After-School Hacking Special

securitas writes "The NY Times writes about an after-school program that teaches teenagers how to hack, attack and defend systems. There doesn't seem to have been the same uproar as the virus-creation course at the University of Calgary (see previous Slashdot thread), even though the participants in Tiger Team (the name of the program) are younger than the university students."

Comments

Cool Idea

[(54)T-Dub]

Sounds like a very interesting program. If someone is serious about system security, this seems like the best way to learn.

I think the program directors argument should qualm any skeptics.

"Some of them grilled us pretty heavily on the concept of, 'Well, aren't you training hackers?' " he said. "I go, yeah. I have a black belt in martial arts. If I wanted to be a bad guy, I could go and hurt people. But I don't do it. That's not the emphasis of the program."

Re:Cool Idea

[ChrisNowinski]

You don't teach people how to create security systems by teaching them to break into bad systems.

You teach them to comment their code, watch the buffers and never let programs leave the box unless you absolutly have to.

This whole hacker mythology is poor.

Re:Cool Idea

[ceejayoz]

If it's their own code, yes. What these kids are being trained to do is find holes in other peoples' code, so a company can fix the insecurities.

There's a good reason people are getting paid $90,000 a year to hack into computers of big companies, despite your scepticism.

Re:Cool Idea

[ceejayoz]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball. No court would find them responsible, unless the teacher was encouraging activity.

From what the article says, he's strongly encouraging ethical behavior. Personally, I wish I had something like this in high school.

Re:Cool Idea

[FroMan]

In a really simple contrived world maybe.

Explaining a buffer overflow and actaully programming one are two different things. And programming an expliot for one drives the idea home even better.

I'm not saying that they should be trying to hack nsa.gov or something. However, when you actaully have a chance to play with a virus or recent exploit in a controlled environment you will get a better understanding.

That is why folks honeypot and such. They can actually figure out what are the techniques used in the wild and how to defeat those techniques.

Re:Cool Idea

[deke_2503]

I disagree. Ever argued with a not-so-bright programmer about why ANSI C is better than Borland C, or Microsoft C? They don't care, they don't understand, and all your arguments of "It's better because it's...uh...standard!" fall on deaf ears. Or have you tried to convince someone to write standardized HTML so that you don't need IE to render it correctly?

Most people don't care about theoreticals. They care about what they can see and what affects them. If you show them their page in Lynx and Mozilla and Opera, perhaps they will understand the need for standardization. If you show them that no one else can compile their program, they might start writing standardized code.

The point is, people aren't going to understand that they have hackable systems unless you hack them and say, "Look what I found!" By proving the flaws in their systems you inspire them to fix them, creating secure systems.

Like they say, there's no teacher like bad experience.

Re:Cool Idea

[Bodrius]

Of course, if you're teaching programmers that's the way to do it. But programmers are not the ones who deal with security problems every day, SysAdmins do.

Typically a SysAdmin staff does not consist of programmers, and even if they are programmers, their job is not to write the security-intensive code and send the company to bankruptcy while they re-implement the OS, the terminal emulators, the network protocol, etc. Their job is to solve problems using the most efficient solution, and this often includes using other people's already developed, tested, code.

Their job is to install it, configure it, manipulate it and understand at a high level how it works; and when things inevitably go bad, minimize the damage and fix it quickly.

Learning to predict HOW things can go bad would help a lot.

Re:Cool Idea

[tomhudson]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball.</quote>

I don't know where you went to school, but most of my chem classes were equations, and we never did get to try the "crushing head with bowling ball" in physics. Head-crushing was kind of frowned upon, both during and outside of school.

If he was really into encouraging ethical behaviour, he'd first teach them the difference between hackers and crackers.

Then, you've got to keep in mind how insecure most school networks are, and how unsophisticated most adult users at schools are:

Q: What's your password?
A: 'password'/'my name'/'my birthdate'/it's written on the post-it on/under/beside the monitor/keyboard/mouse

Sort of like mixing matches and gasoline. It's not a question of 'if' there's going to be a fire, but 'how badly are you going to get burned'.

Re:Cool Idea

[CrayzyJ]

Mind if I back this up for you, FroMan?

My Prof in Netprog showed us a old version of some crappy software (that has been since been repaired). He then installed the code on a server and proceeded to hack into the machine. Seeing this live demo followed up by code analysis REALLY hit home buffer overruns. I really believe this made me a better programmer.

