School Teaches 'Ethical Hacking'

Yardboy writes "A Yahoo! News/Reuters story discusses students in Los Angeles paying $4,000 to attend 'Hacker College' and become 'Certified Ethical Hackers'. Apparently: 'Instructors race through topics like symmetric versus asymmetric key cryptography (symmetric is faster), war dialing (hackers will always call late at night) and well-known TCP ports and services (be wary of any activity on Port 0)', and the president of the college: says 'What we attempt to do in our classes is teach how the hackers think.' Hmmm, perhaps 'Certified Script Kiddie' would be a more accurate designation."

Comments

Gasp!

[Anonymous Coward]

Better watch out, article submitter! Me and my friends are totally gonna DDOS you now!!!!

Re:Gasp!

[Yardboy]

My most humble and abject, heartfelt apologies. yb.

[cynical]

[Maradine]

And I think I speak for all the CISSPs in the room when I say . . .

hahahahahaha!

Thanks, I'll take self-study and put the four grand down on an M3. Sellout? You betcha. *grin*

Re:[cynical]

[Sielle]

Out of the 5 people I personally know that have taken classes like this, 4 of them have continued on to go after their GIAC/CISSP certifications. If a class like this gets people started, I'm all for it. I just worry about the people that think something like this is all they need.

Re:[cynical]

[Maradine]

[/cynical]

Education is extremely important in this segment, no doubt. What concerns me is the "boot camp" format of these particular gigs, as well as the entry fee.

$4000 is an awful lot of money for a Common Body of Knowledge -- especially since its all available from the Internet.

I have nothing but encouragement for those who wish to enter the field. But save your money. Hell, drop sixty bucks and go to defcon.

Re:[cynical]

[bitcore]

4 grand? Dont you mean 40 grand for an M3?

Re:[cynical]

[Anonymous Coward]

And I think I speak for all the CISSPs in the room when I say . . .

Pot meet kettle?

Re:[cynical]

[upside]

My take on courses is: yes, you can learn the same stuff if you take the time. However, your boss is unlikely to give you time during work hours to study. When the employer has to pay muchos buckos for it he gets a warm fuzzy feeling that you are doing something worthwhile.

Re:[cynical]

[Anonymous Coward]

Dude, DefCon is 80 now, bend over and cough ;p

--

Re:[cynical]

[lukewarmfusion]

99% of the stuff I learned in a college classroom was available on the Internet. Putting it together right demands something more than just a Google search.

Other things I got from college:
Credibility
A class ring
Life experience (studied abroad, lived in a dorm)
Friends
Relationships with professors - having connections with people in your field is a good thing

I went to a school that runs around $30,000/year. It was worth every penny.

Re:[cynical]

[Anonymous Coward]

$30,000 is an awful lot of money for a BSEE when all that information is available on the internet.

There is alot to be said about learning from someone that completely understands the subject.

that said, there are many instructors and professors that are wastes of space and only useful for generating carbon-dioxide. My 3rd year EE-digital profess was one. he had tenure and was going to retire in 24 months.. he did not give a rat's ass and taught us nothing other than how worthless some professors become at the end of their useful life.

Re:[cynical]

[Anonymous Coward]

Dude, universities routinely charge criminally insane amounts of money to 'teach' stuff that is commonly available in LIBRARIES. So what's the difference?

Re:[cynical]

[1lus10n]

Things I have gotten from Working since I was 18:

Credibility, people KNOW I can do this for a living. They dont have to worry about weather I can actually do the work.
Several awards from my employer.
Real Life experience.
Friends
Proffesional contacts. Tons and Tons of them.

And I dont have 60k in debt, and wont be paying off school bills for the rest of my life. I have enough experience to walk into higher level jobs and skip the "entry" level BS.

Life is not lived on a Piece of paper that was givin to you by some organisation that is known as a "school".

Re:[cynical]

[matt2004]

The difference is that you typically can't even figure out where to begin. True, most stuff is publicly available, but there aren't a lot of "Newbie FAQs" out there, because, let's face it, nobody wants to take the time to write one. Unless we were paid for it. But then we'd be teachers......probably at a university.

Re:[cynical]

[Anonymous Coward]

But you didn't learn the difference between weather and whether.

Re:[cynical]

[Anonymous Coward]

So his typo made his whole post of no worth? Keep grasping for strings you sad little idiot.

Coward wrote: But you didn't learn the difference between weather and whether.

Re:[cynical]

[admdrew]

College can more useful in opening doors than it is as a tome of information. As you said, you may have learned quite a bit from your on the job training, are in contact with numerous people in your field, and do not suffer the financial hardships of a recent college graduate. Unfortunately you may have a hard time competing with those who have a higher education background, especially if they've worked while going to school (like many of us do).

[A potential employer does not] have to worry about weather [sic] I can actually do the work.

Graduating from college with very good grades requires a lot of work, something any employer knows. If an applicant finishes with a 4.0 GPA, it can be safely assumed that they can "actually do the work."

What you say is a little alarming; your assumption that college is entirely worthless when compared to a high school job is entirely unfounded.

Oh, and before you apply anywhere in the future, work on that spelling and grammar ;)

Re:[cynical]

[heybo]

You forgot Student Loan Payments

Re:[cynical]

[Anonymous Coward]

A class ring? Zowie!! Chick magnet, eh?

Re:[cynical]

[Anonymous Coward]

Oh, and before you apply anywhere in the future, work on that spelling and grammar ;)

College can more useful...

Hello, Kettle? This is pot. You're black.

Re:[cynical]

[lukewarmfusion]

I had a nice situation where I don't have any student loan payments (and I'm only two years out).

Though your point is a good one.

Re:[cynical]

[admdrew]

College can more useful...

^be

:-P

Re:[cynical]

[poofyhairguy82]

If the parent poster was trying to say anything, its that college was worth it for more than "getting a job." Not everyone looks only at opportunities that will make them more money.

Some people (like myself) go to college to learn and grow as a person.

Once you have a degree, a college education is something that can never be taken from you.

Re:[cynical]

[servognome]

Credibility, people KNOW I can do this for a living. They dont have to worry about weather I can actually do the work.
What a college degree gives you though is more flexibility. You have proven you can do a particular job and do it well, but it is much more difficult for you to find a job that might require things outside your current skillset. A college degree shows employers you are able to expand your knowledge outside your core competency.
Several awards from my employer.
In college you can get your name on publications, get rewards from companies in the form of scholarships, and research grants (and companies do keep in mind who they gave money to when they are hiring)
Real Life experience.
You can also get alot of experience in school if you're willing to put in the time. You have 16-20 hours a week of class, which leaves you plenty of time for hands on activities like helping grad students with research, taking a job running one of the campus networks, getting involved in a technical club (like solar powered car), etc.
Friends
You can get those in college too, and there are more women ;)
Proffesional contacts. Tons and Tons of them.
You can get an excellent network in college, internships, co-ops (definately a foot in the door), contacts in companies who donate to your research, and alumni
And I dont have 60k in debt, and wont be paying off school bills for the rest of my life
Yes it is true :(

Re:[cynical]

[Anonymous Coward]

Here are some reasons why should have attended a "school":

don't vs dont
whether vs weather
won't vs wont
giving vs givin

well... you can figure you the rest; or can you? :)

Re:[cynical]

[bluethundr]

4 grand? Dont you mean 40 grand for an M3?

4G is probably the down payment one would need to get the monthly down to between $3-400 a month.

Re:[cynical]

[Anonymous Coward]

worry about whether I can actually do the work.

Professional contacts

by some organization that is known

...it's fairly obvious you haven't had much schooling you illiterate halfwit...

Re:[cynical]

[Anonymous Coward]

Don't get too cocky just yet - it all averages out in the end. You'll find your jobs cap out somewhere towards the intermediate/upper end eventually when you will completely surpassed by those who have the same experience as you, plus degrees.

Re:[cynical]

[1lus10n]

Doing research is a wonderful thing, however its not very likely that he is going to be getting a job doing that full time after school. College is spiffy for people who need to "broaden" the way they think.

A college degree proves that you were attentive enough to pass some tests and do assignments, not that you can drudge through the daily grind of a job. Most certainly it does not tell someone that you can learn anymore efficiently than a person who doesn't have a degree.

Re:[cynical]

[1lus10n]

Unfortunately you may have a hard time competing with those who have a higher education background

Any place that would value "practice" over real world competency is not a place I would choose to work. Last time I checked most schools didn't offer a wide variety of classes dealing with real world situations or software, rather they cater to .com types who need to use WYSIWYG tools for admining a server or developing a program.

Graduating from college with very good grades requires a lot of work, something any employer knows. If an applicant finishes with a 4.0 GPA, it can be safely assumed that they can "actually do the work."

Bullshit. Getting a degree requires work for sure, however so does building a house. Not exactly the same TYPE of work is it ? A degree does not guarantee competency or the ability to work 80/hr weeks because of layoffs, it doesn't guarantee anything other than the fact that the person is willing to learn and tests well. In most work places there are not enough people to babysit the new guy or to explain things with great detail like a teacher would. There also usually is not enough documentation on procedures and internal software you will sooner or later have to munge your way through it. A ton of college grads I have dealt with and trained were completely lost in this respect.

What you say is a little alarming; your assumption that college is entirely worthless when compared to a high school job is entirely unfounded.

When the hell did I say anything about a high school job ? Most people these days graduate from HS at 17 or 18 do they not ?

Oh, and before you apply anywhere in the future, work on that spelling and grammar

I suppose if I was writing a term paper I might give a damn. ;-)

Re:[cynical]

[Anonymous Coward]

Things you didn't learn from working since 18:

#1. Spelling.

weather -> whether
Proffesional -> professional
givin -> given

I suppose you could use more "school".

Re:[cynical]

[Anonymous Coward]

Here are some reasons why should have attended a "school":

Apparently, you were asleep on the day they discussed pronouns.

I believe you wanted some sort of word like "he" or "you" between "why" and "should".

You better make sure your grammar and spelling are absofuckingloutely correct if you're gonna be a Grammar Nazi nit-picker.

"Next time try the preview button"

Re:[cynical]

[servognome]

A college degree proves that you were attentive enough to pass some tests and do assignments, not that you can drudge through the daily grind of a job.
Work is pretty much the same, you are given assignments, you complete assignments. All that having work experience shows is you've done enough to not get fired. And college can definately be a drudge, you don't get paid, you stay up late nights studying, and your diet consists of ramen and Dr. Pepper... perfect training for the real world.
Most certainly it does not tell someone that you can learn anymore efficiently than a person who doesn't have a degree.
If the job position never changes, then its no problem. But in a changing environment, having people who can quickly understand new concepts is important. A degree gives an employer an idea on your knowledge base and how well you learn. Somebody who hasn't completed college, could understand a new concept in 10 minutes or 10 years, but you have nothing to baseline against.

Re:[cynical]

[clymere]

I agree with the "foot in the door" thing.

I'm in college right now, and taking a class on Apache. My progessor is teaching a class full of us to run X-Windows in Linux as root. Because "its easier."

These people will be running your servers someday everyone. Clearly a college degree is no guarantee that you'll know what you're doing.

Re:[cynical]

[AvantLegion]

I suppose if I was writing a term paper I might give a damn. ;-)

This may come as a shock, but language rules were not invented just for "term papers".

Why some people feel proper English is optional, I will never know. More often than not, it's used to excuse a lack of English skills.

Mistakes happen. An attitude that it doesn't matter except for "term papers", however, shouldn't.

Re:[cynical]

[1lus10n]

Really ? cause last time I checked most employers didn't exactly have a complete reference to how good each school is at teaching each discipline/course/field.

A Degree doesn't mean shite. How does U of Phoenix compare to a community college, how does a state school compare to private, large to small etc. Not all learning experiences or institutions are created equal.

Work is not like school, you cant put something off until the last minute, or try to maneuver yourself out of job requirement X because you kick ass at Y. Most employers (because they pay you) don't let things slide. you are going to do your job no matter what or your gone, no neat and fancy research project to replace a course etc ... And you don't get to select what you want to do. Unless of course sleeping under a bridge and not eating sounds fun to you.

If you think college is a drudge compared to real life work, just wait until you endure 5 years of cube hell without any major breaks. College at most (for the average student) is 9 months out of the year with some major vacations in the mix as well. Work ? Try to tell your boss you want to work ~9 months per year, see how well that goes over.

The only jobs I have ever heard of that have "assignments" are clerical positions and grunt work. Most jobs I have dealt with/had/heard of don't have someone hovering over you, no grades, no parents, usually not to much of a boss either. Its assumed you know what your supposed to be doing and are doing it, most employers don't want to run romper-room or pay management to babysit.

Some people walk out of college knowing enough to handle an average computer job. However its becoming increasingly uncommon to see this, has a matter of fact I think the blatant incompetency of most college grads (and the poor curriculum at most schools) is fueling the whole "off shoring" craze.

Re:[cynical]

[1lus10n]

Right. Pull the stick out of your ass.

We are all guilty of fucking shit up sometimes. Syntax checking was invented in programming languages for a reason, however it is also assumed that you will fuck up sooner or later. Hence many things have syntax checking built in.

Not my fault /. doesnt have a spell checker.

And just who gets to define "proper" english ? You ? MW.com ? My old english teacher ? Your god ? Language came from somewhere, that means sooner or later it will be adjusted by individuals or society as a whole, deal_with_it. Doesnt mean its right or wrong, but it sure as hell isnt stopping.

Re:[cynical]

[admdrew]

Last time I checked most schools didn't offer a wide variety of classes dealing with real world situations or software, rather they cater to .com types who need to use WYSIWYG tools for admining a server or developing a program.

In the years of CS and ECE courses I've taken, I have never yet used WYSIWYG editors (hell, most of us don't even use IDEs). I'd like to know what college courses you're referring to and how much time you spent in each one to be able to generalize their material so well.

Getting a degree requires work for sure, however so does building a house. Not exactly the same TYPE of work is it?

You're exactly right! However, programming in an academic environment is a lot closer to real world programming than construction is (I've done all three, by the way). Besides, I was talking about work ethic; people who work hard in school won't necessarily know everything when they go out in the real world, but they'll be more inclined to work hard than a lot of other people.

In most work places there are not enough people to babysit the new guy or to explain things with great detail like a teacher.

You're right and wrong here, IMHO. While it's certainly not worth a company to babysit someone, as you said, many times the new person has more difficulty adjusting to the new work environment than they do to the 'real world.' Let's say you had been using C++ at your last job and I was using C++ in my last course. We were then hired by the same firm to program in Java. We would both have to adjust to a new language, new people, a new place to work.

A ton of college grads I have dealt with and trained were completely lost in this respect.

...and I'm sure you know exactly what was going on your first day of work, didn't you? Education or not, the first day on a job is still the first day.

When the hell did I say anything about a high school job?

Heh, that was a little twisting of your words for my benefit. I was referring to your comment that you had been working since you were 18 (an age where many people are still in school). I'd consider a 'high school job' one that you could easily get without a GED or high school diploma.

I suppose if I was writing a term paper I might give a damn.

