Criminals Target Tech Students With Job Offers

An anonymous reader writes "BBC News is running a story on criminal gangs targeting tech students. Some of these outfits offer to pay for an education in exchange for the student's employment on graduation in criminal hacking activities." From the article: " As the number of criminal gangs looking to move into cyber crime expanded, it got harder to recruit skilled hackers, said Mr Day. This has led criminals to target university students all around the world. 'Some students are being sponsored through their IT degree,' said Mr Day. Once qualified, the graduates go to work for the criminal gangs. As well as the direct route of targeting students, some organised crime gangs were trading on the glamour surrounding the 'hacker' label to help them recruit impressionable youngsters..."

Comments

surprised?

[Xolom]

it's a better job offer than the other offers most kids are going to get, and it appeals to their interests... why are people surprised?

Re:surprised?

[ScentCone]

it's a better job offer than the other offers most kids are going to get, and it appeals to their interests... why are people surprised?

Um... for the same reason people might be surprised if non-crazy students who spend their years in college studying chemistry would look for "sponsorship" from a group that tells them they'll be building suitcase bombs for terrorists? Or an engineering/architecture student that's told they'll get a free ride through college as along as they agree to help break into banks once they graduate? This isn't any different.

Re:surprised?

[Planesdragon]

This isn't any different.

It's significantly different. One is treason, another is abandoning a lucrative private enterprise for crime, and the third is a resort of despiration for those with few prosepcts.

The morality, ethics, and legal response to each of these is different. You might as well claim that vehicular manslaughter and driving with a cell phone "aren't any different."

Re:surprised?

[russ1337]

Funny that you mention ethics. I remember a class a few years ago, we tried to determine what set a 'Profession' different from a 'job'. Eventually we settled on something along the lines 'that a professional has a code of ethics'.e.g Doctors, engineers, lawyers (ok, yeah ok i know - stick with me)..

I dont recall IT professionals having a code of ethics. If BSC/SE graduates swore to uphold a code of ethics, it may weed out a few of the more 'innocent' people that would take up this offer. Of course it may always be to late by the time they graduate too....

One could always join the military to get their training. It even has a similar rank structure to the Mob.

Re:surprised?

[spikedvodka]

While it may not qaulify as a mandetory code of ethics, I'd encourage you to read the SAGE System Administrator's Code of Ethics
We as professional System Administrators do hereby commit ourselves to the highest standards of ethical and professional conduct, and agree to be guided by this code of ethics, and encourage every System Administrator to do the same.
Professionalism

        * I will maintain professional conduct in the workplace and will not allow personal feelings or beliefs to cause me to treat people unfairly or unprofessionally.

Personal Integrity

        * I will be honest in my professional dealings and forthcoming about my competence and the impact of my mistakes. I will seek assistance from others when required.
        * I will avoid conflicts of interest and biases whenever possible. When my advice is sought, if I have a conflict of interest or bias, I will declare it if appropriate, and recuse myself if necessary.

Privacy

        * I will access private information on computer systems only when it is necessary in the course of my technical duties. I will maintain and protect the confidentiality of any information to which I may have access, regardless of the method by which I came into knowledge of it.

Laws and Policies

        * I will educate myself and others on relevant laws, regulations, and policies regarding the performance of my duties.

Communication

        * I will communicate with management, users, and colleagues about computer matters of mutual interest. I will strive to listen to and understand the needs of all parties.

System Integrity

        * I will strive to ensure the necessary integrity, reliability, and availability of the systems for which I am responsible.
        * I will design and maintain each system in a manner to support the purpose of the system to the organization.

Education

        * I will continue to update and enhance my technical knowledge and other work-related skills. I will share my knowledge and experience with others.

Responsibility to Computing Community

        * I will cooperate with the larger computing community to maintain the integrity of network and computing resources.

Social Responsibility

        * As an informed professional, I will encourage the writing and adoption of relevant policies and laws consistent with these ethical principles.