In this case, we learned to "hack" but there was certainly no harm and no foul. I remember to check/fix overruns, but I would have to check my notes on the steps for hacking it.

Re:Cool Idea

[Bodrius]

Not to mention other activities which just as often don't encourage self-control, such as physically intensive competitive sports.

I think the teacher found a very adequate metaphor: when you teach martial arts you're teaching ways to hurt, and sometimes kill. There is no doubt this sort of knowledge can be misused to hurt people; it was perfected for that purpose.

Yet it is also taught and learned mostly for other reasons: for self-defense, for sportsmanship, for physical and/or psychological self-improvement. Sometimes kids are taught martial arts to (gasp!) teach self-control, responsability and discipline.

Society trusts that kind of training because the ethics and discipline are ingrained in the practical teaching, it's not just a chapter and a lecture in the curriculum. Perhaps a similar approach can be used for something like this.

Re:Cool Idea

[deadsaijinx*]

Like the time I stole the magnesium strips from the chem class and lit my dads car on fire. I said it was the chem teachers fault, but NOOOO, somehow it was MY fault. Damn system fails again.

Re:Cool Idea

[JordoCrouse]

Sort of like mixing matches and gasoline. It's not a question of 'if' there's going to be a fire, but 'how badly are you going to get burned'.

You don't seem to have alot of faith in the next generation, or indeed in your fellow human beings. You expound a tired point, which has been used by the less clueful of the world to stop everything from sex ed to skeet shooting.

The point of this class is twofold - first, much like a karate or skeet shooting class, to teach respect and self control for the skills.

Secondly, this class exposes the students to the facts - they learn the facts behind cracker attacks, and what can be done to stop them. Its much easier to make the right decisions when you have the right facts. Otherwise, these kids are going to go out, and experiment on their own - and its much more difficult to tell the difference between right and wrong when you randomly try out root kits that you found on an underground hacker website late at night.

You can't just hide this from people, and hope that it will go away - you will always have hackers, just like you will have always pregenant teenagers. Perhaps with the correct facts, the future crackers of America can make the right decisions. They're going to figure out how to crack your machine anyway - the question is, what color hat do you want them to wear?

Re:Cool Idea

[crazyphilman]

ChrisNowinski said: "You don't teach people how to create security systems by teaching them to break into bad systems.
You teach them to comment their code, watch the buffers and never let programs leave the box unless you absolutly have to.
This whole hacker mythology is poor."

I agree. Instead of teaching people how to hack systems, wouldn't it make more sense to teach them how to set up firewalls properly, restrict setuid, restrict the number of services running, set up a patching strategy, and run an intrusion detection system like PSAD? People interested in programming could take a course focused on verifying user input, and avoiding buffer overruns. That sort of thing would be useful to kids, instead of just making them unemployable.

And, this WILL make it hard for them to get a job. Who on earth is going to want to hire a kid who already has experience hacking? Imagine what the legal staff would say, the kind of liability the company would be up against if he or she decided to have a little fun using his work PC, especially when the company KNEW he was a hacker and gave him net access anyway!

I think that every HR Drone who sees a resume from one of these kids is going to at least briefly envision the following exchange taking place:

Lawyer: "So, you knew that Joey was a hacker -- it's right here in his resume. You knew that, correct?"

HR Drone: "That is correct."

Lawyer: "But you hired him anyway. And, you gave him access to the net, Visual Basic development tools, and access to your servers."

HR Drone: "Well, he WAS a developer..."

Lawyer: "Yes, but also a hacker."

HR Drone: "Yes."

Lawyer: (voice rising, Perry Mason style): "So, you KNEW he was a hacker, and you gave him everything he would need to do whatever he might want to do -- including take down Wall Street's trading systems for two whole days?"

HR Drone: "God, when you put it THAT way, you make it sound like it was our fault or something!"

Lawyer: "Perhaps it is. Your hacker cost Wall Street tens of millions of dollars in lost trades. Maybe if you'd have hired someone who HADN'T expressed an interest in hacking, we wouldn't be in this courtroom in the first place. You DID have other applicants, I assume?"

HR Drone: "We had over 100."

Lawyer: "But you chose the hacker."

HR Drone: "Yes."

Lawyer: "No further questions."

