Slashdot Mirror
The Hacker Profiling Project
NewsForge writes "NewsForge is running a story about a project aiming to profile hackers like the police do with common criminals. Not based out of the U.S. per se, this project falls under the auspices of the United Nations Interregional Crime and Justice Research Institute (UNICRI). The project was co-founded by Stefania Ducci, in 2004, along with Raoul Chiesa." From the article: "NewsForge: What would the project concretely produce as final output? Stefania Ducci: The final goal is a real and complete methodology for hacker profiling, released under GNU/FDL. This means that, at the end of our research project, if a company will send us its (as detailed as possible) logs related to an intrusion, we — exactly like in the TV show C.S.I. when evidence is found on the crime scene — will be able to provide a profile of the attacker. By 'profile' we mean, for example, his technical skills, his probable geographic location, an analysis of his modus operandi, and of a lot of other, small and big, traces left on the crime scene. This will also permit us to observe and, wherever possible, preview new attack trends, show rapid and drastic behavior changes, and, finally, provide a real picture of the world of hacking and its international scene."
init 11 - for when you need that edge.
"exactly like in the TV show C.S.I. when evidence is found on the crime scene"
You mean they stand around in a dark room and spout techno-BS while a computer graphically and textually points out the obvious?
Too bad I bought the Rootkits book from Amazon, I know I should have gotten it at the bookstore and should have paid cash.
Oh that hacker is using Rootkit 123 so it must be somebody on the Internet!
White kid? Bad complexion? Limited social skills? Above average intelligence? Lives in parents basement?
"Round up the usual suspects"
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
So if one does get cought by the UN will they just sanction them and them place them on double secret probabtion.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
Will the rankings be computerized?
UN: the hacker seems to have left an unintelligible string of words in your system. We're not sure what it means. "All your base are belong to us... bitch"
It is better to light one candle than to curse the darkness.
I hope not, cos that would mean that they would look for the hacker in a "furry" community only to find out that the actual vigilante was a farmer who acted in good faith trying to protect his sheep. Ehhh...
Three rings for the Elven-kings in the sky
Reminds me of a project the Argentinian military presented about a year ago in a security congress I went to.
The idea was to "fingerprint" hacking attempts by measuring timing in typing on terminals. Say, a hacker would attack a system, a fingerprint would be taken (of the unknown hacker's typing habits) and then on another break-in, a new fingerprint would be taken and compared to previous ones to determine if it is a formely filed hacker.
Another possibility from that idea was to use the fingerprint also to verify the user's identity (you have to enter a password, but the server also fingerprints you and denies access if the fingerprint does not match).
Definitely one of the best expositions in the congress. Pity I cannot find any papers. I found the original presentation, in spanish though, by searching for "Remote identification of keystroke patterns" on google.
GPG 0x1B479C78
Subject: One Perl Hacker; four-space indentation; 12% comments; averaging 34 lines per sub; prefers OO interface when available; abhores cuddly elses.
Cm'on now, can't we even get our terminology straight?.
AC: Only on slashdot... could the sentence "My hovercraft is full of eels." be moderated "+4, Insightful
Hmm...I see by the look of this log showing the Denial of Service attack on Megacorp's Web server, the suspect is:
40 year old white male
lacks typical social skills
unmarried, no girlfriend
drinks highly caffinated beverages
has a scraggly, unkempt beard
does not shower
lives in his parent's basement...(for free)
That narrows the list of a bajillion suspects down to...hmm...maybe this profiling thing doesn't work as well as it does on tv? Screw it, bring 'em all in!
That way when someone joins a project, you can look up his profile and read, "thinks that orange on neon green is an acceptable combination for user interfaces", and know to only let him work on the back-end of a project.
Frankly, some of those interfaces out there in FS/OS land are at least a misdemeanor. This project is long overdue.
the more accurate the calculations became, the more the concepts tended to vanish into thin air. R. S. Mulliken
Word meanings change, and can have multiple meanings. Sorry if you've some personal attatchment to those 6 letters arranged in a certain, but the fight was over long ago. Find a new word for what you're talking about, because hacker now means someone who breaks into computers. You can't fight what 99% of the population accepts as the definition, no matter what some wikipedia entry says.