Ethical Responsibility

        * I will strive to build and maintain a safe, healthy, and productive workplace.
        * I will do my best to make decisions consistent with the safety, privacy, and well-being of my community and the public, and to disclose promptly factors that might pose unexamined risks or dangers.
        * I will accept and offer honest criticism of technical work as appropriate and will credit properly the contributions of others.
        * I will lead by example, maintaining a high ethical standard and degree of professionalism in the performance of all my duties. I will support colleagues and co-workers in following this code of ethics.

Draft of September 12, 2003, approved September 18, 2003, by the SAGE Executive Committee and September 30, 2003, by the Ethics Working Group.

Co-signed by LOPSA, USENIX, and SAGE 2006.

USENIX grants permission to reproduce this Code in any format, provided that the wording is not changed in any way, that signatories LOPSA, USENIX, and SAGE are included, and that no other signatory or logo is added without explicit permission from the copyright holders.

http://www.sage.org/ethics/

Re:surprised?

[dr_dank]

Wow, looks like somebody at that group read the BOFH stories before drafting these guidelines...

Re:surprised?

[sgt_doom]

Exactly so! Besides, how many hackers do the two major criminal organizations in the US hire (i.e., the Pentagon and the Blackstone Group)? And it sure beats offshoring....

Sweet

[presidentbeef]

Does this mean that legitimate companies, to keep up, will have to do the same thing?
Maybe they could even get into bidding wars over potential students/employees! This could only be a good thing...right?

Re:Sweet

[phatvw]

Haven't folks like Peter Norton (Symantec) been doing this for years? Recruiting kids to write worms and viruses so they can sell their shitty "Utilities" and Virus scanning suites to big business? ;)

Re:Sweet

[neoform]

Not if the companies are employing black hat hackers to take down their competition.. (i worked shortly for such a company, quit out of disgust).

The Godfather

[Nomihn0]

Sonny: Hey, whaddya gonna do, nice college boy, eh?

Hack, that's what!

interesting...

[Anonymous Coward]

how do i sign up?

A new medium for an age old problem

[Mikachu]

This isn't anything new really. I mean I even feel redundant saying this. Where there's commerce, there's crime. Where there's crime, there's organization. Gangs have simply moved on from convincing kids on street corners to steal some stuff into convincing kids in chatrooms to hack into some websites. It was only a matter of time.

This is a good thing

[svunt]

I'm currently doing an IT internship for the Gambino family. The pay is good, I get medical & dental, and if anyone mods me down, they'll find out about some of the other perks of working in the industry.

Re:This is a good thing

[Lane.exe]

Eh, getta load of this guy! We pays you good money so you can keep quiet, sit in your little room, and do your computer thing. But what's this? We finds you on this "internet," advertising who you work for! Hey, bambino, leave the singin' to Sinatra, capische?

Whack 'em.

Re:This is a good thing

[Broken scope]

My god, you have no Idea how much I want to waste a mod point now.

Re:This is a good thing

[Dachannien]

I had no idea that Joe Pesci was a Slashdotter, until now.

Re:This is a good thing

[idonthack]

Whack 'em.

So, uh... I understand you have an opening now?

Re:This is a good thing

[RareButSeriousSideEf]

I for one welcome our new tuition-paying overlords.

Re:This is a good thing

[6Yankee]

Yeah, but youdonthack. Sorry :P

Re:This is a good thing

[RareButSeriousSideEf]

Hear, hear. Shame to see your site is closed until further notice; was the "crap" you refer to spam or just crappy poetry?

Great News!

[iOsiris]

This will reassure CS students that there are jobs lined up for them after they graduate!

pft!

[tloh]

No! No! No! Any hacker with even an ounce of skill is more than capable of setting up shop on his own. What you gotta do is offer the guy something he would never EVER get legitimately. What these criminal types REALLY ought to do is come on slashdot here and promise they can arrange regular *private* meetings with our favorite adult performers from the pr0n we all download.

Re:pft!

[non]

dude, i don't know about favorite, but there are many you can get; look here. at least one of the met-art girls is available!

Re:pft!

[nettdata]

Cool... some place where "Blowjob Friday" might not just be a tale of lore...

Where do I sign up?

Benefits

[phorm]

Ahhhh, but do they offer dental? If not, they could probably manage to add you to somebody else's plan :-)

Re:Benefits

[Massacrifice]

Oh yeah, they have a dental plan... Tony, gimme the pliers.

