Slashdot Mirror
Software Giants Seek Friends Among Hackers
Carl Bialik from WSJ writes "Big tech companies are engaging in a full charm offensive at the Black Hat hacker conference as they seek to convince hackers and security researchers to work with, not against, them, the Wall Street Journal reports. Among those being courted: HD Moore. The suitor is his erstwhile foe, Microsoft. From the article: 'Microsoft plans to wine and dine Mr. Moore at a party at the fancy Palms Hotel. A Microsoft security executive wants to meet with him to discuss his latest work. And earlier this year, the Redmond, Wash., company invited him to speak at a Microsoft-sponsored conference on security. "There were a few tense silences," says Mr. Moore, 24 years old, who lives in Austin, Texas. But he says the meetings put a human face on a company he once saw as impenetrable. "You're less willing to publicly humiliate someone you know in real life," he says.'"
Microsoft: "Welcome Mr. Moore -- it's a pleasure to meet you in person. What's that? You want a hug?"
*they hug* Moore: "Well, I must be going"
*he leaves*
Microsoft: "...wait a minute... HE STOLE OUR WALLETS!"
A computer once beat me at chess, but it was no match for me at kick boxing.
"You're less willing to publicly humiliate someone you know in real life,"
Does that mean I should try harder until they buy me dinner?
Don't they call this Grey Hat?
Ooo man the floppy drive is broken. No wait. The computer is just upside down.
That's only true until they piss you off and let's face it, Microsoft piss every one off eventually.
after all these years of being overly agressive towards hackers microsoft expects to play nice at a few conferences and everything just be fine and dandy?
I don't think he just went soft like that, you don't go from black hat to employee in only a few months flat (or if you did you pish poor example of a black hat.) I think they payed him out the tail to promote their own agenda
Did someone say cake?
Microsoft is quite capable of this all by themselves.
sigh...
it's a blue bright blue Saturday hey hey
Good job, Microsoft, just give the enemy more info on your employees and practices, that's a great idea. Why don't you just slap up an FTP site with a binary of Windows and hand him the URL? I'm sure he'll feel real bad about using what he learns for evil for a few days, until he decides it would be cooler to use it and be the undefeated champion of the black hat universe.
stuff |
Do you remember Mitnic?
(Source: Wikipedia)
I've been to dinner with people from Microsoft, Intel, AMD, Broadcom, Sandisk, the DoD, CRA (Canada), etc.
It's fucking dinner.
Wait till they offer him a grant, job or other swag to be impressed. If they gave him a grant to bash the shit out of Windows that'd be impressive. A $50 dinner on the strip is not (though free eats is good)
Tom
Someday, I'll have a real sig.
Heh heh heh - remember the age old saying, "Follow the money."
Or in this case beer.
Still, a rose by any other name would smell as sweet.
I need scotch, and lots of it, before I'll put out for microsoft.
Badass Resumes
Abraham Lincoln
Wincopy
Extend . . .
(wait for it) . . .
Extinguish!
"Hi! I'm Clippy! I see you're exploiting loopholes in Windows. Would you like to:
"* Tell your zombies to phone home for a head count
"* Plant a malicious WMF at a popular web site to get more zombies
"* Do some illegal file sharing (since all file sharers are black hats)
"* I'm not a script kiddie and don't need any help
" (CANCEL) (OKAY)"
Unless they're someone who really deserves it, in which case, I find it easier.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The problem with this is that it's an illusion.
Corporations are composed of not just a single person, but of many people, each of whom has an agenda. Most of those people tend to limit their thoughts about the decisions they make on behalf of the company to the benefits that decision may bring to the corporation and to themselves, and perhaps to the possible harm the benefits may bring to the corporation and to themselves. The last thing to enter their mind, in general, is the impact the decision may have on individuals outside the corporation. The more conscientious types may consider that, but such people appear to be rare, and such people in positions of great influence within a corporation appear to be especially rare.
So while this person may being to believe that the corporation he's dealing with is somehow now more "human" as a result of his dealings with specific individuals, he's making quite a few bad assumptions, not the least of which is that the people he's dealing with have a large amount of influence over the actions of the corporation. That's almost certainly not the case, and yet the actual "humanity" of the corporation depends on it.
The bottom line is that this guy (Moore) isn't nearly cynical enough, and is likely to get burned.
The very purpose and nature of the corporation, to shield the corporation's stakeholders from the consequences of the corporation's actions, are exactly why the corporation can never be "human" in any meaningful way, except perhaps in a psychopathic sense. The numerous experiments (e.g., those involving simulated torture, imprisonment, etc.) that have been done in which the individual is shielded from the consequences of his actions are proof of how much of a person's humanity is lost from that. The corporation is a formal embodiment of that separation. In light of said experiments, the consequences should be obvious, and the typical behaviour of corporations is further proof.
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
Is this the same Blackhat convention that the FBI asked for hacker help in fighting the internet mob with the bullshit line of better relationships? They could build better relationships by releasing the hackers they have in the cage who tried to help them in the past. It seems when you cross the path of rodents from other countries and turn them in instead of the FBI investigating the rodents you become the focus of their attention. There is no innocent until proven guilty with those bastards, no thank you American Patriot. It's just kick the door down at 3am. AlienSlave
In other words, "Shut the fuck up about all of the stuff you find until we quietly issue a patch. If we get around to it. Oh, and here's an NDA that gives us your nads if you talk in your sleep."
