Pentagon Contractors Openly Post Job Listings For Offensive Hackers

Sparrowvsrevolution writes "In the wake of confirmation that the U.S. government was involved in the creation of Stuxnet and likely Flame, a look over job listings on defense contractor sites shows just how explicitly the Pentagon and the firms that service it are recruiting offense-oriented hackers. Northrop Grumman, Raytheon, Lockheed Martin, SAIC, and Booz Allen have all posted job ads that require skills like 'exploit development,' have titles like 'Windows Attack Developer,' or asks them to 'plan, execute, and assess an Offensive Cyberspace Operation.'"

Comments

Who better?

[jameson71]

Who would better know how to defend against these attacks than someone who knows how to develop and implement them?

Re:Who better?

[i kan reed]

Too bad the people who are going to be doing the attacks are hiring up all the possible defenders then.

Re:Who better?

[Shagg]

What makes you think they're being hired for defense?

Re:Who better?

[Anonymous Coward]

Wanting really hard to believe that's the case despite all the evidence pointing the other way. I see someone skipped their Creationism Science classes.

Re:Who better?

[poetmatt]

We're only about 10-15 years late. What's the worst that could happen, right? /sarcasm.

Re:Who better?

[Eightbitgnosis]

Offense? Defense?

With America's preemptive warfare policy; what's the difference?

Re:Who better?

[Anonymous Coward]

This is a pretty narrow view, my guess, is they'll be working on the next Flame.

Re:Who better?

[cyfer2000]

"job listings on defense contractor sites"

Re:Who better?

[Anonymous Coward]

Good point, I'm sure there was nothing on the offense contractor sites.

Re:Who better?

[ackthpt]

Who would better know how to defend against these attacks than someone who knows how to develop and implement them?

How about people with enough sense to write code which sits there, unobtrusively doing nothing, until such time as it is called upon to do its dirty work? These are the people you want, not just someone who knows today's weakness, which may not be there tomorrow.

Re:Who better?

[Shagg]

You don't think "defense contractors" means they only defend, do you?

Re:Who better?

[bky1701]

Hackers are like soldiers, though, in that defense and offense are really not that far apart (with the exception of just following good programming standards). Just like you can order the guy keeping watch to go shoot at some people, a 'friendly' hacker can still hack your enemies, in theory.

The overall problem with "cyber war" is that it seems like the new excuse, now that kiddie porn has kind of fizzled out and piracy is widely accepted, to lock down the internet. The only real answer is to stop having vital systems programmed by idiots connected to the internet. When most bank and government systems are less secure than a site running PHPBB (for example, using unencrypted passwords), there is a serious problem that can't be fixed by plastering it over with censorship and playing war.

Re:Who better?

[St.Creed]

Cool - they need "Programmer-at-arms" people. Reminds me of A Fire Upon the Deep...

Re:Who better?

[wisnoskij]

Well theoretically if there exists offensive and defensive security experts (like this article implies) then the defensive oriented ones would be better at defence.

Re:Who better?

[Dishevel]

To only defend is a horrible defense.

Re:Who better?

[Stiletto]

...or that the "Department of Defense" actually defends US soil?

Re:Who better?

[Anonymous Coward]

Ha. If you think we are late to the Cyber War, then you are just another sheeple. The United States has one of the most advanced and active offensive cyber operations in the world. Just because YOU never heard about it doesn't mean it never existed.

Re:Who better?

[gweihir]

Who would better know how to defend against these attacks than someone who knows how to develop and implement them?

Almost anybody. Attackers are highly specialized and do not need to cover the whole or even significant parts of the protection angle. If the attacker gets in, the goal is reached. It does not matter at all that if a lot of potential other attack venues were not even touched.

For this reason, black-hats make terrible security experts for the defender side. The myth that a good attacker is a good defender is patently false in IT security (and likely in other areas as well). What a good defender needs first is to find all possible attack venues. That is complicated and requires understanding the whole system, the organization using it, the cultural environment, etc. The black-hat, on the other side, can experiment and does not really need to understand any of these, except for the tony fragment where the attack is to be launched. Even there, the black-hat can afford to fail frequently. This is fundamentally different for the defender.

Re:Who better?

[anared]

Thats one hell of a joke

Re:Who better?