Hack what ?

[jfclavette]

Say what you will, hacking (cracking, don't throw a fit) isn't exactly easy nowadays. Can anyone here honestly tell me that they can get me access to a given business's clients database in the next 48 hours ? Didn't think so. So what are the gangs getting out of this ? Are they getting on a hype bandwagon ?

Re:Hack what ?

[ScentCone]

Can anyone here honestly tell me that they can get me access to a given business's clients database in the next 48 hours ? Didn't think so. So what are the gangs getting out of this ? Are they getting on a hype bandwagon ?

Getting access to a company's database is so 1990's. These days, you need smart computer science types to design better malware to create botnets so that you can practice good old fashioned extortion against Costa Rican casino web sites. Simple as that.

Re:Hack what ?

[phantomcircuit]

The types of attacks that are being carried out are not single target attacks, they are broad attacks used to secure large botnets or to retrieve sensitive information on smaller targets.

The major breach of security events where large amounts of personal information is either pure dumb luck (enhanced by a larger drag net or malware) or the combination of social engineering, physical break in, and computer based attacks.

Re:Hack what ?

[Anonymous Coward]

Wow, that has got to be the most clueless comments on the topic that I have ever read. No offense meant, but really, c'mon! Where have you been the last five years? Hacking hasn't only gotten a lot simpler, with all the automated tools that exist nowadays, but also become much more profitable. The increased profits are largely a result of botnets and the ease one can build one with using readily available tools and the huge number of clueless people on a broadband connection (something that also didn't really exist 5-10 years ago). You can spam people cheaper, install popups cheaper, steal their banking information cheaper (more people do internet banking now than a couple of years ago), and so on.

In short: there's more of everything. More software with more vulnerabilities. More automated tools. More clueless users. More bandwidth in their pipes. More profitable internet companies to blackmail (using DDoS). More companies interested in buying tools and information. Etc.

If there was ever a time to a criminal on the internet, now is it.

Re:Hack what ?

[Geoffreyerffoeg]

Can anyone here honestly tell me that they can get me access to a given business's clients database in the next 48 hours ?

No, but I can get access to a given business's clents database in 48 hours plus flight time, given an appropriate plane ticket and an appropriate change of clothes.

Re:Hack what ?

[owlnation]

I would have thought that phishing and eBay / Criagslist fraud was the quickest and easiest way of making money for criminals. The tech ability for phishing doesn't need to be that high.

What I've often wondered though is, why do phishers just go for the harder targets like eBay, Paypal and Banks? Since a significant proportion of sites these days require a login and password, and that many people will simply use the same login and password, why not phish for some forum or news site, where users are off guard and more likely to fall for the phish? Then you take their login and password and plug in into sites like eBay etc. Seems a piece of cake to me, and more effective.

Re:Hack what ?

[prtsoft]

Getting access to a company's database is so 1990's Not really. Crackers still attempt to gain access to DB in search of creditcard and SS Numbers. With the proliferation of SQL injects available script kiddie can steal information from online shopping carts. Take the recent issue with mastercard and the intrusion into their customer DB. Thousands of credit card number were released. To say that it doesn't happen any more, is to, at best, be a bit naive.

Re:Hack what ?

[Lord Ender]

I can honestly tell you that I could get access to most business's databases within 2 weeks. I won't do it, but I could.

I work in the security industry for a company that does financial software. Despite all our efforts, at best we can only stop poorly-funded, poorly-motivated attackers. And our security is much better than most.

Most people, even those in IT, have NO FREAKIN IDEA how complicated information security is.

Re:Hack what ?

[ScentCone]

Take the recent issue with mastercard and the intrusion into their customer DB. Thousands of credit card number were released. To say that it doesn't happen any more, is to, at best, be a bit naive.

I don't meant to suggest it isn't happening, or isn't a target. But most of that stuff is insider badness, not 133t h@xx0rs coming in from the outside while on Jolt buzz. The malware is where all the action is - because that's how you plant keyloggers, etc., and GET inside access if you don't have an inside man. But, for now at least, the botnets are the real heavy artillary - and then also lead to spaminizing, which can deploy tools for id theft, etc. Malware is a bigger deal than ultra-crafty sneak-into-the-db-like-in-the-movies stuff I think, but YMMV.