AccountKiller
Comment removed based on user account deletion
Most of em have NiN, Tool or Warhammer t-shirts on. Just have a S.W.A.T team take out the mall food courts and we can get em all.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Should read:
NewsForge is running a story about a project aiming to profile hackers like the police do with other common criminals.
Why don't they just watch swordfish? What hacker hasn't been asked to crack a govt database with 8192 bit encryption at gunpoint while getting a blow job by a hot chick in the back of a club.
I think the invisible hand of the market has its middle finger extended
--A wise old fart named SC0RN
I think if this were actually implemented on a widespread basis, sophisticated hackers using some form of remote access would be able to come up with some sort of remote client that randomizes or otherwise alters (uniformizes) the delays between sent keystrokes. As for physical access, now... well, once you have someone with physical access, you're doomed anyway. . .
The World Wide Web is dying. Soon, we shall have only the Internet.
Dear Stefania, I have followed with enthusiasm the course of your disgrace and public shaming. My own never bothered me except for the inconvenience of being incarcerated, but you may lack perspective. In our discussions down in the chatroom it was apparent to me that your father, the dead night watchman, figures largely in your value system. I think your success in putting an end to Jame Gumb's career as a couturier pleased you most because you could imagine your father being pleased. But now, alas, you're in bad odour with the HPP. Do you imagine your daddy being shamed by your disgrace? Do you see him in his plain pine box crushed by your failure; a sorry, petty end of a promising career? What is worst about this humiliation Stefania? Is it how your failure will reflect on your mommy and daddy? Is your worst fear that people will now and forever believe they were indeed just good old trailer camp tornado bait white trash and that perhaps you are too? By the way I couldn't help noticing on the HPP's rather dull public website that I have been hoisted from the Project's archives of the common hacker and elevated to the more prestigious 1010 Most Wanted list. Is this coincidence, or are you back on the case? If so, goody goody, cause I need to come out of retirement and return to public life. I imagine you sitting in a dark basement room bent over papers and computer screens. Is that accurate? Please tell me truly, Special Agent Ducci. Regards, your old pal mr.joebert, MD2020 P.S. Clearly this new assignment is not your choice rather I suppose it is a part of the bargain but you accepted it Stefania. Your job is to craft my doom. So I am not sure how well I should wish you but I'm sure we'll have a lot of fun. Tata, J.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
This has been modded as funny but it really needs to be modded insightful. Governments the world over are trying very hard to get data such as the Amazon purchase data and store that in a useful database. Buying a book about rootkits very well may put you on a list of, oh, let's call them hackers who need to be kept track of. This, "hacker", book purchase can be cross referenced with the hacker's employment records, possibly including training received. It is all too possible that your phone or data line could be tapped and monitored because you are suspected of a crime based on nothing more than you having the skills necessary to commit said crime. Just because I am capable of lifting a baseball bat and swinging it doesn't mean that I should be an immediate suspect should someone be murdered by baseball bat. Having the ability to commit a network intrusion shouldn't make me a suspect of a network intrusion. That should only be the case if there is some indication that it was me.
Of course, providing false information is a useful strategy too. Feel free to provide as much information as you like.
Here's the questionnaire that they refer to - http://hpp.recursiva.org/en/q1.php.
In the land of the blind, the one-eyed man is usually crucified.
I'm a forth generation hacker, cut my teeth on all the 8-bits, mainly a C=64, and I bristle every time someone uses the term in a pejorative sense. Hackers generally just love to code, create, repair, build, and figure things out. They rather like to create, or enhance.
I believe Andrew Burt, founder of nyx.net, one of the free unix shells, coined the term "spider" but that really doesn't work for me. "Crackers" is a more appropriate term.
I think these folks at the U.N need to do less to criminalize a bunch of crackers who are basically tech savy graffiti artists, and go after the real criminals within their own ranks. Do something about that appalling use of depleted uranium by the United States military, for starters.
einstein
http://anarchy.shellprompt.com/
http://rootpassword.com/
I'm sure people who are experts at network penetration and social engineering are smart enough to
.357s?