The above fantasy would scare any HR Droid senseless. And, you just KNOW it's the first thing they'll think of when they see a resume from one of these kids.

Re:Cool Idea

[TedCheshireAcad]

What would this interview look like with a smart/tech-savvy HR Drone?

HR Drone: "So I see you've done an after school program on hacking"

Kid: "Yes, that's correct. I am a security expert because of it."

HR Drone: "...So you're a tool"

Kid: "Well actually sir, I am trying to be a security professional."

HR Drone: "...So you're a tool"

Kid: "In this program, sir, we learned the most advanced techniques for securing today's modern computer systems."

HR Drone: "So you've mastered Windows Update?"

Kid: (blushes and stares at feet) "...yeah"

Re:Cool Idea

[crazyphilman]

The way you describe it, it actually sounds quite attractive and a great idea for training security staff. But I felt that the way it was originally described to me focused way too much on the hacking aspect, which I would think would turn off your average suit. "Hacker" is such a dirty word these days; it doesn't seem all that safe to use it. Just recently, someone I know almost got into some serious trouble because a clueless manager overheard him talking about enjoying the hacking simulator in the new Matrix game! It took a bit of explanation to calm everyone down. ;)

I totally "get" the usefulness of the tiger-team approach, I just think it's a little dangerous to spin it as hacker training, especially in an article that is going to be read by the clueless.

Having said that, I think maybe I would like to modify part of my position, i.e. the part where I said that people shouldn't learn hacking skills but rather should focus on system hardening. Now that you mention it, I can see the usefulness of teams taking turns attacking and defending. In fact it sounds like a blast, besides being very informative.

Still, there's GOT to be a better way to spin this to the media. People are bound to react badly, don't you think? I don't have a lot of faith in people suddenly developing open minds... :)

Yeah!

[grub]

Yeah! Finally we after-schooler AD&Ders have a group nerdier than us to beat up!

Re:Yeah!

[Lord_Slepnir]

You call yourselves nerds and you're only using AD&D? You're barely worthy of the title. Us TRUE nerds switched to 3rd Edition long ago. Oh no...OH NO *Beaten to death by horde chanting "THAC0 FOREVER"*

Re:Yeah!

[the gnat]

Percent of marching band members in my college who were female: 50%

Percent of CS majors in my college who were female: about 5%

Any questions?

mmmm yea

[nege]

I would have loved to go to a highschool offering programs like this. It really would have given me something to do other than being a marching band dork. On the other hand, band was one giant orgy, so maybe its best that I stayed away from computers at that point in my life.

And one time... in band camp... we hacked the white house and asked GWB if he was out of TP.

Now that....

[Chris_Stankowitz]

Now that all the other social issues that teens face have all been meet head-on and dealt with, its good to see us turning our attention to more meaty topics.

Little Johny: Hey, Jimmy try this script out. First one is free tell your friends.

Could be useful

[paranode]

If you educate talented kids on how to defend systems you could produce some very valuable assets to the future security community. Learning how to hack goes hand in hand with learning security because you need to have the same level of knowledge as the hackers (preferably better). If they can see the profit potential of using this knowledge for good then they will probably be swayed from the dark side.

After taking a similar class

[billstr78]

After learning how to break systems fom a prominate IDS designer, I can honestly say that I will design much more secure systems myself. Becuase of my age, I don't feel the need to go out and try what we learned on real systems to see if I can cause havoc.
However, I wonder why the adults behind this "after school program" think that kids will have the same degree of responsibility that university students do when learning these things. What is to keep them from going out and writing viruses, unleasing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

Re:After taking a similar class

[Anti Frozt]

An interesting point. With University students, namely engineers, they are required to take at least one, sometimes several ethics courses designed to encourage responsible practices later on in their careers.

Hopefully, something similar will be put in place for these highschool students, though it may not be as effective due to the generally lower level of maturity.

Re:After taking a similar class

[Drakonian]

It's good to know you considered it useful. I've been completely amazed at the uproar over U of C's virus course. (I'm considering taking it but it doesn't fit into my schedule well. :( ) All these threats like "don't apply for a job here if you took the course". And beautiful circular arguments like "Only bad programmers write viruses so if you take the course you are a bad programmer". Very interesting.