Being a computer engineering major, I haven't had to write many papers at all. In fact, most of the writing I do is job related: project proposals, e-mail correspondence to my co-workers and clients, and memos that are read by my bosses. I'm expected to be professional when I write; instead of losing grading points like in school, my credibility suffers when I'm not able to converse well (something that I think you'd agree is a bit more important).

I have quite a bit of respect for those who go out into the world and succeed without a college degree (or any college at all). It just bothers me when others claim that I'm wasting my time and money on college. If you had a little more respect for higher education, I'd be more inclined take your opinion seriously.

Re:[cynical]

[admdrew]

And just who gets to define "proper" english [sic]?

And who, exactly, defines what being respectful or polite is? I'd say it's definitely an aspect of the society you're in. It does change, as you alluded to, but the comments people are making show that your writing doesn't reflect what most people deem as proper English.

Re:[cynical]

[thedillybar]

A degree does not guarantee competency or the ability to work 80/hr weeks

Your damn right it doesn't guarantee the ability to work 80/hr weeks. In fact, it probably says "this person isn't willing to work 80/hr weeks." Who in their right mind would, if you could get a job working 40 hr/wk?

Re:[cynical]

[thedillybar]

Meant to hit preview...

Your => You're

Re:[cynical]

[admdrew]

Cause [sic] last time I checked most employers didn't exactly have a complete reference to [sic] how good each school is at teaching each discipline/course/field.

No, but they have a pretty good idea of what institutions are credible.

A Degree doesn't mean shite [sic]. How does U of Phoenix compare to a community college, how does a state school compare to private, large to small etc. Not all learning experiences or institutions are created equal.

You're absolutely right; that's why employers can (and do) place more importance on degrees from some schools than they do on degrees from others. The quality isn't just institution specific either; majoring in underwater basket weaving probably won't have as much gusto as an engineering degree.

Work is not like school, you cant [sic] put something off until the last minute, or try to maneuver yourself out of job requirement X because you kick ass at Y. Most employers (because they pay you) don't let things slide.

Procrastination may work in high school, but it rarely does as you go through college (especially if you hope to do well). Also, I've never had a professor or TA that just "let things slide." For people with circumstances beyond their control exceptions can be made... something a good employer would do as well.

You are going to do your job no matter what or your [sic] gone, no neat and fancy research project to replace a course etc ... And you don't get to select what you want to do.

If you don't do your job in school, you fail. You may get more chances to stay in school, but it can be very difficult to get your GPA back up after slacking off. Also, very few of my courses have been electives; most are required by my major. Sure, I get to choose at what times I get to take them, but I also get to decide when I get to work on certain projects for work.

If you think college is a drudge compared to real life work, just wait until you endure 5 years of cube hell without any major breaks.

Neither is easy, and I know that the real world is just that: real. However, college is not a replacement; you still must enter the world after graduating.

College at most (for the average student) is 9 months out of the year with some major vacations in the mix as well. Work ? Try to tell your boss you want to work ~9 months per year, see how well that goes over.

It's September through May every year at a minimum for average students, and is year round for the many people that take summer courses. Factor in a part-time job, and you've got work weeks of 40 - 50 hours, plus time for studying and homework. Oh, and I'm assuming you get paid at your job year round, something that no student gets for their schooling.

The only jobs I have ever heard of that have "assignments" are clerical positions and grunt work.

I'd call development projects the equivalent of assignments. It's just a term.

Most jobs I have dealt with/had/heard of don't have someone hovering over you, no grades, no parents, usually not to much of a boss either. Its [sic] assumed you know what your supposed to be doing and are doing it, most employers don't want to run romper-room or pay management to babysit.

You're describing college almost perfectly; my professors, peers, and parents do not fawn over me to make sure I do work. In fact, most professors don't care if you slack off; try finding a boss with that same attitude. People with little or no work ethic in college are the ones that have a difficult time.

Some people walk out of college knowing enough to handle an average computer job. However its [sic] becoming increasingly uncommon to see this...

Re:[cynical]

[servognome]

I have been living in cube hell for the past 4 years since I graduated. There are parts that are more difficult, and some that are easier than school.
College isn't like high school, there is nobody looking over your shoulder, just like your job. Mom & Dad are hundreds of miles away, and professors could care less what you do. If you don't learn to organize and manage yourself, you end up flunking or dropping out (25% of students) and many who do graduate had to learn the hard way after suffering bad grades their first 2 years. You think they let things slide in college? I've had a professor give me a 0 on a test because I was in the hospital. They don't care about you, neither does anybody else in school. In work you can have somebody cover a presentation for you, and the project managers don't care, they just care about the info; in school you have no help.
"Assignments" in college are different than in highschool also. For engineering you are expected to design things. You are given the "Assignment" like design a golf putter, or wake board. You then have to put together from different classes, and different experiences mechanical designs, and material sets to solve the problem. Then you actually go through the process of building, and compete against other teams. My job "assignments" are similar, design a process to do X within certain parameters.
Many employers actually do evaluate colleges. They rank the schools, and recruit more heavily at places like MIT, Ga Tech, Berkely, and UIC. After the slots are filled from those candidate pools, then the few positions left go to the next level schools like Michigan, Florida, UCSD. Yes not all college experience is the same, and the employers take that into account.
The problem I run into with alot of people who are strictly experienced, is they have a very focused skill set. If I want to hire somebody to just do database stuff, sure its good to hire an experienced database person. But If I need them to do database and maybe some USB driver work on a different project, alot of pure experienced people can't handle such different work.

Re:[cynical]

[Anonymous Coward]

Which exams are better to take. I plan on getting my MCSE and possibly my CCNA? If I wanted to go into security do you know what employers look for mostly? GIAC/CISSP? Which one? Thanks, Ryan

Re:[cynical]

[yo5oy]

umm, don't know if you know this, but college is typically four years in duration. so that debt would be more like 120,000.

Re:[cynical]

[Anonymous Coward]

Was spelling one of the things that you learned from Real Life. Correct spelling is one of the things that people learn in school and value. Use a dictionary please.

Re:[cynical]

[Anonymous Coward]

Was spelling one of the things that you learned from Real Life.[sic] Correct spelling is one of the things that people learn in school and value. Use a dictionary please.

Questions end with question marks.

Re:[cynical]

[1lus10n]

Agreement is fun.

If you had a little less regard for a glorified piece of paper then I might take you a little more seriously. As it stands we are going to agree to disagree.

Re:[cynical]

[1lus10n]

Welcome to the computer industry. Most of the decent jobs are in india or will be soon, so unless that degree is in hindi you had better prepare for some "unwanted" adjustments.

Especially since the average american works 50/hr weeks and the average techie works close to 60/hr weeks.

Re:[cynical]

[1lus10n]

The problem I run into with alot of people who are strictly experienced, is they have a very focused skill set. If I want to hire somebody to just do database stuff, sure its good to hire an experienced database person. But If I need them to do database and maybe some USB driver work on a different project, alot of pure experienced people can't handle such different work.

Thats funny but in my experience its the EXACT opposite, the college grads have to be hand held through learning the new stuff and the people with experience can figure it out themselves.

Many employers actually do evaluate colleges.

Many Large employers do, most employment in this sector, and this country in general does not take place at large companies. You are far more likely to be hired by a mid-sized company that cannot afford to hire "recruiters" or scout college's.

My job "assignments" are similar, design a process to do X within certain parameters.

Indeed, however there wont be more chances to compensate for a pure fuck up. With a job, your fired. With school you are at least given the oppourtunity to re-take the course, or do really well the rest of the semester to compensate.

in school you have no help.

You went to a bad school.

Re:[cynical]

[admdrew]

If you had a little less regard for a glorified piece of paper then I might take you a little more seriously.

Respect begets respect, my friend. I have a profound admiration for those who are successful in your situation, but the way you ridicule those who chose a different path is disturbing.

I have a high regard for what that piece of paper represents, not the physical object itself. I would assume you feel the same way about awards received from your employers.

Re:[cynical]

[1lus10n]

I was assuming that the person got some kind of break as far as a scholarship. And school can be any term from two to six years. Sometimes more or less it is as long as you want it to be (provided you wanna bust your ass, or drag it has the case may be)

Re:[cynical]

[Anonymous Coward]

Many employers actually do evaluate colleges.

Literally every hiring manager will notice a MIT, Stanford, CalTech, or Berkeley degree in the computer field (as they would a Yale or Harvard in politics).

A degree from one of those is very much noted over some random cert, or a degree from an average college - primarily because these guys pre-screened the candidates for the employer. At least you know "at least before all teh drugz in college he looked smart on paper".

It's the pre-screening that the big-name colleges offer. IMHO work experience, a list of certs, a degree from an average college that anyone can get in, are all pretty similar; in that they show interest in the field.

Re:[cynical]

[AvantLegion]

Right. Pull the stick out of your ass.

We are all guilty of fucking shit up sometimes. Syntax checking was invented in programming languages for a reason, however it is also assumed that you will fuck up sooner or later. Hence many things have syntax checking built in.

Not my fault /. doesnt have a spell checker.

Kids, this is why you go to college and get an actual education. Otherwise, this may happen to you.

Re:[cynical]

[1lus10n]

I would assume you feel the same way about awards received from your employers.

Nope. It is shit that some people need to validate themselves and feel accomplished. The only thing I respect is/are people who know what they are doing, know their limitations and have competency up to or beyond what is expected.

Re:[cynical]

[1lus10n]

Kids this is why you want to skip going to private school. First you get teased, then you get your ass kicked an finally you turn into one of those fucking losers who have no life and have to correct grammatical errors on websites.

Be careful, it could happen to YOU !

Re:[cynical]

[admdrew]

From your earlier post:

Things I have gotten from Working [sic] since I was 18:

...Several awards from my employer.

Funny you'd use that as a benefit to working (vs. going to school) when it "is shit that some people need to validate themselves and feel accomplished." Oh, wait, you did just that.

Re:[cynical]

[Anonymous Coward]

I forgive !you.

-anmnoyus unedcuated tlorl

dumb question

[Anonymous Coward]

what operates on port zero?

Not New

[Doesn't_Comment_Code]

The name of the certificate is new, but the concepts are not novel.
We went through an entire class about computer ethics. We had to to get a Computer Science degree. And since it was an actual Computer Science degree, we learned all about security and machine language and what have you... basically everyting you would learn in this course.

This program seams like a stripped down version of computer science for people who are only interested in security related work.

Re:Not New

[Anonymous Coward]

>This program seams like a stripped down version of computer science for people who are only interested in security related work.

I guess thats why it's called a Hacking class instead of Computer Science..

sry.. couldn't help myself =)

Re:Not New

[0racle]

You might be able to strip down a CS course if your only interested in Administering systems, but wouldn't someone who is interested in Security related work require at least more then a working knowledge of all of the different parts of what makes up a Networked system from design to implementation so they could actually understand how these parts are conspiring to create an insecure environment? Its going to be the MCSE's of security, secure on paper but leaving a lot to be desired.

Re:Not New

[RAMMS EIN]

All about machine language and security as mandatory part of the program?! Where did you get that degree? I want to go there too! Around here, universities teach you some high level language, how to comment your code, and writing a few apps and a few parsers.

You can do the real stuff, but it's all optional, giving me the feeling that I can as well kiss the university goodbye and study for myself - which is, in fact, how I learned everything I know about computers and programming. And I mean everything. The only reason I still attend university is that I want to get the diploma, but I'm not even sure how much people are going to care about that if you don't really need to have any deep knowledge and experience to get it.

Re:Not New

[Doesn't_Comment_Code]

Yeah, I was thinking of all the math that's involved in cryptography. And to really know what you're talking about, you should probably understand the guts of networking, tcp/ip and ethernet inside and out. You should know machine language pretty well too.

The most difficult part about security is that you aren't learning how something is supposed to act. That's the easy part. That's what every programmer does (and what I do mostly). But to really do security, you have to know what could happen and how something might work if manipulated. That's really, really hard when you think about all the possibilities!

I just can't imagine squeezing that all in to a short certificate class.

Re:Not New

[Anonymous Coward]

The only reason I still attend university is that I want to get the diploma...

Are you sure it's a university you're attending? Here's the difference: a university will give you a degree whereas a college will give you a diploma. Also, I don't mean to be rude but shouldn't you have investigated the kinds of programs offered by the different universities before choosing the one you did?

Re:Not New

[Doesn't_Comment_Code]

Where did you get that degree?

I went to Drake. They have one or two really good professors who teach you everything, and help when you want to learn something on your own. I hope those professors never leave!

I got thrown into assembly language my first semester of college. Boy was I in for a world of hurt! But I learned a of a lot in that world.

Re:Not New

[Zabu]

This program seams like a stripped down version of computer science for people who are only interested in security related work.

Doesn't this seem a bit odd to anyone else? I don't think a stripped down weekend warrior class for computer science is good for computer security.

Where is the Jolt machine?

Re:Not New

[Doesn't_Comment_Code]

In another post, I was conversing with someone about how difficult it would be to strip down an issue like security, since it depends so much on knowlege from related subjects. In that respect it does seem odd, and not as rigorous as one might hope.

Re:Not New

[stephanruby]

This program seams like a stripped down version of computer science for people who are only interested in security related work.

No, this program seems like a stripped down version of computer security for people who are only interested in the stupid media-prestige that the term "hacker" might bestow.

Re:Not New

[KevinKnSC]

Actually, the difference is that a degree is an academic title given to a student when they complete a course of study, while a diploma is a piece of paper signifying that the holder has earned a degree.

Example: I was awarded my degree at commencement, but I had to wait a few weeks for my diploma to arrive in the mail.

Re:Not New

[Anonymous Coward]

> 10 out of 10 Terrorists agree - Anybody but Bush in 2004

no, you've got that wrong. In real life 10/10 terrorists want MORE Bush -- it's what they feed off.

Re:Not New

[edrain]

A bit like those 'stripped down' flight classes that teach you how to fly a plane but not how to take off or land, no? :)

dumb answer

[JeanBaptiste]

ICMP

Re:dumb answer

[MadRocketScientist]

ICMP is not port 0, it is IP Protocol 1. TCP/UDP port 0 is officially "Reserved"

Re:dumb answer

[0x12d3]

When you send a packet from hping2 it defaults to port 0, unless you specify another. If I saw port 0 in my logs I'd certainly wonder.

Oh man...

[RegalBegal]

First day. 2day kidZ, w3 LeRN 2 HaX0R t3H g00d w^y...w00t. OMG. RTFB.

Re:Oh man...

[theJerk242]

Pr0f3x0r, W|-|3n w177 w3 L3@rn 2 H@x0r teh Gibs0n?

Re:Oh man...

[Nintendork]

In the movie "Hackers", they wanted to use the Cray name, but were denied permission. That's why they invented Gibson.

-Lucas

Hackers will always call late at night

[Anonymous Coward]

What they don't tell you until the PhD course is that it's always late at night somewhere.

Re:Hackers will always call late at night

[lcsjk]

THanks, you made my day! Best laugh I've had since ... last time.

Re:Hackers will always call late at night

[mschiller]

There's two ways to look at this..

#1) A script kiddie may very well be a snot nosed teenager [pre teen these days?] who probably does his/her hacking at night, since the teenager still lives at home they are probably expected to go to school during the day, and are probably better watched in the evening. At night, if they sneak back up from bed, they then can get away with practically anything on the internet...

