Internet Crime Focus of Black Hat Europe

kierny writes "'The Internet needs crime,' said renowned cryptographer Whitfield Diffie, kicking off the Black Hat Europe conference in Amsterdam. His analysis — that there can't be good guys without bad guys — helps explain not just the rise of black hat hackers and, more recently, hacktivism, but signals that the information security profession will continue to not just be relevant, but demanded, especially as the number of data-spewing devices increases exponentially."

Comments

every article needs a first post

[Nyder]

so then we can have replies.

Re:every article needs a first post

[RandomUsername99]

reply

Re:every article needs a first post

[Anonymous Coward]

Ah, grasshopper ... the article _is_ the first post.
Any post you post after the article proper is the second post, at most.

You have much to learn.

Re:every article needs a first post

[Sneeka2]

Ah, grasshopper... the article _is_ the first post. What we need after that is a frist post.

You blew it.

Re:every article needs a first post

[oetkb]

Are you lot on drugs, and if so - please may I have some?

Re:every article needs a first post

[martin-boundary]

Or we could just make a slashdot law like FOPA (First Obligatory Posts Allover), then everybody's posts can be first.

Good can exist without evil

[Anonymous Coward]

Yes there can be good guys without bad guys.

Closed system.

A boy scout helps an old lady across the street.
Is the boy scout good? I would say yes.
Then, where is the bad guy in this example? The old lady?

The old argument that good needs evil to survive is wrong.

Re:Good can exist without evil

[Sneeka2]

Then, where is the bad guy in this example?

The car driver coming down the street at 200mph. Without him, there'd be no need to help the old lady across the street in the first place, she could do it alone.

QED.

Re:Good can exist without evil

[Anonymous Coward]

Bzzt! Wrong!

We say that something is good when it benefits people and evil when it harms people. In a world without evil, old ladies would never need to cross streets in the first place.

What we call evil behaviors exist because we find ourselves in situations where there are multiple obstacle laden paths to our goals, and sometimes some of those paths end up trampling over other people's goals, but are easier. To eliminate evil from the universe, you either have to either eliminate the obstacles (or equivalently, make all paths equally troublesome) or remove the possibility of taking paths that harm others.

Any universe without a structure which permits identification of persistent actors and creates identifiable choices with expected, but not certain, outcomes is isomorphic to a puppet show.

Re:Good can exist without evil

[mwvdlee]

Without a lunatic driving at ridiculous speed, there is still a real danger for honest accidents and there'd still be a need to help the old lady across the street.
Good guys require bad events, which may or may not include events caused by guys.
Likewise, without black hat hackers there'd still be a need to protect against accidental or unintentional damage.

Re:Good can exist without evil

[Ardyvee]

I think that the article/they wanted to imply that without bad guys that look for security holes, and others, there would be no need to make secure software (which should be done, with or without the presence of bad guys. It's good practice). I mean, why would a company spend money trying to make a piece of software secure (from scratch or otherwise) if there is nobody to break into that, put them into shame, and cause damage? From a company POV, there is no reason - unless the administrative head feels compelled to force their employees to make secure software.

IMO, instead of having "bad guys" that cause damage, ideally we could pay people to look for security holes in software in a controlled environment where they cause no damage and flaws are still identified. Note I said we replace the "bad guys" with "good guys paid to act as bad guys".

Re:Good can exist without evil

[turing_m]

It need not be an evil person driving a car. In this closed system it could just be another old person driving a Buick. The old person is not evil, just too old to be driving.

Re:Good can exist without evil

[justforgetme]

The (inherent) bad guy in this situation is the danger of the street.
If there is no danger there is no definition for good.

Same goes for limitations, ignorance etc. You can't have it all so
in some respect you always are bad and good. It's like Schrödinger's
feline example with you being the poison.

Re:Good can exist without evil

[Anonymous Coward]

Yes there can be good guys without bad guys.

Closed system.

A boy scout helps an old lady across the street. Is the boy scout good? I would say yes. Then, where is the bad guy in this example? The old lady?

The other boy scouts that did not help the old lady.

Re:Good can exist without evil

[ShooterNeo]

The evil here is entropy, god, or evolution. One or more of the three has caused the lady's genetic code to have serious flaws, causing her body to decay as time passes rather than maintaining itself in good working order. If that evil were defeated (which will require the efforts of many brave and brilliant scientists) then the old lady wouldn't need help, and no one would know she was old because she'd probably look like women we consider supermodels today.

