to those who have experience with IBM's VM mainframe operating system).

You can rail against this usage all you want, but it's an accomplished fact--and I at least have given up trying to convert the rest of humanity to "cracker" or "threat agent." Perhaps we can all join a class action suit against "the media" based on defamation of character, and force them to use something more acceptable. But probably not.

Andy

Andrew T. Robinson
President, Chairman
Information Security Foundation
www.isfound.org

Re:Hacking in the media

[that _evil _gleek]

Really one should include all definitions...
Your's is an example of my personal favorite" Hacker: anyone who has more tech skills than his boss... "

Contact Info??

[thrillbert]

Anyone have any contact information? I am actually interested in pursuing something like this in my area. Give the teens something to do this summer.

---
It was a book to kill time for those who liked it better dead.

Re:Contact Info??

[thebatlab]

Heaven forbid teens should do something like play a sport, hit the beach, read a book. Knowledge has great benefits and especially this but don't let yourself get completely glued to a computer for your entire life or the world will zoom on by and you'll miss a lot of fun stuff. That's what summer is for when you're a teen. Get a nice summer job to earn some money, then go have fun with your friends!

Re:Contact Info??

[thrillbert]

Good point. And given how late it is already in the year, I think the time has passed to pass the information around the high schools in my area anyway.

Either way though, I still would like to get in touch with this group and see if they have their curriculum available to the public..etc..

---
The 80's -- when you can't tell hairstyles from chemotherapy.

Re:Contact Info??

[fjaffe]

You can get the contact information on the ISF website or you can email information@isfound.org.

Re:Contact Info??

[Bandman]

Hey man, don't get discouraged. I'm thinking about doing the same thing here. I'm going tonight to talk to some other professionals in my area about this to see if I can get the ball rolling. I'm with you in that I'd like to see their curriculum, if there is one.

H@x0R Junction, root that boxen!

[dontspellsogood]

hee hee (with apologies to Schoolhouse rock)

}} c0NjUNCT1oN JUNCT10N, Wh4T'$ y0Ur phUnction?
hOOkIN9 Up WORd5 aNd PhR4s35 4ND CL@u5e5.
}} C0nJuNC+10n junc+1oN, H0w'5 THAt Func+10n?
1 90+ THREE pH@voRIte C4r5
+H4t 93+ M05+ 0pH My J08 D0N3.
}} CONjUNC+1on juNctiON, WH@t'5 +h3ir PHunCt1On?
1 go+ "4nD", "bu+", 4ND "Or",
+hEy'll 93+ j00 Pr3Tty faR.

"aND":
+H@T's @n @DDi+Iv3, liKe "+hI5 @ND Th@t".
"BU+":
th4t'5 50R+ 0F +h3 OPPo$1+3,
"nO+ +HIS *8uT* TH4+".
4Nd +hen Th3RE'S "or":
O-R, wh3n j00 H4Ve 4 chOIcE liK3
"Th15 0r +H4t".
"4nd", "But", 4ND "0r",
G3+ J00 pR3++Y pHAr.

Why Maine?

[teklob]

why couldn't they start this in canada? I'd love to go in that kind of program

Re:mmmm yea

[Shadow99_1]

Err... um no all marching bands are not like that... In fact while I've known several I've never seen one like that... Maybe you should try linking location? That might be a better guess for the similiarity...

Teaching Kids is much worse

[McAddress]

At least college students are (hopefully) smart enough to want to learn something serious about computers. With highschool kids, 95% of them would be content with having a button saying "break into someone's system" that would do just that. However, we hope that in our nation's universities, students are taking the computer classes because that is the field they would like to go into, and as such they will refrain from doing stupid things. My college offers a security class, but there is no way to take it before at least your 4th semester in school, and AFTER you know C++, Java, Assembly language, and have the department approve you. And they don't teach you how to hack either. Sure you will come out of the class knowing how to break into some systems, but the focus of the class is not on cracking, but securing a network or a computer. The kids in NY public schools are just going to become script kiddies. We have enough of those already.