Re:Hack what ?

[Sigma 7]

why do phishers just go for the harder targets like eBay, Paypal and Banks? Since a significant proportion of sites these days require a login and password, and that many people will simply use the same login and password, why not phish for some forum or news site, where users are off guard and more likely to fall for the phish?

eBay, and Paypal aren't too difficult, because that's where everybody swarms. When everybody swarms there, you get plenty on the lower end of the spectrum that fall to phishing.

In a way, the smaller forums tend to be a bit more alert. For example, Slashdot has a highly technical crowd that is resistant to phishing (but not necessarly other tactics such as viruses) as it gets discussed every single day - in addition to the fact that such users have access to... utilities. In addition, small forums generally have the admin posting almost every other day, giving the illusion that the admin knows the userbase well enough that phishing attempts look a little obvious.

Hoax maybe?

[UbuntuDupe]

This seems like a monumentally stupid way to recruit hackers. Let's see, leave a public record of you funding a student (rather than cold cash), then when he graduates, tell him, oops, you want him to break several laws. "Oh really? Well, thanks for the free education. Hey feds, over here!" *gets witness protection* *gets guaranteed income for life* *eliminates obligation to employer*

In order for this to work, you'd have to credibly threaten or capture a loved one. But if you've got the techie that way, ... er, why do you need to pay for his education again?

Re:Hoax maybe?

[another_fanboy]

Good point, but there is also the other perspective. The gang will have the cracker's personal information (required to pay the tuition bills), making it more of a challenge for him to hide if things don't go well. There would have to be a strong trust beyond the average employer/employee mindset or else a false move by either side will cause everyone to get caught.

Re:Hoax maybe?

[Massacrifice]

Well, if they start by requiring the would be hacker to "prove" himself (or herself?) worthy by doing something illegal, they can then blackmail him into doing more. I would assume that criminal activities start before the end of the studies. If the studies ever get completed, that is.

Re:Hoax maybe?

[Anonymous Coward]

Would you really be willing to break contact with your family and everyone you know and commit to a life of fear just to pay school tuition?

Re:Hoax maybe?

[Beryllium Sphere(tm)]

>In order for this to work, you'd have to credibly threaten or capture a loved one.

The old recipe for recruiting a spy was MICE: Money, Ideology, Compromise, Ego. If organized crime really is troling computer students, they could use at least three of those, and maybe even ideology ("stick it to the greedy corporate exploiters and their fascist tools in government", or something like that).

The other problem is, what's a CS degree going to do for a blackhat?

Put them through drama school and psychology if you want to raise a crop of social engineers, use an apprenticeship system if you need vulnerability finders, but CS? There are only a few problems in the criminal world (robust scalable botnet control, untracable communications) that are computer science problems. And there can't be room for many people to work on those.

The article was way too light on any of the specifics that would have inclined me to trust it.

Re:Hoax maybe?

[toganet]

I agree, although the article actually says "IT Degree", which probably translates to a degree from DeVry or the like.

What they should be paying for is an Informatics degree -- it includes the technical aspects of hacking (programming languages from a pragmatic standpoint), but combines it with the social and communication elements you mentioned.

Re:Hoax maybe?

[dr_dank]

The article reminded me of this story from years ago about Columbian drug cartels having an actual IT staff to keep its organization running.

The most remarkable part of that article was the IBM mainframe they'd have datamining phone switch info, cross-referencing it with known numbers of government agents in order to ferret out rats.

Re:Hoax maybe?

[Lord Ender]

Understanding computer and network architecture is useful in the art of penetration. Understanding discrete math, probability, and counting is ESSENTIAL for being able to pick the right attack vector. I imagine a professionally-employed hacker will want to be able to tell his boss "it will take 27 days to have a 50% chance of defeating this password based on their password policy." Most people can't do that stuff without a college education.

Re:Hoax maybe?

[Wiener]

Would you really be willing to break contact with your family and everyone you know and commit to a life of fear just to pay school tuition?

