After-School Hacking Special

securitas writes "The NY Times writes about an after-school program that teaches teenagers how to hack, attack and defend systems. There doesn't seem to have been the same uproar as the virus-creation course at the University of Calgary (see previous Slashdot thread), even though the participants in Tiger Team (the name of the program) are younger than the university students."

Comments

Cool Idea

[(54)T-Dub]

Sounds like a very interesting program. If someone is serious about system security, this seems like the best way to learn.

I think the program directors argument should qualm any skeptics.

"Some of them grilled us pretty heavily on the concept of, 'Well, aren't you training hackers?' " he said. "I go, yeah. I have a black belt in martial arts. If I wanted to be a bad guy, I could go and hurt people. But I don't do it. That's not the emphasis of the program."

Re:Cool Idea

[ceejayoz]

If it's their own code, yes. What these kids are being trained to do is find holes in other peoples' code, so a company can fix the insecurities.

There's a good reason people are getting paid $90,000 a year to hack into computers of big companies, despite your scepticism.

Re:Cool Idea

[ceejayoz]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball. No court would find them responsible, unless the teacher was encouraging activity.

From what the article says, he's strongly encouraging ethical behavior. Personally, I wish I had something like this in high school.

Re:Cool Idea

[FroMan]

In a really simple contrived world maybe.

Explaining a buffer overflow and actaully programming one are two different things. And programming an expliot for one drives the idea home even better.

I'm not saying that they should be trying to hack nsa.gov or something. However, when you actaully have a chance to play with a virus or recent exploit in a controlled environment you will get a better understanding.

That is why folks honeypot and such. They can actually figure out what are the techniques used in the wild and how to defeat those techniques.

Re:Cool Idea

[deke_2503]

I disagree. Ever argued with a not-so-bright programmer about why ANSI C is better than Borland C, or Microsoft C? They don't care, they don't understand, and all your arguments of "It's better because it's...uh...standard!" fall on deaf ears. Or have you tried to convince someone to write standardized HTML so that you don't need IE to render it correctly?

Most people don't care about theoreticals. They care about what they can see and what affects them. If you show them their page in Lynx and Mozilla and Opera, perhaps they will understand the need for standardization. If you show them that no one else can compile their program, they might start writing standardized code.

The point is, people aren't going to understand that they have hackable systems unless you hack them and say, "Look what I found!" By proving the flaws in their systems you inspire them to fix them, creating secure systems.

Like they say, there's no teacher like bad experience.

Re:Cool Idea

[Bodrius]

Of course, if you're teaching programmers that's the way to do it. But programmers are not the ones who deal with security problems every day, SysAdmins do.

Typically a SysAdmin staff does not consist of programmers, and even if they are programmers, their job is not to write the security-intensive code and send the company to bankruptcy while they re-implement the OS, the terminal emulators, the network protocol, etc. Their job is to solve problems using the most efficient solution, and this often includes using other people's already developed, tested, code.

Their job is to install it, configure it, manipulate it and understand at a high level how it works; and when things inevitably go bad, minimize the damage and fix it quickly.

Learning to predict HOW things can go bad would help a lot.

Re:Cool Idea

[tomhudson]

Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball.</quote>

I don't know where you went to school, but most of my chem classes were equations, and we never did get to try the "crushing head with bowling ball" in physics. Head-crushing was kind of frowned upon, both during and outside of school.

If he was really into encouraging ethical behaviour, he'd first teach them the difference between hackers and crackers.

Then, you've got to keep in mind how insecure most school networks are, and how unsophisticated most adult users at schools are:

Q: What's your password?
A: 'password'/'my name'/'my birthdate'/it's written on the post-it on/under/beside the monitor/keyboard/mouse

Sort of like mixing matches and gasoline. It's not a question of 'if' there's going to be a fire, but 'how badly are you going to get burned'.

Re:Cool Idea

[CrayzyJ]

Mind if I back this up for you, FroMan?

My Prof in Netprog showed us a old version of some crappy software (that has been since been repaired). He then installed the code on a server and proceeded to hack into the machine. Seeing this live demo followed up by code analysis REALLY hit home buffer overruns. I really believe this made me a better programmer.

In this case, we learned to "hack" but there was certainly no harm and no foul. I remember to check/fix overruns, but I would have to check my notes on the steps for hacking it.

Re:Cool Idea

[Bodrius]

Not to mention other activities which just as often don't encourage self-control, such as physically intensive competitive sports.

I think the teacher found a very adequate metaphor: when you teach martial arts you're teaching ways to hurt, and sometimes kill. There is no doubt this sort of knowledge can be misused to hurt people; it was perfected for that purpose.

Yet it is also taught and learned mostly for other reasons: for self-defense, for sportsmanship, for physical and/or psychological self-improvement. Sometimes kids are taught martial arts to (gasp!) teach self-control, responsability and discipline.

Society trusts that kind of training because the ethics and discipline are ingrained in the practical teaching, it's not just a chapter and a lecture in the curriculum. Perhaps a similar approach can be used for something like this.

Re:Cool Idea

[deadsaijinx*]

Like the time I stole the magnesium strips from the chem class and lit my dads car on fire. I said it was the chem teachers fault, but NOOOO, somehow it was MY fault. Damn system fails again.

Re:Cool Idea

[TedCheshireAcad]

What would this interview look like with a smart/tech-savvy HR Drone?

HR Drone: "So I see you've done an after school program on hacking"

Kid: "Yes, that's correct. I am a security expert because of it."

HR Drone: "...So you're a tool"

Kid: "Well actually sir, I am trying to be a security professional."

HR Drone: "...So you're a tool"

Kid: "In this program, sir, we learned the most advanced techniques for securing today's modern computer systems."

HR Drone: "So you've mastered Windows Update?"

Kid: (blushes and stares at feet) "...yeah"

Yeah!

[grub]

Yeah! Finally we after-schooler AD&Ders have a group nerdier than us to beat up!

Re:Yeah!

[Lord_Slepnir]

You call yourselves nerds and you're only using AD&D? You're barely worthy of the title. Us TRUE nerds switched to 3rd Edition long ago. Oh no...OH NO *Beaten to death by horde chanting "THAC0 FOREVER"*

mmmm yea

[nege]

I would have loved to go to a highschool offering programs like this. It really would have given me something to do other than being a marching band dork. On the other hand, band was one giant orgy, so maybe its best that I stayed away from computers at that point in my life.

And one time... in band camp... we hacked the white house and asked GWB if he was out of TP.

Now that....

[Chris_Stankowitz]

Now that all the other social issues that teens face have all been meet head-on and dealt with, its good to see us turning our attention to more meaty topics.

Little Johny: Hey, Jimmy try this script out. First one is free tell your friends.

Could be useful

[paranode]

If you educate talented kids on how to defend systems you could produce some very valuable assets to the future security community. Learning how to hack goes hand in hand with learning security because you need to have the same level of knowledge as the hackers (preferably better). If they can see the profit potential of using this knowledge for good then they will probably be swayed from the dark side.

After taking a similar class

[billstr78]

After learning how to break systems fom a prominate IDS designer, I can honestly say that I will design much more secure systems myself. Becuase of my age, I don't feel the need to go out and try what we learned on real systems to see if I can cause havoc.
However, I wonder why the adults behind this "after school program" think that kids will have the same degree of responsibility that university students do when learning these things. What is to keep them from going out and writing viruses, unleasing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

Re:After taking a similar class

[leighton]

I doubt that ethics courses will really help all that much. As a medical researcher, I've been forced to sit through any number of such classes. I don't think any of them taught me anything I didn't already know, except how to comply with innumerable arcane Federal regulations (which is useful, but isn't really the same as ethics anyway). Most of the ethics components offered useful advice like "Don't lie to your patients." (I never would've thought of that, and now that you've told us, I'm sure all the immoral people out there will immediately stop doing it!) When instructors tried to present more complicated ethical issues, they usually could not adequately defend their "answers," and were viciously beset from all sides by doctors (and occasionally techs like me) who actually understood the moral complexities of the situations the ethicists were talking about.

I think such classes are basically there to help stave off lawsuits; they allow you to say "Hey, we tried, we gave him ethics training; if he violates it, that's HIS responsibility." It gets rid of the (usually bullshit) argument that the kid simply didn't know it's wrong.

Re:After taking a similar class

[EinarH]

What is to keep them from going out and writing viruses, unleashing them upon the Internet and generally causing lots of trouble after learning how to "protect" systems.

The same thing that keeps 18-20 years old men fresh out of the military from creating havoc with a weapon: Ethics.

Most modern civilised societies today train *thousands* of young men to kill, wound, stab and inflict damage on others. Despite this, rarely does it happen that these people use their skills after-hours in an inappropriate way. Of course there are exceptions, for example people with mental illness etc.

Personally, I have a fully automatic rifle with XXX numbers of shoots stored in my home provided to me by the government. I could easily create a mess with this weapon, or with a shotgun or a pistol I own privately. Despite this I don't.

As long as the individuals/persons that are taught these skills are enough mature and they are taught ethics and the difference between right and wrong I don't se the problem.
After all: Deep inside, most people are good.

It's better that they acquire these skills in a way that gives someone the possibility to correct bad behaviour right then. And besides that it gives them something they can put on their CV and use to get a white-hat job.
This is a clear example of a case where the positive effects out-weights the negative.

I heard that the website advertising the course..