Re:Teaching Kids is much worse

[Ratphace]

Yep, instead of having kids out on the streets dealing drugs and comitting crimes, we can teach them how to sit in the comfort of their own homes and commit bigger crimes! :)

Highschool

[Anonymous Coward]

I was just at my highschool editing some video things and the top computer teacher asked me how to use the format command in DOS, he didn't know what it would do. I also had to install computer equiptment for him. When I was there a couple of years ago I didn't take any computer courses and I still had access to the entire network. Teachers don't know what they're doing, they teach word processing and that's about it.

My trombone

[Andy Dodd]

has more dents than your head.

Go away if you know what's good for you. :)

Re:My trombone

[andrewski]

Only woodwind players fear a tromboner.

Feel the crushing weight of my tuba and be afraid!

Re:mmmm yea

[Molz]

Well the obsession with Monty Python humor is valid, but the orgy experiance never happend in my marching band, except for some reported debachery that happend in the (mostly male) drum line.

Now drama, that was where the orgys were happening at my school, atleast according to many independantly verified reports.

H4x0rvill3 H1gh Sch00L...

[rulethirty]

Let us spread amoung the population more script kiddies, more DoS attackers, more clubies!!!
LETS TEACH THEM HOW TO RUN ./el8h4x0r.sh and to hide all their scripts in the ./.../ directory tree!
Yes, H4x0rv1ll3 H1gh sch00L will be a great place for all!!!

*folds arms and gives an approving grin*

Any Questions - I am on the Board of the Program

[fjaffe]

If anyone has any questions about the Tiger Team, I am on the Board of Directors and would be glad to answer them.

Re:mmmm yea

[jgerman]

Heh, marching bands, helping ugly people get laid in high school since 1903.

Re:Any Questions - I am on the Board of the Progra

[rulethirty]

How can you effectively teach these kiddies not to use their knowledge for performing illegal activities? Will ethics be included in this course? Do you have a course syllabus you would like to share?

As long as they teach ethics as well...

[thepacketmaster]

I don't necessarily see a problem with this. How many 'white hat' do the same things every day in test labs and for clients? This could be good career training for them. However, I've observed kids often view hacking, etc as something cool to do, without thinking of the consequences. While they're running this program, they should be teaching ethics and legality. Otherwise these kids might take this program as a license to hack.

ISF URL

[fjaffe]

For those who are interested, the Information Security Foundation website is at www.isfound.org. Be gentle, it is not a large machine. You might have better luck with the Google cache. It can be found here

Re:Any Questions - I am on the Board of the Progra

[thrillbert]

Is the curriculum available to others so that they can implement the program elsewhere?

Not half as dangerous as...

[Anonymous Coward]

...you'd be if you'd had a class that taught you to spell.

Great idea-

[Mu*puppy]

-for the teacher involved as well. Not only can the teacer gain more knowledge about tools and methods, but the teacher also has the oppurtunity gain the RESPECT of the local script kiddies/hackers, if he/she plays his/her cards right. Most script kiddies/hackers start out with local targets, and considering the age of the kids involved, their current school becomes one of the prime targets.

Most likely, the teacher involved with a program like this is the defacto 'resident tech' of the school, being the one-person network admin/troubleshooter/etc. Having a face and personality assosciated with 'The Admin, my Enemy' can give a whole new perspective to the 'up-and-coming' hacker. This can be good or bad ('y'know, X isn't so bad, maybe I shouldn't target the school' vs. 'Oh, I -hate- that fscker, time to bring on the hurt'), but at least it can bring up the point that there's a real PERSON behind that box they're hacking. If done right, clubs like this can help cultivate the 'old-school hacker mentality' by having in-depth discussions of ethics, legalities, etc.

We live in a world where 'morals' are generally defined by social groups. If a kid getting his feet wet is exposed to nothing but script kiddies and their sites, just guess which way he's most likely to turn out...

Re:Great idea-

[rulethirty]

A "friend" of mine did exactly that! The local admin/network geek soon became public enemy number one and at all costs was he to be shown the all powerful "script-kiddie powers!" This "friend" was thrown into programs to help his "addiction for computer mischeviousness."

I only hope the teachers of this program can prepare themselves to be attacked, cracked, whacked, and smacked. The first target is "Master" for each and every "grasshopper" to prove his worth and abilities. Sorry about all the "" quote marks! :oP

Re:Any Questions - I am on the Board of the Progra

[kryliss]

How does a chemestry teacher teach kids not to make bombs. How does a physics teacher teach kids not to make projectile weapons. How does a music teacher teach kids not to make rap music.