Re:After taking a similar class

[Neil Watson]

I was watching a documentary about teenagers on TLC or Discovery a few months back. They had studies that suggested the part of the brain enables you to predict the consequences of your actions may not develope until the end of puberty . Thus teenagers may be irresponsible becuase their brains are wired that way.

Re:After taking a similar class

[leighton]

I doubt that ethics courses will really help all that much. As a medical researcher, I've been forced to sit through any number of such classes. I don't think any of them taught me anything I didn't already know, except how to comply with innumerable arcane Federal regulations (which is useful, but isn't really the same as ethics anyway). Most of the ethics components offered useful advice like "Don't lie to your patients." (I never would've thought of that, and now that you've told us, I'm sure all the immoral people out there will immediately stop doing it!) When instructors tried to present more complicated ethical issues, they usually could not adequately defend their "answers," and were viciously beset from all sides by doctors (and occasionally techs like me) who actually understood the moral complexities of the situations the ethicists were talking about.

I think such classes are basically there to help stave off lawsuits; they allow you to say "Hey, we tried, we gave him ethics training; if he violates it, that's HIS responsibility." It gets rid of the (usually bullshit) argument that the kid simply didn't know it's wrong.

Re:After taking a similar class

[EinarH]

What is to keep them from going out and writing viruses, unleashing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

The same thing that keeps 18-20 years old men fresh out of the military from creating havoc with a weapon: Ethics.

Most modern civilised societies today train *thousands* of young men to kill, wound, stab and inflict damage on others. Despite this, rarely does it happen that these people use their skills after-hours in an inappropriate way. Of course there are exceptions, for example people with mental illness etc.

Personally, I have a fully automatic rifle with XXX numbers of shoots stored in my home provided to me by the government. I could easily create a mess with this weapon, or with a shotgun or a pistol I own privately. Despite this I don't.

As long as the individuals/persons that are taught these skills are enough mature and they are taught ethics and the difference between right and wrong I don't se the problem.
After all: Deep inside, most people are good.

It's better that they acquire these skills in a way that gives someone the possibility to correct bad behaviour right then. And besides that it gives them something they can put on their CV and use to get a white-hat job.
This is a clear example of a case where the positive effects out-weights the negative.

Re:After taking a similar class

[billstr78]

Most people are good. But teenagers typically don't fully comprehend the impact of thier actions. Also the gun analogy is not a valid one. In order to "create a mess" with your firearms, you would have to witness the horror caused by your actions and have a high probability of being caught.
Cracking computer systems is much different. You can do it from the comfort and privacy of your own home. You don't see the greif your actions causes others. It is traditionally much more difficult to get caught.
I see that they are doing everything they can to discourage deviant behaviour, but they cannot prevent it and as someone said earlier, if they enable these kids with the skills necessary, a chain of responsibility is created and lawsuits will propogate up the chain stopping at the organization with the most money.

I heard that the website advertising the course..

[Idimmu Xul]

didn't have any spinny flaming skulls on it, and their wasnt a single biohazard sign anywhere! :(

I severely doubt it's integrity and capability with regard to teaching me the kiddie skillz I need to get by on IRC nowadays!

- DemonShadowHa>0rSpawnNeo

--------------- THERE IS NO SPOON
--------------- HACK THE MPAA RIAA AND AA

The Hacking After-School Special

[Anonymous Coward]

Timmy: Hi Susie!

Susie: Hi Timmy! Wanna go get a malted milk?

Timmy: Nah, I've got something keener to do.

Susie: What then?

Timmy: I don't think you would get it.

Susie: Come on! We're best friends, right?

Timmy: OK then. I'm gonna go home and hack.

Susie: (pause) Gosh Timmy! You shouldn't hack!

Timmy: Why not?

Susie: Hackers are theives and cost lots of folks money! They're akin to a device that breaks the lock on your house!

Timmy: Aw shucks, you're so old fashioned. I gotta go, see you tomorrow.

[ Susie walks away sadly. ]

[ The next day... ]

Teacher: Rodney?

Rodney: Here.

Teacher: Susie?

Susie (sadly): Here.

Teacher: Timmy?

[ silence ]

Teacher: Susie, do you know where Timmy is?

Susie: I sure do, Mrs. Martin. He went to jail.

[ murmurs from the classmates ]

Susie: He was downloadin' music and stuff, and he got caught. He's really in a darn pickle now.