In this scenario "night" is any time, since the hacker could be anywhere.

#2) A more intelligent hacker might realize that system administrators are probably most alert during a certain time of the day. For example, a small - medium sized business might only have a system administrator on duty during business hours [on call the rest of the time]. In this case Security logs are probably viewed during business hours. So unless the hacker tripped a trip wire [thus notifying the system administrator]. They might be well advised to hack at night. Of course the disadvantage here is that if you aren't successful enough to cover your tracks.... It's going to be much more suspecious at 3am, then a few bad passwords [for example] at 9am, when a regular user might be trying to log in. In anycase in this scenario it's local time...

Hmmm

[Neil Blender]

Sounds like they are social engineering people out of $4,000.

This can go 2 ways...

[XaviorPenguin]

One way is that we have more "white hats" out there to help secure networks and make other businesses better.

The second way is that we will have more script kiddies out and about to cause trouble to everyone on the Internet and other networks.

I just hope that the school is going to do the right thing when it comes to this touch-ee subject.

Lots of companies teaching CEH classes..

[x.Draino.x]

Am I missing something? Lots of companies are doing this.. for example: InterfaceTT CEH Information

great..

[Anonymous Coward]

Now we have SCHOOLS that teach that "hacking" means breaking into computer systems

Re:great..

[umrgregg]

But this isnt hacking!! THIS is hacking. What you're refereing to is cracking.

Re:great..

[armando_wall]

Another one who bites the media dust.

You refer to cracking. Hacking means knowing a system more than you need to. Enjoying it is optional.

Re:great..

[Anonymous Coward]

Hacking means knowing a system more than you need to.

Homer: Hmmmmm.... cybersex!

Re:great..

[Anonymous Cowtard]

Sorry man, but the word is used to mean malicious computer access as well. Words take on the meaning that the majority use them for.

Re:great..

[nacturation]

But this isnt hacking!! THIS is hacking. What you're refereing to is cracking.

You know, it's only been within the last few years that I've heard any significant usage of the word "cracker" with regards to computer security. Before that, anyone who broke into a computer system was known as a hacker. Cracking was what you did to software to remove copy protection. Kevin Mitnick refers to himself as a hacker, and he broke into systems long before the politically correct term, cracker, came into usage.

While it's a nice effort to wish for a distinguishment between the two, the use of the word hacker for those who break into systems has long been established. Let it go, man.

Re:great..

[Anonymous Coward]

God forbid a school should teach something correct.

Access computer systems without permission = "hacking"
Patching or pre-loading a binary to bypass copy protection = "cracking"
Exhibiting great skill with computers in some legal, positive way = "being a loser GNU hippie"

Hope this vocabulary lesson clears things up.

Re:great..

[Anonymous Coward]

So I guess I'll have to stop using the word "niggardly", then.

Re:great..

[Anonymous Coward]

You refer to cracking

No. Cracking refers to breaking the copy protection on software. Cracking has refered to breaking software since at least the days of the Amiga.

You get pissed when people use the word hacker incorrectly and then you turn around and use the word cracker incorrectly. WTF.

Re:great..

[Anonymous Coward]

C64 and before ;p

-- vranash

Re:great..

[Anonymous Coward]

Cracker means using computer and tools or whatever for illegal stuff in the context of stealing, breaking into stuff you don't own - so removing copy protection or "hacking" into a bank is all cracking.

If you say hacking though everyone knows what you mean.

Re:great..

[hearingaid]

Where've you been?

The hacker vs. cracker debate has been raging since at least the '70s. It was in full force when I hit university, back in '87.

Perhaps you missed it, but... cracker way predates Mitnick.

Re:great..

[Anonymous Coward]

Mitnick is NOT a hacker. the man is not even a cracker.

he is a simple petty thief asshat that used technology.

he did nothing that was novel or innovative and was SCRIPTED. the farker was nothing more than a script-kiddie that was more of an asshole than normal..

Yes I met him. yes i knew hime about the time he starting running his crappy car had lots of stolen computer junk in it and he was using already broken accounts at the well he bought from other kiddies he fooled into believing he was Leet...

Mitnick = poser script kiddie that deserved getting slammed... fricking petty thief... nothing more.

Re:great..

[1lus10n]

Kevin Mitnick was and is a social engineer. He uses the fucking term (Hacker) to puff out his chest and act like a fucking ass. Cracking is breaking some type of security on a computer system. Hacking is making something work in a better or more effecient way, sometimes extending the use beyond what the product/idea/system was originally meant for. This does include security, however a "Hacker" wouldnt do malicious things with the system or the data (ie spam, virus's etc).

I recommend you actually learn about where the word came from and stop hanging out in aol chat rooms. w00t !

Hackers By Steven Levy.

And the proper use of the word hacker pre-dates the media ideal (also known as market speak bullshit) and probably even pre-dates your being born. Let it go, man.

Re:great..

[BubbaFett]

Words take on the meaning that the majority use them for.

Which is why the press isn't about to start calling people crackers. Sorry folks, you're going to have to get over it.

Re:great..

[nacturation]

And the proper use of the word hacker pre-dates the media ideal (also known as market speak bullshit) and probably even pre-dates your being born.

I don't dispute the use of the word hacker to mean doing neat tricks (hacks) that things weren't specifically designed to do. All I'm claiming is that I've always heard the "breaks into computer systems" people being called hackers, and it's only been recently that usage of the word "cracker" has come into vogue to distinguish the good from the evil hackers.

It's altogether possible that the term cracker has been used for decades and I've only heard the term hacker. Regardless, the use of "hacker" in the malicious sense has been firmly entrenched into today's vernacular and I don't think it's going away anytime soon.

Re:great..

[sploo22]

Sad but true.

Re:great..

[doshell]

The parent is right. Why not focus on the difference between blackhat vs. whitehat hacker instead of the hacker vs. cracker one, which nobody (except whitehat hackers) takes seriously?

Re:great..

[Anonymous Coward]

Nope. In fact, I'd suggest you use it more often. Do your best to work the word "niggardly" into your everyday speech.
You'll show us all that you're no slave to public opinion!
For example...
"I'm sorry for giving you such a niggardly sum for cleaning my windshield, large angry black man."
Let me know how that works out for ya!

With titles like those...

[mikael]

I wonder how long before they offer the qualification of "Certified Pointy Haired Boss"?

Re:With titles like those...

[peragrin]

Already due have a "Certified Pointy Haired Boss" It's called an MBA or EMBA..

These degrees are there to ensure only stupid people ge management roles.

Re:With titles like those...

[peragrin]

Of course with spelling like that maybe I should go after one.

Damn I have got to proofread before hitting send. One gets used to the automatic spell check in KDE 3.2 in a big hurray.

Re:With titles like those...

[mikael]

One gets used to the automatic spell check in KDE 3.2 in a big hurray.

There's nothing worse than receiving an order for "demonized water" from a chemistry lab.
Do we call them back for confirmation, or just try looking up the yellow pages for a witch-doctor?

Certs like this have been around for a while now.

[Sielle]

I remember when the CEH first came out. They may work as a simple start, but they shouldn't be considered a stoping point to learning.

Sounds like

[Creepy Crawler]

A really sucky "school"..

You teach ethics, not "hacking ethics". Sounds like a money grab for gullible script kiddies.

I shoudlve thought of it first.

Re:Sounds like

[nkh]

There no such thing as "hacking ethics" of course. But "ethics" can't be taught either. You are what you are. If you're a moron in the beginning, you have few chances to become intelligent. Of course you can always meet someone who will show you the real way of doing things (Thou shall read Donald Knuth's Holy Books, for example).

Re:Sounds like

[joshmccormack]

I know this is painfully obvious, but it's not ehics, it's ethical hacking - which means hacking to test the security of a system with consent.

Re:Sounds like

[Creepy Crawler]

Wrong, ethics can be taught..

Here's an example of "Computer Profesionals for Social Responsibility" ethos..

-----
The Ten Commandments
of Computer Ethics
by the Computer Ethics Institute

Thou shalt not use a computer to harm other people.

Thou shalt not interfere with other people's computer work.

Thou shalt not snoop around in other people's computer files.

Thou shalt not use a computer to steal.

Thou shalt not use a computer to bear false witness.

Thou shalt not copy or use proprietary software for which you have not paid.

Thou shalt not use other people's computer resources without authorization or proper compensation.

Thou shalt not appropriate other people's intellectual output.

Thou shalt think about the social consequences of the program you are writing or the system you are designing.

Thou shalt always use a computer in ways that insure consideration and respect for your fellow humans.

http://www.cpsr.org/program/ethics/cei.html
--- -------

Now ask yourself this, what good things come out of this if all computer professionals followed this. Now ask yourself if all did not follow this..

What if Doctors denyed the Hippocratic Oath and told others secretly (or anonomously) of conditions of others? Would you go to them if you knew they had a history of this?

Morals are pertaing to religous rules. Ethics are rules and agreements to a type of trade whether that be The Law, medical, social, Teaching that when agreed to, promotes the further learning and legitimacy of the field.

First line of the story

[liquidsin]

Sporting long sideburns, a bushy goatee and black baseball cap, instructor Ralph Echemendia has a class...

He wears a black hat, and we're expected to believe that he's teaching ethical hacking? It's a cover! He's building an army! TERRORISTS!!!

Re:First line of the story

[Anonymous Coward]

a bushy goatee

Whoa, glad I reread that. At first I thought it said bushy goatse. I shuddered at the thought!

Re:First line of the story

[Decaff]

He wears a black hat...

Its OK. Its a baseball cap, and he wears it backwards.

Re:First line of the story

[Anonymous Coward]

Oh man. Slashdot. The only place where when you see "goatee", you immediately think of a certain man's profile from behind and the gaping cavity found.

Re:First line of the story

[Anonymous Coward]

Not very good ones....aren't they supposed to cover their faces with their hats???

Re:First line of the story

[illuminatedwax]

AND he must be a Yankees or White Sox fan! Kill him!!!

I'm Waiting

[stinkyfingers]

Wake me up when they offer Ethical Racketeering, Ethical Pimping, and Ethical Congressional Campaigning.

I got mine last week

[Anonymous Coward]

I think comptia already offers the ScriptKiddie+ certification

My $5

[Doesn't_Comment_Code]

I'm offering 5 dollars to help a poor Microsoft programmer attend this school, where he will learn how hackers think in order to stop them. Maybe if we all contribute to the pool, we'll have easier lives.

Re:My $5

[the_mad_poster]

Or, at the very least, less money.

Plus, the Microsoft programmers will come out of the same school of hacking as their clueless boss, and then get our jobs.

So, at the very least, MUCH less money.

But the real question is

[Scoria]

4r3 7h3y c3r71f13d 1n 1337sp34k? j00 c4n't b3 4 h4x0r w17h0u7 1337sp34k. ;-)

Re:But the real question is

[the_weasel]

It bothers me that I had no trouble reading that. None at all. And I am about as far from being l33t as you can imagine.

Re:But the real question is

[rpbailey1642]

Hey, guys, it looks like yet another person has fallen asleep on their keyboard while posting to Slashdot.

Re:But the real question is

[Anonymous Coward]

Read this and thought... there oughta be an emacs translator. But then I realized, someone MUST have already done it.

Re:But the real question is

[Carbonite]

Oh, that's what happened! I thought someone was posting a Perl script.

Re:But the real question is

[hearingaid]

I wonder if it's possible to write a Perl script that's also a message in leet-speak? Hmm. Perhaps a task for the JAPH crew.

Re:But the real question is

[Snowmit]

Man, that's a hot encryption scheme. You should patent that.

Re:But the real question is

[Patrik_AKA_RedX]

I had a little more trouble reading it now. I used to be able to read it just as easy as Engrish. And since last month I've got a gf...
Oh no! My geekpowers must be slipping away! There is no other option, I must start upon a quest to the caves of Assembly to retrieve a token of the Divine Binairy Digit, before it's too late and the clocks start flashing 12:00.
Servant! Bring my cloak, pocketprotector and trusty calculator! I have a quest to fulfil...

Re:But the real question is

[Weirdofreak]

'j00 \/\/4|<3 |)|_||21|\|9 |'=~/\/\ 71|\/|35 1|\| 73|-| 5|'3(7|2|_||\/| 0|= |)00|\/| 4|<4 |_||/

You wake during P-M times in the spectrum of doom AKA UV. Could be better, but I don't care. It executes fine, unless you happen to be using an English parser.

Re:But the real question is

[Superfreaker]

You also probably don't have any trouble reading this either, doesn't mean u read l33t sp34k!

frist and lsat ltteer is at the rghit pclae. The rset can be a
toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae we do
not raed ervey lteter by it slef but the wrod as a wlohe.

Re:But the real question is

[Anonymous Coward]

There is no other option, I must start upon a quest to the caves of Assembly to retrieve a token of the Divine Binairy Digit, before it's too late and the clocks start flashing 12:00. Servant! Bring my cloak, pocketprotector and trusty calculator! I have a quest to fulfil...

I wouldn't worry. After writing something like that, I don't think you'll ever be in any danger of losing your geekiness ;^)

Re:But the real question is

[Denial93]

4I^3 7I-I3? 0I^ vv17I-I0I_I7 13375p34I!!!!!!!!!!0I\I30I\I30I\I33l3v3n Does that offer comfort?

Re:But the real question is

[Anonymous Coward]

If it was a Perl script, there'd be more emoticons. ;) :P

Re:But the real question is

[Wesser]

I would find it more scary if you could read this on the fly. Then you'd be a true h4xx0r! :)

01001001 00100111 01101101 00100000 01100001 00100000 01100010 01101001 01100111 00100000 01110100 01101001 01101101 01100101 00100000 01101000 01100001 01100011 01101011 01100101 01110010 00100000 01101110 01101111 01110111 00100001 00100000 00100000 01010111 01101111 01101111 01101000 01101111 01101111 00100001

Re:But the real question is

[xgamer04]

I had trouble reading that, and I think that that study is bull.

On a related note, my high school history teacher gave everyone a copy of that, and my friend replied right away "Hey, this has less mistakes than your regular tests." (It was true)

Re:But the real question is

[Reteo Varala]

You scare me...

Wait... I didn't even hesitate when reading that...

*shudder* Mommy?

Re:But the real question is

[Anonymous Coward]

"And since last month I've got a gf..."

I don't think he'll be in any danger of keeping that girlfriend either.

Re:But the real question is

[hearingaid]

Sadly, it doesn't actually do anything. Oh well :)

This is an outrage...

[Gyorg_Lavode]

This is an outrage to all of us who toiled for years to become script kiddies and received no formal documentation of our accomplishments.

Re:This is an outrage...

[Rick.C]

This is an outrage to all of us who toiled for years to become script kiddies and received no formal documentation of our accomplishments.

Can you spell "Pr0f3ss0r 3m3r17us"? For an additional $4000 and three 1337 script samples (in your own handwriting, please), you can be one.

Re:This is an outrage...

[The_REAL_DZA]

Maybe they'd let us CLEP the course for $3500 if we promised to buy the textbook at the campus bookstore instead of the "outlaw" place across the street...

Ahah!