Lacking <sarcasm> tags,
If that doesn't work, shoot them in the back of the head.
J.W. Booth
Badass Resumes
Mr. Moore sips a latte on his veranda on a brisk autumn morn. Some movement in his peripheral catches his attention. 'What the hell is that?' he wonders aloud. He tries to flick the small red dot from the front of his housecoat. Then with sudden horror, he realizes that that little dot is a projection. A laser projection. From a Microsoft sniper hidden in the shadows and fog. As he falls, dying, his last thoughts are of his recent dinner with Microsoft execs and what a naive fool he was to believe they loved him.
The assassin approaches the body and Mr. Moore. With a small shoulder radio he signals the job is complete.
"That's right. We got him. You shouldn't have to worry about Michael Moore any more" the assassin gloats.
"What?!" the voice on the line exclaims.
"I said I tagged that fat ass. He's dead. Let's see him make another inflamatory documentary now!"
"You killed MICHAEL Moore? Aw, crap...."
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
I have been saying this for a while and I'm glad that the executives in charge of things are one the same wavelength. The computer underground is full of brilliant people with the knowledge that will make products better. Microsoft doesn't even need to put people on the payroll. They can simply pay them as consultants. It's a great situation for everyone involved. Microsoft gets knowledge that the typical programmer who has gone the legit route through college and computer science will not have. The black hats get paid for their fresh sk33lz and the rest of the world gets a better, more secure product.
They bought all the Linux anti-virus companies out there. Groove used BDB (from sleepycat now Oracle), and they bought them. Sun's their best buddy in the SCO affair.
And in our company, they pay us to port our stuff from competing platforms to theirs.
If only they treated their partners as well as their enemies, perhaps Micrsoft partner companies would be doing better. Instead they like competing with partners and befriending their enemies. Cool straegy
It makes perfect sense to have an alliance going between the two. I am glad that Microsoft is taking all these initiatives to try and improve their software. They took over Sysinternals some time ago, which gives me a hope that I may not have to go googling to find tools for Windows and will in future find them in Windows.
Is this a wise idea? If he is willing to hack once, he might do it again. And with inside information, he can do it better, and possibly cover his tracks. It is a huge gamble to invite a hacker in.
The problem with a collaboration such as this is Microsoft won't really be serious about it. If Moore tells Microsoft the real facts about Microsoft security and what they will likely need to do about it, in that truth are mostly things Microsoft really doesn't want to hear and they will just go into denial about it. Moore will end up frustrated, his contributions falling on deaf ears...
On the other hand, in the meantime Microsoft will have distracted a potential foe, and Moore will have made some $$$, but anyone thinking the result will be any more than that is unrealistically optimistic...
In the words of Admiral Ackbar: It's a trap! ;-)
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
Get an axe
"You're less willing to publicly humiliate someone you know in real life," he says.'"
Sucker.
Try me. I'd happily humiliate Microsoft at every opportunity even if I was sleeping with Melinda.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Does that mean I should try harder until they buy me dinner?
What it means is Dear Aunt, let's set so double the killer delete select all.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
I got no problem with Microsoft taking him out.
Permanently.
"My God...it's full of trolls!"
..and you've got us on your side ;)
Note the inclusion of Oracle and Cisco in this list.
Oracle has one of the worst records on fixing vulnerabilities, running up to a year. I'm too lazy to google up the specific vulnerabilities.
Cisco's record is worse. I coudn't find the article I was looking for, but there was a recent case (in the last year IIRC) where an security researcher in a South American country notified cisco of an issue. After a period of time, he decided to go public (hazy on the details) and cisco did everything they could to shut him down. He had followed best practices guidelines on reporting security issues. Found it. Choice quote:
"Then they accused me of working with terrorists, and even still tried to patent my work!"
meh
Rather than be disappointed he discloses the vulnerabilities he is working on.
Tim Brown
I'm picturing that scene in The Matrix where the agents are talking to Neo and he just gives them the finger.
OT: haha. Did you really just waste a mod point to mod this 'overrated' when it was only "+1" because I'm a registered user? ... meaning that nobody 'rated' it +1 in the first place?
That's special.
...unless you're working at Msoft, and then, humiliation is a matter of corporate policy.
:/
I guess it's only a matter of time before the other shoe drops and the company decides to return to villifying these folks again. After all, as long as they are enemies, they'll continue to be motivated to test the OS security (?) for free.
Ms: As you can see Mr. Moore we've had our eye on you for some time now. It seems that you've been living two lives. In one life, you're H. D. Moore a 24-year old geek, you have a social security number, you pay your taxes, and you help your landlady carry out her garbage. The other life is lived in computers, where you go by the hacker alias H.D. and are guilty of virtually every computer crime we have a law for. One of these lives has a future, and one of them does not. I'm going to be as forthcoming as I can be, Mr. Anderson. You're here because we need your help. My colleagues believe that I am wasting my time with you but I believe that you wish to do the right thing. We're willing to wipe the slate clean, give you a fresh start and all that we're asking in return is your cooperation in bringing a known system to a functional state. Moore: Yeah. Wow, that sound like a really good deal. But I think I got a better one. How about I give you the finger... and you give me my phone call.
Never underestimate the power of idiots in large groups
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons