Slashdot Mirror
School Teaches 'Ethical Hacking'
Yardboy writes "A Yahoo! News/Reuters story discusses students in Los Angeles paying $4,000 to attend 'Hacker College' and become 'Certified Ethical Hackers'. Apparently: 'Instructors race through topics like symmetric versus asymmetric key cryptography (symmetric is faster), war dialing (hackers will always call late at night) and well-known TCP ports and services (be wary of any activity on Port 0)', and the president of the college: says 'What we attempt to do in our classes is teach how the hackers think.' Hmmm, perhaps 'Certified Script Kiddie' would be a more accurate designation."
Better watch out, article submitter! Me and my friends are totally gonna DDOS you now!!!!
And I think I speak for all the CISSPs in the room when I say . . .
hahahahahaha!
Thanks, I'll take self-study and put the four grand down on an M3. Sellout? You betcha. *grin*
trustedworlds.net - gaming, security, and the gunk that lives in between
The name of the certificate is new, but the concepts are not novel.
We went through an entire class about computer ethics. We had to to get a Computer Science degree. And since it was an actual Computer Science degree, we learned all about security and machine language and what have you... basically everyting you would learn in this course.
This program seams like a stripped down version of computer science for people who are only interested in security related work.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
First day. 2day kidZ, w3 LeRN 2 HaX0R t3H g00d w^y...w00t. OMG. RTFB.
"It'll destroy you if you try to make it mean anything to anyone but yourself." - Henry Rollins
What they don't tell you until the PhD course is that it's always late at night somewhere.
Sounds like they are social engineering people out of $4,000.
Am I missing something? Lots of companies are doing this.. for example: InterfaceTT CEH Information
Now we have SCHOOLS that teach that "hacking" means breaking into computer systems
I wonder how long before they offer the qualification of "Certified Pointy Haired Boss"?
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
I remember when the CEH first came out. They may work as a simple start, but they shouldn't be considered a stoping point to learning.
A really sucky "school"..
You teach ethics, not "hacking ethics". Sounds like a money grab for gullible script kiddies.
I shoudlve thought of it first.
Sporting long sideburns, a bushy goatee and black baseball cap, instructor Ralph Echemendia has a class...
He wears a black hat, and we're expected to believe that he's teaching ethical hacking? It's a cover! He's building an army! TERRORISTS!!!
do not read this line twice.
Wake me up when they offer Ethical Racketeering, Ethical Pimping, and Ethical Congressional Campaigning.
I'm offering 5 dollars to help a poor Microsoft programmer attend this school, where he will learn how hackers think in order to stop them. Maybe if we all contribute to the pool, we'll have easier lives.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
4r3 7h3y c3r71f13d 1n 1337sp34k? j00 c4n't b3 4 h4x0r w17h0u7 1337sp34k. ;-)
Do you like German cars?
This is an outrage to all of us who toiled for years to become script kiddies and received no formal documentation of our accomplishments.
I do security
...of self knowledge and recognized accomplishment amongst your peers that only MCSEs have enjoyed up to now.
The problem with teaching Comp Sci, let alone "hacking," is the methodology in which the teachers teach. The only way I ever learned any type of programming was when someone said, "Go build an application that simulates RSA cryptography." 12 C++ files later I learned more then I did in 2 years of "intro" classes. The same goes for this as well, these kids wont get much more out of these classes then learning to use some scripts or demon dial or whatever.
They should get a project that entitles building some sort of application which can be relseased to the Open Source community.
Wow, war dialing, early 90s, wow.
GroupShares Inc. - A Free Online Investment Community.
-------
artlu.net
Learning how to defend against getting hacked by learning how to hack is nothing novel. It sounds like a great idea on the surface, because it gives you the tools to probe your own weaknesses the way your attackers will. But you're always going to have to keep up with the latest methods, scripts, etc. IMO, A net admin who isn't at least a hobbyist hacker probably won't get much from a hacking bootcamp except a false sense of security.
- Greg
Start a happiness pandemic
ICMP is not port 0, it is IP Protocol 1. TCP/UDP port 0 is officially "Reserved"
...although $4000 sounds a little steep. Most hackers are probably self trained, as in $0. Every corporate network better have someone involved in its design and maintainance that has some knowledge of hacking though, or else it will be a sitting duck. I had a professor that was a consultant who hacked companies to discover thier vulnerabilities. Obviously nothing malicious, and he told them about everything he gained access to and fixed it. Sounds like one hell of a fun job.
Recent graduates of the 'Hacker College' realize that their diploma is virtually worthless in the real world and come to realize that they were just socially enginered out of $4000 dollars.