[marnargulus]

So now they are going to have a listing of all of these script kiddies' addresses. Now we know where they live, just match up the IP to the address to the name.

Re:Ahah!

[hearingaid]

So here's the question: Will this school allow you to register using a P.O. Box, perhaps registered to Charles U. Farley? :)

As for the phone#, all you need is a pay-as-you-go phone, which takes a card that you pay for with cash.

Your CEH cert will give you the pride...

[Anonymous Coward]

...of self knowledge and recognized accomplishment amongst your peers that only MCSEs have enjoyed up to now.

Just Like Anything Else...

[artlu]

The problem with teaching Comp Sci, let alone "hacking," is the methodology in which the teachers teach. The only way I ever learned any type of programming was when someone said, "Go build an application that simulates RSA cryptography." 12 C++ files later I learned more then I did in 2 years of "intro" classes. The same goes for this as well, these kids wont get much more out of these classes then learning to use some scripts or demon dial or whatever.

They should get a project that entitles building some sort of application which can be relseased to the Open Source community.

Wow, war dialing, early 90s, wow.

GroupShares Inc. - A Free Online Investment Community.

Re:Just Like Anything Else...

[Anonymous Coward]

I remember war dialing in the early 80's and I'm sure it happened before then also.

Re:Just Like Anything Else...

[pegr]

"Go build an application that simulates RSA cryptography." And in GW too!

Input "Plaintext";x$: Print "Cyphertext:": for i = 1 to len(x$): print(chr$(int(rnd()*256)+1);: next: Print

Simulated enough for ya? ;)

Re:Just Like Anything Else...

[Anonymous Coward]

Uhh what you describe is in no way "computer science". It's software engineering.

Computer science is about MATH. Period. If you're coding, it's almost certainly not computer science.

"Computer science is no more about computers than astronomy is about telescopes." -- Edsger Dijkstra

Re:Just Like Anything Else...

[Anonymous Coward]

We were war dialing even in the 70s. Probably even before that.

Re:Just Like Anything Else...

[Anonymous Coward]

Saying that computer science is about math is an insult to mathematicians.

Re:Just Like Anything Else...

[Anonymous Coward]

Okay, okay, you're right. That was unfair. Computer science is an application of math. Happy?

Re:Just Like Anything Else...

[Bishop]

The US Air Force had been using modems since the late 1950s. However, anyone who had access to an Air Force modems probably also had access to the phone numbers. The first commercial modem was the Bell 103. It was available in 1962. I am guessing that hackers and phreakers have been wardailing ever since.

An introduction to modem history

Re:Just Like Anything Else...

[Kupek]

I guess all of those operating systems papers I read last year that involved implementation weren't computer science. And I guess the paper I have in front of me, "The Performance Implications of Thread Mangagement Alternatives for Shared-Memory Multiprocessors" isn't computer science since they actually coded their ideas.

Re:Just Like Anything Else...

[maximilln]

What's even scarier than being able to read the obnoxious 13375p34| farther up is that I recognize this code.

The LEN statement is a bit fuzzy--I can't remember if that was available in the dialect that I'm thinking of. The int(rnd()) construct is certainly indicative of a particular dialect. :)))

Re:Just Like Anything Else...

[TwistedSquare]

Computer science is about MATH. Period. If you're coding, it's almost certainly not computer science.

I think what the AC meant was:

...If you're coding, it's almost certainly not theoretical computer science.

Re:Just Like Anything Else...

[Anonymous Coward]

Indeed.

Re:Just Like Anything Else...

[pegr]

The LEN statement is a bit fuzzy--I can't remember if that was available in the dialect that I'm thinking of. The int(rnd()) construct is certainly indicative of a particular dialect.

This is GW-BASIC, standard in DOS until DOS 5, I believe... (It should run in QBASIC and even VB!) The LEN returns the LENgth of the enclosed string... The joke is that the code returns a random character for every character in the input, thereby "simulating" DES... Since you were the only one that "got" the joke, maybe I should code jokes in C from now on. ;) (But it's just FUNNIER to code jokes in GW-BASIC!)

"Harmless" Hacking

[gbulmash]

Puts me in mind of The Guide to Mostly Harmless Hacking.

Learning how to defend against getting hacked by learning how to hack is nothing novel. It sounds like a great idea on the surface, because it gives you the tools to probe your own weaknesses the way your attackers will. But you're always going to have to keep up with the latest methods, scripts, etc. IMO, A net admin who isn't at least a hobbyist hacker probably won't get much from a hacking bootcamp except a false sense of security.

- Greg

Re:"Harmless" Hacking

[Doesn't_Comment_Code]

Many computer security companies hire converted hackers. But others refuse, saying that anyone with that bad seed can't every be trusted. They only hire people who have studied hacking, but have never been a hacker (like graduates of this school).

Like you said, it sounds like a good idea, but there are going to be weak points in your staff if they don't really know what they're doing. For instance, I've studied security from books, and I'm pretty adept at defending my computer. But I know there's a lot that I don't know that I would know if I hacked computers on a regular basis.

Re:"Harmless" Hacking

[clintp]

Or, an analogy that hits home to Slashdot readers...

This seems akin to having sexual experts who have studied sexual practices, but are still virgins.

Re:"Harmless" Hacking

[wwest4]

> others refuse, saying that anyone with that bad seed can't every be trusted

I've always seen this argument (the Spafford argument, if you will) as weak. You can't really trust anyone absolutely. A past offense doesn't guarantee a future offense any more than a lack of past offense guarantees future ones.

Any system should have a set of checks and balances for the admins & security guys as well. You don't want anyone holding all the keys on principle. That way, you're mitigating any risk by hiring someone who you know has trust issues.

Dumber answer

[NoMoreNicksLeft]

Anything with root privileges, assuming something else hasn't binded (bound?) to the port.

Knowledge of hacking is important...

[qtothemax]

...although $4000 sounds a little steep. Most hackers are probably self trained, as in $0. Every corporate network better have someone involved in its design and maintainance that has some knowledge of hacking though, or else it will be a sitting duck. I had a professor that was a consultant who hacked companies to discover thier vulnerabilities. Obviously nothing malicious, and he told them about everything he gained access to and fixed it. Sounds like one hell of a fun job.

Re:Knowledge of hacking is important...

[Anonymous Coward]

Sounds like one hell of a fun job.

As in not? Would be repetitative and... boring

In other news. . .

[JohnFromCanada]

Recent graduates of the 'Hacker College' realize that their diploma is virtually worthless in the real world and come to realize that they were just socially enginered out of $4000 dollars.

Re:In other news. . .

[Anonymous Coward]

...realize that their diploma is virtually worthless in the real world...

Hmm. They'll be twice as pissed when they find out that it's really worthless in the virtual world, too.

A white hat

[slasher guy]

Do they get a white hat with the certificate?

Remember that information...

[mrhandstand]

is never good or evil. If the students are atttending for the right reasons, then this will help them understand the basics of how script kiddies work. And what do the current stats tell us about most attacks? That they are unsophisticated and are run by people who have little deep knowledge of systems. So this course wil (theoretically) allow them to better protect against the majority of attacks. If the students are attending for the wrong reasons, then they spent $4k for what a day or two of googling and reading would have gotten them. BFD.

Re:Remember that information...

[np_bernstein]

They're much better off taking one of the @stake classes. They don't pretend to teach you how to be a 'hacker', but how to secure your systems. They do show several (four or five) outdated scriptkiddy hacks, but mostly, the focus is making people aware of issues and giving them a toolkit to try and secure it.

I wish it had been a /little/ more technical, but in their defense, we did spend 90% of the time actually doing lab exersizes, and I did take some good stuff away from it. My boss, who is our director of IT, went with me, and really loved it; His focus is not as security focused as mine, so I think a lot more of it was new to him. Anyway, at least you know you've got really good instructors, so if you are curious about a specific aspect of security, they can sit down and teach you about that, or if they don't know, they can get somone who does to answer it.

Also, it was pretty cool to have the guy who wrote The Sleuth Kit as an instructor. Needless to say, the forensics section was pretty interesting.

Re:Remember that information...

[Lumpy]

but it's not. we had a "security professional" at work go through this program. what he came out with was more basic that what you could get by reading any "hacking exposed" book.

I asked him during lunch about how his new security measures on the network were working....

he mentioned a bunch of things until I interrupted with... "so you sweep the building on a regular basis for keyloggers? how about devices on the network that you were not notified of? Is that HP laserjet 4400 at 10.165.1.223 REALLY a printer?

He glossed over and said, "keyloggers are not an issue as users cant install their own software..."

at that point I realized that my company is utterly doomed in regards with computer security.

Sounds like...

[robslimo]

more of an course to help corporate types to be better aware of and combat cracking (note usage of correct word here) techniques. Your typical 'script kiddie' ain'ta gonna blow $4000 on a course on cracking; he's gonna hang out on IRC and cracking/warez sites to try and mooch some free advice and 'proggies'.

IMO, a network admin ought to all ready know the tricks of the trade and keep him/herself up to date on the tech. But I guess this course probably does provide a good service to some... seen waaaaay to many fresh IT grads who may have aced all their classes but still manage to get out in the real world without really knowing how it all works.

Re:Sounds like...

[Anonymous Coward]

" (note usage of correct word here) " ... I gave up on trying to explain a long time ago. I think its funny that you're the only one out of all these people who bothered to say it.

You remind me, of me, two years ago.

*sigh*

yeah right....

[evenprime]

I haven't read it yet, but I'm rather skeptical. It seems like $4000 dollars and a few weeks in the classroom teaches you how to run sploits you download from packetstorm. It doesn't make you suddenly become skeptical of everything a vendor tells you, or make it become a habit to run a sniffer with watchtemp when you install software on your test lan. It doesn't make you enjoy reading bugtraq.

There's a heck of a lot more to "hacking" than what they can teach you....think "lifestyle"

Re:yeah right....

[Anonymous Coward]

'think "lifestyle"'

Or Lack of?

Computer Ethics?

[AviLazar]

Anyone who is smart enough to hack, is smart enough (save for those with mental problems) to realize the difference between right and wrong.
Anyone who wants to take an ethics class obviously has some ethics (what you think someone lacking morales will be taking an ethics class to hope improving himself)???
What they should offer is a class that teaches non-techies what is a hacker - so they learn that not all hackers are evil people bent on ruling the world (not there is anything inherently wrong with this..I mean if I ran the world, it would be a much better place - for you and me....well more me, but it's all good)

Re:Computer Ethics?

[ari_j]

Anyone who is smart enough to hack, is smart enough (save for those with mental problems) to realize the difference between right and wrong.

But anyone who is dumb enough to be a script kiddie and call himself a hacker is dumb enough to not realize the difference between right and wrong.

Re:Computer Ethics?

[AviLazar]

As much as we like to make fun of script kiddie's, they are not THAT dumb. It still takes a level of intelligence to run a script. It is not something that is so basic. It may be as easy as double clicking on an exe file, but you need to find that file.
*I* cannot put down the intelligence of a script kiddie to the level of someone who is mentally retarded or a four year old (and even four year olds have a basic sense of write or wrong).

Re:Computer Ethics?

[techno-vampire]

Anyone who wants to take an ethics class obviously has some ethics (what you think someone lacking morales will be taking an ethics class to hope improving himself)???

Well, a smart but unpricipled cracker might take the course to learn how to "talk the talk" and make himself sound ethical. That would help him social engeneer himself into a security job where he can get paid to crack into systems and steal data while claiming to be looking for vulnerabilities to patch.

Re:Computer Ethics?

[dubl-u]

Anyone who is smart enough to hack, is smart enough (save for those with mental problems) to realize the difference between right and wrong.

Wrong! This is based on an old model of "smart", that there is a single, linear measure of intelligence, one's IQ. Newer research suggests that people have different capabilities in different degrees; this is broadly known as Multiple Intelligences.

People with high interpersonal and intrapersonal intelligence will have a native advantage in understanding ethics. This makes sense when you consider that morals are an evolved capacity, one not unique to humans. (For more on the topic, see books like Good Natured: The Origins of Right and Wrong in Humans and Other Animals.) This doesn't mean that a hacker can't learn ethics. But it may come no more naturally to him than, say, dancing. And like dancing, if it doesn't come naturally then it might be worth taking a class.

Re:Computer Ethics?

[Bull999999]

How can you blindly say the parent poster is wrong when you argument is base on one theory (yes theory, not a law) out of many?

Re:Computer Ethics?

[AviLazar]

Wrong! This is based on an old model of "smart", that there is a single, linear measure of intelligence, one's IQ

Eh, Right! You are putting an assumption as to what I referred to as "smart." My reference of "smart enough" is someone who is capable of utilizing a computer, searching for a hack script, and then running it with the intent of causing some harm. Plus - as I stated, someone who does not have mental retardation (i.e. idiot savants) The person doesn't need to be a genious (for your IQ system 150), but the person does need to be reasonably intelligent (above 70 IQ).
While people who are on a higher intelligence scale may have an easier time understanding complex issues, such as advanced ethics, a person does not have to be a genius to understand basic ethics. Hacking with the intent to cause harm is fairly basic. Script kiddies tend to realize that what they are about to do is going to cause someon e grief. Let's not assume because a person is a "script kiddie" that they are not smart enough to realize between right and wrong.

Re:Computer Ethics?

[ari_j]

It is specifically the inability to tell right from wrong that I hold against script kiddies. Network security officers would be wise to run script kiddie attacks against their own networks and plug the holes that they find.

Script kiddies are either stupid or evil. Possibly both.

Re:Computer Ethics?

[techno-vampire]

I'm sure some skript kiddies do know the difference between right and wrong; they just don't care. What they do care about is the approval they get from each other for their "exploits." They want attention, they want to be noticed, they want people to think they're cool, and this is the way they've chosen to get it. I suspect most of them take this route because they are either unwilling or unable to get the attention they crave in more acceptable fashion.

Re:Computer Ethics?

[Mazem]

Your post implies that there is some sort of universal set of ethics that everyone who is smart should see as "obvious". That is false on so many levels. Who decides right and wrong? Whose code of ethics is the correct one? Yours? And of course no one can have an intellectual disagreement over it because then they would be labeled "immoral" or "evil".

Re:Computer Ethics?

[ari_j]

Like I said: either stupid or evil. :P

Re:Computer Ethics?

[dubl-u]

How can you blindly say the parent poster is wrong when you argument is base on one theory (yes theory, not a law) out of many?

Turn it around: How can you say that the creationists are wrong when darwinian evolution is base [sic] on one theory out of many?

It's because the new theory comes later, explains more than the previous theory, and has better supporting evidence, that's how.

That's not to say I'm right, any more than the single-intelligence model was right 50 years ago, even if it was the best theory available. I'm just going with the best I've found; if you've got better theories or new data, step up to the plate.

Re:Computer Ethics?

[dubl-u]

My reference of "smart enough" is someone who is capable of utilizing a computer, searching for a hack script, and then running it with the intent of causing some harm.

Not to be rude, but did you read the links I included?

I am saying precisely that the ability to use a computer, find a hack script, and use it to break in is a separate ability from making the moral judgements involved. Both can be learned by anybody, but some people find one easier and some find the other easier.

Plus - as I stated, someone who does not have mental retardation.

