Get Paid To Crack?

John Klein writes "Corporate Technologies USA, Inc. is offering hackers $250US and up as part of the Hacker Wargame Research Project. Participants are given sufficient time to hack three primary goals on real Windows 2000 servers on an internet connected wargame network. The servers are updated with fairly current Windows patches, so this is not necessarily an easy task. The difficulty is part of the point. The Project is studying how hackers think, called cognitive research, in an effort to better understand how future IDSs might identify the target of an attack during it's early stages. The Project guarantees complete anonymity for those that want to participate without pay, or complete privacy protection to those that choose to get paid."

Comments

Wargame Servers

[sabNetwork]

Wargames are interesting, maybe even fun, but they shouldn't be used for cognitive research. You simply can't replicate the environment of a real corporate network.

Where is the poor tech support agent that I call to inform of the "new authentication procedures"? Where are the client boxes sending out cleartext FTP passwords over a compromised proxy server?

Seriously, this isn't a great way to study "cracker patterns". Most crackers aren't creative enough to gain access to a box that lacks the common weaknesses of a corporate server. It's easy to setup a server that no one is supposed to use, but the challenges (and weaknesses) come from the balance between security and usability.

I trust them implicitly

[godzillion]

From the FAQ:

Q4: How do I know you aren't working for the man?
A: We're not, we promise.

Future Build Weaknesses

[SolemnDragon]

So... let me get this straight. They're paying a bunch of people a pittance to hack a machine that isn't set up like the ones that hackers would usually break into.

And they think that this will reveal how hackers think.

So, what we end up with is a bunch of people getting paid a little bit of money to mess with statistics. How many are going to use obvious techniques, just to skew the results in a 'nobody thought of this so it must be safe from exploit' way?? How many are going to have a grand time hacking into their real system just for fun?

And for that matter, how many dumb wanna-bes are going to end up sharing their IP address with a company that might just duly record them, along with the name that they're writing the check out to, and hand it over to other investigators, saying, "Hey- these are the hackers who applied"?

I'm guessing that anyone who's willing to take the money but isn't up to a level where they can really accomplish anything is going to eventually get caught playing with someone else's network- i don't pay enough attention to hackers in the news, so i'm not up to speed on whether this constitutes admission of previous (potentially criminal) activity or not... but if the company has a list of people who registered to 'contribute,' to the effort, they could then give the list to anyone, right?

Somehow, the only way that this could look funnier to me is if they had to enter the system, install kazaalite, upload copyrighted music files to it, and make them available for download. At which point the RIAA would step in and prosecute, creating a net loss of approximately $14,750.00USD for the hacker.

Scenario two is the same, but they have to upload Gigli, and set it to play in a continuous loop until the machine explodes in a desperate move of self-preservation. (And the MPAA would be prosecuting.)

That is... if the hacker were dumb enough to give their real name and use their own (and static) IP address....

This won't work realistically.

[3Suns]

They have a firewall in which they will allow only one IP address at a time to make the attempt. Thus, you sign up for a set time period and they watch you as you hack away...

Interesting. Seeing as many security tripwire programs shut out an IP as soon as they get suspicious, I can't see how this would replicate a realistic programming environment. One of a cracker's most important tools is being able to attack from unexpected (spoofed or rerouted) IPs. To come from every direction, as it were.

This reminds me of a similar study on Unix use I was in, that studied how people navigate a directory tree in a Unix shell and find relevant files and information quickly. The catch? No pipes or multi-command lines. But pipes are how a knowledgeable Unix user does things - the system is built up around it. So basically, the artificial limitations of the study cripple the performance of the participants.