A Peek At Script Kiddie Culture

Brian Bruns writes "NewsForge is covering an article on the Script Kiddie Culture, in an interview with my co-admin Andrew Kirch. It provides insight into a culture that not many people fully understand, or get to see."

Comments

Just how do you stop a DDoS?

[LostCluster]

From an admin's perspective, a DDoS is the scariest attack of all. There's nothing you can do to prevent it, and nothing you can do to stop it.

An admin whose network is being DDoSed really doesn't have much hope of doing anything. Their inbound communication line to the outside world is being flooded with so much garbage information, the signals that they want to get over that line are simply drowned out. Incoming connections can't get a turn going down the pipe, so they time out. He's powerless, everything in his shop is nice and secure, but can't function without geting any useful requests. That poor admin can call his ISP... but there's really not much the ISP can do from their side of the line.

The real problem in a DDoS attack is not that the final victim's security has gone wrong, but the security of other computers elsewhere on the Internet have been compromised, and they've been turned into zombies contributing to the DDoS flood. The DDoS will not subside until nearly all those machines are all patched, but that's not something the victim's people can do. They have to wait for the Anti-Virus providers and software providers to knock down the flamethrowers that are all being shot in the same direction.

Any time you're relying on third parties who don't work for you to save your business, you're really up a creek and are throwing yourself on the mercy of the tech world. Hopefully they'll save you in time, because there's really not much you can do from your own datacenter.

Re:Just how do you stop a DDoS?

[0racle]

I just don't see how a DDoS that does nothing except bog down your network connection, usually just to the outside world if you actually earned that job, is the scariest.

It slows things down, to a crawl or a dead stop, its irritating, and all you can do is sit it out, but in the end, what did it really do, again from the admins perspective? Nothing, it didn't do anything. You don't now have to worry about machines being used as zombies or otherwise compromised and there's next to no cleanup. And as for the there's no hope till the AV companies update scanners, I don't really recall MS's net admins running around and crying when MyDoom.whatever was supposed to flatten their network.

There may be monetary implications in a DDoS, but from an admins perspective, there's nothing to do, and nothing to worry about.

Re:How is this a 'culture'?

[Anonymous Coward]

Given that there are always a considerable number of individuals at this 'level of ignorance', and that they associate with one another on a regular basis, I would call it a culture. Just because this 'script kiddie level' is merely a stepping stone to greater understanding of technology does not mean it, as just a snapshot of one point in this progression, is not worthy of being a culture in and of itself. After all, like other cultures of this kind (gaming, geek, fratboy, whatever) there are new script kiddies joining and old script kiddies retiring from it each day.

Also, if you've ever associated with them, script kiddies have their own rules (mostly unspoken), trends, and even something of their own language. It may all be borne of ignorance and immaturity, but the same could be said about a number of other cultures/subcultures.

Innate Security of Windows vs Linux

[miyako]

I noticed that microsofts statment that (if|when) Linux gains as much popularity as Windows, we will find that it is not inherintly more secure because "Using Linux does not make you defacto smarter"
Reading this I knew that SOMEONE would bring it up, so I might as well be the first
I think that as linux sits right at this moment, it does make one smarting to be using it, simple because it requires the user to be more aware of their system. I do not see this changing in the near future either, not because of the technical inability of linux to emulate Windows automagic configuration, but because the people who write the software do not seem to want that (I know I don't).
So does this mean Linux is more secure by default? I would have said yes if you asked me a week ago, but this last weekend I was at a LAN party and installed Linux on several machines of friends who were interested in learning about it. What I saw made me realize that in the hands of an average (l)user, Linux can be LESS secure
The thing is, even after my lecure I still had people choosing root passwords like "poopoo" and "iforgotit". Not only that, after a brief tutorial on how to do basic system administration through YaST (I installed SuSE 9 on their boxen), I had at least 3 people go in and turn on every single network service that was offered. One of these people even set up his box as an anonymous FTP server with read and WRITE priviliges to the root directory!
At the same time I had another guy logging on to IRC as root and downloading files, while I was taking care of these machines someone else had already created a user account and given the user name and password out to several people in his AIM buddy list.
I'm the last person to say that we should include less software with a distrobution. I think the fact that most distorbutions contain a complete operating environment is a good thing, but with a little bit of knowledge these people had already made their system much much less secure than a windows box with the security updates applied would have been.
The whole point of that rant being (other than just getting that off my chest), as linux becomes more popular I can easily see scripts writen to take advantage of clueless linux users just the same as there are scripts to take advantage of clueless windows users.

Re:How is this a 'culture'?

[LostCluster]

I thought the script kiddies were the ones that didn't do any more cracking than search/download/copy-and-paste?