Cyberchase

[marnanel]

That's PBS's Cyberchase, and yes, it gives hackers a bad name.

Re:Any Questions - I am on the Board of the Progra

[fjaffe]

We have all the students sign an agreement, we teach 2 class sessions on ethics, one session on laws, and frequent anti-hacking reminders between classes.

Any student who engages in unlawful use of a computer, during classes or outside of classes, faces immediate expulsion from the program.

Re:Any Questions - I am on the Board of the Progra

[fjaffe]

Not at the present time. This is our first run through, and we do hope to take the program national in the near future.

Re:Any Questions - I am on the Board of the Progra

[rulethirty]

How does can an effective teacher control the use of the knowledege she/he places in the hands of adolesents?

Your analogy is wrong, this is more closely like a chemistry teacher teaching how to make bombs, a physics teacher how to make projectile weapons, and a music teacher how to make rap music.

If this class was about computer security then your analogy would hold true.

NY Times hack

[eXoXe]

Could someone please provide the NYT no-account-required-to-look-at-our-pages hack?

Login as

[Durin_Deathless]

username:anonymoose1 password:aaaaa

Nice troll, but not good enough

[PurpleFloyd]

Nice troll, but the "Visual Basic development tools" reference put you over the top into unbelivability.

And to commence feeding: your comment on hacking experience being bad is totally groundless: I wouldn't trust an architect who couldn't tell me the points in a building vulnerable to bombing, and I wouldn't trust a sysadmin who didn't have at least a basic knowledge of hacking techniques.

Re:Nice troll, but not good enough

[crazyphilman]

BUT, and this may come as a shock to you, many business DO use Visual Basic (or its bastard child, VB.Net). And, where would a young, feisty hacker type fresh out of after-school hacking class be able to do more damage? A Linux/Java shop, where he probably doesn't have root and won't be able to do all that much before the sysadmin introduces him to the cluebat? Or a Windows shop, where the admins are all generally MCSE's and he would be able to run rampant? Think about it. It was a well-chosen satirical example. The question is, how will a relatively uninformed HR Drone react to knowing that a job candidate spent all his time after school learning how to hack computer systems? Especially when most suits read article after article in the media about how the evil hackers of the world are busily working on stealing their credit cards, their bank accounts, nekkid pictures of their wives, and their daughter's virginity... MY theory is, the HR drone will circular-file that person's resume instantly. Even if the person is hired, sooner or later, it'll come out that he did this and he'll fail a security audit.

By the way: in response to your example, if I was hiring an architect, and he told me that he'd
spent all his time after school blowing up abandoned buildings, so he's going to design my building to be safer than all the other non-bomb-proof buildings, I'd hire someone else and make sure that the bomber architect's picture was posted on the wall in the security office with "DO NOT ADMIT" in giant red letters. It was a really bad example, dude. ;)

Re:Nice troll, but not good enough

[PurpleFloyd]

First, VB may be good for rapid app development (I can crank out a DB frontend in a couple of hours in VB!), but it's nothing for cracking. Doing buffer overflows in VB is practically impossible; the language isn't designed with direct access to memory in mind. C is, and it's a much better language to crack systems in. While it's probably possible to do dangerous things in VB, given enough time, you're just reinventing the wheel. I could do much worse with access to lcc-win32 or gcc than I could with VB.

Regarding the "HR drones:" if an 31337 crax0r graduate of this program were to put "computer security training" on their resume, they would be telling the truth and not make the "evil hacker" association in the HR worker's mind. Putting the right spin on the truth is almost as important as the facts behind it in this case.

Re:Nice troll, but not good enough

[shaitand]

"and he told me that he'd
spent all his time after school blowing up abandoned buildings"

I agree, if that's what he told me I'd feel the same. However, if he came to me and told me that he took and after school class on techniques used to bomb building and methods of preventing those techniques and wanted to utilize the knowledge gained in construction of my defense contract... I don't really see anything wrong with that at all.

