Criminals Target Tech Students With Job Offers

An anonymous reader writes "BBC News is running a story on criminal gangs targeting tech students. Some of these outfits offer to pay for an education in exchange for the student's employment on graduation in criminal hacking activities." From the article: " As the number of criminal gangs looking to move into cyber crime expanded, it got harder to recruit skilled hackers, said Mr Day. This has led criminals to target university students all around the world. 'Some students are being sponsored through their IT degree,' said Mr Day. Once qualified, the graduates go to work for the criminal gangs. As well as the direct route of targeting students, some organised crime gangs were trading on the glamour surrounding the 'hacker' label to help them recruit impressionable youngsters..."

Comments

surprised?

[Xolom]

it's a better job offer than the other offers most kids are going to get, and it appeals to their interests... why are people surprised?

Re:surprised?

[ScentCone]

it's a better job offer than the other offers most kids are going to get, and it appeals to their interests... why are people surprised?

Um... for the same reason people might be surprised if non-crazy students who spend their years in college studying chemistry would look for "sponsorship" from a group that tells them they'll be building suitcase bombs for terrorists? Or an engineering/architecture student that's told they'll get a free ride through college as along as they agree to help break into banks once they graduate? This isn't any different.

Re:surprised?

[Planesdragon]

This isn't any different.

It's significantly different. One is treason, another is abandoning a lucrative private enterprise for crime, and the third is a resort of despiration for those with few prosepcts.

The morality, ethics, and legal response to each of these is different. You might as well claim that vehicular manslaughter and driving with a cell phone "aren't any different."

Sweet

[presidentbeef]

Does this mean that legitimate companies, to keep up, will have to do the same thing?
Maybe they could even get into bidding wars over potential students/employees! This could only be a good thing...right?

This is a good thing

[svunt]

I'm currently doing an IT internship for the Gambino family. The pay is good, I get medical & dental, and if anyone mods me down, they'll find out about some of the other perks of working in the industry.

Re:This is a good thing

[Lane.exe]

Eh, getta load of this guy! We pays you good money so you can keep quiet, sit in your little room, and do your computer thing. But what's this? We finds you on this "internet," advertising who you work for! Hey, bambino, leave the singin' to Sinatra, capische?

Whack 'em.

Re:This is a good thing

[Dachannien]

I had no idea that Joe Pesci was a Slashdotter, until now.

Re:This is a good thing

[idonthack]

Whack 'em.

So, uh... I understand you have an opening now?

Re:This is a good thing

[6Yankee]

Yeah, but youdonthack. Sorry :P

pft!

[tloh]

No! No! No! Any hacker with even an ounce of skill is more than capable of setting up shop on his own. What you gotta do is offer the guy something he would never EVER get legitimately. What these criminal types REALLY ought to do is come on slashdot here and promise they can arrange regular *private* meetings with our favorite adult performers from the pr0n we all download.

Hack what ?

[jfclavette]

Say what you will, hacking (cracking, don't throw a fit) isn't exactly easy nowadays. Can anyone here honestly tell me that they can get me access to a given business's clients database in the next 48 hours ? Didn't think so. So what are the gangs getting out of this ? Are they getting on a hype bandwagon ?

Re:Hack what ?

[ScentCone]

Can anyone here honestly tell me that they can get me access to a given business's clients database in the next 48 hours ? Didn't think so. So what are the gangs getting out of this ? Are they getting on a hype bandwagon ?

Getting access to a company's database is so 1990's. These days, you need smart computer science types to design better malware to create botnets so that you can practice good old fashioned extortion against Costa Rican casino web sites. Simple as that.

Hoax maybe?

[UbuntuDupe]

This seems like a monumentally stupid way to recruit hackers. Let's see, leave a public record of you funding a student (rather than cold cash), then when he graduates, tell him, oops, you want him to break several laws. "Oh really? Well, thanks for the free education. Hey feds, over here!" *gets witness protection* *gets guaranteed income for life* *eliminates obligation to employer*

In order for this to work, you'd have to credibly threaten or capture a loved one. But if you've got the techie that way, ... er, why do you need to pay for his education again?

Re:Hoax maybe?

[Massacrifice]

Well, if they start by requiring the would be hacker to "prove" himself (or herself?) worthy by doing something illegal, they can then blackmail him into doing more. I would assume that criminal activities start before the end of the studies. If the studies ever get completed, that is.

Re:Hoax maybe?

[Beryllium Sphere(tm)]

>In order for this to work, you'd have to credibly threaten or capture a loved one.

The old recipe for recruiting a spy was MICE: Money, Ideology, Compromise, Ego. If organized crime really is troling computer students, they could use at least three of those, and maybe even ideology ("stick it to the greedy corporate exploiters and their fascist tools in government", or something like that).

