Slashdot Mirror
A Peek At Script Kiddie Culture
Brian Bruns writes "NewsForge is covering an article on the Script Kiddie Culture, in an interview with my co-admin Andrew Kirch. It provides insight into a culture that not many people fully understand, or get to see."
From an admin's perspective, a DDoS is the scariest attack of all. There's nothing you can do to prevent it, and nothing you can do to stop it.
An admin whose network is being DDoSed really doesn't have much hope of doing anything. Their inbound communication line to the outside world is being flooded with so much garbage information, the signals that they want to get over that line are simply drowned out. Incoming connections can't get a turn going down the pipe, so they time out. He's powerless, everything in his shop is nice and secure, but can't function without geting any useful requests. That poor admin can call his ISP... but there's really not much the ISP can do from their side of the line.
The real problem in a DDoS attack is not that the final victim's security has gone wrong, but the security of other computers elsewhere on the Internet have been compromised, and they've been turned into zombies contributing to the DDoS flood. The DDoS will not subside until nearly all those machines are all patched, but that's not something the victim's people can do. They have to wait for the Anti-Virus providers and software providers to knock down the flamethrowers that are all being shot in the same direction.
Any time you're relying on third parties who don't work for you to save your business, you're really up a creek and are throwing yourself on the mercy of the tech world. Hopefully they'll save you in time, because there's really not much you can do from your own datacenter.
Given that there are always a considerable number of individuals at this 'level of ignorance', and that they associate with one another on a regular basis, I would call it a culture. Just because this 'script kiddie level' is merely a stepping stone to greater understanding of technology does not mean it, as just a snapshot of one point in this progression, is not worthy of being a culture in and of itself. After all, like other cultures of this kind (gaming, geek, fratboy, whatever) there are new script kiddies joining and old script kiddies retiring from it each day.
Also, if you've ever associated with them, script kiddies have their own rules (mostly unspoken), trends, and even something of their own language. It may all be borne of ignorance and immaturity, but the same could be said about a number of other cultures/subcultures.
I thought the script kiddies were the ones that didn't do any more cracking than search/download/copy-and-paste?
The script kiddies we're talking about are those who are copy-and-pasting 0day hacks. A hack that the White Hats don't know about yet, and even most black hats don't know about yet. The big mysterious question: Just how did these kids get into the web-of-trust it takes to have this tool before the "good guys" do?
Afterall, the first "good guy" who gets this tool will hand it over to the white hat experts who will start the work on the patch that makes the hack worthless. So, the web of trust on these things has to be tight... so again, how do the new script kiddies get in the club?
I think it's mainly a result of the "generation gap".... You've got parents who know very little about their own computers, and their kids who are pretty comfortable getting around online with it.
I've known quite a few kids/teens who got into loads of mischief with their PC, despite having otherwise caring and pretty observant parents.
Their folks were just sucked into the idea that their kids spending a lot of time on the computer had to be a "good thing", since they were learning "useful skills" and "doing something more educational than sitting around, watching TV".
There are plenty of things to blame parents for, but this is probably not really one of them. If you're the parent of a kid who is of "above average intelligence" and generally seems to stay out of trouble (not doing drugs and partying all night long, etc. etc.), and you're not too computer literate yourself -- just how much are you supposed to do when he/she figures out how to DoS corporate networks with his/her newfound online buddies?
BGP is a little less fragile than that, but not by much.
A well setup core router will protect your network from most bad announcements from your downstream clients, but if one of your upstream providers gives you the right bad info because their router has been screwed with, you're out of luck until a real person figures it out and takes the link down.
Then of course, all the outgoing traffic for that link cascades over to your others.... and now that many people are blocking snmp due to Cisco vulnerabilities it gets a little harder to figure problems out.
And of course, much of the incoming traffic probably still sees the downed link as a valid ASN path, and since that's beyond your control... yeah, you can get screwed pretty easily by one router on an upstream provider's network that misbehaves in just the right ways.
Truthfully, most major ISPs' NOCs are pretty fast to respond to BGP screwups, but problems caused by a mistake vs. problems caused on purpose with a little forethought and topology knowledge are two different beasties...