[Starteck81]

You don't think "defense contractors" means they only defend, do you?

The best defense is a good offense.

Re:Who better?

[Hentes]

He was just pointing out that hiring these people is not necessarily for offensive reasons.

Re:Who better?

[flyneye]

But , do they really have to be offensive? Is there some special new Kinect interface for offensive, that somehow makes this advantageous?
              Even many ratbag industrial physical labor jobs have standard policies regarding hygiene.
I am rarely disgusted by much, but this is apparently some bureaucratic attempt to be politically correct and non discriminatory in federal workplaces.
One Washington faux passe that will get some quick review I'm sure. I wouldn't be shocked to find this to be the work of lobbyists for some silly Brad Pitt/Alysha Silverstone " natural" movement so the stinker pigs of the world can "come out" and get some rights served up. Eventually it will wind up with the job being outsourced to smellier countries than this one, comrade.

Re:Who better?

[cavreader]

Nobody has produced any verifiable proof that the US built Stuxnet. People use opinions instead of actual facts to make grandiose claims. As more people accept an opinion it magically turns into a fact. The US could be responsible but so could a lot of other countries. After all It was Russian contractors who plugged in the infected USB at the Iranian facility.

Re:Who better?

[Anonymous Coward]

Because it's called the "Defence Department", dummy ;)

Re:Who better?

[WrecklessSandwich]

It used to be called the Department of War up until 1949. Shame that they decided to change the name when they reorganized all of the branches under a joint command.

Re:Who better?

[Anonymous Coward]

i wholeheartedly agree but who the fuck would apply with name and adress to a job post like that from a government that's been prosecuting? is this like stupid or just looking for creative?

or just hoping to catch a few and make a bonus as in standard procedure worldwide ... the glam does not exist, there's only never been there if it comes to that, there's a few that might apply, and they might have quite some skill

does that cover everything, i think it does

Re:Who better?

[Jah-Wren Ryel]

The only real answer is to stop having vital systems programmed by idiots connected to the internet.

Disconnect idiots from internet before starting critical system software development -- Check!

Re:Who better?

[baegucb]

I was called older than dirt, on irc, back in the 90s. If you've been around long enough, you get to know people. Like on private irc servers. Anything can be cracked. Sheesh, between social engineering, knowledge of unpublished holes in various OS's you find, and a few people with skills, anything can be gotten into.

Now, get off my lawn. Really, get off.

Re:Who better?

[gweihir]

The pathetic state of practical IT security does not mean things cannot be secured a whole lot better. And yes, "not possible to break in" is achievable from a technological side, even for an Internet connected system. It will require high effort, a simple service and some special hoops, but it can definitely be done. Of course, it cannot be done by everybody. Social engineering also has its limits, depending on who you attack. For example, you will never get customer data by social engineering from a competently run bank and there are quite a few of these around.

Still, plenty of very soft targets, both for social engineering and technological attacks. The trick the black-hats use to make people believe they can get into anything is to try often, hide their failures (of which there are many) and over-hype their successes. Quite a bit like your posturing.

Re:Who better?

[Xest]

What rubbish, an attacker similarly needs to understand every possible attack vector to be able to find a point of entry. They don't just magically happen upon an attack vector and then ignore the system, it takes a lot of time and effort to approach just about all different angles. If they carry out more than one attack in their life time, it's unlikely they'll be able to exploit the exact same vector every time so they'll have to cover many different angles to find ways in.

Unless you're talking about script kiddies who use pre-discovered exploits, but I'm pretty sure that's not what the GP was referring to - he was talking about hackers that actually find methods of entry in the first place, and you cannot do that reliably if you only understand one small part of a system.

The attacker just does not get some big magical arrow over the company pointing to a part of it saying "attack here, this is where an exploit is".

One of the fundamental reasons why attackers are some of the best defenders in security is because to attack, they not only have to be astoundingly competent technically, but have to be extremely good at out thinking of the things no one else has - and that's really key. To attack you genuinely have to be on the cutting edge and be able to consider issues no one else has before. you even mention yourself that the attackers can afford to fail frequently, which has the implication that they'll have to try again - here's a hint, when they fail what do you think they do? they'll have to attempt at another part of the system which they'll then need to understand. Even the script kiddies like Lulzsec had to gain an understanding of the wider system for their HBGary hack which makes a decent case study - their attack involved SQL injection, social engineering, password cracking all of which allowed them to penetrate deeper and deeper.