A. Not respond
B. Lie
C. Use these results to their advantage
Don't worry about that intrusion on the development server - the profile suggests it was only a script-kiddie looking for mp3s
What is next? A questionnaire if the Mafia prefers 9mm or
just like CSI you say?
interesting
will it feature lots of weird camera angles, like from the floppy disks point of view?
how about from the keyboard point of view, looking straight up the nose of the hacker
You can get geographic information from IP addresses, so it isn't entirely unreasonable.
"The final goal is a real and complete methodology for hacker profiling, released under GNU/FDL. This means that" ... anybody who seriously wants to crack into somewhere will look up the profile of somebody on the other side of the world and follow the text book examples. Nice.
Looks like lots of self rating on the site. With out a better test (more thorough, less transparent) and/or follow up interview, even if the person is honest I find it to be of questionable validity.
putting the 'B' in LGBTQ+
So here it is: http://www.adequacy.org/stories/2001.12.2.42056.21 47.html
enjoy
I wonder how they would profile that middle school hacker who was suspended for three days (The 8th grader in question used the "net send" command to send a single word message ("Hey!") to the 80 machines tied to his school's network.)
For logs, I suppose a teacher would have sent in a screen capture of the messenger window?
I remember this being tried in 1999 with the 'pr0filer' project they revealed at Defcon 7. I remember lots of boos, people filling up their database with garbage, and it eventually sinking into nothingness.
and that program is called....perl
What does it mean if the compact version deviates from the control group? That people lied on the survey, or that the control group was poorly selected? Is this science or politics?
If you want to understand computer criminals, do a broad study of people who have been convicted of committing the sort of crime you are interested in.
If they're smart, they'll somehow fork a honeypot off of this, since advertising such a project seems to be equivalent to putting a big digital bullseye on their foreheads.
Jesus told him, "I am the way, the truth, and the life. No one can come to the Father except through me. - John 14:6 NLT
As a hacker, you can just as easily spoof IP addresses using an insecure HTTP Proxy from another Country, or control a botnet of remote compromised machines, so it isn't entirely logical, unless you can get the logs of those machines and trace back to the actual source of the attack, which could be layers upon layers of proxies, in some cases.
the only permanence in existence, is the impermanence of existence.
Generally speaking, it comes out that hackers are usually brilliant, inventive, and determined. They generally feel anger and rebellion towards authorities and narrowmindedness, seen as a menace for civil liberties. Hacking is conceived as a technique and a way of life with curiosity and to put themselves through the hoops, or as a power tool useful for raising awareness among the general public about political and social issues. Normally, they are driven by the love for knowledge. Nevertheless, there are also hackers who have profit purposes and, therefore, practice phishing/pharming, carding, or industrial espionage. Their preferred targets are military and governmental systems, as well as information systems of corporations, telecommunication societies, schools, and universities, but also end users and SOHO.
You've got to be kidding.
What's the methodology for this profile? Googling the word "hacker"? Please. Tell me something I didn't know years ago. (For example, MEECES.
Seriously, these guys sound like they have a seriously flawed survey methodology, in that all they are doing is self-selecting their sample and parroting the results. Moreover, I don't see how they plan to create anything useful out of the forensic data they expect everyone to send them. In that regard, I see little difference between what they say they are going to do and what the Honeynet Project has been doing for years.
#!
What I find anoying about these articles is that they dont provide enough background to be informative (e.g., What is the cost of the project?How did the project come about?Who will have access to the analysis information?Who are the project participants (including companies)?, and so on
BTW if anyone knows who the individual that authorized the project, please send me their contact information so I can sell them the shirt off my back.
Language unfortunately gets screwed up and typically ends up going with the mass usage. Colour becomes color. Milliard (10^9) becomes billion...
Engineering is the art of compromise.
I assume they mean determining the region (and I would still consider this just as untrustworthy as using the IP) by figuring in things such as the types of attacks used, apparent knowledge, what they were attacking, what information they took/used/ignored, etc as compared to trends of the same measures from different areas of the world.
The only people willing to fill out the questionnaire are stupid enough to fill out the questionnaire!
