Slashdot Mirror
Hacker Group L0pht Making a Comeback
angry tapir writes "The news report begins with shots of a tense space shuttle launch. Engineers hunch over computer banks and techno music pounds in the background. There is a countdown, a lift-off, and then you see a young man in a black T-shirt and sunglasses, apparently reporting from 'space.' This is the Hacker News Network, and after a decade offline it is lifting off again, this time with a quirky brand of video reports about security. Hacker News Network is one of the side projects of the Boston-based hacker collective known as L0pht Heavy Industries. They're the guys who famously told the US Congress that they could take down the Internet in about 30 minutes, and who helped invent the way that security bugs are reported to computer companies."
Assuming these guys are 'white hats', and they are not _necessarily_ the most able or l337 hax0rs out there, then why has someone not already attempted to take the internet down in 30 minutes already? For, say, 1 million dollars? I call hubris..
Those guys also were probably among the first to make it publically obvious that computer skills were not simply vehicles for the personal amusement of the socially inept. The press at the time always discussed how they had one apartment for themselves, and one next door for their gear. They made money being hackers, (in the old sense of the word -- not crackers.) I imagine that a substantial part of the sudden increase in society's respect for geeks, (maybe mostly their potential incomes,) was due to the glamorous press exposure l0pht received at that time. Perhaps Slashdot should thank them -- I'm not really sure. It will be interesting to see what this new l0pht is like.
Since I like history and dead-tree, anyone have a suggestion for a good book covering the history of these 1990s hacking/security/blackhat/whitehat/grayhat groups, and what you might call the fragmentation/dissolution of the underground? There's good material on the 80s, but much less on the 90s, it seems, despite a decade having passed.
The only one I know of with more than a passing mention is a 20-page overview in Ch. 3 ("Hacking in the 1990s") of the book Hacker Culture (2003). Others?
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
But you -do- have that right, you just don't feel like using it. That is what happens with freedom, even though I have pretty much every right to fill this post with random links to Goatse, penis jokes and conspiracy theories about how 9/11 was planed by Jewish people, I choose not to. Same with you, you have, and should have every right to publish it, you just choose not to.
Taxation is legalized theft, no more, no less.
L0pht Heavy Industries went corporate in 2000, and became "@Stake", which was acquired by Symantec in 2004, and disappeared into the Symantec empire.
L0pht, founded in 1992, was itself a descendant of the Cult of the Dead Cow, founded in 1984 and still around, more or less.
There have been various spinoffs and buybacks along the way, but it's been a while since cutting edge work came from that crowd.
But what's more dangerous, the bag of tricks in the hands of a few skilled people or an open bulletin board with 0day-exploits for everyone?
What makes this question even more complicated for me is that Secunia, the people who protect us from exploits if we pay them, is sponsoring this practice.
The bag of tricks in the hands of a few - hands down. What we're talking about here is carte blanc access in the hands of a select few. We have to trust that the motives of these few strangers will fall in line with ours. And then we have to trust that the "select few" will remain few. Eventually they won't in both cases. Individuals will use these exploits to cause damage. And knowledge of these exploits will spread until even the least trusted in the underground has access to it.
We ran this gambit in the 80s. Exploits would become known within the underground. The most elite would share the knowledge amongst other inner-circle personalities. Eventually the exploit would slip to wider and wider distribution. Vendors would either be oblivious to the exploit or completely unmotivated to fix it. The general public would be oblivious to it or unmotivated to invoke any fixes a vendor might have provided. Until some amateur will do something damaging (intentional or not) with the information.
An interesting thing to note is the nature of computer crime over the years. A good deal of it was the activities of the stereotypical exploring hacker / phreak. And there was always the insider looking for revenge or manipulating data to steal. However, there were also "classic" hackers making money manipulating systems to steal equipment. And the Mafia was a consumer of Blue Boxes.
Today, the computer crime scene has expanded to provide ample opportunities to tempt the first individual willing to hand over an exploit. You can question Secunia's motives if you want. But you should be aware that there are others just as driven with much more sinister motives.
I agree that 0day exploits on public bulletin boards breeds chaos. But it's very visible chaos. Many more people are aware of the issues presented by a publicly published vulnerability. And that gives it a better chance of being addressed and its effective life shortened.
It would be better, of course, if the vulnerability never existed. But they tend to exist. There are 0days right now waiting to be discovered. The question is how long until they are discovered, by who, and how will they be used?