Just as you've implicitly generalised all attackers as script kiddies who use single pre-discovered attack vectors and nothing more one might equally generalise about the countless "security consultants" working on the defence side of things who think securing a system is about running some pre-written pen testing software and seeing if the UI shows a bunch of ticks and a bunch of crosses, and if it shows any crosses, just installing the latest updates. The point being that that doesn't make you secure against competent attackers - it's the same flawed doctrine that anti-virus software uses, by largely only defending against known threats with a bunch of weak heuristics on top to detect similar threats it completely fails in the face of new threats. The only time I've ever seen AV software find anything in the last 10 - 20 years is when it's already infected the system and too late for the AV software to do anything about it. Much of the defensive security industry is a complete sham in this respect, it's built on a lie that it is somehow going to keep you safe, when in reality it mostly just slows your computer down with it's bloat and gets in your way with it's renewal nag screens.

Re:Who better?

[Anonymous Coward]

The best defense is a good offense.

Yes, you make one hell of a lot of friends that way

Re:Who better?

[marcello_dl]

No no they don't defend at all, they contract.

Re:Who better?

[gweihir]

The problem is that attackers do not need do be complete at all. There is absolutely no need (or typically skills and resources) to look at all possible attack vectors. Attackers will generally look at more than one possible vector, but once they have found one they can exploit with the specific attack techniques they have mastered, they are done. And with the sad state practical IT security is in, finding one vector that works is usually done relatively fast and with relatively limited skills.

The defender needs to identify _all_ vectors and needs to consider all possible attack techniques, even "unknown" ones. That is quite different. Defenders also do not need skill at programming exploits beyond a basic understanding. Defenders do need to understand things like architecture and design, data-flows, data formats, etc. An attacker can just explore these things and look for information once he/she has the data. The defender needs to know and the knowledge needs to be as complete as possible. Defenders also need to really understand the system and software design process. The whole skill- and mind-set of attackers and defenders does not overlap very much.

You are quite right that this does is not true for "script-kiddie" defender types, of which there are many. There are reasons practical IT security is to pathetic, and one is low-competence defenders. They can only defend against script-kiddies, as they basically have the same skills, namely running scripts made by others. Competent defenders know how limited that is. This is also the only reason why attackers as defenders is sometimes perceived as a good idea: They at least have a general idea what they are defending against. They can do penetration-tests. Nobody competent in IT security sees penetration tests as very important. They are not difficult to do. What matters is what you conclude from a pen-test. And even then, there are quite a few problems you cannot find with a pen-test because of resource limitations.

Re:Who better?

[Anonymous Coward]

Seriously. How is this not an act of war against the entire world?

Re:Who better?

[Xest]

I think the problem is that you're still conflating low brow script kiddies against extremely talented defenders, it's just not a fair comparison.

The fact is, to perform a highly skilled attack against a system that is well defended you do need to understand everything the defender does, because the system will be locked down so tight you'll need to be able to consider every possibility, and look so deep into every aspect of a system to find a way in.

Attacking a well protected system ultimately relies on attacking areas of that system where there is a lapse in security, or an unpatched exploit. The problem is you can't guarantee that will be the same from target to target, and it's highly unlikely that every security expert is going to be making the exact same lapse on the exact same type of system on every target you attack. Effectively you're having to develop a completely bespoke route of entry that could be so incredibly different from target to target that the chance of you finding one that will work everywhere against well secured systems is negligible. You cannot look high and low for that point of entry on each well secured system you attack unless you have at least as good an understanding of the complete set of attack vectors that someone defending a system will have.

The idea of having one method of entry that you use for everything only works for script kiddies who are just throwing mud at everything and seeing where it sticks. To defend against the kind of attacker who is willing to go the extra mile and craft a bespoke method of entry for your systems then it absolutely is a massive advantage having someone on your team with the talent to do that themselves. This is also the precise type of attacker the likes of the Pentagon will face.

Re:Who better?