IP addresses can be spoofed, but you can get a vague idea about time zone if the attacks are manual instead of being automated. If you get an old-school intruder who leaves taunts behind, you can make guesses from the style and grammar: my wife used to be able to pinpoint a student's native language based on how they wrote English.
here are some more: color (colour), milliard (billion), dick (richard).
Engineering is the art of compromise.
" NF: Why should hackers collaborate with you?
SD: Because the purpose of this study is trying to describe objectively hackers' everyday life, providing the people that have a poor knowledge of the hacking scene and the digital underground with a clear vision, uninfluenced by mass media or personal prejudices, putting an end to all the stereotypes surrounding this world. "
BWAHAHAHAHAHAHAHAHHAHAHAHAHAHAHAHA! *wipes tears from eyes*
Well, that's what it used to say.
The Wikipedia page on Hackers has also defined them as "LONELY LITTLE BOY WITH NO FRIENDS", made claims that a variety of people are hackers, and even asserted that the reader is a noob.
While Wikipedia is a wonderful resource, I suggest you link to a particular revision of an article if you wish to claim it as authoritative.
[...]released under GNU/FDL[...]
Finally GNU is used by "Teh Evil[tm]". I mean, come on, this is ridiculous.
On second thought, let's not go to Camelot. It is a silly place.
We already have a profile for at least one hacker.
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
They should be worried about people that break into computers. Such people are "wannabes", not hackers. They may have some of the skills that would be suited to becoming a hacker, but they don't have the true hacker mentality, which is about building things, not breaking them. As ESR states, "being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer."
This reminds me of somethat that I've been thinking of for a while. By tracking various publicly available information, it should be possible to profile the current politician crop as to how corrupt they really are. For example, if a politician has attended the same parties that Abramoff attended or even was even in the same cities at the same time more than probability allows, then that would count towards that politician's corruption index. Say if that politician used the same lawyers that mob connected people use, then the index goes way up.
Factor in every piece of information of this type, test against known corrupt politicians like the Abscam people, Tom Delay, Randy Cunningham, Marion Barry, etc, throw in a little Baysian logic, and find the current corrupt crop of politicians. Be interesting to test George Bush and Dick Cheney against this index. Think about it.
sounds alot like d0xmaster :)
The idea was to "fingerprint" hacking attempts by measuring timing in typing on terminals. Say, a hacker would attack a system, a fingerprint would be taken (of the unknown hacker's typing habits) and then on another break-in, a new fingerprint would be taken and compared to previous ones to determine if it is a formely filed hacker.
Extending the above, it's better to use the fingerprinting as the basis of prosecuting an alleged hacker, by testing the null hypothesis, which is: a particular hacker is the one we have profiled.
If you delay pleasure infinitely, the pleasure will be infinite. (YM)
Did anyone actually read their survey form? As a sociologist-in-training, I have to say that it's one of the poorest pieces of work I've had the...experience of reading. Grammar errors galore, mistargeted questions, redundancy, bias, loaded questions (though those are to be expected in a survey on criminal activities), over-lengthy, items poorly ordered, questions that will return prima facie bogus results...and enough sampling problems to fill a doctoral thesis.
O heavens above, I pray this research doesn't get used for policy creation...unfortunately, the agnostic in me bets it will be.
It's possible that changing of the meaning of the word form positive to pejorative is the sign of how society see software developers. It's similar how in modern russian old word for "Jew" become offensive word, and it's modern form also sometimes used as offence (less so after the fall of communism)
For things like telnet traffic, it may be trickier to do this: When your IP stack receives multiple single characters from an application within, say, a fifth of a second, it will put them in a single packet before sending them. This is specifically intended to handle things like SSH and telnet traffic -- there's no sense sending three 55 byte packets over the net when you could send one 57 byte packet, right? But the consequence is that we can no longer do fine-grained timing analysis of keystrokes received over the 'net. Of course, this may make things easier when our wiley hacker types particular strings very fast because they always arrive as a single packet.
This is not my sandwich.
Didn't you always want to know where your speed inefficiencies lie? After all, that's what a profiler is for, isn't it?
The Tao of math: The numbers you can count are not the real numbers.