A hacker who didn't learn what was done to secure a system wouldn't be much of a hacker. The reverse is true, someone securing a system isn't worth a damn if they don't know what their securing against.

Re:Nice troll, but not good enough

[shaitand]

An example, setting up a firewall is great and all... But how exactly do you learn that you should be blocking windows media player no matter what streaming music employees want if you don't know that are dozens of exploits that attack it? Or that most firewall solutions are vulnerable to exploits that drop them in a windows environment.

Or to be wary of data encoded in http data... or what to secure on your web server where the designers employ cgi?

Re:Nice troll, but not good enough

[crazyphilman]

Again, I would expect a security professional to understand the techniques used by hackers. However, I would look upon a person who had spent time in an actual hacking course very dubiously. Again, it's a matter of focus. If a person is primarily interested in security, and had to read up on past incidents and such to understand the ways in which he needed to secure his system, that would be fine. If a person claims to be interested in security, but spent most of his time in training learning how to crack systems, then I would consider him a system cracker, not a security professional. And, again, he'd end up with the old "do not admit" picture by the security office.

You don't have to learn to crack systems to defend them. That's propaganda used by people who *really* just want to learn system cracking, but don't want to be viewed as system crackers. It's like the NRA saying that they need access to assault rifles so they can go hunting. Suuuure they do. I'm sure it has nothing with private fantasies about fending off an attack on their home, bandanna on head, AK in hand, cordite in the air... Think about it. What people SAY their motives are, and what their motives ACTUALLY are, are two different things. Can you really tell me that all those kids want to learn hacking because they want to be straight-arrow security geeks? That none of them are interested in the coolness of being a badass, at least on some level? At least a few are probably going to give their skills a test drive at some point. Then the cops get involved, and it isn't fun and games anymore.

I think it's a bad idea all around.

Re:Nice troll, but not good enough

[crazyphilman]

Boy, did you ever miss my point.

What method did probably 90% of the currently problematic worms and hacks use to get around? Vulnerabilities in MS Exchange, MS Outlook, and MS Outlook Express, IIS, and SQL Server. What language offers the tightest integration with all of these systems, including many, many prebuilt system objects for working with them? VB. What language would an employee of a Microsoft shop probably be working with daily? VB. So, if you were to hire a hacker to work in your Microsoft shop, he would probably find it most convenient to work with the development tools sitting right there in front of him. Not that he would need any others. And, he would even be inside the firewall of your organization, possibly able to start using other people's internet accounts, and etc... It would be a nightmare with the potential of massive liability if he were to use your system to do something nefarious.

My POINT is, especially if you're a Microsoft shop, you'd have to be absolutely NUTS to hire someone who was a self-professed hacker, and had coursework already completed which would give him the skills he would need to cause problems for you.

As far as the interview goes, think about it: as soon as the HR Drone reads the blurb about "computer security training", he's going to ask about it. Boom -- the kids boat is sunk the minute he opens his mouth to reply, unless he lies his ass off, and if that's the case, office politics will get him later as soon as a coworker figures out where he learned his skills.

that's all I'm saying.

Re:Nice troll, but not good enough

[crazyphilman]

As I've said, reading up on security issues at CERT and SecurityFocus, paying attention to how sites are being hacked, reading articles about what other people have done to secure their systems, all of these things will give you the information you're describing. You don't have to learn system cracking to protect your system. As far as windows firewalls go, if you're not behind a hardware firewall/router, you shouldn't be running windows, period. Honestly. Even getting a cheap Linux box and using that as a NAT firewall would be helpful.

Besides, even if the public sites I've mentioned didn't have the info you craved, there are plenty of books out there that you can learn from. You don't have to participate in a very public after-school activity that'll mark you for life (do you think those kids haven't found their way onto a bunch of lists, just by virtue of their being in the course? Those cops didn't agree to chat with them out of the goodness of their hearts, you can bet they're getting course rosters and paying very close attention to the curriculum with an eye towards noting what techniques the kids prefer -- or does that make me paranoid?).

Re:Nice troll, but not good enough

[shaitand]

That some want the coolness factor is a given, 90% of those will be weeded out within 2 weeks when they discover this is a pretty boring study. Breaking security IS essential to being able to implement it at high levels, this is a must not a myth.