The script kiddies we're talking about are those who are copy-and-pasting 0day hacks. A hack that the White Hats don't know about yet, and even most black hats don't know about yet. The big mysterious question: Just how did these kids get into the web-of-trust it takes to have this tool before the "good guys" do?

Afterall, the first "good guy" who gets this tool will hand it over to the white hat experts who will start the work on the patch that makes the hack worthless. So, the web of trust on these things has to be tight... so again, how do the new script kiddies get in the club?

Re:How is this a 'culture'?

[digitalsushi]

but if use BGP in your work life, you can probably think of a few also)

I dont know how BGP works, but I heard that way back in the day, some dude at some ISP announced that he had a /0, or some such thing, and the entire net got routed to him, and subsequently, broken. And then they put in filters into BGP so that core routers could say "you're full of crap that's not your ASN". Is the BGP system still sketchy enough that the existing safeguards against taking down stuff as big as a country still exist? (granted a lot of countries probably have one internet connection going in, sadly)

Re:Society Problem

[King_TJ]

I think it's mainly a result of the "generation gap".... You've got parents who know very little about their own computers, and their kids who are pretty comfortable getting around online with it.

I've known quite a few kids/teens who got into loads of mischief with their PC, despite having otherwise caring and pretty observant parents.

Their folks were just sucked into the idea that their kids spending a lot of time on the computer had to be a "good thing", since they were learning "useful skills" and "doing something more educational than sitting around, watching TV".

There are plenty of things to blame parents for, but this is probably not really one of them. If you're the parent of a kid who is of "above average intelligence" and generally seems to stay out of trouble (not doing drugs and partying all night long, etc. etc.), and you're not too computer literate yourself -- just how much are you supposed to do when he/she figures out how to DoS corporate networks with his/her newfound online buddies?

Re:How is this a 'culture'?

[_Sharp'r_]

BGP is a little less fragile than that, but not by much.

A well setup core router will protect your network from most bad announcements from your downstream clients, but if one of your upstream providers gives you the right bad info because their router has been screwed with, you're out of luck until a real person figures it out and takes the link down.

Then of course, all the outgoing traffic for that link cascades over to your others.... and now that many people are blocking snmp due to Cisco vulnerabilities it gets a little harder to figure problems out.

And of course, much of the incoming traffic probably still sees the downed link as a valid ASN path, and since that's beyond your control... yeah, you can get screwed pretty easily by one router on an upstream provider's network that misbehaves in just the right ways.

Truthfully, most major ISPs' NOCs are pretty fast to respond to BGP screwups, but problems caused by a mistake vs. problems caused on purpose with a little forethought and topology knowledge are two different beasties...

Re:not many people fully understand, or get to see

[MMaestro]

The sad part is people SHOULD care. Everyone from Joe Average to Bob Businessman should take notice of this.

If Joe Average's cable modem bandwidth is getting sucked up by some kiddie script, he should care. Especially when his ISP sends him a warning letter saying hes using up too much bandwidth when the most graphic intense site he's visited that month is CNN.com.

Bob Businessman definately should care as well. That dedicated T3 line he uses at work is being used to get information to his consumers. If the site starts to get slow due to a worm causing him to download hundreds of gigs of pr0n, not only will his consumers get angry but his employees may suffer in effeciency...

Re:How is this a 'culture'?

[DoraLives]

if we can find a way to take away their motivations, we'll have less hassles to do with on our networks.

Bored children break stuff for the sheer hell of it. To seek deeper meaning here is to completely fail to understand bored children. Distract (and that's all you can do, merely distract) child A from breaking a thing, and child B will come along and break it while you're still busy with child A. There's nothing to see here. Move along.

we'd like to know what motivates black hats

You're presuming to use logic (or something similar) to understand a non-logical phenomenon. Don't work. Human emotion is a manifestly NONlinear function and additionally changes from one state to another with about the same level of predictabliity as the position and momentum of a particular subatomic particle. Fuggabouddit.

we'd like to find a way to get them to play on the white team

That way has already been found: Let them grow up. They'll get over it. Or at least most of them will. But you can never predict with certainty exactly which ones. And every year a new crop is growing.

Re:not many people fully understand, or get to see

[SurgeonGeneral]

The sad part is people SHOULD care. Everyone from Joe Average to Bob Businessman should take notice of this.

Are you kidding me?
I mean, I know we're all techies here, but lets break out of our shells for a second. This matters to people who make over 40k a year. Joe Average works in a factory and lets his kids use the internet for schooling. Do you think Joe Average, who was raised on libraries and encyclopedias, cares even for a second about whether his ISP goes down for 6 hours? Joe Average has to deal with bills, healthcare, school, drugs, gangs, crime, etc. etc. Joe Average needs tax dollars spent ensuring the welfare of our society, not the welfare of Bob Businessman's T3 lines so profit margins remain high.