Re:Good can exist without evil

[Anonymous Coward]

'A boy scout helps an old lady across the street.Is the boy scout good? I would say yes.Then, where is the bad guy in this example?'

Baden Powell

Re:Good can exist without evil

[Hentes]

But danger is not necessarily human-caused.

Re:Good can exist without evil

[Anonymous Coward]

I went to school with someone who thought prisons should be closed and criminals released because there was an imbalance of good in society.

Re:Good can exist without evil

[Ihmhi]

It need not be an evil person driving a car. In this closed system it could just be another old person driving a Buick. The old person is not evil, just too old to be driving.

The Buick may be evil. We can't be sure. At least it's not a Lincoln Town Car - those things are downright Satanic.

Re:Good can exist without evil

[biodata]

The car drivers talking on their phones, drunk at the wheel, going too fast, or just not really thinking about what they are doing are the bad guys. Without the bad guys the boy scout's actions are not good, and maybe even a little creepy.

Re:Good can exist without evil

[justforgetme]

No, what it does is generate two (or more) groups of ethics, one group is concerned about the effects of said danger and one that isn't. That first group spawns sub groups that can eventually be labeled good and bad.

Re:Good can exist without evil

[Anonymous Coward]

There is nothing brave or brilliant about being afraid of death, and no greater evil than superficial, immortal people.

Re:Good can exist without evil

[Securityemo]

Name wasn't Mordenkainen by any chance?

Re:Good can exist without evil

[buchner.johannes]

Without a lunatic driving at ridiculous speed, there is still a real danger for honest accidents and there'd still be a need to help the old lady across the street.
Good guys require bad events, which may or may not include events caused by guys.
Likewise, without black hat hackers there'd still be a need to protect against accidental or unintentional damage.

Not bad events. Helping over the street can be helping with the troubles of old age (walking being difficult). There is no actor and no event there, it's just normal.

His analysis — that there can't be good guys without bad guys — helps explain not just the rise of black hat hackers

That is not a explanation, it's just putting the burden of explanation somewhere else (remind you of something?).

Re:Good can exist without evil

[lxs]

I don't know the boy scout. He might be an opportunist looking for reward. Did the old lady want to cross the street in the first place? In matters of ethics context is everything.

However, at first glance his actions appear to be mostly beneficial.

Re:Good can exist without evil

[Anonymous Coward]

Sorry to go around in circles, but to modify the previous closed system:

A boy scout helps an old lady carry some groceries.
There's no danger, but it transfers a difficult task for her into an easier one for him.
She appreciates the help, and we say the boy scout is "good".

No danger involved. The second ethical group (that contains non-boy scouts), don't wish any harm on the lady. She will only suffer discomfort from her load, not injury. So is this second group of people "bad"? I'd say "lazy" or "self-involved" at the most. So in a contrived situation I'd say we can have "good" and neutral, without their being a need for "bad".

But we can argue semantics. And admit that the article is a real world story not and not a philosophical exercise.

Re:Good can exist without evil

[Anonymous Coward]

If the old lady does not wish to cross the road then the boy scout is quite obviously the evil one.

Re:Good can exist without evil

[riondluz]

"Then, where is the bad guy in this example? The old lady?"
Without crossing genderlines and the 'boy' scout being the only guy the answers is 'nowhere'; unless the little urchin is bipolar maybe.
Otherwise I would like to submit
http://evilladies.com/
say:
http://evilladies.com/serial-killers/dorothea-puente-old-lady-who-killed-men/

as a possible candidate.

Re:Good can exist without evil

[dave562]

The only reason that you can speak of good is because of evil. If there were not evil, good would not be good because there would not be a "not good" to compare it to. It simply would be what is.

Re:Good can exist without evil

[jvkjvk]

They must not have been paying attention to politics or governments or business, then.

Re:Good can exist without evil

[Em Adespoton]

Bzzt! Wrong!

We say that something is good when it benefits people and evil when it harms people.

I think you'll find that "evil" generally requires intent. The word you are looking for is "bad." We also sometimes anthropomorphise evil onto bad events when there appears to be no balancing good that comes out of the event.

Good (positive) is to Bad as Good (saintly?) is to Evil.

Re:Good can exist without evil

[Anonymous Coward]

The inherent bad guy could be the old bitches hip getting ready to blow out and may need help up and over the curb. With out him (boy scout) that old evil hip and bad curb were probably conspiring to kill the old broad. I'm sure it's the Hip, curb, and Buick that are evil and are only canceled out by the gracious goodness of the kind little scout. You guys are high! or not high enough.