The other problem is, what's a CS degree going to do for a blackhat?

Put them through drama school and psychology if you want to raise a crop of social engineers, use an apprenticeship system if you need vulnerability finders, but CS? There are only a few problems in the criminal world (robust scalable botnet control, untracable communications) that are computer science problems. And there can't be room for many people to work on those.

The article was way too light on any of the specifics that would have inclined me to trust it.

Not Much of a Surprise.

[PixieDust]

Everything internet related means lots of dollar signs. What's intruiging here is how it could also play out amongst large corporations. We all know about the difference between a White Hatter, and a Black Hatter. Now consider a network of say, 20 people, top to bottom. At the top, is some poor twit either finishing up college, or already working for a fairly large business (as this article indicates some targets are). At the bottom (in this case, origin), is Company A, that really wants to see company B go down. High profile, but they're paying a pretty penny. Think about it.

Wal-Mart. Big huge massive retail company. How much do you think it would be worth to K-Mart, or Target, or various other retailers, for Wal-Mart to just be down for a few days? Easily into tens of millions, if not hundreds of millions of dollars.

Sad part is, the person at the top doesn't even have to know what's going on. They just say "Hey write a program that will do this, and propogate. We'll give you a cool 100Gs." Kid says hells yea, takes a few hours, whatever, writes it, and gives it to them, collects.

Two weeks later, Wal-Mart plant sticks the little nasty into the Wal-Mart mainframe, and it gets disseminated to every single store in the company. The plant is nice and safe (removed by organization, or perhaps just left to fend for themselves, whatever), many of the people involved will never be caught, and the person that wrote it may not even know they were responsible!

Perhaps I should take off my tin-foil hat, but still, it's a helluva "What-If".

Re:Not Much of a Surprise.

[Lehk228]

if an attacker had access to wal*mart's systems, shutting them down for a few days would be a bad way to do it, instead attack trust and dependability.

screw up certain shipments for holidays, occasionally add an item or three to credit card purchases, add a hundred bucks to random debits.

then at the end transfer all credit card numbers, debit card numbers, signatures, and PINs to a third party


halting operations would be bad for walmart, leaking EVERY SINGLE credit card transaction processed by walmart would be much worse long term.

the attack could be even more effective if the pharmacy/medical records kept could be leaked. people get pissed when their viagra perscription gets posted on the internet

Re:The year for this article is 2006

[xrayspx]

Back in The Day, Slashdot listed only the day and date, which if I gave a shit, would be sufficient to narrow it down to the year. However, sometime in the last 2 years I was pleasantly surprised to see they started putting the year as well attached to every post.

Don't believe me? Read everything to the right of my name on this post.

Of course, I suppose I could be lying too.

Hookers as Employee Benefits!

[LinuxLuver]

Criminal gangs should be able to offer some very "creative" fringe benefit packages. You want $200,000 a year? Or maybe $150,000 and a two hookers / week? Tax that!

Re:Hookers as Employee Benefits!

[NotFamousYet]

Actually, it is true that what most tech-savvy people expect from an IT job is a good combination of comfort and challenge (see Google's very long list of fringe benefits).

If you're a student, such an offer is definitely more tempting and self-rewarding than working in a cubicle.

Re:Benefits

[Massacrifice]

Oh yeah, they have a dental plan... Tony, gimme the pliers.

Re:Not likely...

[presidentbeef]

I kind of see your point...but doesn't the military already do this? They offer to pay for college, you agree to serve for 6 years or whatever. Does it make a difference if it's a private company?
I know that some companies will help pay for your education if you agree to continue working for them for a certain amount of time after your education is complete. It's not so different, right? This is just getting them younger.

Of course, my original comment was more of a joke :)

Criminal gangs are targeting tech students?

[rampant mac]

SCO is hiring? I'm so in there...

Re:The year for this article is 2006

[mincognito]

The point is, you can set a date format that includes the year in your Slashdot preferences (in the homepage section).

Hey, wait, it's McAfee

[nbauman]

Did anybody notice that this BBC story is based entirely on a report, "McAfee Virtual Criminology Report http://www.softmart.com/mcafee/docs/McAfee%20NA%20 Virtual%20Criminology%20Report.pdf and an interview with one of its authors?

This report -- from 2005 -- doesn't have anything that you couldn't have already read on Slashdot or the newspapers.

The BBC didn't check McAfee's claims with another source. The McAfee report doesn't say anything about criminals paying tuition for students to study computer science. The McAfee security analyst didn't give any details. The BBC didn't ask him the obvious question, "How do you know?" Did he talk to a student like this? Did he find it in court records? Or did he hear it from another security expert after a few drinks?

Has McAfee been reliable in the past?