Yeah...student loans can be a real bitch sometimes.

Not Much of a Surprise.

[PixieDust]

Everything internet related means lots of dollar signs. What's intruiging here is how it could also play out amongst large corporations. We all know about the difference between a White Hatter, and a Black Hatter. Now consider a network of say, 20 people, top to bottom. At the top, is some poor twit either finishing up college, or already working for a fairly large business (as this article indicates some targets are). At the bottom (in this case, origin), is Company A, that really wants to see company B go down. High profile, but they're paying a pretty penny. Think about it.

Wal-Mart. Big huge massive retail company. How much do you think it would be worth to K-Mart, or Target, or various other retailers, for Wal-Mart to just be down for a few days? Easily into tens of millions, if not hundreds of millions of dollars.

Sad part is, the person at the top doesn't even have to know what's going on. They just say "Hey write a program that will do this, and propogate. We'll give you a cool 100Gs." Kid says hells yea, takes a few hours, whatever, writes it, and gives it to them, collects.

Two weeks later, Wal-Mart plant sticks the little nasty into the Wal-Mart mainframe, and it gets disseminated to every single store in the company. The plant is nice and safe (removed by organization, or perhaps just left to fend for themselves, whatever), many of the people involved will never be caught, and the person that wrote it may not even know they were responsible!

Perhaps I should take off my tin-foil hat, but still, it's a helluva "What-If".

Re:Not Much of a Surprise.

[Lehk228]

if an attacker had access to wal*mart's systems, shutting them down for a few days would be a bad way to do it, instead attack trust and dependability.

screw up certain shipments for holidays, occasionally add an item or three to credit card purchases, add a hundred bucks to random debits.

then at the end transfer all credit card numbers, debit card numbers, signatures, and PINs to a third party


halting operations would be bad for walmart, leaking EVERY SINGLE credit card transaction processed by walmart would be much worse long term.

the attack could be even more effective if the pharmacy/medical records kept could be leaked. people get pissed when their viagra perscription gets posted on the internet

Re:Not Much of a Surprise.

[littlerubberfeet]

This is a sticky subject...

The probable mechanism for profit would be to short NYSE:WMT just before a viral attack is executed. If that attack were to happen on thanksgiving, just in time for 'black Friday', the profit could be huge.

The long-term is a better strategy in monetary terms, but risk is proportional to time. A single event is much harder to get caught at then a bunch of events. Introducing endemic shrinkage in the credit handling system would require a large number of (potentially) traceable events.

Now watch us all get watchlisted for discussing this...

Re:Not Much of a Surprise.

[icepick72]

Ya, I saw that movie too where the computers worked all the time, people got in and out without being detected and the law enforcement was bumbling the issues and couldn't catch up to the criminals.

Re:Not Much of a Surprise.

[Lehk228]

the multiple errors would be done by computer code added just once, the second contact would be required to export the credit information to yourself, however due to the goals of this release there is no need to ensure it goes to yourself.

posting bots that roam VBullitin sites, spam mailers, usenet, and IRC would together make a very large receptical for a data dump.

The Firm :)

[thinkingpen]

Ok,so now techies are also supposed to watch out when getting hired; not just lawyers like those in that John Grisham novel. :)

Re:i really can't believe...

[OmniBeing]

A close friend of mine and I were offered "work" for a criminal organization years ago when we were fresh out of high school (we developed quite a rep, did some stupid things like send all the account usernames and passwords for the district to the main laser in the library. Nobody knew who did it till a friend ratted us out. That's another story though.)

The offer was nice, new machines and $10,000 each for a weeks work attacking ADT's system so they could stage a b&e spree.

Scared the crap out of me, I had friends that ran with those people, one was a runner who shortly there after went missing after he embezzled. I left the city (for other reasons) no idea what happened to Jamie...

There are other things to consider other than renumeration, like physical safety.

Re:The year for this article is 2006

[xrayspx]

Back in The Day, Slashdot listed only the day and date, which if I gave a shit, would be sufficient to narrow it down to the year. However, sometime in the last 2 years I was pleasantly surprised to see they started putting the year as well attached to every post.