Putting feds on the case of script kiddies is taking away from money and manpower that our society desperately needs. We need more concern over corporate accountability and less for corporate profits.

Let us bandy words, shall we?

[Squarepusher]

I won't pretend to be a real techie guy, you can go ahead and stick me in the "Joe Average" category. Although as a Mr. Average I do hang around /. a bit and so am aware of these kind of topics and concerns, which is more than (can I say most?) could say.

Anywho...with that said here's my $.02:

I think that everyone posting above me has their own valid points which I shall paraphrase here.

1. We don't want money being thrown away to fight a battle that may or may not be won, if winning is even a real possibility.

2. We can agree that the actions of these "script kiddies" is to some degree detrimental to business. Seeing as how s#it rolls down hill, it can also have an impact on us blue collar folks. I think it's accurate to say that the negative impact will grow and become more noticeable as time passes.

So, what kind of happy medium can be found amidst the viewpoints which say either "It's a waste of resources to fight." or "Something must be done."?

Should officials not try to trim the fat from current programs and then allocate the new resources to fight this growing problem? I'm responding here off the cuff so I sheepishly admit I don't have a prepared list of potential candidates for severence. But, therein lies my question; Where is the government and general law enforcement concentrating that is perhaps irrelevant.

I know plenty of people here can come up with a long list of things our government wastes money on. Furthermore I'll bet'cha we can get over half those involved in the discussion to agree to the slashing of this or that. What say ye pantheon of knowledge?

---

nothing new

[Cheeze]

I remember being in a friend's dorm room about 8 years ago and watching him show me how he floods people off of irc with a CTCP flood. This was the beginning of the DoSnets. His bot was linked up to about 400 others that would all send commands to a specific user at once. I can only imagine the technology change in the last 8 years. From the sounds of it though, it's the same old crap, just using different protocols.

I also remember when winnuke came out. It was nearly impossible to use the internet for about 6 weeks, until microsoft got a patch out. I put a linux machine up as a firewall and logged all of the attempts. It was like people were just winnuking all of the available ip space. After winnuke, it was teardrop, then smurf. I'd never seen a windows machine crash so fast.

ahh...the good old days. I'm suprised this is just now getting attention. It was no big deal when single computers would crash all over the internet, but when CNN.com or AOL.com gets attacked, it's a big deal all of the sudden.

Better term: Cyber Punk

[BrianMarshall]

Isn't 'cyber punk' pretty much what we are talking about here? Someone with some actual power and 'street smarts', but still, essentially, a punk?

(Not to be confused with 'punk rock', the style of music that embraces the point of view: "This is shit, everything is shit, life is shit, you are shit, I am shit".)

Hm. Kinda like school yard bullies, but. . .

[Fantastic Lad]

their asinine activities can affect huge corporations and the world at large.

Interesting!

Until now, the idiocy of the school yard jerk was something you had to put up with when you were a kid, but thankfully left behind when you graduated. But now juvenile crap overflows into the 'real' world, and can affect even the most insulated ivory tower type. Is this the first time?

I remember bullies and morons in school. The 'play'ground held a unique undercurrent of threat and horror for me as a kid. Going to school included genuinely believing that every day there was the possibility that you might be tortured and murdered by some half-wit big kid with a cruel streak, and that the safe world of adult supervision was unaware of most of the hells being perpetrated. Being a kid was a horror in many ways.

So what can be done about the skript-kiddie 'threat'?

Zip. Let the adult world suffer, I say. Think of it as payment for forcing kids through such a horrific 'education' system. There are only two other institutions which are so similar in structure and ideology, and they are the military and the penal system. School sucks, and aside from the handful of friends I made there, I hated nearly every aspect of it. The most valuable lessons I learned were how to survive it. Little else was of much use except shop class, typing class, art class and any time where there happened to be one of those very rare adults who inspired. You know the ones I mean. The good teachers who somehow defied the system and taught you valuable lessons in the face of all the state-ordained mind control. (Learn how to Obey and be Bored out of your mind doing repetetive tasks. A robot factory cranking out Perfect Workers.)

I also think it's neat that the Skript Kiddies are the geek version of 'Moe' type bullies. There's an ironic balancing in effect there somehow. . .

-FL

Yes

[Felinoid]

It's easier to sell companys, government agentcys and cable modem users on using reasonable security precautions with half a million children running around with viruses and such looking to screw with anyone who gives them half a chance than it is to sell them on the notion that the 6 big bad nasty terrorist black hatters will crush them like a grape if they make the sligtest mistake.

People will assume they are safe from the big time terrorist dude becouse "I'm not a sereous target".
DDoS attacks against major targets use hacked cable modem users desktops.
Spammers use Worms to establish a spamming network.
ID theft resulting from the simplist of mistakes.

That stuff happening today.