[gweihir]

What I see is that in each sector of competence, the skills are different for attacker and defender. While some black-hats may actually be good defenders, there is no reason to believe they are, besides a general understanding of the area. And no, you do not look at every possible attack vector even on the very top of attacker competence. There you look for a vector that fits your requirements. For example: How important is it that you remain undetected after the fact? For how long? How much time do you have? What must be compromised, what is nice to have? How much budget and what skills? Is there intelligence support available or maybe even somebody undercover? Can a hardware shipment be compromised? Can somebody be bribed? And so on.

All these border conditions narrow the attacker focus considerably and select a small part of the possible vectors. From that you select the attack experts you need. While defenders do a similar kind of triage, it is far less effective at reducing the possible vectors. It really boils down to the attackers just having to find one working attack vector, while the defenders have to secure all of them.

So, if you want to be secure, your defenders need to be at least one competence class above compared to the attackers. That is one more reason why attackers are limited as defenders. And while I do not compare script-kiddie attackers against highly competent expert defenders, there is some asymmetry in this conflict area.

However, you have one thing right: Having competent attackers as consultants to be used by the team of defenders, in particular to estimate attack efforts and the like and as intelligence on current attacker capabilities can be beneficial. But they can only ever be part of such a team, not defenders in their own right, unless they acquire a lot of additional skills and insights. So if you only hire attackers as defenders, you are screwed. If you hire some attackers to augment the skill-pool available to the defenders that may be good idea, depending on the circumstances.

Of course, all very good defenders can also attack. They usually find it not hard conceptually, just tedious, boring and requiring a lot of time.

Re:Who better?

[peawormsworth]

The word defense is a euphemism. The "department of Defense" is equivelent to "military". Wikipedia says: "The Department – headed by the Secretary of Defense – has three subordinate military departments: the Department of the Army, the Department of the Navy, and the Department of the Air Force."

"one mans terrorist is another mans freedom fighter." To some the people who u would call "insurgent" is some elses "hero".

In regard to "defensive" vs "offensive" technology, there is no difference. The same knowledge that can protect ur technology from attack is the same knowledge which can be exploited in order to attack an enemy who does not protect against this threat.

Re:Who better?

[Xest]

"What I see is that in each sector of competence, the skills are different for attacker and defender. While some black-hats may actually be good defenders, there is no reason to believe they are, besides a general understanding of the area. And no, you do not look at every possible attack vector even on the very top of attacker competence. There you look for a vector that fits your requirements. For example: How important is it that you remain undetected after the fact? For how long? How much time do you have? What must be compromised, what is nice to have? How much budget and what skills? Is there intelligence support available or maybe even somebody undercover?"

You don't have that luxury that's the point, you can't pick and choose your point of entry on a well secured system, you have to find one.

"Can a hardware shipment be compromised? Can somebody be bribed? And so on." ...which proves the point? It's about checking every possible point of entry until you find one, which requires knowledge of all possible points of entry to find one that works.

"It really boils down to the attackers just having to find one working attack vector, while the defenders have to secure all of them."

Yes and again, HOW do you think they find it? As I said before, there isn't just some magical red arrow that says "Point of entry, here".

The problem with defenders is that they're generally bought into the field based entirely on only a theoretical basis. They do not have the understanding that a former blackhat might, because the theoretical field is always one step behind what is actually happening in the real world. Textbooks can't tell you everything - nothing beats practical experience, and you can't get practical experience defending against an attack that hasn't been publicised or happened yet, when it actually happens it's too late.

Throughout the history of the internet those who have attacked systems have shown an impressive level of knowledge they attack - most often more so than the system admins administering those systems. It was the same when kids were attacking AT&T's cellphone network, it's the same when hackers sponsored by organised crime are breaking into steal credit cards, and and it's the same now that groups protesting against the world or whatever do serious hacks. If you don't think talented attackers have at least as good an understanding of the systems they break into as those defending them then you've missed decades of news on the subject.

Like I said, even the Lulzsec crew, who were relatively low brow had to understand a lot about the system they were entering to penetrate so deep, from software versions, to the topology of the network such that they could pinpoint the weakest target to start with, to password hashing algorithms, to the people and their jobs at the company to pull off a social engineering stunt.

Re:Who better?

[FishOuttaWater]

Developing weapons is a diplomacy tool. Using them is an act of war.

Re:Who better?