Don't believe me? Read everything to the right of my name on this post.

Of course, I suppose I could be lying too.

Not likely...

[Marnhinn]

At least I hope not.

It will probably become a felony to accept funding from such groups first (if it already isn't) since its somewhat similar to bribery. Simply because if this were to spread to other professions, the impact could potentially be much worse (and could result in having a government like some third world countries where since the mafia is willing to pay more, the whole government is corrupt).

Re:Not likely...

[presidentbeef]

I kind of see your point...but doesn't the military already do this? They offer to pay for college, you agree to serve for 6 years or whatever. Does it make a difference if it's a private company?
I know that some companies will help pay for your education if you agree to continue working for them for a certain amount of time after your education is complete. It's not so different, right? This is just getting them younger.

Of course, my original comment was more of a joke :)

Re:Not likely...

[Marnhinn]

True, but only to an extent.

Many companies offer benefits in return for service (as you mention), the difference isn't in really in what the companies offer, it's in what they do.

If we just looked at offers - then there is not much difference between a lobbyist giving a politician large sums of money and someone donating to charity. Both are giving money away right? But the law looks at more than action - it looks at intent (thankfully). Which means that accepting money from a criminal enterprise is very different than accepting money from a legitimate company.

Re:Not likely...

[Reservoir Penguin]

I think the difference is that you're unlikely to get blown up to pieces or spend the rest of your life paralyzed while doing hacking jobs for a shady group.

Re:Not likely...

[gatesvp]

Actually, the military route may be even better for a hacker. You get computer training on some advanced tech and you get weapons and other military training.

Organized crime is always looking for ex-cops and ex-military. These guys already know basic tricks of the trade, they know how to use guns, they may have first aid (or better) medical training. They may have covert ops training and if they're really smart and computer-trained, they'll probably have a good handle on military-grade gear as well.

So if the mob wants to arrange for a pair of Sam Fisher's newest goggles, they'll "know a guy who knows a guy".

As far as organized crime is concerned, they are a business. It turns out that some of their best possible recruits (ex-military) are generally poorly-paid. Honestly, this whole thing just sounds like good business to me :)

Hookers as Employee Benefits!

[LinuxLuver]

Criminal gangs should be able to offer some very "creative" fringe benefit packages. You want $200,000 a year? Or maybe $150,000 and a two hookers / week? Tax that!

Re:Hookers as Employee Benefits!

[NotFamousYet]

Actually, it is true that what most tech-savvy people expect from an IT job is a good combination of comfort and challenge (see Google's very long list of fringe benefits).

If you're a student, such an offer is definitely more tempting and self-rewarding than working in a cubicle.

Re:Hookers as Employee Benefits!

[SoVeryTired]

At $500 a go, those would want to be some pretty special hookers. I prefer mine to be the $10 motel variety. Plus, you can put your cigarettes out on them.

Re:Hookers as Employee Benefits!

[LinuxLuver]

I was thinking of the higher end of the market, yeah......and $500 could either guarantee one hour with a goddess or 4 hours with someone slightly less attractive, but probably much more fun. :-)

Getting caught - who does the catching?

[Che Guevarra]

The low risk of being caught and the relatively high-rewards on offer helped the criminal gangs to paint an attractive picture of a cyber criminal's life, said Mr Day.

Why exactly isn't there a fear of getting caught? Considering the way the RIAA and other orgs (FBI) is able to track internet users, why so anon? -devils advocate

Re:Getting caught - who does the catching?

[ZachPruckowski]

The people who get caught by the RIAA are the "low hanging fruit" most of the time. They're either hitting ten year olds or they're hitting the superseeders (or the guys who run the sites). People with IT degrees who pirate would use safer, and harder to trace, methods. Even just using PeerGuardian or pirating via proxy (or stealing wireless) is going to help you a great deal in terms of not getting caught. Additionally, they "stay in the middle" in terms of threat level.

Same for these hackers. They're semi-safe because they're smarter than the average script-kiddie, and they're not quite as dangerous as the guys who hack the Pentagon or whatever. Law enforcement will feel two pressures: Go after the major crimes and close a lot of cases. They close the easy cases quickly, and catch the high-profile cases for the headlines. These guys probably feel safe since they're neither.