[Idimmu Xul]

didn't have any spinny flaming skulls on it, and their wasnt a single biohazard sign anywhere! :(

I severely doubt it's integrity and capability with regard to teaching me the kiddie skillz I need to get by on IRC nowadays!

- DemonShadowHa>0rSpawnNeo

--------------- THERE IS NO SPOON
--------------- HACK THE MPAA RIAA AND AA

The Hacking After-School Special

[Anonymous Coward]

Timmy: Hi Susie!

Susie: Hi Timmy! Wanna go get a malted milk?

Timmy: Nah, I've got something keener to do.

Susie: What then?

Timmy: I don't think you would get it.

Susie: Come on! We're best friends, right?

Timmy: OK then. I'm gonna go home and hack.

Susie: (pause) Gosh Timmy! You shouldn't hack!

Timmy: Why not?

Susie: Hackers are theives and cost lots of folks money! They're akin to a device that breaks the lock on your house!

Timmy: Aw shucks, you're so old fashioned. I gotta go, see you tomorrow.

[ Susie walks away sadly. ]

[ The next day... ]

Teacher: Rodney?

Rodney: Here.

Teacher: Susie?

Susie (sadly): Here.

Teacher: Timmy?

[ silence ]

Teacher: Susie, do you know where Timmy is?

Susie: I sure do, Mrs. Martin. He went to jail.

[ murmurs from the classmates ]

Susie: He was downloadin' music and stuff, and he got caught. He's really in a darn pickle now.

Teacher: Class, let this be a lesson to you all. Good kids don't hack. If somebody asks you to hack, just say, "I don't hack. That's whack."

Are there morals taught as well??

[mustangsal66]

It's great to teach others, but without the background, or the teaching of consequenses (I can't spell worth a damn), that could bite the school in the arse.

Hmmm... Old-School Mindset

[Trent Polack]

I'm still of the mindset that the best way for high school kids to learn things is on their own. No matter what, throughout high school, the most I learned was all on my own time. I didn't have ANY courses in my school about anything related to computers (except a "typing" class), so, in an effort to actually try and challenge myself, I ordered a few books off of Amazon.com, and taught myself C++. And, I think that if I had access to a class that simply taught C++ with proprietary textbooks and software, I wouldn't have appreciated the experience nearly as much.

Wow

[stratjakt]

Tiger team.

Anyone else see visions of the football team, glee club and chess team in an ad-hoc alliance, beating the living shit out of the "tiger team"?

Im curious where they get their teachers....

[Brushfireb]

I'm curious where they get their teachers. In order to make this program worthwhile (IE - the kids learn something about security), you would need someone with some significant experience and knowledge.

I know that I was in high school a few years ago, the head netadmin/sysadmin was worse than pitiful, a MS Certification only type of person. The only systems he ever hacked into were those in a computer game. Granted, I did go to private HS, and IT was not at the top of their budget priorities.

Regardless, it brings up a good point of having competent people teaching these types of classes, and how difficult it is for schools feeling the budget crunch to find competency.

Re:Im curious where they get their teachers....

[ceejayoz]

Hey... there's a link to an article there for a reason...

Mr. Robinson, 38, who runs a small information security company... ...he created a nonprofit organization, the Information Security Foundation, dedicated to educating the public about information security...

Great Idea.

[twitter]

Everyone has lots to learn and the instructors here know it. This is not how things have worked elsewhere. At least that's how I've heard some "computer" classes go here in Baton Rouge high schools. The kids are banging around with Slackware and Gentoo, while the teachers try to master Front Page. None of those cluefull kids bother with the class. Other programs, such as the one at Baton Rouge High, let the students loose on a BSD network and let them do what they please. If the program listens to their students, they might all learn something.

We can then hope that industry picks these students up and listens to them. Some companies won't like what the clueful have to say about their software. But every other company in the world needs to hear it.

Remeber when hacker was a good word?

[thbigr]

*sigh*

I can remeber when I used to say I was a hacker and that was a good thing. That was back when hacker was closer to the dictionary, a hacker or hack was someone who worked long hours.

This grumpy old man moment was brought to you by...

this is very good

[newsdee]

I can relate to this from personal experience.

During my high school years, I had been banned for a time from using computers at the school library, only because of my programming knowledge was superior to that of the teacher of Computer class (this was 1994 - the guy even thought the Net was an useless fad!). Rumor must have spread that I could hack a machine by looking at it, or something of the sort, since they didn't want me near a two-meter radius of any terminal. At first I didn't give a damn since I limited my computer stuff to home and that class...

However at some point the professor hired some "security expert" consultant to assess threats to the network, and my name appeared on top of a list of people who allegedly had "hacking tools" in their network space. This was too much (I only used it for school papers, and I could prove it) and I had to go to the professor and threaten to sue for libel. Of course I didn't had to go so far, since the professor apologized, removed my name for the list, and restored my normal access to the library computers. Since then I didn't have any problems (even the librarians asked for help afterwards).