Politicians would suffice

[niftydude]

Even if crime didn't exist on the internet, we'd still need the white hats to protect us from politicians.

The privacy invading tripe legislated by our current mob isn't criminal by definition.

Re:Politicians would suffice

[justforgetme]

Nah, black hats are much better for that. white hats and grey hats are cataloged and very silencable.
Black hat cataloging exists too but isn't as efficient.

And for those who consider replying with "But but black hats are motivated by personal gain": So are
You. At least they can make a point.

We need thieves, arsonist murderers and rapists...

[Anonymous Coward]

... so that the fire brigade, police and other law enforcement officers will not be out of work.

We need thieves, arsonists, rapists and murderers

[leehanxue]

... so that the fire brigade, police and other law enforcement officers will not be out of work.

"there can't be good guys without the bad guys"

[themushroom]

But sometimes it's the corporation behind the server being hacked into that is the bad guy, so that part of the equasion already exists.

And vandals too

[turing_m]

...so that all those broken windows can be fixed by someone. If there are sufficient vandals to keep every shopkeeper and farmer in the land busy repairing windows full time instead of doing their regular jobs, the demand for labor will be such that no one need ever be unemployed again!

Re:And vandals too

[justforgetme]

Ponzi is that you old fella?

No good guys

[DarkOx]

I think there is actually more to this than many slashdotors are dismissing the "no good guys without the bad" as. The things that turns a bad guy into a bad guy are motives and opportunity. Having the skills is a big part of opportunity. Even with the economy as it is most of us in the Western World with education and experience required to be security professionals can make a better living doing that or at least avoid the risks associated with being a criminal while living comfortably. That is not true in some other places and its possible it could become untrue here.

So maybe there is something to the pushing "hacking is cool" is a bad idea thought. Creating tons of security 'professionals' might just be creating tomorrows black hats mob employees. Sorta like in places all over the world yesterdays soldier has become today's insurgent and or revolutionary. They know the business of war, and its a huge leg up. Knowing is actually I think more than half the battle. I am not saying we should all stop attending $CON and talking to each other about developing better techniques to identify weaknesses. If we did that the integrity of the system would stop improving, and the few bad guys that will be out there anyway, even if working in a vacuum, will be completely unchecked.

University systems and other stuff got owned all the time in the 70's and 80's before the Internet exited to facilitate communication among black hats, grey hats, and white hats. I don't know what the answer is and I don't really think trying to censor information is ever a good approach but none the less there is something to think about here.

Re:No good guys

[Securityemo]

The problem with that line of reasoning is that hacking is basically just using programming/IT skills in a certain manner; the only "special knowledge" required beyond that is knowledge of specific exploits and methods. You'd obviously also need to spend time (and/or money) to establish a toolchain and a workflow of sorts and keep that up-to-date, which clearly must be eased by stuff like metasploit and nmap, but otherwise I've seen nothing to indicate that black hats aren't self-made.

Also, remember that penetration testing tools developed as a response to the "bad guy tools", not the other way around.

Re:No good guys

[DarkOx]

That is pretty much what I was thinking about. If you have ever worked with or even watched a professional pen test team the first thing you notice (if they are any good) is they target collaboration tools that are integrated with stuff like Nessus, Nmap, and Metasploit ( the pro version has build in collaboration tools already).

You have one person identifying and classifying, and others going after hosts according to specialty, finally you have them sharing information between each other when they discover credential pairs, network topology etc.

If I had to guess I bet the bad guy tools existed first, someone saw them and commercialized them; made them better and now the bad guys use them.

Re:No good guys

[Securityemo]

The structured framework approach seems to be the effort of the security/pen-test industry. Metasploit is basically a very structured approach to exploit code offering payloads in the form of shellcode (notably the meterpreter), crypters to go with that, and basic trojan/binder functionality. It also has a few auxillary modules for various stuff. There's also CANVAS and Core Impact but those are expensive and I've never played with them. Before and besides that exploits were and are written in the form of small programs in C/Perl/whatever like the ones you can find at http://www.exploit-db.com/.

Re:No good guys

[Securityemo]

On the other hand there's the black-hat exploit kits you can buy for cash, but those seem as a class to be quite different in purpouse and function, namely that of being loaded onto a web page and spreading botnet binaries.

You need money.

[petergk]

People who talk about the importance of the source of a problem, often live from the money what they earn with fixing problems. Clear to see the strategy behind this. If you say,that "you" need crime to respect the good guys, you are very close to commit a crime. Or you already did it in the name of this bullsh!t? Nobody is guilty until its proven by the proper authority. This kind of thinking (we need bad things) is against the community. I not say we don't need security rules or security checks/verification procedures, just handle it right at its place, in the lab, and don't make crime. (you can shoot on a beer bottle (empty!), why shoot on living things?

What Depth Of Evil?

[glorybe]

It does make sense that the more hackers and crackers are out there the more skilled people will be in demand to secure and produce better products. We see an example of good coming out of evil, I suppose. But at what depth the evil? We are witness to a similar situation in right wing politics. The left and the center moved clearly towards the right. That left those on the right with no plank on which to stand so they shifted further and further to the idiotic and radical right. So we now see presidential candidates wanting to ban birth control and make condoms illegal. So in computing what does this imply? If we have serious pressure from terrorists seeking to do real harm will that mean that more security oriented programmers and IT managers will be caused to evolve? Normally our system is money driven. Is there a clear path between security oriented skills paying rewards as high as a successful game developer might earn?

Police

[Anonymous Coward]

When we were young we killed the foreign fellows,
they spoke in strange tongues and were brown or yellow.
We'd make mincemeat of 'em and when each one was a corpse,
then for their killings we'd be heroes, of course.
Well now you're Chief of Police and I am King of Thieves,
and each one in our own career something achieved,
though both from the gutter were conceived,
well now, with respect we are received.

We are the police
(we are the police)
we are the thieves
(we are the thieves)
and each the other does need.
We are the police
(we are the police)
we are the thieves
(we are the thieves)
and each the other does need.

When we were young we went and joined the army,
those were the days, they were all so balmy.
Those young girls we would rape to shut them up
their mouths we'd sellotape,
to keep 'em quiet while them we did rape.
Ha ha ha ha!

So now our lives could become a success,
power and influence and money in excess.
You're the Chief of Police and I'm the King of Thieves,
and each in our own career something achieved.

We are the police
(we are the police)
we are the thieves
(we are the thieves)
and each the other does need ...

"Requiring Bad Guys"?

[Myu]

If Good requires Evil, then maybe we would be better off without both? Just a thought. Especially if "Good" means "ridiculous amounts of legislation, overinflated security software pricing and a persistent universal mistrust of your fellow man".

Philosophic Thursdays

[Anonymous Coward]

A very philosophic thursday on Slashdot, does the good need the bad to be good? Can the bad be good? What is the meaning of life?

Ah that could be a good, thing philosphics thursdays, far better than friday jokes!

And we need kids throwing rocks thru windows...

[rthille]

So that we can have people to repair them.

Black, White, so clear - In Other News....

[riondluz]

At least here in the good ol' U S of A, Ms Napolitano is redefining the word terrorist to include anyone having a minor beef w/the "System" and our wonderful Dept of Justice, in consort with a congress that has the lowest approval rating in history, pushing hard for 'hacking' to become a crime of terror.

I wouldn't be surprised if someday soon just running Linux and 'non-approved' applications will get you on the 'black-hat', 'no computer for you!, list.

Remind me, who are the good guys again? Because I remember a recent /. story which aluded to the 'netgods of the 70/80's being upset and saying "don't screw w/our creation, or ELSE!"

Maybe they'll become our next action heros, followed by legions of anonymous; wearing grayhats and fawkes' masks. I know I'd rather see them behind the wheel than a hoard of monkey-bots sitting in the glare their RoundUp RPT screens panting 'think of the children (and god knows who else)', deploying their micro keyhole-sats to hover over illegal hot-spots to catch us wankers in the act of sharing our packages; telling us to "get off THEIR lawn".

If there were no Evil, there would be no stories

[Xaedalus]

There would be no more heroes, and no more villains. Stories would be told about cooperation against implacable obstacles and overcoming overwhelming odds. There would be no deviation from the norm because good would 'be' the norm. For that matter, there would be no more free will, or choice. Only totally rational automatons always cooperating together, no matter what. There would be no more right, no more wrong. There would be only ONE mind, one ideology because without wrongness, without evil there would be no variation.

Wonderous

[lightknight]

So, instead of finding the cure, they wish to profit from a steady stream of treatments.

Instead of making code easier to secure (better libraries, saner programming languages), or programming the compiler to scream when a possible issue needs to be attended to, we're going to employ thousands of people in a jobs program.

Am I the only person from the school of 'fix it once, for all eternity'?