That said, the reason crime doesn't pay is that a cops only needs to get lucky once, but the criminal needs to be lucky everytime.

Re:The year for this article is 2006

[Schraegstrichpunkt]

You could always look at the URL.

Criminal gangs are targeting tech students?

[rampant mac]

SCO is hiring? I'm so in there...

I Condemn All These Crackers!

[Kiba Ruby]

All "hackers" who choosen to work for criminal organizations are not true hackers.

They are against the ways of the hackers! They choose to harm the internet! They don't deserve the title "hackers". What they really deserve is the title "crackers". For they have chosen such unspeakable unethical career!

          -Happy Hacking, Kiba

Re:I Condemn All These Crackers!

[Kiba Ruby]

I never see the movie "Hacker".

Re:The year for this article is 2006

[gb3]

http://yro.slashdot.org/article.pl?sid=06/12/09/05 8252 1906?

Had to be said

[NotFamousYet]

And what's their motto?

DO evil? :P

Uh...

[Belial6]

Uh... Bribery is not illegal. There are certain types of bribes that are illegal, but much like being a monopoly, it is not inherently illegal. You know, if I offer may local mayor a new car in exchange rezoning some land I own, it's a crime. If I offer my son a new car in exchange for mowing the lawn, I may be a crappy parent, but I certainly have not committed a crime.

Re:Uh...

[Rix]

You're confused about the definition of bribe.

Re:Uh...

[Maxo-Texas]

If you give the mayor $25,000 for his reelection commitee it's also legal.
If you give the mayor $25,000 with the understanding that he'll give you a zoning variance, it's illegal.
If you give the mayor $25,000 with no understanding he gives you a zoning variance, it's legal.

Re:Uh...

[Belial6]

Funny, I got my definition for Bribe from Merriam-Webster. If you have a better authority on the definition, I'm happy to hear it.

Re:Uh...

[Maxo-Texas]

Grr... 3 little letters.

If you give the mayor $25,000 with no understanding AND he gives you a zoning variance, it's legal.

If they were good hackers

[antifoidulus]

they could just get a degree the same way "Michael Parker" from Mitnick's first book got one.

Re:The year for this article is 2006

[VGPowerlord]

Lets see if I can figure out the year from some obvious source... lets see... not the submittion text...

Oh, hey, how about the article url!

http://yro.slashdot.org/article.pl?sid=06/12/09/05 8252

Lets see... today is 2006/12/09... nope, I'm not seeing it.

Re:The year for this article is 2006

[mincognito]

The point is, you can set a date format that includes the year in your Slashdot preferences (in the homepage section).

No...

[Rix]

Not a specific one, but *any* business' client database? Yes, definitely.

I do

[Rix]

Webster's can't even be counted on for correct spelling. Here is the definition of the English word.

Re:I do

[TriezGamer]

dishonest != illegal.

sneakers

[Skadet]

Where there's crime, there's organization.

Don't kid yourself. It's not that organized.

How about 'recruiters' phishing?

[maggotbrain_777]

I just had a headhunter call me the other day regarding an open position at SomeBigSearch Engine.
I had never conducted business with me before. We had never talked. In order to submit my application to the company, he stated that he needed me to give him my SSN#. I spent several minutes explaining that I do not give out my SSN to strangers, never mind when I initially submit my resume to a company. He was incredulous at my reluctance.
Now, I'd imagine there is a huge untapped market, of soon to be graduating students, here.
I'd bet there is a good entry level organized crime position just waiting to be filled cold-calling prospective employees.

Re:How about 'recruiters' phishing?

[cinexero]

Yesterday I got an email from SomeBigProcessorManufacturer trying to recruit me. Seemed fishy as hell, I'm gonna call the company in question Monday to figure out what is going on.

Actually, I think I may have already fallen for one such scam. I was contacted by a student at my university claiming to be the student recruiter for AnotherBigICManufacturer asking for a resume. I fired it off without a glance. Tried to email him again, it bounced. Fuck.

I mean, you could really screw someone with their resume, I put my phone, and adress[es] both email and physical on mine. And just with that, you could really do some damage.

