Slashdot Mirror
The Path From Hacker To Security Consultant
CNet has a series of interviews with former hackers who ran afoul of the law in their youth, but later turned their skills toward a profession in security consulting. Adrian Lamo discusses taking "normal every day information resources and [arranging] them in improbable ways," describing a time when he broke into Excite@Home's system and ended up answering help desk questions from their users. Kevin Mitnick, famous for gaining access to many high-profile systems, warns today's young hackers not to follow in his footsteps, saying, "A lot of pen testers today have done unethical things in their past during their learning process, especially the older ones because there was no opportunity to learn about security. Back in the '70s and '80s, it was all self-taught. So a lot of the old-school hackers really learned on other people's systems. And at the time, I couldn't even afford my own computer." Mark Abene explains how he got interested in phone phreaking, and how it led to a prison term and a career in computer security. Like Mitnick, he says that easy access to powerful modern computers removes part of the motivation for breaking into other systems.
It takes one to know one. This works in all sorts of industries. The best teachers for example were often the worst behaved students.
sudo mount --milk --sugar
Speaking from experience, it is difficult to get back into the workplace after a battle with law enforcement due to a high-tech crime. It is possible, however. Keep your nose clean and keep up with the industry and eventually you can regain a bit of trust. I am proof that it is possible, as I was once the subject of a Slashdot interview regarding a pretty public piracy case.
I worked at a company who shall remain anonymous. I worked there as their security consultant and was in charge of keeping the systems secure.
I noticed that their systems were insecure, I kept telling them that these things will get hacked, I kept telling them that they are wide open. Did they listen to me? No. They kept going on and on, I worked to patch as many holes as I can, but the system was insecure in itself (things like passwords stored in plain text on mysql databases etc...). Fixes I recommended were rejected by management because they would change things from how they were used to, or too expensive, or "but who would want to hack us" responses.
A few weeks ago our external servers get hacked (surprise surprise), and the hacker notifies the company. What do they do? They pay the guy 600 euros per domain (we have a lot of domains) to fix it for us. That dude had the ear of all management, everything he said went, they changed things that I've been recommending to them for months because he said so. And to finish it off, he earned more money in those two weeks working for this company than I did in the last 6 months, to make fixes I've been telling them to do since I got the job.
F*ck it, in future I will just break into computers and then offer them a huge fee to fix them, It seems to pay more to do it that way. The company didn't call the police, just kept it as quiet as possible so word didn't get out.
Posting anonymously for obvious reasons.
"A lot of jobs"? You mean jobs where you're an employee.
This is why most of these guys are "consultants". That is, they run their own business and therefore don't typically require any of the normal checks that employees have to get. Some (government) things require security clearance but most stuff does not. All you need is a good reputation and proven skills.
I'm disappointed, Slashdot reader/commenter. Everyone here should know that the meaning of the word "hacker" has changed over time and evolved to mean, most of the time, what "cracker" means. Word definitions change over time and this word has been assimilated with a new definition, accepted by the majority of the English-speaking world. If you want to hang on to the cracker vs hacker definitions, feel free. But most people have moved beyond this.
Plus, your definition of "hacker" is off anyway. In the classical sense, "hacker" means someone who experiments and gets something to do something it was not intended to do. Doesn't have to be code, doesn't have to be a computer, doesn't have to be anything in particular. The original targets/subjects of the earliest "hacking" (largely out of MIT) was the phone system, not programs or computers.
Back in the late 90's (age 13-17) I was a "curious" about security. I did many things which would now be considered criminal or, at the very least, of ethical concern. I now hold the highest level security clearance you can get, helping to defend our military infrastructure. This is after admitting my youthful behavior to my investigators. Perhaps it is more about being caught than actually committing the crime? Or perhaps it was that I had grew out of it and proven myself a trustworthy individual? Probably a combination of both.