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Bored children break stuff for the sheer hell of it. To seek deeper meaning here is to completely fail to understand bored children. Distract (and that's all you can do, merely distract) child A from breaking a thing, and child B will come along and break it while you're still busy with child A. There's nothing to see here. Move along.
we'd like to know what motivates black hats
You're presuming to use logic (or something similar) to understand a non-logical phenomenon. Don't work. Human emotion is a manifestly NONlinear function and additionally changes from one state to another with about the same level of predictabliity as the position and momentum of a particular subatomic particle. Fuggabouddit.
we'd like to find a way to get them to play on the white team
That way has already been found: Let them grow up. They'll get over it. Or at least most of them will. But you can never predict with certainty exactly which ones. And every year a new crop is growing.
Is it fascism yet?
Anywho...with that said here's my $.02:
I think that everyone posting above me has their own valid points which I shall paraphrase here.
1. We don't want money being thrown away to fight a battle that may or may not be won, if winning is even a real possibility.2. We can agree that the actions of these "script kiddies" is to some degree detrimental to business. Seeing as how s#it rolls down hill, it can also have an impact on us blue collar folks. I think it's accurate to say that the negative impact will grow and become more noticeable as time passes.
So, what kind of happy medium can be found amidst the viewpoints which say either "It's a waste of resources to fight." or "Something must be done."?
Should officials not try to trim the fat from current programs and then allocate the new resources to fight this growing problem? I'm responding here off the cuff so I sheepishly admit I don't have a prepared list of potential candidates for severence. But, therein lies my question; Where is the government and general law enforcement concentrating that is perhaps irrelevant.
I know plenty of people here can come up with a long list of things our government wastes money on. Furthermore I'll bet'cha we can get over half those involved in the discussion to agree to the slashing of this or that. What say ye pantheon of knowledge?
---
Every hour wounds. The last one kills.
It's easier to sell companys, government agentcys and cable modem users on using reasonable security precautions with half a million children running around with viruses and such looking to screw with anyone who gives them half a chance than it is to sell them on the notion that the 6 big bad nasty terrorist black hatters will crush them like a grape if they make the sligtest mistake.
People will assume they are safe from the big time terrorist dude becouse "I'm not a sereous target".
DDoS attacks against major targets use hacked cable modem users desktops.
Spammers use Worms to establish a spamming network.
ID theft resulting from the simplist of mistakes.
That stuff happening today.
When telling people how important security is:
With out script kiddies
"Why would anyone attack me?"
"Your system can be used as a launching point for all sorts of attacks"
"Yeah right."
It's hard for a person to picture how "they alone" could be be a target and they'd be right becouse they aren't alone. But the details sound like SiFi to most people and they tune you out.
With script kiddies.
"Why would anyone want to attack me?"
"Becouse your an easy target. Script kiddies need no other reason"
I don't actually exist.
They don't necessarily know what they're doing. Admittedly, when I was in highschool I tried to launch my own botnet. I was DoSed twice on unrelated conditions and got fed up. Plus I wanted to mess with my own friends' connections. After a little digging I found a binary for a botnet which I was able to hex edit and customize to create my botnet. At this time I was just learning C++ and later I found an open source trojan that had much more abilities already coded plus I could add my own. I knew nothing about the inner workings of the net, spoofing (which was hard on win9x machines), or very much C++ at all. One week summed up a nice botnet. At a very young age I discovered that people will run anything if you just plant enough binaries. I disguised it as things I myself would've been interested in: console emulators, porn (yes executable porn, youve seen this), and secuirty related software. I found out that some of my closest online friends has independetly and secretly built their own botnets. It seems like the best thing since well..the internet. To have so much power at a young age and EVERYONE was doing it. Soon I was confronted by a very intelligent person who talked me out of this shit, very nicely even though I was trying to infect him. I uninstalled the bots and shut down the channel. Now I know if I had kept going I would have had a lot of power that I shouldnt. I wasn't using exploits that affect hundreds of thousands of windows machines or any other fancy distribution methods. I just put my file on the net and let them come to me. Botnets are too easy to create and since bandwidth is cheap they will cause more problems. Something must be done to stop these kids without ruining their lives. I wanted to learn and destroy, but not without good reason to. Of course if someone will DDoS company sites and cause damage they should be punished but they should be stopped before this happens. They dont know what they are doing.