Re: $25,000 and Variances

[TaoPhoenix]

If you give the mayor $25,000 and he understands what a zoning variance is, it's a good value for the money.
If you give the mayor $25,000 and he doesn't understand what a zoning variance is, it's a bad value for the money.
If you give the mayor $25,000 and neither of you understand what a zoning variance is, then it's your fault for not giving your money to a better candidate.

Awww

[b.burl]

...I thought it was going to be about the new ms recruitment drive.

Homer meet Godel

[TapeCutter]

"Professionalism"

"I will maintain professional" - Doh!

"Professionalism"

"I will maintain professional" - Doh!

"Professionalism"

"I will maintain professional" - Doh!

"Professionalism"

"I will maintain professional" - Doh!

Stupid "professionalism", take that, argg, and that, ugff,....

Re:Not Much of a Surprise...Yes,but...

[E 99]

Yes, but this is not how "hackers" make money. They make money by selling spam and pop-ups sent through bot nets. And also by phishing email/websites. (Although the latter is extremely traceable, so it only seems to be done by people in countries where they don't do anything about it, like the former Soviet bloc.)

Hey, wait, it's McAfee

[nbauman]

Did anybody notice that this BBC story is based entirely on a report, "McAfee Virtual Criminology Report http://www.softmart.com/mcafee/docs/McAfee%20NA%20 Virtual%20Criminology%20Report.pdf and an interview with one of its authors?

This report -- from 2005 -- doesn't have anything that you couldn't have already read on Slashdot or the newspapers.

The BBC didn't check McAfee's claims with another source. The McAfee report doesn't say anything about criminals paying tuition for students to study computer science. The McAfee security analyst didn't give any details. The BBC didn't ask him the obvious question, "How do you know?" Did he talk to a student like this? Did he find it in court records? Or did he hear it from another security expert after a few drinks?

Has McAfee been reliable in the past?

The Wired Article

[Phat_Tony]

Three years ago, Wired had an article written by a guy who does tech support for the Mafia.

Do they offer benefits?

[SilverJets]

Medical, dental? How about a retirement package?

Stetson Tailored Tin Foil Hat

[not_hylas( )]

What we *had* here was a failure to communicate.
That seems to be clearing up, somewhat.

If you remember just a few, scant years ago, this discussion would be full of:
* "Your a moran"
"How about that tin foil hat"
"You watch too much TV"
"I guess you are a leet hacker dude :-P"

and so on.

Perhaps Kevin (TM) has helped us understand what has been perpetrated on us for years (witting or unwitting social engineering).

The Art of Deception: Controlling the Human Element of Security

http://www.amazon.com/exec/obidos/tg/detail/-/0471 237124/ref=ase_mitnicksecuri-20/103-6052457-813506 9?v=glance&s=books

So the internet does make us smarter, eh?

For example:
The Kennedy assassination made the word "conspiracy" a knee jerk, almost unconscientious reaction to discount whatever followed as ludicrous.

As an exercise let me roll this past you.

If the Japanese in WWII could have attacked every home in the US by way of their radio set top box (a "brown note" for electronics), to start fires in every home ...

http://www.schmarder.com/radios/crystal/

http://en.wikipedia.org/wiki/Brown_note

do you think they would have conspired with College (engineering) students to help them?

Criminals are now MBAs, Engineers and Rocket Scientists.
Your desktop could be mocking you.

* [yes, it's misspelled]

Actually...

[Rix]

Dishonesty, in the context of financial transactions, certainly is illegal.

lavoro di squadra ("teamwork" in italian)

[Tarnum]

As "hacker" for a big organization you will not work alone. A nice guy with a wad of Dead Presidents will persuade the minimum-wage night guard to open the back door at 03:00. At 03:01 you get in, reboot the Windows server in safe mode, install a backdoor and leave in 03:15.

Re:The year for this article is 2006

[wiredlogic]

My guess is that they are trying to reduce a few percent off the bandwidth usage by keeping the default date as an abbreviated short format. The year is always in the URL anyway so you can pin down the year of the article there if you aren't logged in or linked in through the Ggoogle cache.