[stewbacca]

...or that the "Department of Defense" actually defends US soil?

Yes, it actually DOES defend US oil...oh wait...

Re:Who better?

[ananthap]

"Defense contractors" probably comes from persons contracted by the department of defense. They could play defensive, offensive, clean the toilets, anything.

Great for non-bathers

[busyqth]

For that exquisitely offensive hacker smell...

Offensive

[Concerned Onlooker]

Aren't all hackers offensive?

Re:Offensive

[Anonymous Coward]

...and not just the odor!

Re:Offensive

[Anubis IV]

Aren't all hackers offensive?

Only to certain senses.

Re:Offensive

[mcgrew]

What is so offensive about repurposing hardware? What is so offensive about writing quick and dirty single-use code? What is so offensive about pen testing your own network?

Son, if you think hackers are offensive, you're on the wrong site, and so is the idiot who modded you "insightful." Not knowing there are white, gray, and black hat hackers shows a complete and utter lack of insight.

Re:Offensive

[St.Creed]

Too bad. Since they're hiring "offensive hackers" and hackers aren't offensive, I guess they won't be able to find anyone then :)

Re:Offensive

[wisnoskij]

In this sense I think they said offensive hacker instead of defence oriented security expert.

Re:Offensive

[Anonymous Coward]

Smell, for example.

Re:Offensive

[Anonymous Coward]

You should have a needless hissy fit over it. Oh, good, you already did!

Re:Offensive

[Anonymous Coward]

What makes the white/gray/black concept so hard to understand?

Re:Offensive

[i286NiNJA]

No they want hackers to break into computers, they also want hackers to help them secure their own systems because they're awful at it. This is hardly news either you have no idea what you're talking about.

Re:Offensive

[Anonymous Coward]

The same thing that makes the joke go woosh...

Microsoft must be so pleased....

[ip_freely_2000]

the government is hiring people to hack my software with the intention of doing harm. If I was Apple or Google I'd be looking at this closely. Even if you hate Microsoft, this seems pretty ambiguous. I wonder if there's something in the Windows EULA that Microsoft should sue the government for violating.

Re:Microsoft must be so pleased....

[Anonymous Coward]

What makes you think they only hack Windows boxes?

Re:Microsoft must be so pleased....

[idontgno]

...the government is hiring people to exploit the weakensses I allow in my software with the intention of doing harm

FTFY. If Microsoft doesn't want Windows hacked, they only have to fix the damn thing.

I wonder if there's something in the Windows EULA that Microsoft should sue the government for violating.

There's this little EULA that says Microsoft can just suck it.

Re:Microsoft must be so pleased....

[ackthpt]

What makes you think they only hack Windows boxes?

Because Windows is easier to pirate, which is why Iran was running so many copies of it on .. I love this part .. Nuclear Centrifuges!!!

It's like feeding your army at McDonalds

Re:Microsoft must be so pleased....

[Mindcontrolled]

And if the Linux community wants Linux to be used, they only have to make it usable.

Waiting for more than a decade...

Re:Microsoft must be so pleased....

[tchdab1]

I think these guys have all the source code and back doors they need from domestic developers. It's new features that they need to develop. Foggy Bottom/Langley needs to be able to say "I have an app for that!".

Re:Microsoft must be so pleased....

[Anonymous Coward]

well... it is usable, Scientific Linux is used by Fermilab and CERN and that's probably because they don't want script kids playing around with their particle accelerators

Re:Microsoft must be so pleased....

[Anonymous Coward]

Wow, a butthurt Linux fanboy, that's got to be a first. News flash for you; Linux isn't any more 'secure' it just isn't popular enough as a desktop platform to be worth the trouble, kinda like Mac. As someone who uses a wide range of platforms I can honestly tell you there's 'flaw' and exploitable features in everything.

Re:Microsoft must be so pleased....

[mjwalshe]

Um i think you will find that Governments reserve the right for their security services do do naughty things

Re:Microsoft must be so pleased....

[the eric conspiracy]

Soon Windows Update will distribute these attacks.

Re:Microsoft must be so pleased....

[Anonymous Coward]

After all this time, you still seem ignorant of the fact that the Siemens controllers for the centrifuges are supported only on Windows.
The choice of Windows was pushed by the contractors and the hardware selection, not Iran.