Teacher: Class, let this be a lesson to you all. Good kids don't hack. If somebody asks you to hack, just say, "I don't hack. That's whack."

Re:The Hacking After-School Special

[xScruffx]

"I don't hack. That's whack."

Now THAT is a t-shirt waiting to happen. Perhaps the back could have a good old "Just say n0."

xScruffx

Are there morals taught as well??

[mustangsal66]

It's great to teach others, but without the background, or the teaching of consequenses (I can't spell worth a damn), that could bite the school in the arse.

Hmmm... Old-School Mindset

[Trent Polack]

I'm still of the mindset that the best way for high school kids to learn things is on their own. No matter what, throughout high school, the most I learned was all on my own time. I didn't have ANY courses in my school about anything related to computers (except a "typing" class), so, in an effort to actually try and challenge myself, I ordered a few books off of Amazon.com, and taught myself C++. And, I think that if I had access to a class that simply taught C++ with proprietary textbooks and software, I wouldn't have appreciated the experience nearly as much.

Wow

[stratjakt]

Tiger team.

Anyone else see visions of the football team, glee club and chess team in an ad-hoc alliance, beating the living shit out of the "tiger team"?

Re:Wow

[stanmann]

Anyone else have visions of the football team, glee club and chess team mysteriously flunking all their classes?

Im curious where they get their teachers....

[Brushfireb]

I'm curious where they get their teachers. In order to make this program worthwhile (IE - the kids learn something about security), you would need someone with some significant experience and knowledge.

I know that I was in high school a few years ago, the head netadmin/sysadmin was worse than pitiful, a MS Certification only type of person. The only systems he ever hacked into were those in a computer game. Granted, I did go to private HS, and IT was not at the top of their budget priorities.

Regardless, it brings up a good point of having competent people teaching these types of classes, and how difficult it is for schools feeling the budget crunch to find competency.

Re:Im curious where they get their teachers....

[DMDx86]

Its a struggle in general with public schools to get competent teachers teaching *ANY* course. Colleges are just chruning out these Education majors who have little knowledge about the classes they are teaching.

Re:Im curious where they get their teachers....

[ceejayoz]

Hey... there's a link to an article there for a reason...

Mr. Robinson, 38, who runs a small information security company... ...he created a nonprofit organization, the Information Security Foundation, dedicated to educating the public about information security...

Great Idea.

[twitter]

Everyone has lots to learn and the instructors here know it. This is not how things have worked elsewhere. At least that's how I've heard some "computer" classes go here in Baton Rouge high schools. The kids are banging around with Slackware and Gentoo, while the teachers try to master Front Page. None of those cluefull kids bother with the class. Other programs, such as the one at Baton Rouge High, let the students loose on a BSD network and let them do what they please. If the program listens to their students, they might all learn something.

We can then hope that industry picks these students up and listens to them. Some companies won't like what the clueful have to say about their software. But every other company in the world needs to hear it.

Re:mmmm yea

[Anonymous Coward]

On the other hand, band was one giant orgy

Were you boys all playing the skin flute?

Remeber when hacker was a good word?

[thbigr]

*sigh*

I can remeber when I used to say I was a hacker and that was a good thing. That was back when hacker was closer to the dictionary, a hacker or hack was someone who worked long hours.

This grumpy old man moment was brought to you by...

Wait, wait, wait...

[nametaken]

Wasn't everyone throwing a fit about N.Korea doing this, in a slashdot article this week?

this is very good

[newsdee]

I can relate to this from personal experience.

During my high school years, I had been banned for a time from using computers at the school library, only because of my programming knowledge was superior to that of the teacher of Computer class (this was 1994 - the guy even thought the Net was an useless fad!). Rumor must have spread that I could hack a machine by looking at it, or something of the sort, since they didn't want me near a two-meter radius of any terminal. At first I didn't give a damn since I limited my computer stuff to home and that class...

However at some point the professor hired some "security expert" consultant to assess threats to the network, and my name appeared on top of a list of people who allegedly had "hacking tools" in their network space. This was too much (I only used it for school papers, and I could prove it) and I had to go to the professor and threaten to sue for libel. Of course I didn't had to go so far, since the professor apologized, removed my name for the list, and restored my normal access to the library computers. Since then I didn't have any problems (even the librarians asked for help afterwards).