Just like those who reverse engineer software are generally some of the most skilled programmers around, it takes some serious assembler knowledge to do more than read cracking guides (in the sense cracking is usually used, reverse engineering copy protection schemes on software) for anything challenging, and as a programmer, if you don't intimately know the assembler of the platforms your targeting you are seriously impaired (no matter what language your coding in, the more you know about what is happening behind the scenes in your high level language the better).

If they are teaching script kiddie techniques, this is harmless and pointless. If they are teaching these kids to be real hackers it means being fluent in at least 6 languages, an extremely intimate knowledge of network protocols, packet and data types, advanced routing, firewalling, security models and IPC in numerous OS's, the list goes on and on... most security professionals never learn the fully array of topics a real cracker (as in what people call hacker) needs to know to do the job effectively.

If the level of expertise required to maintain a secure network just means install security patches and learn how to configure a firewall... your right you don't need to learn how to crack systems to do this. But that isn't the appropriate level of expertise at all, it barely scratches the surface. You are just wandering in the dark, trying to keep up with one side of the fight... I've never seen a security hole published on sites for security professionals before it's available even to script kiddies for instance!

Alot of the information you evaluate you will see suggestions for security from whoever is providing that information... howto, corporate information, etc... some is obvious, but I've never seen this information be complete or 100% accurate, or adequately explain why these are good suggestions. I do however see sysadmins take those suggestions and make them their bible without ever really understanding or investigating... a hacker will always have the inside track on how hackers think, what tools they use.

Re:Nice troll, but not good enough

[crazyphilman]

Well... Ok, I'm warming to the idea. I just responded to a post from one of the people involved with the project, and admitted that what he was describing (teams taking turns attacking and defending, etc) actually did sound like a pretty good way of testing defenses. So, I'd have to admit, maybe they're on to something here after all.

I don't know; actually I'm kind of torn on the issue now. I still think the focus should be on network security rather than cracking per se. But, ok, I think I can see why you might want to develop those skills to test your work.

Good points.

Re:Nice troll, but not good enough

[atr-isf]

shaitand writes: [...] If they are teaching these kids to be real hackers it means being fluent in at least 6 languages, [...], the list goes on and on...

A very good point, but everyone has to start somewhere. Some people posting here seem to be saying that if the Tiger Team program doesn't crank out "real" hackers, it's not worth doing. Knowledge is easy to acquire, but fluency and expertise require experience. Even a savant doesn't become an expert instantaneously, and most people aren't savants.

Andy

Re:Nice troll, but not good enough

[shaitand]

By the time the information on either of those sites (which generally lack detailed information so that hackers can't use them to implement the attacks) it's been on the hacker sites for a month, and in the more private circles for twice that.

ok granted, any class that is going to be taught by any school out there is going to be a bit behind the times. You also don't have to involve yourself in anything so public... rather you should engage in private research on test systems and such. But regardless of how you go about it, the knowledge is essential and I think the course is certainly being offered with some good intentions here.

As for the cops, I'm with ya on the paranoia, on the other hand, these are your most likely future employers, military, fbi, cia, and nsa are all employers who consider former hackers, and hacker training to be important for the job. If you are going into a class like this, I should hope that is who you are hoping will hire you... you'll run into a more opposition on many fronts in corporate america.

Re:Nice troll, but not good enough

[shaitand]

My god, this is two firsts in one... a slashdotter giving ground without being hid repeatedly in the head with a hammer and forced to see alternating NT splash screen/BSOD images played at high speed for days without sleep.

And, a good discussion that actually was a discussion on these boards, not a debate really, not an argument, trollfest, slamming, bashing, grammar nazi attack... but an honest to god discussion. This is refreshing :)

Re:Nice troll, but not good enough

[shaitand]

Definately, I didn't emphasize that and should have. If it were only knowledge of the various areas required then a reading list would do for the brighter students rather than needing the course.

Re:Nice troll, but not good enough

[crazyphilman]

Thanks! You're pretty reasonable yourself. It's an interesting subject, isn't it? Kind of makes me wish I was in High School again, so I could give the course a try and see how it looks from the inside...