Yes. Mental retardation isn't necessary. People with, e.g., Aspergers, have great technical skills and little interpersonal sense, from which a moral sense derives. Some people don't formally meet the criteria for Asbergers but still tend in that direction; they will have a harder time with moral judgements than somebody with high interpersonal and intrapersonal intelligence.

Script kiddies tend to realize that what they are about to do is going to cause someone grief.

I don't know any script kiddies, so I can't say either way. But I have known some technically clever hackers (in the old sense of the term) who were much sharper technically than they were morally. They saw their adventures as harmless exploration; other people saw them as morally deficient.

Re:Computer Ethics?

[AviLazar]

Differing cultures, even before global communication, helps to prove that there is a universal (at least Terran based) set of moral codes that people tend to agree upon. So actually, it is correct on many levels.
Now, more advanced sets of ethics (i.e. drinking and driving) is not inherent into our nature, but things like killing for no other reason is considered a universally ingrained policy.
Even some mammels agree with some of these codes of ethics (i.e. primates).
And yes people can have intellectual disagreements over ethics/morality and not be considered evil or immoral. Those who are considered evil or immoral are those who prove themselves to be oppressive zealots. Those who force their ethics on others.
But again, I stress to you, that some ethical codes are inherent into our human nature. That is why things like "smiling" are universal (as well as laughing, crying, making faces of pain, etc.)

Seems expensive

[senzafine]

$4,000 seems a bit expensive. I'm not seeing the true benefit of having a "Certified Hacker Certificate"? I think the days of getting a job out of highschool because you took a hacking course are over (if they ever existed in the first place).

Right now the University of Cincinnati is about $8,000 for a year. And I thought that was expensive.

Seems trendy to me...I just don't see hacker courses having much of a true impact on security.

But kudos to whoever is making money off the idea. Wish I would have thought of it.

Re:Seems expensive

[Doesn't_Comment_Code]

Be careful with dynamic memory.

Watch for stack overflows.

Always restrict access as much as possible.

Use the strongest encryption available depending on the sensitivity of your data.

Turn off all services that you don't use.

Don't set your root password to root.

Assume every user has bad motives.

Plan for the worst.


Send $4000 and a self addressed, stamped envelope with your name as you would like it to appear on your certificate.

Re:Seems expensive

[Diego_27182818]

I took the time, got your money order and self address and stamped an envelope only to realize I didn't have your address! What am going to do now? Without a certificate will any one believe I took your excellent class? ;)

Re:Seems expensive

[Doesn't_Comment_Code]

I didn't think anyone would send me anything weird in the mail...

But I thougt about it and decided not to take any chances.

Re:Seems expensive

[Tongo]

Could you imagine having your snailmail box /.'d? It would be fun to get a PO Box and post it on here a few times....

Re:Seems expensive

[Dogtanian]

I'm not seeing the true benefit of having a "Certified Hacker Certificate"?

Damn, you know it's a shoddy qualification when the people running it can't even spell. Everyone knows it's 'c3r7ipHi3d h4x0R5 53R7IPhiK473'.

Re:Seems expensive

[Anonymous Coward]

though i really couldn't care less politically, your sig is inaccurate. al quaeda has endorsed bush. here's the link. the relevant info is at the bottom.

Re:Seems expensive

[dustman]

I wouldn't mind having my snailmail box slashdotted with $4000 checks :)

Re:Seems expensive

[edrain]

It'd be a lot easier for me if you'd just post yr. bank account number - that way I could wire you the money.
Awaiting your response... :)

Re:Seems expensive

[nlindstrom]

Don't set your root password to root.

Excellent point. You should always use a secure combination, such as 1-2-3-4-5.

Re:Seems expensive

[sharkdba]

Could you imagine having your snailmail box /.'d?

Won't happen. Most /.ers only use snailmail for Only birthday/Xmas cards. Handwriting is a dying (if not already dead) skill over here.

Re:Seems expensive

[auzy]

I've heard about many courses like this.. and believe me, its not a new concept. Overall, the courses I believe are generally relatively crap too, because they only teach simple exploits.

One good thing, is that it keeps them script kiddies. The day the "ethical hackers" (as they like to call themselves, probably because they think it sounds better then script kiddie) actually wake up and know what they are doing, is the day we get worms which we cant control.

I've never actually seen a ethical hacker who actually has something to really contribute to the hacking community, in fact, I've seen alot of irony in the ethical hacking community. One persom who called himself a ethical hacker, actually blackmailed companies into paying up (what he did was kept crashing servers.. I know an adobe server was one of his targets), and then tell them that he could fix that if they payed him. The irony is that he didn't think it was melicious because "he wasn't forcing them to pay up". And just after seeing stuff like that by the ethical hacking community, pretty much confirmed to me that to become a ethical hacker, the steps are:
1) Go to security focus
2) get an exploit
3) Scan a few computers and use it

When did "hacker" change?

[ajs]

If you're wondering when the word "hacker" came to mean something sinister, the answer is 1987.

As far as I can tell, it was the the US media that got that ball rolling when they were trying to investigate the 1987 "Internet Worm" released by Robert Morris Jr. The Worm caught the news media off-balance because 1) they did not know what this "internet" thing was 2) there was no terminology for this kind of crime.

Remember, this was before the World Wide Web (which some of you may not realize is a layer ON TOP OF the Internet, not the same thing), and the news only knew that the military had been connecting computers for research, but even that information was kind of sketchy if you weren't in the thick of it.

So, they asked around and got some experts on the phone and the word that kept coming up was "hacker". Well, the reporters in question didn't realize that a "hacker" was a fairly old term used by the MIT Tech Model Railroad club and later spread around the word as term for a "productive enthusiast". They just knew that Morris the Younger was a "hacker who broke into thousands of computers", and that was news!

We've all tried to stop that land-slide ever since because those of us who called ourselves hackers pre-87 are not too thrilled with the perversion of the word's meaning, but at this point it has become clear that it's simply going to be a matter of dialect. In certain circles the word has one meaning and in the rest of society (not just English-speaking society) it has a very different one... oh well.

Re:When did "hacker" change?

[ajs]

And one note on Mr Morris, who I actually respect a fair amount for his successful bid to bring computer security into the spotlight. I don't advocate writing worms or viruses (the so-called Internet Worm actually classified as both, depending on which attack vector it was using at the time), but in the case of Morris' program, his intent was a reasonable one, even if his actions were not. For that, he deserves a nod: he took a big fall in order to get us to stop pretending holes didn't exist, and CERT was formed as a direct response to his actions.

I know, he also cost us a huge amount of lost productivity, but can you imagine the chaos that someone who DID have malicious intentions would have caused just five years later?! We took that hit to productivity because there was a problem, and though people like Bob Page (who wrote one of the better papers on the worm, and was in charge of sysadmin at my school at the time) were not amused, I do think they were better off in the long term.

Now, if Morris' code hadn't had that fatal bug that caused it to replicate out of control.... heh ;-)

Re:When did "hacker" change?

[RedShoeRider]

"which some of you may not realize is a layer ON TOP OF the Internet, not the same thing"

You must be new here.
This is /. We know everything.

(Yes, I see your UID, but it had to be said)

Re:When did "hacker" change?

[Noah Adler]

If you're wondering when the word "hacker" came to mean something sinister, the answer is 1987.

While there may have been some earlier hints at the new meaning, it didn't become something really sinister until, oh, let's say 1995.

Re:When did "hacker" change?

[Techguy666]

Actually, "hacker" has always had an negative conotation. By always, I mean since the early 80s.

A "hacker" used to suggest someone who tried to achieve a goal but found an obstacle in his way. The industrious person found a way to hack through the obstacle to reach his goal.

It was a pretty generic term that could apply to hobbyists who innovate, people who broke into computers, people who took a chainsaw to break down a door to access a server room. The thing is, all these acts have an air of subversiveness - subverting the status quo - and that's the connotation that's stuck with "hacker" until about 1987, where it became that much more subversive and, now, evil (with a mystique).

Back then, there were only two legitimate ways to be labeled a "hacker" - an established hacker publicly referred to you as a hacker or someone clueful in law enforcement referred to you as a hacker. In the good old days, it was very much a meritocracy. Nowadays, "hackers" are a dime a dozen chosen by clueless media people.

Re:When did "hacker" change?

[ajs]

You're thinking more of the phreaking crowd, I think, and I never heard of law enforcement using the term hacker... though it may have happened, it was not a wide-spread phenomenon until 1987.

Re:When did "hacker" change?

[ajs]

No, the movie hackers popularized a kind of hip-hopified version of phreaking that had little or nothing to do with the controversy that had surrounded the word hacker since the press got ahold of it in 1987 had continued to use it through the early 90s. Check out any report of a new DOS virus between 1990 and 1994. Also take a look at USENET archives for PROLIFIC discussion on the topic (you might even find a few of my posts ;-) from that time period.

Re:When did "hacker" change?

[jstultz]

Actually, if you look into the history of it far back enough, hacker was originally used quite a long time ago at MIT as a term referring to the exploration of the roof and tunnel system around campus and to harmless "pranks." See what you can dig up on such names as Jack Florey and James E. Tetazoo.

Re:When did "hacker" change?

[Anonymous Coward]

Now, if Morris' code hadn't had that fatal bug that caused it to replicate out of control.... heh ;-)

So you are saying that the Morris worm was kind of like a spelling flame on slashdot? His intent was to show the bugginess and vulnerability of the system, but just as Dharma dictates that all spelling flames must contain spelling errors themselves, his code was itself buggy.

(PS, unless he is your deity, it should be "Morris's code.")

Re:When did "hacker" change?

[Anonymous Coward]

Speaking of Spelling flames...

Since Morris's looks awkward, so it is perfectly acceptable to end any "S" word that way.

Re:When did "hacker" change?

[ajs]

Well, sort of. What he was trying to do was not to show that the systems were buggy and insecure, because everyone knew that to one degree or another. Sendmail, for example, had had a debug mode that allowed remote shell access for years, and everyone who had done significant sendmail admin knew it.

The problem was that it was never a priority for anyone to fix the problems because there was always something more important.

In a way, Morris' (sue me) bug was actually more of a feature, since it prevented any kind of reasonable and proportional response to the problem (everyone killed finger daemons, and dozens of mail and ftp server replacements sprang up).

Woefully, the only way to do that was to really anoy people to the point that they pressed criminal charges. I wonder what the Net would be like today if the Internet Worm had never happened. Maybe the same... but I doubt it. I think the response in 1991 to as wide-spread a worm would have been much more reactionary.

Great.

[NoMoreNicksLeft]

The world needs more hall-of-famer quarterbacks, and they're recruiting 5yr old peewee footballers.

For you apologists out there, keep in mind that I myself would only charge $2000, and you'd be at least twice as non-lame as these jokes.

I signed up for this class

[The_Rippa]

And paid for it with credit card numbers I stole from various hotmail accounts.

bah

[Anonymous Coward]

the script kiddies are all going to be outsourced to a 3rd world country soon anyway... oh wait!

Certified Ethical Hacker Exam

[yintercept]

Hey, I think this is a great idea. I think that every hacker should get the certified ethical hacker badge.

BTW, I will be selling the answers to the certified ethical hacker exam on my site for selling answers to the MCSE exams and other equally important certificates.

Re:Certified Ethical Hacker Exam

[XMyth]

Hey! At least you don't have to worry about your site getting hacked for the answers!

Like "Hackers"?

[cdavies]

Woah. If the course is lectured by Angelina Jolie, I'll cough up my 4KUSD in about 3 seconds flat ;)

Re:Like "Hackers"?

[JohnFromCanada]

If this was like "Hackers", they would have to dedicate the first semester to figure out what in the hell is going on with the GUI.

Re:Like "Hackers"?

[cdavies]

I have a theory about that. Just like every program attempts to expand until it can read mail, I believe every Linux hacker attempts to develop software until his/her desktop is like those shown in hackers. Cases in point: + Enlightenment + xscreensaver, despite screensavers being redundant and the being a duplicate of xlock, people develop ever more sophisticated xscreensaver hacks + Bootspash, where previously we had useful messages This is Davies' law. Though not the Davies' law that states that no matter how much faster processors get, after Windows is loaded there will be the processing power and RAM available to applications equivalent to a Sinclair ZX-81.. different Davies.

Re:Like "Hackers"?

[RAMMS EIN]

For 4K USD, you could fly to the Netherlands and get laid multiple times, how is that?

Re:Like "Hackers"?

[Dogtanian]

despite screensavers being redundant

Veering offtopic, but... I just want to say here; worst screen-"saver" ever:-

Asteroids.

As in an accurate simulation of the classic 1979 arcade game in 'attract' mode when no-one is playing it.

If ever there was a game less likely to "save" your screen, it's Asteroids. All the machines I saw (admittedly quite a few years old at the time) had really obvious CRT-burn where the same letters/patterns appeared on the screen at the same place.

Still, who the heck actually uses them as screensavers these days?

BTW; yeah, your theory *is* pretty accurate.

Re:Like "Hackers"?

[SolvayGuy]

Why pay $4,000 when you could just use your Mac Plus to HACK THE PLANET!! That's what it's all about, man.

you are correct

[JeanBaptiste]

and with my post being 'dumb answer', i am also correct. your answer was smarter :-]

I got next!

[Otter]

I'm now crafting my article submission about this Economic Times article about the "EC-Council" holding a similar program in -- brace yourself -- India! It looks like the career window for being a "certified ethical hacker" is only a couple of weeks wide.

(BTW, doesn't this "Economic Times" look like a pretty shameless rip of the Financial Times? I wonder if their print edition is salmon-colored.)

Re:I got next!

[sirdude]

Yes, the print edition is also salmon-coloured, as are most finance-related papers/supplements in India. [e.g. FE].

The New York Observer [ugly site], also uses it extensively..

Anyways, check my other post detailing another program in progress in the same city..

Re:I got next!

[boltfromtheblue]

I just saw what colour is financial times. economic times is exactly the same colour.

Similar program already underway

[sirdude]

...in Cyberabad/Hyderabad, India. Ankit Fadia, who is India's pet hacker, started up a similar company named e2labs last year.. Not sure how progress has been though..

E2Labs
Course Options

Certified Open Source Security Expert (1 - week) *New
Computer Forensic Expert (3 - days) *New
Certified Encryption Expert (1 - week) *New
Certified Anti-Virus Expert (1 - week) *New
&#183; 3 months - C.S.S (Certified Security Specialist) Job Oriented
&#183; 3 months - C.S.S (Certified Security Specialist) Non-Job Oriented
&#183; 1 month - C.S.P (Certified Security Professional)
&#183; 1 week - S.S.C.M (Security Specialist in Counter Measures) - Corporates

The company has priced these courses at Rs 25,000, Rs 75,000 and Rs 1,50,000 for weekly, monthly and three monthly programs respectively 1USD ~= 45.7INR

Mitnick?

[jmays]

"from the honorary-mitnick-doctorate dept."

Strange ... the article title states 'Ethical Hacking' ...

REALLY!!!

[tod8688]

my favorite line...
"We teach students how to hack and how to code and here are the students applying what they've learned against us," he said.

wait up

[Anonymous Coward]

the correct term is Hactivists. sheesh.