Re:Microsoft must be so pleased....

[Anonymous Coward]

And if the Linux community wants Linux to be used, they only have to make it usable.

Waiting for more than a decade...

Wait, if Linux isn't usable, then what he hell am I typing this comment on? A cheeseburger?

Re:Microsoft must be so pleased....

[donscarletti]

Linux has been usable for 90% windows can do for over a decade. And today is used by an awful lot of people for a lot of things.

Windows is targeted for home and office PC users and it fills that niche quite well. I just willingly paid for a Win7 professional OEM edition that was not forced on me, because I want my home desktop to run Windows. But like hell I'm going to install that thing on the server cluster that needs to stay up around the clock, unhacked for me to make money.

Linux is already "pretty usable" on the desktop, the question is whether it is as good as Win7 and OSX. Probably not, but why do I care whether Linux can out-compete these operating systems in their own niches?

Re:Microsoft must be so pleased....

[Mindcontrolled]

It's the 90% thing that doesn't do it for me. Sure, I consider myself a nerd. I do run a fileserver and a thin mediaplayer client on linux. My main desktop, however, is Win7 and will stay Win7 for a considerable time, because Linux just does not do what I need when it comes to gaming and sound editing/digital music production. That's not the main point, though - the main point is that even my fileserver/media client setup is not something you can sell to your average Joe Blow. There IS a usability issue.

Department of Redundancy Department

[Tablizer]

So then, why don't we have a Department of Offense instead of just a Department of Defense? If the lie, I mean creative labeling works for DOD, why not use it for hacking titles also?

Also, I wonder if the inadvertent Stuxnet admission had anything to do with the change. Why mention such in job ads anyhow?

Re:Department of Redundancy Department

[busyqth]

The original name was the Department of War, which sounds way cooler.

Re:Department of Redundancy Department

[ackthpt]

The original name was the Department of War, which sounds way cooler.

Yeah, and it was called Eastern War Time, before this Daylight Savings Time malarky.

Re:Department of Redundancy Department

[gl4ss]

Department of International Freedom Struggles.

anyhow, sounds like easy money. apply for the job, if they ask you for references say that you can't tell them because that would land you in jail.

Re:Department of Redundancy Department

[bky1701]

Well, they can always claim they are good at defense, since we haven't been invaded in a long time. If you put war back in the name, people might start asking questions about why a department with "war" in the name utterly failed the last several we were in.

Re:Department of Redundancy Department

[ibneko]

Because "DOO"

Re:Department of Redundancy Department

[St.Creed]

Oooh good one. Hadn't thought of it that way.

Re:Department of Redundancy Department

[man_of_mr_e]

Because the best defense is a good offence.

Or so my coach used to tell me.

Re:Department of Redundancy Department

[Anonymous Coward]

Anytime is wartime, so it logically follows that we have Eastern War Time and Western War Time. Eastern War Time is more popular with the Chinese cold war.

Re:Department of Redundancy Department

[ffflala]

So then, why don't we have a Department of Offense instead of just a Department of Defense? If the lie, I mean creative labeling works for DOD, why not use it for hacking titles also?

DoD covers both: because the best defense is a good offense. This same kind of sports-based reasoning is also why we have "three strikes" laws, btw. Because nothing quite as accurate as a good sports analogy to explain how to kill a bunch of people and/or imprison them for life.

Do I detect a bit of dot-com in the mix?

[Anonymous Coward]

But rocketing demand and a lagging supply of skilled hackers is boosting salaries and driving the defense industry’s war for talent into the open, says Alan Paller, the director of research at the cybersecurity education-focused SANS Institute. He cites SANS’ statistics that highly skilled cybersecurity staffers were paid as much as $175,000 in 2011, up 25 to 30 percent from two years before, and points to comments from the Booz Allen Hamilton executive Patrick Gorman to Bloomberg last year that the company tries to hire 1,000 cybersecurity experts a year, and struggles to find them.

Gentlemen, the next new fad. Here's a trick question: how many script kiddies does it take to develop an exploit?

Re:Do I detect a bit of dot-com in the mix?