Do they get a white hat with the certificate?
is never good or evil. If the students are atttending for the right reasons, then this will help them understand the basics of how script kiddies work. And what do the current stats tell us about most attacks? That they are unsophisticated and are run by people who have little deep knowledge of systems. So this course wil (theoretically) allow them to better protect against the majority of attacks. If the students are attending for the wrong reasons, then they spent $4k for what a day or two of googling and reading would have gotten them. BFD.
Always value the individual over the system. --Bruce Lee "I don't need a Sig - I have a custom 191" - me
more of an course to help corporate types to be better aware of and combat cracking (note usage of correct word here) techniques. Your typical 'script kiddie' ain'ta gonna blow $4000 on a course on cracking; he's gonna hang out on IRC and cracking/warez sites to try and mooch some free advice and 'proggies'.
IMO, a network admin ought to all ready know the tricks of the trade and keep him/herself up to date on the tech. But I guess this course probably does provide a good service to some... seen waaaaay to many fresh IT grads who may have aced all their classes but still manage to get out in the real world without really knowing how it all works.
I haven't read it yet, but I'm rather skeptical. It seems like $4000 dollars and a few weeks in the classroom teaches you how to run sploits you download from packetstorm. It doesn't make you suddenly become skeptical of everything a vendor tells you, or make it become a habit to run a sniffer with watchtemp when you install software on your test lan. It doesn't make you enjoy reading bugtraq.
There's a heck of a lot more to "hacking" than what they can teach you....think "lifestyle"
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
Anyone who is smart enough to hack, is smart enough (save for those with mental problems) to realize the difference between right and wrong.
Anyone who wants to take an ethics class obviously has some ethics (what you think someone lacking morales will be taking an ethics class to hope improving himself)???
What they should offer is a class that teaches non-techies what is a hacker - so they learn that not all hackers are evil people bent on ruling the world (not there is anything inherently wrong with this..I mean if I ran the world, it would be a much better place - for you and me....well more me, but it's all good)
I mod down so you can mod up. Your welcome.
$4,000 seems a bit expensive. I'm not seeing the true benefit of having a "Certified Hacker Certificate"? I think the days of getting a job out of highschool because you took a hacking course are over (if they ever existed in the first place).
Right now the University of Cincinnati is about $8,000 for a year. And I thought that was expensive.
Seems trendy to me...I just don't see hacker courses having much of a true impact on security.
But kudos to whoever is making money off the idea. Wish I would have thought of it.
Better than Flickr - Manage, Share, Archive
If you're wondering when the word "hacker" came to mean something sinister, the answer is 1987.
As far as I can tell, it was the the US media that got that ball rolling when they were trying to investigate the 1987 "Internet Worm" released by Robert Morris Jr. The Worm caught the news media off-balance because 1) they did not know what this "internet" thing was 2) there was no terminology for this kind of crime.
Remember, this was before the World Wide Web (which some of you may not realize is a layer ON TOP OF the Internet, not the same thing), and the news only knew that the military had been connecting computers for research, but even that information was kind of sketchy if you weren't in the thick of it.
So, they asked around and got some experts on the phone and the word that kept coming up was "hacker". Well, the reporters in question didn't realize that a "hacker" was a fairly old term used by the MIT Tech Model Railroad club and later spread around the word as term for a "productive enthusiast". They just knew that Morris the Younger was a "hacker who broke into thousands of computers", and that was news!
We've all tried to stop that land-slide ever since because those of us who called ourselves hackers pre-87 are not too thrilled with the perversion of the word's meaning, but at this point it has become clear that it's simply going to be a matter of dialect. In certain circles the word has one meaning and in the rest of society (not just English-speaking society) it has a very different one... oh well.
And paid for it with credit card numbers I stole from various hotmail accounts.
Woah. If the course is lectured by Angelina Jolie, I'll cough up my 4KUSD in about 3 seconds flat ;)
(BTW, doesn't this "Economic Times" look like a pretty shameless rip of the Financial Times? I wonder if their print edition is salmon-colored.)
What I'm listening to now on Pandora...
Man creates computer, internet.
Intelligent, misunderstood youths discover internet, realize they've been lied to, strung along, generally mistreated. Youths show the guts and brains to learn without teachers.
Feds discover internet, realize there are children smarter and more skilled than them, throw beauracratic temper-tantrum, track down said kids (well, some of 'em) and bust them, refuse leniency.
Feds realize this "internet thingy" is more important than they though, and worse, there are kids in other countries who not only have mad skillz, but also actively hate america. Feds shit bricks.
Gov't, realizing it has cut off it's left testicle, tries to fill the gap with "Ethical hackers", ie, tries to create what it had in the first place.
Jeezus F Kryst on a surfboard, why didn't you just train the @#(*&^*(@# hackers in ethics in the first place? You can't teach curiosity, autodidactism or problem solving.
Nature laughs, goes back to being inscrutable.
Way to go.
"A witty saying proves nothing." ~Voltaire
"d'Oh!" ~Homer
This is true 'ethical' hacking. And you don't even have to go to school to learn it. Well never mind, you have to go to school...
NMG
Is it worth $4,000? Depends what you're looking for. If you're trying to train up new secteam personnel, it might be a good buy. At the same time, experienced security researchers will find it a solid but not frontier-pushing class, so I wouldn't recommend it to anyone who, say, posts to BugTraq. As well, a lot of specialized platform knowledge also gets passed by, so this doesn't obviate the need to do significant research on your particular installations.
Comment removed based on user account deletion
Script kiddies don't need to know why symmetrical encryption is faster... they just need to know how to subscribe to Bugraq.
Old news :(
Honestly please stop posting this crap. Not only is it old news, but its really alot of poo poo. Try reading Phrack or other underground zines. There are tons of entry level zines and zines that are for more advanced users (phrack). Save yourself $4000 and do it from the confort of your own home. If you want to know how hackers think, try speding some time on undernet. You get the feeling real quick :)
This is not a flame.
Hrrm... I usually just sign my name.
My company sends me to pretty much any security course I want to learn a thing or two and to keep up with the trends. I'm a CISSP and if you've already gotten that far, the CEH is really really basic. You are far better off spending your money on a SANS conference and prepare for a GIAC cert.
(1) Do as I say, not as I do.
(2) Do it to someone else, not to me.
(3) You learned this from someone else, not from me.
-kgj
-kgj
Well, actually it was a UK course teaching the same curriculum, it seems.
Shortly afterward, the fucker got fired for gross misconduct, and hacked our company's servers using backdoors that he'd personally set up. So no, I'm not too impressed by people teaching this.....
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
Though as it was already pointed out, this is an excellent example of social engineering. They ought to give kickbacks to Mitnik for every fool who enrolls in the class.
Chris Knight is my hero.
75% of the graduating class is under house arrest for hacking back into the schools' cc merchant account servers and getting their $4000 back. The other 25% also stole back their money, but couldn't be traced, and are presumed at large.
stuff |
You WILL NOT learn hacking, even in the context that they're teaching (subverting the security of computer systems), in a class. You may learn about all kinds of tools; and about steps and techniques to attempt to break into computers, but the real work is not in a classroom. I still believe this after taking SANS Track 4; which was excellent training, but did not drop me back on the street with the ability to be pen tester extraordinaire. It's like the commercial says: you get good with practice. I think that's part of the reasoning behind SANS's practical papers for their certifications - so you research, and PRACTICE, and learn things by doing. Now, let me add yet another disclaimer to my posts - practicing does not mean going out and writing malicious code and breaking into sites. Practice means taking your own little air-gapped network and exploring every aspect of the art that you have time and aptitude to learn. Real hacking, the essence, and I'm not trying to start a definition war here; is trying everything you can and learning everything you can - for good or for evil now; but you get the point.
I think with the interesting people, their lives can't possibly be wrapped up into a nice little package.
Perhaps the real reason for this class is simply to collect a large mass of 1337 Do0d5 in once place for their eventual "disposal"
--Shhhh....don't tell anyone.
"Me fail English, that's unpossible." --Ralphie
The course seems pretty expensive and probably not exactly ideal, but it's a bit more than just script-kiddiesm. Unless, of course, the tests look like this:
Q: You are the IT manager of an online business. The owner is pleased to announce that the business has enjoyed rapid growth, and has asked you to prepare an outline of system upgrades and estimated costs to deal with an estimated 8,000 daily visitors consuming approximately 320KB, with the number of visitors doubling every six months. What are your main concerns likely to be? (circle all that apply)
a) Cost of expanded bandwidth utilization
b) Maintenance issues associated with a medium-sized server farm, as well as software concerns regarding your web application and load balancing
c) Continued self-hosting via the corporate T1 line vs. co-location
d) wtf ???? ummm just run linux+apache d00d !!!!!
Q: You are a consultant, hired to evaluate the security and efficiency of a small business's server configuration. Your employer, inexperienced with both the technology itself as well as online business in general, has hinted to you that he's not certain how competent his system administrator Simon is. In evaluating the systems, you discover that Simon has misappropriated the server budget to upgrade his desktop system to play Unreal Tournament 2k4, and has left the actual servers themselves equipped with 386s and faulty hard disks. As you were confronting him about this in the server room, he excused himself from the room to fetch "documentation" while his young and pimply-faced apprentice tripped the halon fire extinguishers. What should your reaction be?
a) Immediately contact the police.
b) Inform the manager, and urge him to speak with the apprentice's parents about a possible intervention.
c) Return a favorable report after realizing that you have become tangled with things far larger than you, and never interfere with those servers again.
d) whats a halon fire
Q: A company has suffered a break-in. Not having a security professional on-hand, they have turned to you as a forensics consultant to help them assess the damage, identify the point of origin, and take appropriate response measures. What will your first action be?
a) Request a list of all servers on the network with their operating systems, as well as servers and version numbers.
b) Unplug the servers.
c) Inquire if there is any way an employee could have accessed the servers.
d) Ask your friends on EFNet if they did it.
So they're teaching skills. That's not ethics. "Ethical" hacking, if there is such a thing, requires action, not just a skill set. So the ethical part is how you use your skills.
after the Sept. 11, 2001, attacks on the World Trade Center and the Pentagon, the company expanded its focus to information security courses.
That makes no sense. I could see them expanding in the wake of some vicious worm or virus, but they might as well take their inspiration from Chechnya. It makes it seem like they are in the business to trade on fear-of-hackers rather than to provide real security. Not that that's a bad marketing angle, but just one I'd have moral issues using.
HIV Crosses Species Barrier... into Muppets
7Hi5 c3r7iFi35 7H@7 U g07Z p@5$3D @Ll 7h3 rEqUiReD c0uR535 f0r H@ck3r c0lL3G3. U @R3 N0W 31337.
> You know, it's only been within the last few years that I've heard any significant usage of the word "cracker" with regards to computer security.
It usually means dumbass white motherfucker where I'm from.
The dangers of knowledge trigger emotional distress in human beings.
I gravitated towards ISECOM's OPST/OPSA classes because they fill a role I felt was missing in the security class space. Many non-vendor specific security classes have a very narrow tools based focus. While I agree that knowing how to use your tools in a test is important, I feel knowing why and when to use them is far more important. Knowing the politics involved in testing, going over internationally accepted testing practices, and reviewing regional and national legal regulations are just as much part of the job. These things are not merely important, but are required to be successful in your role as a security tester. In addition to the intensely technical aspects of the testing process, this is what the OPST represents; the "professional" side of security testing. Also, the ISECOM classes teach from ISECOM's Open Source Security Testing Methodology Manual (OSSTMM) which provides a much needed methodical framework to bring a scientific method style to the chaotic world of security testing.
The CEH class represents the other kind of class. One that is "flashy", "fun", "exciting", but not overly useful to the serious professional. While I have a lot of respect for Clément (one of the instructors for Intense School), I have very little respect for any organization that markets "hacker" classes. This includes the so-called ethical hacking, applied hacking, exposed hacking, grandmother hacking, squirrel hacking, super-duper 3y3 4m 31337 hacking, or any other fancy way of saying "Learn how to think and act like the bad guys".
While choosing where to spend your time and money, consider the community you are aligning with. If you look at ISACA, SANS, ISC2, ISECOM, etc.. they all have a true dedication to security and the betterment of the global information security community. Contrast the value of being affiliated (via education/certification) with any of those organizations over a piece of paper and a cd of toys.
hmmm i wonder what the school's called
maybe "0wnz U"?
'What we attempt to do in our classes is teach how the hackers think.' Hmmm, perhaps 'Certified Script Kiddie' would be a more accurate designation.
Except then it would be "What we attempt to do in our classes is teach how the script kiddies think." And putting the words "think" and "script kiddie" next to each other like that creates a paradox. Impossible to comprehend, much less teach.
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
Some people are good at it. Most aren't. And the PHBs can't tell the difference.
so the job goes to the person more interested in tooting his horn and being spoon fed pre-digested drivel, than in learning and in doing the job well. I'm sick of working with idiots, and half of them are taking this class.
<tangent>
I only went for the CISSP because it seemed like it was the hardest to to get. 250 nit-picking questions over ten major areas in 4 hours. Then another CISSP has to say that you know what the hell you're doing or you took the test for nothing. But management can't tell the difference between that and an MSCPC (Micorsoft Certified Point and Clicker. (I was the first to use that acronym 2 years ago, don't you dare claim it for yourself.))
I still value my CISSP since it was difficult to get. But I'm sick of the InfoSec field since it's become a haven for Doogie Howzer with a CS degree and no idea about how to protect information.
I recently had an interview, in wihich I was told that my skills were right on, but my personality just wasn't a fit for the organization. Reading the above you probably get an idea of what they were talking about. I still don't. I don't know anone who is any good at this shit that fits in even halfway. Who cares about your quirks as long as you can function in society and keep the bad guys off the servers.
</tangent>
This class is just one more example of a solution in search of a problem.