Wash, rinse, repeat

[phyruxus]

Nature creates man.

Man creates computer, internet.

Intelligent, misunderstood youths discover internet, realize they've been lied to, strung along, generally mistreated. Youths show the guts and brains to learn without teachers.

Feds discover internet, realize there are children smarter and more skilled than them, throw beauracratic temper-tantrum, track down said kids (well, some of 'em) and bust them, refuse leniency.

Feds realize this "internet thingy" is more important than they though, and worse, there are kids in other countries who not only have mad skillz, but also actively hate america. Feds shit bricks.

Gov't, realizing it has cut off it's left testicle, tries to fill the gap with "Ethical hackers", ie, tries to create what it had in the first place.

Jeezus F Kryst on a surfboard, why didn't you just train the @#(*&^*(@# hackers in ethics in the first place? You can't teach curiosity, autodidactism or problem solving.

Nature laughs, goes back to being inscrutable.

Way to go.

Re:Wash, rinse, repeat

[CAIMLAS]

Don't think yourself so superior.

Problem solving is just as trainable ability as any type of mathematics or programming. It requires critical thinking, and often a good handle on the deductive and inductive trains of thought. If you're a good problem solver, chances are you had someone in your youth that prompted and prodded you to think about things in different lights, and thus why you can think critically.

Re:Wash, rinse, repeat

[James Turpin]

The reason they didn't teach the original "hackers" ethics in the first place is quite simple: If they had, some of these hackers would have realized how corrupt the system is - the system that the feds protect - and may have gone about undermining the system in some ingenious but ethical manner. And the last thing the feds want is _ethical_ civil disobedience. I mean, you can have a war on crime, or a war in terrorism, but a war on creative ethical civil disobedience!?!? No, they couldn't fight such a thing publicly without creating a public back lash, so better to stop its creation in the first place via poor education, misinformation, and stereotyping.

Re:Wash, rinse, repeat

[Anonymous Coward]

hey! its jeezuz H kryst! not jeezuz f kryst..whats wrong with you man?

CSK

[Anonymous Coward]

Certified script kiddie for sure.

I mean the real certified ethical hacker degree exists for a long while and it's called computer science.

A fool and its gold...

Cracking...

[umrgregg]

This is true 'ethical' hacking. And you don't even have to go to school to learn it. Well never mind, you have to go to school...

Re:Cracking...

[Anonymous Coward]

Do you always dupe your own posts?

Re:Cracking...

[TwistedSquare]

What is this, two modded-up posts for the price of one day on slashdot?

Re:Cracking...

[shish]

+8, funny. You just social hacked the mods \o/

Re:Cracking...

[umrgregg]

It's these crazy Monday /. mods.

I'm familiar with this course ...

[Anonymous Coward]

The instructors are actually quite knowledgeable in the field, and the texts, though not anything you couldn't compile with a fair amount of time at SecurityFocus and the like, are pretty good for people who are technically competent but who don't know much about security. The level of knowledge is certainly well above script-kiddie level, and I'd say that it's sufficient for junior security team members. (Disclosure: My company asked me to check out the dog-and-pony show for the class, but neither I nor any of my co-workers attended the full class.)

Is it worth $4,000? Depends what you're looking for. If you're trying to train up new secteam personnel, it might be a good buy. At the same time, experienced security researchers will find it a solid but not frontier-pushing class, so I wouldn't recommend it to anyone who, say, posts to BugTraq. As well, a lot of specialized platform knowledge also gets passed by, so this doesn't obviate the need to do significant research on your particular installations.

Re:I'm familiar with this course ...

[StraightTalkExpress]

Is it worth $4,000? Depends what you're looking for.

From the writeup it sounds like it's mostly corporate/gov't/military types looking to get a look at The Enemy from the inside.

Re:I'm familiar with this course ...

[stephanruby]

From the writeup it sounds like it's mostly corporate/gov't/military types looking to get a look at The Enemy from the inside.

From the actual people interviewed in the writeup it sounds like it's mostly unemployed inarticulate high school kids who were given the class free-of-charge because they were friends of the instructor.

-----
"It's an amazing thing how insecure the big corporations are," Echemendia said during a break in the weeklong seminar. "It's just amazing how easy it is."

Hackers are believed to cost global businesses billions of dollars every year, and the costs to defend against them are soaring. One study by Good Harbor Consulting showed that security now accounts for up to 12 percent of corporate technology budgets, up from 3 percent five years ago.

"This is definitely bleeding edge -- so bleeding edge in fact, sometimes, that it's frightening," said Loren Shirk, a student in the class at Mt. Sierra College who owns a small-business computer consulting company.

Comment removed

[account_deleted]

Comment removed based on user account deletion

script kiddie?

[MattW]

Script kiddies don't need to know why symmetrical encryption is faster... they just need to know how to subscribe to Bugraq.

I suppose their assignment is...

[farzadb82]

To break in and steal the source code for Duke Nukem Forever ?

crypto

[Anonymous Coward]

symmetric versus asymmetric key cryptography (symmetric is faster)

That's like saying "sleeping vs driving (sleeping is faster)". Two different things used for two very different purposes...

Uh...who cares about the speed

[Anonymous Coward]

Instructors race through topics like symmetric versus asymmetric key cryptography (symmetric is faster)

If the extent of what they teach you about symmetric and asymmetric encryption is that symmetric is faster, then you should be demanding your money back. Saying that symmetric is faster is neither a useful comparison, nor even neccesarily true.

Link...

[Anonymous Coward]

Link to the official h4x0r1n6 t00|, handed out only for those who have received their degrees.

0f1c14| H4x0r1n6 t00|

CISSP Renamed?

[Anonymous Coward]

:p

Crap

[freaksta]

Old news :( Honestly please stop posting this crap. Not only is it old news, but its really alot of poo poo. Try reading Phrack or other underground zines. There are tons of entry level zines and zines that are for more advanced users (phrack). Save yourself $4000 and do it from the confort of your own home. If you want to know how hackers think, try speding some time on undernet. You get the feeling real quick :) This is not a flame.

CEH Cert

[ignaric]

My company sends me to pretty much any security course I want to learn a thing or two and to keep up with the trends. I'm a CISSP and if you've already gotten that far, the CEH is really really basic. You are far better off spending your money on a SANS conference and prepare for a GIAC cert.

Mmm... Maturity

[superpulpsicle]

You can teach kids how to use a gun, but you cannot make them mature over night. That's why it's better off NOT teaching kids how to use a gun. I don't care if they are A students, kids are kids, they do stupid things. Even if they have an IQ of 1000, it's no different.

Re:Mmm... Maturity

[cynic10508]

You can teach kids how to use a gun, but you cannot make them mature over night.

That's why someone should wait until their kids are mature enough to understand the consequences before teaching them things like guns. Driving is a good example also. Although ignorance doesn't work either. To paraphrase Kierkoff (sic): "Security through obscurity: isn't."

Education?

[wasudeo]

Shouldn't this article be in `Its Funny Laugh'?

Ethics in Three Simple Lessons

[handy_vandal]

(1) Do as I say, not as I do.

(2) Do it to someone else, not to me.

(3) You learned this from someone else, not from me.

-kgj

My company sent the IT manager on this course

[CdBee]

Well, actually it was a UK course teaching the same curriculum, it seems.

Shortly afterward, the fucker got fired for gross misconduct, and hacked our company's servers using backdoors that he'd personally set up. So no, I'm not too impressed by people teaching this.....

Re:My company sent the IT manager on this course

[Seek_1]

Hmmm. That's rather unfortunate.

Ordinarily though, I'd be more "not impressed" by the people securing your network that allowed the backdoors in the first place..

Re:My company sent the IT manager on this course

[CdBee]

Fair comment. In my defence, I was the new trainee and dependent on the outgoing IT manager for training. Suffice it to say I've now got better training and better security!

About time

[RedShoeRider]

...but if you think about, it was just a matter of time before something like this caught on. In CS/CE, the measure of how big of a man/woman you are is how many certs you have to your name (at least it is in quite a few corportate environemnts). Soon enough, we'll see job postings that see "CEH preferred".

Though as it was already pointed out, this is an excellent example of social engineering. They ought to give kickbacks to Mitnik for every fool who enrolls in the class.

In other news...

[192939495969798999]

75% of the graduating class is under house arrest for hacking back into the schools' cc merchant account servers and getting their $4000 back. The other 25% also stole back their money, but couldn't be traced, and are presumed at large.

Re:In other news...

[Yardboy]

Daniel Simpson Day - whereabouts unknown.

I am not a native speaker :-)

[RAMMS EIN]

Err...the confusion of degree and diploma is probably caused by me using the words incorrectly. I am not a native speaker of English, but haven't spoken my native language (Dutch) seriously for so long that I wouldn't know how to name these things correctly in that, either.

I might have been better off if I had done more investigation, indeed, but there are a couple of issues that complicate things. The college I attended gave me a BA degree, and few of the courses I took were CS courses (they didn't really offer any). On this basis, many universities won't even accept me, unless I do a bachelor first. However, I already know much of what I need to know, so a CS bachelor would probably bore me to death and cause me to drop out because of that.

The university I am in offers plenty of interesting courses in CS and EE (which I personally don't like to do, but my girlfriend likes it a lot), and has good facilities, and accepted me without requiring me to do take a bachelor program first. Also, I was hoping that since a lot of open-source projects have a major distribution hub here in Enschede there might be some interesting activity going on. I haven't really found that yet, but then, I've been too busy to look for it.

I can speak to this topic in a strong way...

[krinsh]

You WILL NOT learn hacking, even in the context that they're teaching (subverting the security of computer systems), in a class. You may learn about all kinds of tools; and about steps and techniques to attempt to break into computers, but the real work is not in a classroom. I still believe this after taking SANS Track 4; which was excellent training, but did not drop me back on the street with the ability to be pen tester extraordinaire. It's like the commercial says: you get good with practice. I think that's part of the reasoning behind SANS's practical papers for their certifications - so you research, and PRACTICE, and learn things by doing. Now, let me add yet another disclaimer to my posts - practicing does not mean going out and writing malicious code and breaking into sites. Practice means taking your own little air-gapped network and exploring every aspect of the art that you have time and aptitude to learn. Real hacking, the essence, and I'm not trying to start a definition war here; is trying everything you can and learning everything you can - for good or for evil now; but you get the point.

Hmmm

[Anonymous Coward]

Hmmm, perhaps 'certified arrogant ass' is more fitting for the submitter/editor.

I've dabbled the last couple years in computer security and rolled a lot of exploits. (I've read every damn book, article and theories, everything from the "smashing the stack for fun and profit" to the latest O'Reilly Secure C & C++ Programming Cookbook).

I don't parade around as an ass and try to make others feel lesser than themselves just because I've written shellcode to 'sploit a couple bigger name products.

A Social-Hacking Honeypot?

[00Sovereign]

Perhaps the real reason for this class is simply to collect a large mass of 1337 Do0d5 in once place for their eventual "disposal"

--Shhhh....don't tell anyone.

Not script kiddies

[Anonymous Coward]

The course seems pretty expensive and probably not exactly ideal, but it's a bit more than just script-kiddiesm. Unless, of course, the tests look like this:

Q: You are the IT manager of an online business. The owner is pleased to announce that the business has enjoyed rapid growth, and has asked you to prepare an outline of system upgrades and estimated costs to deal with an estimated 8,000 daily visitors consuming approximately 320KB, with the number of visitors doubling every six months. What are your main concerns likely to be? (circle all that apply)
a) Cost of expanded bandwidth utilization
b) Maintenance issues associated with a medium-sized server farm, as well as software concerns regarding your web application and load balancing
c) Continued self-hosting via the corporate T1 line vs. co-location
d) wtf ???? ummm just run linux+apache d00d !!!!!

Q: You are a consultant, hired to evaluate the security and efficiency of a small business's server configuration. Your employer, inexperienced with both the technology itself as well as online business in general, has hinted to you that he's not certain how competent his system administrator Simon is. In evaluating the systems, you discover that Simon has misappropriated the server budget to upgrade his desktop system to play Unreal Tournament 2k4, and has left the actual servers themselves equipped with 386s and faulty hard disks. As you were confronting him about this in the server room, he excused himself from the room to fetch "documentation" while his young and pimply-faced apprentice tripped the halon fire extinguishers. What should your reaction be?

a) Immediately contact the police.
b) Inform the manager, and urge him to speak with the apprentice's parents about a possible intervention.
c) Return a favorable report after realizing that you have become tangled with things far larger than you, and never interfere with those servers again.
d) whats a halon fire

Q: A company has suffered a break-in. Not having a security professional on-hand, they have turned to you as a forensics consultant to help them assess the damage, identify the point of origin, and take appropriate response measures. What will your first action be?

a) Request a list of all servers on the network with their operating systems, as well as servers and version numbers.
b) Unplug the servers.
c) Inquire if there is any way an employee could have accessed the servers.
d) Ask your friends on EFNet if they did it.

woo-hoo!

[ed.han]

yet another cert! c'mon guys, you know you love cert-creep!

ed

Re:woo-hoo!

[yintercept]

The hacker certificate raises the interesting question of whether cheating on the final exam is a greater badge of honor than acing the test.

Mark this:

[Anonymous Coward]

1in0x 4 h0m0s

Not Able to Call This "Ethical"

[cynic10508]

So they're teaching skills. That's not ethics. "Ethical" hacking, if there is such a thing, requires action, not just a skill set. So the ethical part is how you use your skills.

Ok boys n gals. The 5 Golden rules

[Man in Spandex]

to become a true l33t hax0r:

Rule #1: Soviet Russia does NOT hack you
Rule #2: Windows hackers are referred as "llamas", therefor, do it more!
Rule #3: DDoS attacks are also referred as "trainee's training"
Rule #4: Hacking an O/S which makes part of 1% of the market makes you an l33t3r h@x0r.
Rule #5: If you get caught, you blame it on the guy who doesn't speak english. Ah Zutroy.

wardialing?

[sirGullible]

wtf? ethical and wardialing in the same paragraph?
how do you ethically wardial?

Cracking...

[umrgregg]

This is true 'ethical' hacking. And you don't even have to go to school to learn it. Well never mind, you have to go to school...

WTF - WTC motivation

[morcheeba]

after the Sept. 11, 2001, attacks on the World Trade Center and the Pentagon, the company expanded its focus to information security courses.

That makes no sense. I could see them expanding in the wake of some vicious worm or virus, but they might as well take their inspiration from Chechnya. It makes it seem like they are in the business to trade on fear-of-hackers rather than to provide real security. Not that that's a bad marketing angle, but just one I'd have moral issues using.

Not even a new concept to Slashdot...

[WebCowboy]

...The idea has been covered here before. Of course, this time around students are paying a lot more ($4000) so I guess that part is new ;-)

j00 have a degree now.

[siliconjunkie]

7Hi5 c3r7iFi35 7H@7 U g07Z p@5$3D @Ll 7h3 rEqUiReD c0uR535 f0r H@ck3r c0lL3G3. U @R3 N0W 31337.

Why?

[Anonymous Coward]

It's a perfectly cromulent word.

Their training video....

[theJerk242]

I bet their training video will be the movie Hackers.