I like the guy who's running the program, too. He's very sensible. Apparently, they DO focus mostly on security, with the hacking aspect being more of a test of the security projects the other kids are doing. He said the kids basically play capture the flag, switching sides periodically. The way he describes it, it sounds totally sensible and reasonable. I think it just got some bad spin early on, you know?

Thanks for a good, hearty discussion!

Re:Nice troll, but not good enough

[crazyphilman]

That's a pretty solid point. As I've said, I'm really warming to this idea fast. And, I am paranoid sometimes... I might be way off base there. It's starting to look like a better program the longer I consider it.

Still... I'd be nervous about the whole "now I'm on a list" thing. Maybe not nervous enough to skip the program, which would probably be worth the risk, but still -- nervous. ;)

Re:Nice troll, but not good enough

[Slack3r78]

Keep in mind that these kids are all minors - even getting their names to put on any kind of tracking "list" would be more than a little illegal.

Re:Nice troll, but not good enough

[crazyphilman]

Since when did the illegality of a thing stop the feds from giving it a try? Remember Watergate? Cointelpro? Iran-Contra? Compared to stuff like that, bending the rules to get a list of young hackers seems like child's play. At least the CIA doesn't have to send over some spooks to snuff anyone, right?

(BRRRRRRING!)

Hang on -- there's someone at the door.

Doh!!!

Re:Nice troll, but not good enough

[Slack3r78]

No doubt, it hasn't stopped them before, it's just that there's generally a different set of rules involving minors. Pretty much anything you do as a minor and any records the gov keeps of it have to be destroyed when the kid turns 18. People tend to get rather pissy about this, even more so when the child's name is specifically attached to it, so I'd imagine that it just plain wouldn't be worth it from the perspective of a potentially major PR disaster for the law enforcement officers.

Re:Nice troll, but not good enough

[crazyphilman]

I can see why you would buy into that, but when you consider the massive scope of the other things the government has been caught doing, and the incredible fallout that happened as a result of that, AND the fact that, for example, some of our current government were actually convicted in Iran-Contra, but are now in positions of significant power... You have to wonder whether any "potentially major PR disaster" would even be a consideration for them. If CONGRESS doesn't scare 'em, no pissed off parent will (and, really, that's about all they'd have to worry about - pissed off parents hiring a local lawyer and maybe getting a little newspaper buzz - and that's if any of what they're doing ever even comes to light).

Just a thought...

More about the University of Calgary

[Blarfy_Snarflepoop]

We've released a statement outlining our position. Happy Reading...

Knowing how to break things is not evil.

[twitter]

Good. The more such hacking and virus writing schools will be around the world the less chances Windows will have to survive on the market.

That's true, but not for the reasons you put forth.

So, until the law will work we have to live in the anarchy and chaos of hackers, virus writers and, of course, spammers (BTW, not spammer courses around yet?).

The law will no more catch up to cracking than it will catch up to murder. It will always be possible.

The more bad guys the less Windows market share.

That does not follow. It only takes a few malicious people to screw the M$ monoculture. The more knowledgable people there are, the fewer people will use M$. I don't see this place creating bad guys, I see it teaching people skills they can use one way or another.

A security plan involves the follwoing things:

1. Know your assets, what you want to protect.
2. Know what you consider damage to your assets.
3. Know how people might cause that damage.
4. Know how to prevent, mitigate and track the damage.

While other schools are teaching dummies how to use VB script, this one will learn why they should not.

Re:Any Questions - I am on the Board of the Progra

[Lord_Dweomer]

" If anyone has any questions about the Tiger Team, I am on the Board of Directors and would be glad to answer them. "

Um.....yes..........Who thought up the name "Tiger Team"? And did they consider the social consequences in a High School environment?

Re:mmmm yea

[Xabraxas]

Weird because all of them I have known were just like that. I never was in marching band but I had a lot of friends that were and my girlfriend (different school) was at one time. I heard more crazy sex stories from them than any of my other frineds. It does make sense though. There are girls and guys traveling together and staying in hotels together. Then when I went to college it was the same thing. One of my friends from high school went to the same college (state school) that I did and it was the same thing all over again. I met some kid on my floor who was in band and he always had a new band girl on his arm. They may be dorks, but they've screwed a lot of other dorks!