[ackthpt]

But rocketing demand and a lagging supply of skilled hackers is boosting salaries and driving the defense industry’s war for talent into the open, says Alan Paller, the director of research at the cybersecurity education-focused SANS Institute. He cites SANS’ statistics that highly skilled cybersecurity staffers were paid as much as $175,000 in 2011, up 25 to 30 percent from two years before, and points to comments from the Booz Allen Hamilton executive Patrick Gorman to Bloomberg last year that the company tries to hire 1,000 cybersecurity experts a year, and struggles to find them.

Gentlemen, the next new fad. Here's a trick question: how many script kiddies does it take to develop an exploit?

Depends .. how many bug writers does Microsoft employ? 10,000? 20,000?

meanwhile, Jawa seen at Euro 2012

Re:Do I detect a bit of dot-com in the mix?

[gweihir]

Gentlemen, the next new fad. Here's a trick question: how many script kiddies does it take to develop an exploit?

Hehe, right on the mark!

Nooooooooo

[thewils]

Don't respond!!! It's a trap!!

Re:Nooooooooo

[ackthpt]

Don't respond!!! It's a trap!!

*cough* *wheeze*You were right.. The imperial forces were arrayed against us*cough*

Re:Nooooooooo

[synapse7]

Don't people usually go to jail for using such skills?

Re:Nooooooooo

[History's Coming To]

People go to jail for "unauthorised" use of such skills. There's nothing wrong with using them on systems where you have permission to, such as penetration testing, and I'm willing to bet MS employ a good few people to do just that. And, of course, when you hand your perfectly legal research over to the government or military then it's up to them to use it responsibly. Which, of course, they will.

Re:Nooooooooo

[mjwalshe]

Yes and for British Telecom I broke into a customers system when we took over a contract and the previous people had left under a cloud and not left the password - that was authorized by my boss the customer and a checked with a Very senior manager.

ironically one of my coworkers i got help from was a reformed phreak and had been done for hacking :-)

Re:Nooooooooo

[the eric conspiracy]

Not if they are good at it.

day in the life of a govt hacker

[Eponymous Hero]

the only downside... can't smoke weed at work

http://www.youtube.com/watch?v=BBMtl79atFs

Re:day in the life of a govt hacker

[ackthpt]

the only downside... can't smoke weed at work

http://www.youtube.com/watch?v=BBMtl79atFs

Problem with that stuff is it doesn't make you smarter or more creative, it just makes you think you are.

Re:day in the life of a govt hacker

[Eponymous Hero]

yeah, hackers!!! you hear that? booyah, bitches!!! sup now??

Re:day in the life of a govt hacker

[History's Coming To]

It can snap you out of an infinite brain loop though. I've lost count of the number of times I've been stuck on a problem, but solved it pretty quickly after having a smoke. Ditto alcohol, adrenalin and caffeine, anything to get your brain out of the rut it's in. I've also had some insights while using the strongest hallucinogen known, dreaming. Agreed, being perpetually stoned isn't going to help in the long run, but many people working on logic based problems will admit to moderate drug use when they hit a mental block.

Re:day in the life of a govt hacker

[ackthpt]

It can snap you out of an infinite brain loop though. I've lost count of the number of times I've been stuck on a problem, but solved it pretty quickly after having a smoke. Ditto alcohol, adrenalin and caffeine, anything to get your brain out of the rut it's in. I've also had some insights while using the strongest hallucinogen known, dreaming. Agreed, being perpetually stoned isn't going to help in the long run, but many people working on logic based problems will admit to moderate drug use when they hit a mental block.

And here I was just going out for a walk...

Re:day in the life of a govt hacker

[History's Coming To]

TL;DR - it gets you out of the Deja Foobar ;)

Re:day in the life of a govt hacker

[Anonymous Coward]

It can snap you out of an infinite brain loop though. I've lost count of the number of times I've been stuck on a problem, but solved it pretty quickly after having a smoke. Ditto alcohol, adrenalin and caffeine, anything to get your brain out of the rut it's in. I've also had some insights while using the strongest hallucinogen known, dreaming. Agreed, being perpetually stoned isn't going to help in the long run, but many people working on logic based problems will admit to moderate drug use when they hit a mental block.

And here I was just going out for a walk...