What the moral of this story? Ignorant professors == bad news. If kids are smart enough to want to learn hacking, or programming, then they should allow their creativity to be expressed. Or else you will fall into idiotic situations like what I have lived.

PS: As a matter the fact the professor, much to his credit, at some point offered to create a "Linux club" (1995). However, the college grad supposed to sponsor the club dissapeared after the first meeting... so we never had anything... :-( [we theorized that he learned afterwards that Linux was Haxx0r material, so he banned it, but we'll never know for sure :-) ].

Us and Them guessing game

[zptdooda]

This sounds like the North Korean story from a few days ago, so here are lines from both stories and you can guess which article the students are from:

- "White-hat Hackers" or "Cyber terrorists"
- "hunger stricken" or "fortified with pizza"
- "another weapon" or "band of pickpockets"
- "creating mischief" or "training hackers"

Not a fair comparison, I know. All of the above is out of context.

When will people ever learn...

[Robin Edman]

... what a hacker is: http://catb.org/~esr/faqs/hacker-howto.html

Learning Dangerous Skills

[jamesmartinluther]

While many adults want to shelter our children from anything that may harm them, I would advocate teaching children (at an appropriate age) how to responsibly make use of dangerous tools. These would include using a firearm, various contact sports, martial arts, chemistry, computer security, and so on. Of course, there are morons who will mis-apply their karate or hacking skill, but then there will be many more trained peers to counter them.

If everyone is equally stronger and more knowledgable, the entire system is stronger. The world cannot be populated with softies who leave security to the "experts".

- James

sure thing!

[Anonymous Coward]

here you go

Contact Info??

[thrillbert]

Anyone have any contact information? I am actually interested in pursuing something like this in my area. Give the teens something to do this summer.

---
It was a book to kill time for those who liked it better dead.

Teaching Kids is much worse

[McAddress]

At least college students are (hopefully) smart enough to want to learn something serious about computers. With highschool kids, 95% of them would be content with having a button saying "break into someone's system" that would do just that. However, we hope that in our nation's universities, students are taking the computer classes because that is the field they would like to go into, and as such they will refrain from doing stupid things. My college offers a security class, but there is no way to take it before at least your 4th semester in school, and AFTER you know C++, Java, Assembly language, and have the department approve you. And they don't teach you how to hack either. Sure you will come out of the class knowing how to break into some systems, but the focus of the class is not on cracking, but securing a network or a computer. The kids in NY public schools are just going to become script kiddies. We have enough of those already.

My trombone

[Andy Dodd]

has more dents than your head.

Go away if you know what's good for you. :)

Any Questions - I am on the Board of the Program

[fjaffe]

If anyone has any questions about the Tiger Team, I am on the Board of Directors and would be glad to answer them.

As long as they teach ethics as well...

[thepacketmaster]

I don't necessarily see a problem with this. How many 'white hat' do the same things every day in test labs and for clients? This could be good career training for them. However, I've observed kids often view hacking, etc as something cool to do, without thinking of the consequences. While they're running this program, they should be teaching ethics and legality. Otherwise these kids might take this program as a license to hack.

Great idea-

[Mu*puppy]

-for the teacher involved as well. Not only can the teacer gain more knowledge about tools and methods, but the teacher also has the oppurtunity gain the RESPECT of the local script kiddies/hackers, if he/she plays his/her cards right. Most script kiddies/hackers start out with local targets, and considering the age of the kids involved, their current school becomes one of the prime targets.

Most likely, the teacher involved with a program like this is the defacto 'resident tech' of the school, being the one-person network admin/troubleshooter/etc. Having a face and personality assosciated with 'The Admin, my Enemy' can give a whole new perspective to the 'up-and-coming' hacker. This can be good or bad ('y'know, X isn't so bad, maybe I shouldn't target the school' vs. 'Oh, I -hate- that fscker, time to bring on the hurt'), but at least it can bring up the point that there's a real PERSON behind that box they're hacking. If done right, clubs like this can help cultivate the 'old-school hacker mentality' by having in-depth discussions of ethics, legalities, etc.

We live in a world where 'morals' are generally defined by social groups. If a kid getting his feet wet is exposed to nothing but script kiddies and their sites, just guess which way he's most likely to turn out...

Re:Any Questions - I am on the Board of the Progra

[kryliss]

How does a chemestry teacher teach kids not to make bombs. How does a physics teacher teach kids not to make projectile weapons. How does a music teacher teach kids not to make rap music.