Cracker

[mfh]

> You know, it's only been within the last few years that I've heard any significant usage of the word "cracker" with regards to computer security.

It usually means dumbass white motherfucker where I'm from.

Glorified Script Kiddies? I think not.

[Cheirdal]

Actually there is a need in the business world for ethical hacking. I know companies that do ethical hacks against sites that host their products every time they offer a new product to the public via the web. Having a working knowledge of cryptography and knowing how to apply it when trying to hack into a site and/or database is beyond a pimple-faced 15 year old sitting on daddy's computer tweaking existing virus code.

It's not really a $4k tuition fee

[TiggertheMad]

The $4k is just a security deposit. The graduating students hack into the schools accounts and steal the $4k back once they get their diploma.

Doctor heal thyself

[g0bshiTe]

The same goes true for hacking. I don't know of anyone who would drop $4000 on a one week course in hacking. There are plenty of sites out there solely to teach this to a new generation of 1337 kod3 k1dd135.
Does the teacher delve into the reasons why most Windows systems are compromised? Are the first two days dealing with using strong passwords? Day three kernel patching. Do they teach how to write shell code? To they teach a course on ASM so the student may reverse software to find flaws? Do they teach about buffer overflows and injecting code into the buffer?

The point bieng a piece of paper doesn't mean a thing. Can these people now implement what they have learned? Can they use SQL Injection? How can you cram all that in a week?


BTW for $4000 a week do you get a hummer with that?

Ugh.

[SCHecklerX]

Somewhat related annoyance:

The same guys who push the MCSE courses on the radio have, for the past year, been advertising "You can become a cyber-cop!". I think it is computer learning network. They basically guarantee that you'll learn everything you need to know to work in the security field by taking their 10 week course.

Don't think yourself so superior.

[phyruxus]

Good point. Didn't realize I came of so haughty sounding. FWIW, I Am Not "Elite".

CEH vs OPST (from pen-test)

[jrl]

For me, the value of a class is not in the test or even the certification at the end. The lasting value is in the knowledge and skill set that you refine and take with you back to your job. I also have made lasting relationships from the classmates, students, and instructors that I've met over the years. All of these mean a lot more to me than the "e-i-e-i-o" at the end of my name.

I gravitated towards ISECOM's OPST/OPSA classes because they fill a role I felt was missing in the security class space. Many non-vendor specific security classes have a very narrow tools based focus. While I agree that knowing how to use your tools in a test is important, I feel knowing why and when to use them is far more important. Knowing the politics involved in testing, going over internationally accepted testing practices, and reviewing regional and national legal regulations are just as much part of the job. These things are not merely important, but are required to be successful in your role as a security tester. In addition to the intensely technical aspects of the testing process, this is what the OPST represents; the "professional" side of security testing. Also, the ISECOM classes teach from ISECOM's Open Source Security Testing Methodology Manual (OSSTMM) which provides a much needed methodical framework to bring a scientific method style to the chaotic world of security testing.

The CEH class represents the other kind of class. One that is "flashy", "fun", "exciting", but not overly useful to the serious professional. While I have a lot of respect for Clément (one of the instructors for Intense School), I have very little respect for any organization that markets "hacker" classes. This includes the so-called ethical hacking, applied hacking, exposed hacking, grandmother hacking, squirrel hacking, super-duper 3y3 4m 31337 hacking, or any other fancy way of saying "Learn how to think and act like the bad guys".

While choosing where to spend your time and money, consider the community you are aligning with. If you look at ISACA, SANS, ISC2, ISECOM, etc.. they all have a true dedication to security and the betterment of the global information security community. Contrast the value of being affiliated (via education/certification) with any of those organizations over a piece of paper and a cd of toys.

Very, very OT: Re - Your sig.

[Anonymous Coward]

"10 out of 10 Terrorists agree - Anybody but Bush in 2004"

Which is a bit of a dumb sig. He's the best recruiting sergeant that Al-Quiada ever had. I read one analysis that said that the A-Q are desperate to commit an "atrocity" on US soil during the elections in order to gift the election to Bush, and keep him in power.

always call at night ?!?!

[Anonymous Coward]

works best if you try during the 13:00 - 14:00 hour, the entire place is either AT LUNCH, or comatose from the 4 martini lunch. During the noon hour the entire place is likely to be on the net making bandwidth too precious. After hours calls attract too much attention these days.

fast hacking

[uberfruk]

"Instructors race through topics"
I thought hacking was only fast in the movies.

Grrr!

[Hassman]

Ya know, I used to hate it when people would bitch about subimitting a story and getting rejected...then a few hours later it gets posted from someone else.

Well, now I understand. I submitted this story earlier this morning. WTF? To everyone else who has been hosed on and rejected... I now feel your pain.

*tear*

There is always something more.

[tonedevil]

He was held without bail and without charges before all the cool muslim kids started doing it.

college vs. university

[jhagler]

I was always under the impression that (at least in the US) the difference was that a university had graduate programs and a college didn't. I went to Sewanee and we were told that it is considered a university because if offers a graduate degree in theology, while other schools in the area, such as Davidson College, were colleges because they had no graduate programs. It's the difference between being able to give Bachelors and Masters degrees.

Anyone else heard this version?

heh

[ed.han]

now that is an interesting question. of course, given the attitude of the test designer, that might actually be redundant. :>

ed

RE: Security testing methodology

[jrl]

The security testing world actually has a pretty good methodology behind it now.

Check out the Open Source Security Testing Methodology Manual (OSSTMM) from the Institute for Security and Open Methodologies (ISECOM)

school name

[auroran]

hmmm i wonder what the school's called
maybe "0wnz U"?

Script kiddie education cost breakdown

[Anonymous Coward]

Script kiddie preschool: $500
Script kiddie kindergarden-middleschool: $1000
Script kiddie highschool: $2500
Script kiddie juco: $3000
Script kiddie U: $4k
Cost of being the scapegoat for when your company gets hit hard by other script kiddies when the boss asks you "But I thought you where certified to deal with this?" as your escorted out of the building: priceless.

My computers teacher used to say...

[Anonymous Coward]

that she was a hacker who worked for big businesses. She said it was so easy 'hacking' because they left the passwords on post-it notes on the screens (no shit) Throughout the whole year, I would get yelled at by her for 'being wrong' or 'arguing with her', whenever SHE was wrong. She told me that if I turned off a computer while it was on, it would mess up the BIOS and that my family would have to pay the school two thousand dollars to have a DELL Pentium 4 with CRT monitor to be fixed. God I hated her.

that would create a paradox

[LuxFX]

'What we attempt to do in our classes is teach how the hackers think.' Hmmm, perhaps 'Certified Script Kiddie' would be a more accurate designation.

Except then it would be "What we attempt to do in our classes is teach how the script kiddies think." And putting the words "think" and "script kiddie" next to each other like that creates a paradox. Impossible to comprehend, much less teach.

"Harmless" Hacking?

[Saeed al-Sahaf]

A past offense doesn't guarantee a future offense any more than a lack of past offense guarantees future ones.

Just because I have had 12 DUIIs in the last 5 years, committed 4 burglaries since January, and shoplifted countless packs of smokes does not guarantee that my car will be visiting your front yard late at night or that I think your new flat screen will look better in my living room... But maybe it gives a clue of possible trends in my lifestyle...

Re:"Harmless" Hacking?

[wwest4]

Yes, good point, rep is a good indicator when there are a lot of data points to be had. I should have clarified that I was thinking about those with a past conviction and no relapses (Mitnick or Morris, for example).

root passwd...

[Anonymous Coward]

how about r00+?

can I use r00+?

RTFB!!! Well then, here are some...

[Anonymous Coward]

As some one posted earlier RTFB!! I am quite interested in this topic, and I have been reading the books. An earlier post mentioned Ankit Fadia, but did not mention his book. "The unofficial guide to Ethical Hacking", has thus far been a pretty good read. He does not touch on WinXP, or 2003 server. Also he is not that up on the networking side (my forte), so ignore some of his IP Address/class information. I think his book is well written if a bit dated. I have read about 6 other books on the topic. The last time I programmed was Basic (dating myself aren't I?!!), and I also agree that if you don't program you shouldn't call yourself a hacker (Script Kiddie maybe, but not a Hacker). Kevin Mitnick's book "The Art of Deception" was also a pretty good read. One of the chapters is in essence the outline of a security class/policy for corporations. Reading Mitnick's book will force you to change undergarments, and at the same time become more aware of Social Engineering tactics. Also others have pointed out the plethora of information on the web. If you really want to remain anonymous I wouldn't be looking up this sort of info on the web (yep! I am paranoid.), but rather fork over some cash @ your local book store to remain as anonymous as possible. Not that I am looking to crack, but being associated with those words in a IS/IT job can be considered a career limiting decision.

BTW I am not an English major, so please ignore my poor grammar/punctuation/run on sentences/etc...

Like most things in IT

[blackbear]

Some people are good at it. Most aren't. And the PHBs can't tell the difference.

so the job goes to the person more interested in tooting his horn and being spoon fed pre-digested drivel, than in learning and in doing the job well. I'm sick of working with idiots, and half of them are taking this class.

<tangent>
I only went for the CISSP because it seemed like it was the hardest to to get. 250 nit-picking questions over ten major areas in 4 hours. Then another CISSP has to say that you know what the hell you're doing or you took the test for nothing. But management can't tell the difference between that and an MSCPC (Micorsoft Certified Point and Clicker. (I was the first to use that acronym 2 years ago, don't you dare claim it for yourself.))

I still value my CISSP since it was difficult to get. But I'm sick of the InfoSec field since it's become a haven for Doogie Howzer with a CS degree and no idea about how to protect information.

I recently had an interview, in wihich I was told that my skills were right on, but my personality just wasn't a fit for the organization. Reading the above you probably get an idea of what they were talking about. I still don't. I don't know anone who is any good at this shit that fits in even halfway. Who cares about your quirks as long as you can function in society and keep the bad guys off the servers.
</tangent>

This class is just one more example of a solution in search of a problem.

sixty bucks and go to defcon

[IrishMASMS]

Excuse me, but when was the last time you went to Defcon?

It must have been afew years, because the last two years it cost $75, and this year it is supposed to go up to $80.

Or do you know a secret that you are not sharing with the rest of us to save $20? =)

Re:sixty bucks and go to defcon

[Maradine]

Last year. I watched almost the whole thing from the bar. Fyodor's quite entertaining after a dozen Vodka Gimlets or so.

As for the cost, its called, "buy Blackhats and the Defcon's free." Sixty was a round number. I'll be more specific in the future. *grin*

Re:sixty bucks and go to defcon

[Anonymous Coward]

must be nice to be a rich 'tard (or have an employer that is willing to foot the bill) and can afford blackhat.

Some day, I will find one as well.... some day =)

I know....

[Seraphim_72]

How about appending "pirate" to it - it seems to be all the rage these days. Computer Pirate, Network Pirate, LAN Pirate, etc. Plus for this school instead of a cap and gown you could get to wear a cool hat, eyepatch, and the valedictorian would get a parrot.

Re:I know....

[Anonymous Coward]

Don't forget Ass Pirate...

Oh and...

[Valiss]

....back up everything. Twice.

certified ETHICAL hackers

[1ucius]

I wonder how they test ethics?

war dialing?

[bl8n8r]

Holy shit.. they need to upgrade their curiculum.. unless of course they are practing the chapter "how to find tone for fun and profit while in the Matrix"

Sorry for the polemic

[bluethundr]

10 out of 10 Terrorists agree - Anybody but Bush in 2004

Sorry, couldn't let that one go past.

The terrorists are very likely to want Bush in the Oval Office. House of Bush, House of Saud details the business relationships between the Bush family and the Bin Laden family, as well as the ruling Saudi family. Bush's military record was enough to label him a "deserter" by Michael Moore. To whit, the White House released a censored version of Bush's military record. What was censored? Curiously, it was one name: that of James R. Bath. We know this because copies of the GW Bush Military record from 2000 still show his name. It was censored post 9/11 due to the fact that James Bath was a buddy of GW's from the military. After the military, Bath went into the Aviation business and his first business deal was to sell an airplane to Osama's brother. This is all a matter of public record. Since the early 70s, the Bin Laden's (second wealthiest family in Saudi Arabia) continued to funnel money to Bath, who in turn funded several failed oil business of GW's. GW was great at drilling empty wholes that didn't provide any oil. When GHW Bush (first president Bush) was in Office the Carlyle group invested a TON of money into what would turn out to be ANOTHER failed oil business captained by Baby Bush. Several Bin Ladens sat on the board of Carlyle. Since then, Saudi oil money has funneled roughly 1.5 BILLION dollars per year to Bush, their family and friends. If you're being paid $400,000 dollars a year to server the American people and another group is paying you $1.5 billion (with a "b") per year, whose interests do you think you would represent?

The only problem is that Saudi has a public face and a private face. The Prince is the public face, and his brother is the minister of the interior who fosters the furtherance of their wahabist culture. They (the Wahabis) run the schools and religious instruction of the youth in that country. As early as 3rd or 4th grade, children's textbooks start to refer to America and the West as "The Great Satan". The Princes' brother is funneling money to those people that run the schools.

In the time since Iraq had been invaded AL Qaeda has grown in size, power and organization. America's military structure is still geared towards a cold war way of thinking. Al Qaeda has been able to morph into a true Information Age culture, using the web, cellphones and other technologies to conduct their horrors. The real focus of the "War on Terror" needs to be on Afganistan and the Wahabi's in Saudi. While we have few qualms invading Afganistan, there is simply NO WAY a Texas Oil Man who sits on the throne America Tis going to jeapordize America's relationshiop with the Saudi's. Whose total investments per year represent roughly 7% of the total American economy. No way. The war in Iraq is nothing more than a distraction on what SHOULD be the war on terror. Don't fool yourself.

Ethical Truth? How About Ethical Film Makers?

[rm3friskerFTN]

J. Michael Straczynski's Babylon 5 "Illusion of Truth" episode leads one to speculate JMS is aware of how "truth" might not always be ethical truth ... remember that Dan Randall (the b5 ISN news reporter) was very truthful ... he just strung the facts together in an unethically truthful way

From

"Illusion of Truth" plot summary (spoiler warning)

From a second "Illusion of Truth" plot summary (spoiler warning)

From a thrid "Illusion of Truth" plot summary (spoiler warning)

And finally a fourth "Illusion of Truth" plot summary (minor spoiler warning)

Ed Koch (democrat mayor of New York City from 1978 to 1989) might agree there is a need for "Ethical Film Makers"

Disagreeing with America's foreign policy and seeking to change it, responsibly or irresponsibly, is a fundamental right protected by the First Amendment.

Shaming those who do it irresponsibly [unethical Moore?] is our only lawful recourse and rightly so.

Senator John Kerry in criticizing United States' foreign policy and the incumbent president is acting responsibly, albeit I disagree with many of his views. On the other hand, Michael Moore, writer and director of the film "Fahrenheit 9/11," crosses that line regularly. The line is not set forth in the criminal statutes, but it is determined by Americans who know instinctively what actions and statements taken and uttered violate the obligations of responsibility and citizenship they deem applicable in time of war.