What the moral of this story? Ignorant professors == bad news. If kids are smart enough to want to learn hacking, or programming, then they should allow their creativity to be expressed. Or else you will fall into idiotic situations like what I have lived.

PS: As a matter the fact the professor, much to his credit, at some point offered to create a "Linux club" (1995). However, the college grad supposed to sponsor the club dissapeared after the first meeting... so we never had anything... :-( [we theorized that he learned afterwards that Linux was Haxx0r material, so he banned it, but we'll never know for sure :-) ].

When will people ever learn...

[Robin Edman]

... what a hacker is: http://catb.org/~esr/faqs/hacker-howto.html

Learning Dangerous Skills

[jamesmartinluther]

While many adults want to shelter our children from anything that may harm them, I would advocate teaching children (at an appropriate age) how to responsibly make use of dangerous tools. These would include using a firearm, various contact sports, martial arts, chemistry, computer security, and so on. Of course, there are morons who will mis-apply their karate or hacking skill, but then there will be many more trained peers to counter them.

If everyone is equally stronger and more knowledgable, the entire system is stronger. The world cannot be populated with softies who leave security to the "experts".

- James

sure thing!

[Anonymous Coward]

here you go

Contact Info??

[thrillbert]

Anyone have any contact information? I am actually interested in pursuing something like this in my area. Give the teens something to do this summer.

---
It was a book to kill time for those who liked it better dead.

Any Questions - I am on the Board of the Program

[fjaffe]

If anyone has any questions about the Tiger Team, I am on the Board of Directors and would be glad to answer them.

As long as they teach ethics as well...

[thepacketmaster]

I don't necessarily see a problem with this. How many 'white hat' do the same things every day in test labs and for clients? This could be good career training for them. However, I've observed kids often view hacking, etc as something cool to do, without thinking of the consequences. While they're running this program, they should be teaching ethics and legality. Otherwise these kids might take this program as a license to hack.

Great idea-

[Mu*puppy]

-for the teacher involved as well. Not only can the teacer gain more knowledge about tools and methods, but the teacher also has the oppurtunity gain the RESPECT of the local script kiddies/hackers, if he/she plays his/her cards right. Most script kiddies/hackers start out with local targets, and considering the age of the kids involved, their current school becomes one of the prime targets.

Most likely, the teacher involved with a program like this is the defacto 'resident tech' of the school, being the one-person network admin/troubleshooter/etc. Having a face and personality assosciated with 'The Admin, my Enemy' can give a whole new perspective to the 'up-and-coming' hacker. This can be good or bad ('y'know, X isn't so bad, maybe I shouldn't target the school' vs. 'Oh, I -hate- that fscker, time to bring on the hurt'), but at least it can bring up the point that there's a real PERSON behind that box they're hacking. If done right, clubs like this can help cultivate the 'old-school hacker mentality' by having in-depth discussions of ethics, legalities, etc.

We live in a world where 'morals' are generally defined by social groups. If a kid getting his feet wet is exposed to nothing but script kiddies and their sites, just guess which way he's most likely to turn out...

Re:Any Questions - I am on the Board of the Progra

[rulethirty]

How does can an effective teacher control the use of the knowledege she/he places in the hands of adolesents?

Your analogy is wrong, this is more closely like a chemistry teacher teaching how to make bombs, a physics teacher how to make projectile weapons, and a music teacher how to make rap music.

If this class was about computer security then your analogy would hold true.

Nice troll, but not good enough

[PurpleFloyd]

Nice troll, but the "Visual Basic development tools" reference put you over the top into unbelivability.

And to commence feeding: your comment on hacking experience being bad is totally groundless: I wouldn't trust an architect who couldn't tell me the points in a building vulnerable to bombing, and I wouldn't trust a sysadmin who didn't have at least a basic knowledge of hacking techniques.

More about the University of Calgary

[Blarfy_Snarflepoop]

We've released a statement outlining our position. Happy Reading...

Re:Hacking in the media

[atr-isf]

I absolutely hate the word "hacking" when used in the media

I read the MIT Hacker's Dictionary before many people posting in SlashDot were born. The fact is that "hacker" and "hacking" have had a pejorative connotation for a long time. I remember the University of Maine operations manager calling me a "hacker" (in a disparaging tone) in 1980 when I first exploited a race condition to break out of the limited student shell into "full CMS" (the humor here will only be apparent to those who have experience with IBM's VM mainframe operating system).

You can rail against this usage all you want, but it's an accomplished fact--and I at least have given up trying to convert the rest of humanity to "cracker" or "threat agent." Perhaps we can all join a class action suit against "the media" based on defamation of character, and force them to use something more acceptable. But probably not.

Andy

Andrew T. Robinson
President, Chairman
Information Security Foundation
www.isfound.org