Re:mmmm yea

[Anonymous Coward]

Act your age, it must have been George Sr.

Not
G. W.

Come on, give me a break.

Re:Frisy Ps0t for itchy nuts!

[Anonymous Coward]

These must be Tiger Beat Teams

7337?

[Anonymous Coward]

---teet? A teet hacker? COOL, I can't code but I got that 7337 action down way back in high school, I can reach around a girl and one handed undo them ^&*(!!#@ bra straps slick as you please. I get "root" then, well, at least usually. Now I am an important member of the elite hacking community. Where's my 90 grand job now?????

same with modern dance

[Anonymous Coward]

I took a modern dance class once at the local community college. ALL girls except moi. My beer guzzling buddies were razzing me serious heavy until I reminded them of this particular datum: "dozens of graceful and very physical sweaty girls in little skimpy outfits, and I get to hang out with them and pick them up and swing them around and stuff" then they STFUed about it.

Re:Any Questions - I am on the Board of the Progra

[fjaffe]

Good Question. Andy Robinson, the originator of the program thought up the name. A lot of time was spent considering the social consequences in high school. In many ways, the kids attracted to the program are already less socially active with many high school peers, because they are into computers. We hope this environment actually helps them learn teamwork because it requires a lot of interaction among the team members.

Point of view from a member of the Tiger Team

[TodFarkus1]

I seem to find the less people tend to do their research, the more ridiculous they sound on Slashdot.

Perhaps people decided not to bother going to the ISF website?

Today, I set up an Apache server and beat the bloody hell out of it. Throught this, I learned new things and applied the lessons. When the other team gets to hacking the Apache server, I'm going to learn something that I didn't know existed.

Perhaps over-reliance on the New York Times (which, as most now know, isn't a very reliable source) tends to give people a demonized or skewed image of what the whole program is trying to accomplish.

Oh, and a note to the AD&Der's: As a teenager with built up rage and paranoia, I could devour your miserable soul, after taking a +10 elixer and Pills of Sleepless Nights (No-Doz).

Love and kisses,
-Dave C.

ahem...

[10bt]

it's the word "virus."

Re:Any Questions - I am on the Board of the Progra

[atr-isf]

fjaffe writes:
Good Question. Andy Robinson, the originator of the program thought up the name.

Just to clarify Frank's post, I didn't originate the term "Tiger Team." It has been used for some time to describe the "red team" in both physical and electronic security evaluations.

Andy

Has anyone read the article?

[fciron]

From the NYT
"Working as two teams, the teenagers play a virtual game of capture the flag, trying to crack the other team's network and do damage while defending their own. An honor code keeps them from creating mischief outside their labs."

If you screw around outside on your own time you might not get to play with your friends. This is the only threat that gets my 14 year old son moving.

The guy teaching the course has a computer security company of his own so I bet he is a great role model for future "white hats."

Read the info and make useful comment.

Excuse me but

[drinkypoo]

If you can't find the contact info on your own, you're unqualified. I mean, sheesh.

Just one

[drinkypoo]

Do you think frosted flakes are g-r-r-r-reat?

MOD PARENT DOWN! ...he's a loser...

[Anonymous Coward]

Hello again Erik. Don't worry, your secret about your sexuality is safe with me. I won't tell anyone that Erik Rucker likes little boys.

See you at church.

Re:MOD PARENT DOWN! ...he's a loser...

[bhtooefr]

Spell my name right, Pr0n Boy... It's Eric.

BTW, I'm not gay... I know someone who is (and likes little boys too...yuck...). I don't go to church. So, is your favorite site goatse.cx? I take it that it's your IE home page, right?

ALL SPAMBOTS PAY ATTENTION HERE: This AC's e-mail address is: pr0nboy@hotmail.com

Re:MOD PARENT DOWN! ...he's a loser...

[Anonymous Coward]

Spell my name right, Erik... It's pr0nboy.

BTW, sorry about calling you gay. I mean, when people bat for both teams sometimes I think of them as gay instead of bi. My fault. Maybe you should go to church. Some good spiritual guidance may help you overcome your pedophilic tendencies.

ALL SPAMBOTS PAY ATTENTION HERE: This loser's e-mail address is: bhtooefr@softhome.net

Peace!