Franklin Roosevelt (president of usa during ww2) might agree there is a need for "Ethical Film Makers"

And, finally, there are a few among us who have deliberately and consciously closed their eyes because they were determined to be opposed to their government, its foreign policy and every other policy, to be partisan, and to believe that anything that the Government did was wholly wrong.

To those who have closed their eyes for any of these many reasons, to those who would not admit the possibility of the approaching storm--to all of them the past two weeks have meant the shattering of many illusions.

They have lost the illusion that we are remote and isolated and, therefore, secure against the dangers from which no other land is free.

In some quarters, with this rude awakening has come fear, bordering on panic. It is said that we are defenseless. It is whispered by some that only by abandoning our freedom, our ideals, our way of life, can we build our defenses adequately, can we match the strength of the aggressors.

I did not share those illusions. I do not share these fears
[snip][snip][snip]
But there is an added technique for weakening a nation at its very roots, for disrupting the entire pattern of life of a people. It is important that we understand it.

The method is simple. It is, first, a dissemination of discord. A group--not too large- a group that may be sectional or racial or political--is encouraged to exploit its prejudices through false slogans and emotional appeals. The aim of those who deliberately egg on these groups is to create confusion of counsel, public indecision, political paralysis and, eventually, a state of panic.

Sound national policies come to be viewed with a new and unreasoning skepticism, not through the wholesome political debates of honest and free men, but through the clever schemes of foreign agents.

As a result of these new techniques, armament programs may be dangerously delayed. Singleness of national purpo

Intro to hackin stuff

[kaoshin]

Today class, before we get started I want to bring something to your attention. Before any of you even stepped in the door, you were all owned by us. We totally ripped you on four big ones. Sorry about that, but we had to do this to stress the importance of decision making. Don't feel bad though. You all need so much help that we shouldn't have much trouble putting together a great set of lesson material. Lets see...

*searches on google*: hacking computers

5 matches down = "How to become a hacker"

Ok class. To start things off, lets ask ourselves the question "What is a Hacker?"...

something you missed

[Anonymous Coward]

College also teaches you communication skills. If your post is any indication of how you handle written communication, then that may be the one thing holding you back.

I went to college, and paid off all my student loans within 5 years of graduating. It helps that I had a scholarship.

Having been in the field a while now, including being involved in the hiring process, I can say that candidates with college degrees are given much higher priority than candidates without. That doesn't mean that a college degree is required, but those with college degrees definitely get offered a higher starting salary at every company I've worked for.

Whistling in the dark (Re:[cynical])

[ediron2]

I really respect where you're coming from, but you might still want to consider knocking out 'any old' degree just to have the piece of paper. Every good techie I know that lacks a degree has eventually been demoted or passed over by an employer that overvalues degrees.

• One was the VP over IT until they realized he lacked a BS degree. Suddenly, pay cut and a new boss. Six months later, he was doing the same work as before, with less pay, and his boss was getting a fat check for .. well, for doing nothing much.
• Another took night classes for 12 years (add in kids and work and his was a seriously cramped lifestyle) because of getting burned that way.
• Another brilliant one has hit his head on a promotion ceiling twice. Both times, it's made him bitter enough to leave the company and move on. Both times, his new job started at 90% of the old job's paycheck, let him climb a while, and then stagnated. I hope this time he'll have better luck...
• At the same time, I know programmers with english and teaching and political science degrees. Techies don't diss 'em, if they're competent. And employers don't discriminate that finely, usually. They just notice the degree.
• Don't just take my examples. Ask around in the 45-and-older crowd, and see how many war stories you hear.

It's unfair. It's foolish. And it's real. You can make a good living without a degree. But you'll often make a better living with a degree.

Re:Whistling in the dark (Re:[cynical])

[1lus10n]

Nice examples, and your point is taken, however I wouldn't work for a company that tried to fuck me. Matter of fact I would fuck them back.

I know programmers with english and teaching and political science degrees. Techies don't diss 'em, if they're competent.

Yes, *IF* they are competent.

Ask around in the 45-and-older crowd, and see how many war stories you hear.

Agreed however there is also a lot of seperation between the amount of "degree" people and non "degree" people from back then, now everyone and their mother has a degree, its devaluing the effort it takes to get a degree when so many people who dont know or like computers can attain them. Thankfully employers are now realizing this and adjusting their requirements. It is one of the few things I can thank the .com bust for.

Re:Whistling in the dark (Re:[cynical])

[admdrew]

It is one of the few things I can thank the .com bust for.

The companies that failed during the dotcom bust did so because they had no real revenue, something that wild-eyed entrepreneurs failed to see as a problem. Look at the companies that survived (and prospered) and compare them to the ones that floundered. Ebay, Google, and Yahoo did not employ individuals above and beyond every other company (there were many bright individuals who worked for failed dotcomers). They emerged because they've all had a sound business sense and made more money than they spent.

Re:Whistling in the dark (Re:[cynical])

[1lus10n]

You missed the point. The .com era introduced a slew of people who had no passion, desire or creativity about computers. They simply choose this field because of the money and because at the time you could clear what a lawyer or doctor was making; with only half (or less) schooling.

Having a fuckton of these types of people (majority perhaps ?) wandering around applying for jobs that they have no business applying for is what is making the HR and PHB type's think there are no qualified people in the IT industry. Hence fueling the offshore craze.

I once had a headhunter call me and say she had over 3000 applications for a junior sysadmin position that paid 50k/year in the bay area. She almost begged me to consider the job because I was one of only four people she could find who were qualified for the position. I never even applied for it, she pulled my resume of the net. (it was even two years out of date.)

Re:Whistling in the dark (Re:[cynical])

[admdrew]

I'm getting a little confused as to what your stance is. If it bothers you that so many people have flooded the IT industry because of money, you should encourage people going to college. People who aren't interested can get weeded out without having to affect the market out there. Doing work with little immediate payoff (and, indeed, having to pay to do that work) is a good incentive to quit something that you don't like. However, if someone goes into a well-paying tech job out of high school, they may be inclined to stay there despite not being terribly adept at it.

Re:Whistling in the dark (Re:[cynical])

[1lus10n]

... I disagree. College is a lot easier for many people than you seem to think. Once they actually make it through college they have even more incentive not to quit, and the employer has more of a reason to keep giving them chances.

Re:Whistling in the dark (Re:[cynical])

[admdrew]

Name one reputable educational institution where it's easy to get an IT degree. Oh, and what college did you go to that was so easy?

Sure, lots of people can get through relatively easily with mediocre grades, but a 2.0 GPA won't get someone a whole lot of job offers. Actually, anything less than 3.5 and you're terribly lucky if you graduate with an engineering degree.

It's disheartening to see your arguments boil down to a simple assumption you've made about something you know nothing about. I was kinda enjoying this up until now.

Re:Whistling in the dark (Re:[cynical])

[1lus10n]

Name one reputable educational institution where it's easy to get an IT degree.

Depending on your definition of "reputable",I have attended school for a total of three semesters at two community college's and have done some serious research on a few of the online offering's (UofPheonix, Berkley) and found them seriously lacking in the "reality" department. Of note is the fact that I did a large part of this work AFTER I started working in IT .... hence I did know a lot more than most students (and a hefty portion of the teachers)

I have also been involved (on some level, not always as a student) with two other universities in the area (RIT and U of R).

I might also reference that of the team of 9 people I work with 6 of them have degree's (4 in computers, one MBA, one Chem.). The two people who are the best at doing what we do do not have degree's (Not including myself.). This has Generally echo'd with all of our clients (AOL, Allstate, TimeWarner, Chase etc etc). No one I know has had any difficulty in attaining a degree in computers. However obviously there are schools out there that are beyond what most grads can handle (or what most non-grads could handle) like MIT.

Never actually looked into what the average employer does as far as research into grades and schools. I can gaurantee its not as in-depth as you think. I know several people who work for a major Linux company who lied their asses off on their resume's and got jobs paying very large amounts of money. They kept their jobs because it is very very difficult to fire someone where they are located, and because they can bullshit their way out of almost anything. Welcome to the state of IT ....

It's disheartening to see your arguments boil down to a simple assumption you've made about something you know nothing about

::SIGH:: Its sad to see you assuming things. It's even sadder to see you basing your opinion off of what very little full time experience you have. (wonderful when people assume shit isnt it ?)

Re:Whistling in the dark (Re:[cynical])

[admdrew]

I have attended school for a total of three semesters at two community college's [sic].

I have no desire to demean anyone that has attended a community or technical college, but I will point out there are very real reasons why they offer two year programs for far less money than a four year university. Their degrees are less comprehensive and rarely offer study in the area of engineering.

[I] have done some serious research on a few of the online offering's [sic] (UofPheonix, Berkley) and found them seriously lacking in the "reality" department.

What kind of research have you done? Have you emailed professors and school officials? Have you previewed course materials? At any rate, a standard employer would have difficulty placing any amount of respect on an online-only degree. Ask around.

I have also been involved (on some level, not always as a student) with two other universities in the area (RIT and U of R).

I once ushered during a music concert at a college in my hometown, but that sort of involvement doesn't really apply.

In all honesty, how involved were you? You say "not always as a student," alluding to the statement that you were indeed a student some of the time. Considering your stance on this matter, it's a little surprising you didn't bring up before that you've been a student of RIT and U of R (Rochester, am I right?). If you were not enrolled, how exactly does 'being involved' help your credibility?

The two people who are the best at doing what we do do not have degree's [sic] (Not including myself.). This has Generally [sic] echo'd [sic] with all of our clients (AOL, Allstate, TimeWarner, Chase etc etc).

Unless the degreed employees are notably worse at their job than the non-degreed ones, you don't have much of an argument. The people that went to college obviously got more use out of a higher education than your two best people would have. I've never said "a college degree makes you the best and brightest." Hardly; it can make you better and foster intellect in a way not possible in a standard day job, but it isn't something magical like you seem to be skeptical of.

No one I know has had any difficulty in attaining a degree in computers. However obviously there are schools out there that are beyond what most grads can handle (or what most non-grads could handle) like MIT.

There is a huge spectrum from 'not difficult' to 'impossible.' If the previous example you gave with your co-workers is any indication, you don't seem to be the best at gathering sample sets. However, let's assume these people are the norm. What institutions did they go to? What degree programs were they in (example: I'd have an easier time with a CS degree than I would with an ECE degree, primarily because my geekiness and work history have been closer to software than hardware)?

Never actually looked into what the average employer does as far as research into grades and schools. I can guarantee [sic] its [sic] not as in-depth as you think.

Since you've relinquished any sort of credibility on this subject, I'll assure that it's quite a bit more in-depth than you think. Having been involved in a few hirings (not just my own :-P) at our company, two degreed applicants were turned down because of their sub-par grades. The one that got the job has been one of those straight-A 4.0 students all his life, something that ended up being terribly important.

I know several people who work for a major Linux company who lied their asses off on their resume's [sic] and got jobs paying very large amounts of money. They kept their jobs because it is very very difficult to fire someone where they are located, and because they can bullshit their way out of almost anything. We

Re:Whistling in the dark (Re:[cynical])

[1lus10n]

First and foremost most of the online degree programs do not issue a degree with an asterisk. There are some that do indeed issue them with an asterisk (such as "Earned online").

Linux Company = Company that focuses specifically on Linux and Linux related products. ie Novell, Redhat etc

there are some jobs (in this case they pay very well) that almost require you to go through college.

My point is that if those people can get the job by lying then perhaps the people doing the background check dont go as in depth as some people think, thus the whole "which school is better" and "grades are important" points aren't very true.

I would also point out that my job *REQUIRES* a 4 year degree, when we hired more people last year thats exactly what they put for req's. I trained those people and I have no degree. I got my job because I knew someone who worked here. There are very few jobs that require a degree that actually require it (if you follow). Most of the time its listed as a requirement its not really important except to the HR assmunch who also has a degree. He lists it so he can feel validated.

it's the way you portray your situation and cut down anyone with a college education that bothers me, especially when based on faulty or nonexistent evidence

College degree's are not as important as people think they are, and they are over valued by people who already have them. Like most things with people it is beyond their grasp to understand how someone can learn in a way different from themselves. Also exactly what makes my experience any less valid or useful as evidence than yours ? Who gets to make the detirmination as to what the rule is and what the exception is ?

why exactly is it difficult for these people to get fired (their bullshit aside)?

In many states it is very hard to dismiss an employee based on hearsay. Such things will have to be proven, or else lawsuits will ensue. The employers in questions dont always know people are lying, they might collectivly have their heads so far up their ass that they cant even tell when they are doing good or bad at their jobs.

why do you think these people lied on their resumes?

"How the hell did you get THAT job ?!?! I Lied" that about surmises it. And they didnt neccasarily lie about school, they could have lied about experience. I know what one of them lied about was what a prior job had for duties, of course corporate policy at that place only discloses pay, title and if they would re-hire the employee.

If the previous example you gave with your co-workers is any indication, you don't seem to be the best at gathering sample sets. However, let's assume these people are the norm.

... As opposed to pulling shit out of my ass ? I used information I had access to and could verify (within reason anyway), I unlike some people do not wish to spew shit just to prove a point. Everything I have said to this point is based on real life experience, which harkens back to my original point: Real life experience > a degree.

Re:Whistling in the dark (Re:[cynical])

[admdrew]

Heh, because it's basically just you and me left, I'll see if we can come to a quick consensus. That, and it's been a long day. If I have to declare another datatable anytime in the next week, I'm probably going to kill someone.

What you have:
+ extensive full-time work experience
+ limited college experience, but enough to formulate a sound opinion

What I have:
+ extensive college experience
+ limited full and part-time work experience, but enough to formulate a sound opinion

We both have a fair amount of technical knowledge, I'd assume, and have taken the opposite sides on the academic/real world argument. So far neither of us have been able to convince the other of his stance.

If the degreed people you've met have inflated the value of their education to something absurd, then I feel for you. That's the sort of unfounded elitist attitude that basically makes up a fair bit of the asshole population. Though I value my education and the educations of others, I'd hate to see myself or anyone I know turn into that.

Oh, sorry for the "faulty or nonexistent evidence" comment. I wasn't referring to your work experience anyway, but I probably shouldn't have said it at all.

I can beat that.

[Anonymous Coward]

I'm a Certified Unethical Hacker. Maybe I'll put that on my resume and see if anyone catches it. Sure it's a lie... but what do you expect? I'm unethical. Says so right there on the certification.

Sounds like $ans

[Anonymous Coward]

If you have 15 chumps paying 4,000 apiece for "hacker" training, you get Intense School quality.

If you have 400 chumps paying 2,500 apiece for "hacker" training, you get $ans quality.

Both are lame imho.

Mods on crack?

[ron_ivi]

This guy got an Insightful and a Redundant.

Can't be redundant, because he's the first guy who made the analogy with the CISSP.

I thought it was very funny. It's like going "you guys who paid for a red-hat cert! i think I speek for all the mandrake-certified guys whan I say... ha ha ha".

Insightful? What, that there's more than one certification organization conning people out of their money?

Re:Mods on crack?

[Maradine]

Honestly, I was confused myself. I was hoping for the standard quick "+5 Funny" hit and then the slow, steady drag of "-1 Overrated" grinding. Go figure.