When telling people how important security is:
With out script kiddies
"Why would anyone attack me?"
"Your system can be used as a launching point for all sorts of attacks"
"Yeah right."
It's hard for a person to picture how "they alone" could be be a target and they'd be right becouse they aren't alone. But the details sound like SiFi to most people and they tune you out.

With script kiddies.
"Why would anyone want to attack me?"
"Becouse your an easy target. Script kiddies need no other reason"

Re:How is this a 'culture'?

[Anonymous Coward]

The ones the article is talking about are still script kiddies-the 0day ones are only highly skilled in building social networks. In the vast majority of cases the original source of the vulnerability "accidentally" leaks it to some random but well-known "ub3r l33t" script kiddie who is guaranteed to use and spread the crack in a predictable manner, but who isn't able to trace the original author. The 0day inner circle is simply an informal distribution network, and that's exactly what the "script" part means. That's not to say they're dumb-staying in the inner circle takes good social engineering skills that very few script kiddies have.

Re:How is this a 'culture'?

[Anonymous Coward]

They don't necessarily know what they're doing. Admittedly, when I was in highschool I tried to launch my own botnet. I was DoSed twice on unrelated conditions and got fed up. Plus I wanted to mess with my own friends' connections. After a little digging I found a binary for a botnet which I was able to hex edit and customize to create my botnet. At this time I was just learning C++ and later I found an open source trojan that had much more abilities already coded plus I could add my own. I knew nothing about the inner workings of the net, spoofing (which was hard on win9x machines), or very much C++ at all. One week summed up a nice botnet. At a very young age I discovered that people will run anything if you just plant enough binaries. I disguised it as things I myself would've been interested in: console emulators, porn (yes executable porn, youve seen this), and secuirty related software. I found out that some of my closest online friends has independetly and secretly built their own botnets. It seems like the best thing since well..the internet. To have so much power at a young age and EVERYONE was doing it. Soon I was confronted by a very intelligent person who talked me out of this shit, very nicely even though I was trying to infect him. I uninstalled the bots and shut down the channel. Now I know if I had kept going I would have had a lot of power that I shouldnt. I wasn't using exploits that affect hundreds of thousands of windows machines or any other fancy distribution methods. I just put my file on the net and let them come to me. Botnets are too easy to create and since bandwidth is cheap they will cause more problems. Something must be done to stop these kids without ruining their lives. I wanted to learn and destroy, but not without good reason to. Of course if someone will DDoS company sites and cause damage they should be punished but they should be stopped before this happens. They dont know what they are doing.

Re:How is this a 'culture'?

[golgotha007]

i ran a bbs in the early 80's and was part of the 'scene'. yes, i had a message subboard called 'ELITE' where we would all post our MCI and Sprint codes and intesteresting phone numbers.

most of us then were total geeks that either couldn't hold his own at a jock party or was too nervous around girls. the one thing that we did have was power when it comes to telecommunications. and that power, because it wasn't to be enjoyed outside the computer, made us all arrogant little assholes.

i see nothing has changed.

of course, then we didn't call them script kiddies (which i find appropriate), we called them 'kidhacks'.

Re:How is this a 'culture'?

[Build6]

mean, I could think of a 1/2 dozen ways to wipe out a whole country's internet access completely for a day or two (no, I'm not going into details here, but if use BGP in your work life, you can probably think of a few also

There's a difference between doing something, and doing something and not getting caught. Are your ideas the kind that will end up you being in a federal prison (i.e. quite pointless) or the kind where you cannot get traced (i.e. you are then in fact quite dangerous)?

there's a difference between going to the bank with a shotgun and getting a lot of money, right before being either shot dead or hauled off to prison, and figuring out some way to siphon off bank funds into your account in a way where nobody ever detects it (or only does long after you're gone).

Re:addendum to topic paragraph

[Solosoft]

EFnet used to be alot like that. I stoppped hanging around that area after I kept getting hit. But EFnet is like a "city". You enter the wrong area "bad neighbourhood" your going to get in trouble. I used to hang out in those areas. Never did anything bad but just knew some people and ended up in those channels.
Most of the time, I noticed it's VERY young kids with a DDoS net but most of the time it's not their DDoS net. Also, if you "buddy buddy" with them they will show you the net to brag and show how cool they are. Them being stupid would DDoS me sometimes and I would log the packets. Of course to see if it would effect me (which my server was WAY too slow at the time to handle any of that DDoS the most I would see come in is like 50k/s so they couldn't take my line just bog my computer to a bitch. While I was logging I would simply find there address in there and match it with the IRC txt and send it into there ISP. Most of the time they would come back a few days later complaining there ISP sent them a warning. It was actually kinda funny. "What you mean I can get into trouble for this".

Anywho my Opinion on Script kiddies