Slashdot Mirror
After-School Hacking Special
securitas writes "The NY Times writes about an after-school program that teaches teenagers how to hack, attack and defend systems. There doesn't seem to have been the same uproar as the virus-creation course at the University of Calgary (see previous Slashdot thread), even though the participants in Tiger Team (the name of the program) are younger than the university students."
If you educate talented kids on how to defend systems you could produce some very valuable assets to the future security community. Learning how to hack goes hand in hand with learning security because you need to have the same level of knowledge as the hackers (preferably better). If they can see the profit potential of using this knowledge for good then they will probably be swayed from the dark side.
Timmy: Hi Susie!
Susie: Hi Timmy! Wanna go get a malted milk?
Timmy: Nah, I've got something keener to do.
Susie: What then?
Timmy: I don't think you would get it.
Susie: Come on! We're best friends, right?
Timmy: OK then. I'm gonna go home and hack.
Susie: (pause) Gosh Timmy! You shouldn't hack!
Timmy: Why not?
Susie: Hackers are theives and cost lots of folks money! They're akin to a device that breaks the lock on your house!
Timmy: Aw shucks, you're so old fashioned. I gotta go, see you tomorrow.
[ Susie walks away sadly. ]
[ The next day... ]
Teacher: Rodney?
Rodney: Here.
Teacher: Susie?
Susie (sadly): Here.
Teacher: Timmy?
[ silence ]
Teacher: Susie, do you know where Timmy is?
Susie: I sure do, Mrs. Martin. He went to jail.
[ murmurs from the classmates ]
Susie: He was downloadin' music and stuff, and he got caught. He's really in a darn pickle now.
Teacher: Class, let this be a lesson to you all. Good kids don't hack. If somebody asks you to hack, just say, "I don't hack. That's whack."
Tiger team.
Anyone else see visions of the football team, glee club and chess team in an ad-hoc alliance, beating the living shit out of the "tiger team"?
I don't need no instructions to know how to rock!!!!
I'm curious where they get their teachers. In order to make this program worthwhile (IE - the kids learn something about security), you would need someone with some significant experience and knowledge.
I know that I was in high school a few years ago, the head netadmin/sysadmin was worse than pitiful, a MS Certification only type of person. The only systems he ever hacked into were those in a computer game. Granted, I did go to private HS, and IT was not at the top of their budget priorities.
Regardless, it brings up a good point of having competent people teaching these types of classes, and how difficult it is for schools feeling the budget crunch to find competency.
If it's their own code, yes. What these kids are being trained to do is find holes in other peoples' code, so a company can fix the insecurities.
There's a good reason people are getting paid $90,000 a year to hack into computers of big companies, despite your scepticism.
Chemistry classes teach kids how to make explosive materials, physics classes teach the physics of crushing someone's head in with a bowling ball. No court would find them responsible, unless the teacher was encouraging activity.
From what the article says, he's strongly encouraging ethical behavior. Personally, I wish I had something like this in high school.
In a really simple contrived world maybe.
Explaining a buffer overflow and actaully programming one are two different things. And programming an expliot for one drives the idea home even better.
I'm not saying that they should be trying to hack nsa.gov or something. However, when you actaully have a chance to play with a virus or recent exploit in a controlled environment you will get a better understanding.
That is why folks honeypot and such. They can actually figure out what are the techniques used in the wild and how to defeat those techniques.
Norris/Palin 2012
Fact: We deserve leaders who can kick your ass and field dress your carcass.
Most people don't care about theoreticals. They care about what they can see and what affects them. If you show them their page in Lynx and Mozilla and Opera, perhaps they will understand the need for standardization. If you show them that no one else can compile their program, they might start writing standardized code.
The point is, people aren't going to understand that they have hackable systems unless you hack them and say, "Look what I found!" By proving the flaws in their systems you inspire them to fix them, creating secure systems.
Like they say, there's no teacher like bad experience.