Slashdot Mirror
Aaron Barr Talks About DEFCON, Anonymous Attacks
Trailrunner7 writes "Finding Aaron Barr at this year's DEFCON hacker conference in Las Vegas was like a giant game of 'Where's Waldo.' Given the events of the past year, you can hardly blame him for keeping a low profile. First there was the attack on him and his then-employer, HBGary Federal, his decision to part ways with HBGary, his work to rehabilitate his image and turn his personal misfortunes into a 'teaching moment' for the industry, and then the legal wrangling in recent weeks that threw cold water on his plans to take part in a panel discussion about Anonymous at DEFCON. Barr was courted by numerous news outlets at the show, including the mainstream media. But he preferred, for the most part, to keep his own counsel. But he offered his thoughts to Threatpost on the experience of being at the conference, what the attack by Anonymous has done to him and whether it's possible for the group to turn its attentions to more constructive pursuits."
Is he implying, by the notion of "more constructive" that crushing him and shedding some light on his creepy private-sector-spook buddies was not, in fact, a valuable use of time?
If it were possible to do so more widely and efficiently that would certainly be "more constructive"; but I'm suspecting that he has something else entirely in mind...
...Anonymous are just a bunch of thugs now. Had they stuck to their original purpose they could have been a force for good. Now they're farce - no different from every ego-centric hacker group that came before them.
It's worse than that, honestly. If he were just a chest-thumping internet blowhard, that would just put him among the untold millions of gratingly defective personalities infesting the internet. No big deal.
However, for all his pleasant protests to the contrary "Oh, look at me, I'm against Wal-mart and the Iraq war!", he is basically the smiley face standing in front of a bunch of unsavory characters(HB Gary's work on rootkits, for instance, was not exactly "defensive" in nature...)
Choice little bits like "Good threat intelligence requires comprehensive real-time collection and analysis on all threats, and in a constantly connected, social media-dominated world, this appears to some as an encroachment by governments or companies on privacy in the name of security. In my opinion, well-intentioned efforts run afoul of some civil libertarians and privacy advocates because of the perception of encroachment. But with mediums like social networking Web sites, which enable easy manipulation of identity, it is getting difficult to separate the actual threats from the bystanders." certainly do sound all nice and 'nuanced'; but are basically a polite re-statement of the justification for the too-creepy-even-for-congress Total Information Awareness stuff.
In a slightly different vein, his "The need for anonymity for in the latter case is critical to protect whistleblowers or dissidents. In the case of the former - online protests - I believe anonymity and the lack of personal accountability is absolutely corrupting what I think are some of the key tenets of lawful protest. These include personal sacrifice and a willingness for individuals to stand up and be associated with a cause or idea with boots on the ground, as it were." sure does sound nice, except for its implied premise that there are "whistleblowers or dissidents", the good guys, who can be clearly separated from mere "protesters" who had better be ready to wear nametags and stand neatly in the free speech zone. Fantastic... Earth to Aaron Barr... Entities being attacked always classify their attackers, whatever their means, as the most dangerous/evil category available. Nobody says "Well, gosh, I guess that the guy who just leaked our secret plans is just a good, honest, whistleblower. Good on him!".
For all his 'shades of grey' droning, assertions of 'liberalism', and whatnot, this guy is a dirty little cog doing his bit for surveillance society(but not to fear, he says he is a "white hat"). At best, he maintains the oh-so-not-at-all-daring position that other people's dissidents are good guys who are worthy of protection; but the(apparently not "dissident") actions of 'attacking' "Law Enforcement" and "Sony" are just evil criminal stuff. Apparently they are in the way of "Western Information Dominance"...
Anonymous's theoretical view is that anyone can join.
That means they will attract both "good" and "bad" (and perhaps some "ugly"). Therefore "more constructive pursuits, " whatever that may be- will be followed, as will more dumbarse pursuits, more juvenile pursuits, and more lulzish pursuits.
You have to think what type of people will be attracted to the un"organization" to see what direction it will take.
Outright criminals are unlikely- no profit.
Professionals are unlikely
Bored, younger, tech-savy singles are most likely
I suspect therefore their targets in general are going to continue to be more for the mischievious and disruptful.
"That's the way to do it" - Punch
Board rooms now regularly discuss corporate vulnerabilities and mitigation strategies. In turn, they are spending more on security as a result of these threats. That is a good thing right? Maybe.
Maybe?? Did this guy not work for a fucking security firm? Now it's "maybe" a good thing they are spending more on security?
Is he trolling himself now?
Funny how the conversation always comes around to it being all because of those damn dirty hackers. You don't see anyone in the mainstream media saying "Hey, Sony, maybe you shouldn't have been storing customer info in plaintext on your poorly secured servers?" Anonymous gets a hold of that, and they embarrass people. Eastern European or Chinese hacker groups get a hold of it, we're in a far worse position.
We can sit here and pray for a day when there won't be hackers, it'll never happen, but whatever. But what we can't do is just ignore the woefully inadequate security measures being used in these companies that, frankly, can afford a lot better. They refuse to let us use these services without every piece of information about us they can get short of a DNA sample, throw said info on an open server with no protection, and then blame everyone else when they get hacked and lose customer data.
This is why customer data should be regulated the same as medical data. If our medical records were stored like our credit card numbers are on so many sites, people would have a shit fit. It's time to start holding these companies liable for gross negligence when they can't maintain the security of our data within reason.
FTA: "I would have loved the opportunity to convey a few misunderstandings about me." Nothing to see here, move along.
(HB Gary's work on rootkits, for instance, was not exactly "defensive" in nature...)
And the astroturfing software, too, that gave me the warm and fuzzies:
It was also revealed that HBGary Federal was contracted by the U.S. government to develop astroturfing software which could create an "army" of multiple fake social media profiles to manipulate and sway public opinion on controversial issues. This software could also scan for people with points of view the powers-that-be didn't like and then have the "fake" profiles attempt to discredit those "real" people.
source
Yeah, he's one of the "good guys" alright. Give me a fucking break.