Re:Any Questions - I am on the Board of the Progra

[rulethirty]

How does can an effective teacher control the use of the knowledege she/he places in the hands of adolesents?

Your analogy is wrong, this is more closely like a chemistry teacher teaching how to make bombs, a physics teacher how to make projectile weapons, and a music teacher how to make rap music.

If this class was about computer security then your analogy would hold true.

Login as

[Durin_Deathless]

username:anonymoose1 password:aaaaa

Nice troll, but not good enough

[PurpleFloyd]

Nice troll, but the "Visual Basic development tools" reference put you over the top into unbelivability.

And to commence feeding: your comment on hacking experience being bad is totally groundless: I wouldn't trust an architect who couldn't tell me the points in a building vulnerable to bombing, and I wouldn't trust a sysadmin who didn't have at least a basic knowledge of hacking techniques.

Re:Nice troll, but not good enough

[crazyphilman]

Boy, did you ever miss my point.

What method did probably 90% of the currently problematic worms and hacks use to get around? Vulnerabilities in MS Exchange, MS Outlook, and MS Outlook Express, IIS, and SQL Server. What language offers the tightest integration with all of these systems, including many, many prebuilt system objects for working with them? VB. What language would an employee of a Microsoft shop probably be working with daily? VB. So, if you were to hire a hacker to work in your Microsoft shop, he would probably find it most convenient to work with the development tools sitting right there in front of him. Not that he would need any others. And, he would even be inside the firewall of your organization, possibly able to start using other people's internet accounts, and etc... It would be a nightmare with the potential of massive liability if he were to use your system to do something nefarious.

My POINT is, especially if you're a Microsoft shop, you'd have to be absolutely NUTS to hire someone who was a self-professed hacker, and had coursework already completed which would give him the skills he would need to cause problems for you.

As far as the interview goes, think about it: as soon as the HR Drone reads the blurb about "computer security training", he's going to ask about it. Boom -- the kids boat is sunk the minute he opens his mouth to reply, unless he lies his ass off, and if that's the case, office politics will get him later as soon as a coworker figures out where he learned his skills.

that's all I'm saying.

More about the University of Calgary

[Blarfy_Snarflepoop]

We've released a statement outlining our position. Happy Reading...

Re:Hacking in the media

[atr-isf]

I absolutely hate the word "hacking" when used in the media

I read the MIT Hacker's Dictionary before many people posting in SlashDot were born. The fact is that "hacker" and "hacking" have had a pejorative connotation for a long time. I remember the University of Maine operations manager calling me a "hacker" (in a disparaging tone) in 1980 when I first exploited a race condition to break out of the limited student shell into "full CMS" (the humor here will only be apparent to those who have experience with IBM's VM mainframe operating system).

You can rail against this usage all you want, but it's an accomplished fact--and I at least have given up trying to convert the rest of humanity to "cracker" or "threat agent." Perhaps we can all join a class action suit against "the media" based on defamation of character, and force them to use something more acceptable. But probably not.

Andy

Andrew T. Robinson
President, Chairman
Information Security Foundation
www.isfound.org

Re:Any Questions - I am on the Board of the Progra

[fjaffe]

Good Question. Andy Robinson, the originator of the program thought up the name. A lot of time was spent considering the social consequences in high school. In many ways, the kids attracted to the program are already less socially active with many high school peers, because they are into computers. We hope this environment actually helps them learn teamwork because it requires a lot of interaction among the team members.

Point of view from a member of the Tiger Team

[TodFarkus1]

I seem to find the less people tend to do their research, the more ridiculous they sound on Slashdot.

Perhaps people decided not to bother going to the ISF website?

Today, I set up an Apache server and beat the bloody hell out of it. Throught this, I learned new things and applied the lessons. When the other team gets to hacking the Apache server, I'm going to learn something that I didn't know existed.

Perhaps over-reliance on the New York Times (which, as most now know, isn't a very reliable source) tends to give people a demonized or skewed image of what the whole program is trying to accomplish.

Oh, and a note to the AD&Der's: As a teenager with built up rage and paranoia, I could devour your miserable soul, after taking a +10 elixer and Pills of Sleepless Nights (No-Doz).

Love and kisses,
-Dave C.