Riiiiight *wink*

Re:day in the life of a govt hacker

[CanHasDIY]

the only downside... can't smoke weed at work

http://www.youtube.com/watch?v=BBMtl79atFs

Problem with that stuff is it doesn't make you smarter or more creative, it just makes you think you are.

Sayeth the Prophet -

They lie about marijuana. Tell you pot-smoking makes you unmotivated. Lie! When you're high, you can do everything you normally do just as well – you just realize that it's not worth the fucking effort. There is a difference.

Re:day in the life of a govt hacker

[Phyrexia]

I think there are studies which refute your assertion.

Windows Attack Developer - Wanted

[ackthpt]

Best advertising you could ask -- for Linux or Mac.

Re:Windows Attack Developer - Wanted

[Reschekle]

Not really. The spooks want to attack the platform the enemy is using and will have high value in comprimising.

Linux and Mac computers don't manage the SCADA system in Iran's enrichment plants, nor do their military commanders, bureaucrats, and etc. use Linux or Mac computers on a day to day basis.

Both Linux and Mac OS have had their share of embarrassing exploits.

Re:Windows Attack Developer - Wanted

[ackthpt]

Not really. The spooks want to attack the platform the enemy is using and will have high value in comprimising.

Linux and Mac computers don't manage the SCADA system in Iran's enrichment plants, nor do their military commanders, bureaucrats, and etc. use Linux or Mac computers on a day to day basis.

Both Linux and Mac OS have had their share of embarrassing exploits.

That's the point. If all these developers are going to hack for $$$, without risk of going to the pokey, that's that many less who will be sitting around hacking Mac or Linux. Besides, Stuxnet succeeded because idiotic Iran bought a load of commodity PCs all loaded up with Windows and didn't have a lick of sense to isolate them from the outside world. If they had any competency they'd stay away from commodity garbage and be using dedicated hardware with specifically coded firmware, for the job, not a load of boxes which can run office, games, web browsers, play music or video, etc, on something as critical as a Nuclear Centrifuge .. geez, that's just amazing they did that. Probably coded all their controling software in VB, too.

Re:Windows Attack Developer - Wanted

[Anonymous Coward]

No need to hack GNU/Linux, you can just use the package manager to inject code.

Re:Windows Attack Developer - Wanted

[sqrt(2)]

The Stuxnet infected computers were "air gapped" meaning they had no connection to the outside internet. Many probably weren't even part of a network at all. They were infected by USB thumbdrives, and maybe a double agent who deliberately delivered the payload to the target machine.

Re:Windows Attack Developer - Wanted

[Anonymous Coward]

Except that stuxnet started in the enrichment plant and then escaped. It was a targeted worm and would have been developed to target whatever they built. The attack was specific to the centrifuges to the point that the US built a mock lab, with identical hardware/software just to do effective destructive testing (no, not penetration tests).

Openly Post Listings?

[busyqth]

Well I'm glad that they're posting the job listings openly.
Secretly posted listings don't usually have a great response rate.

Re:Openly Post Listings?

[Anonymous Coward]

In soviet russia, job finds you!

Re:Openly Post Listings?

[firewrought]

Well I'm glad that they're posting the job listings openly. Secretly posted listings don't usually have a great response rate.

Yes, but posting it secretly--to your honeypot network--makes it a a whole lot easier to ferret out people with actual skill. ;-O

Re:Openly Post Listings?

[Anonymous Coward]

Secretly posted listings don't usually have a great response rate.

i have repeatedly encountered, in the source comments and obfuscated or hidden text of various websites applications and protocols, email addresses and urls to job postings for both start-ups and established companies.

i never follow up on them though, so i guess you're right.

captcha: honestly

Not official

[cpu6502]

Quoting another slashdotter: "This is just a reporter's opinion sourced from conversations with people whose names he won't reveal at times he won't reveal..... he details the exact contents of a meeting that consisted of president Obama, vice president Biden, and CIA director Leon Panetta. For him to have this conversation, it means he has interviewed either the president, the vice president, or Panetta on this. Fat fucking chance. It's probably true, but no it's no way in hell close to "offical"."

Re:Not official

[TubeSteak]

Quoting another slashdotter: "I know what happened in a lot of meetings I never personally attended. Participants talk, transcripts are shared, etc. I suspect this info came second or third-hand from the people under Panetta."

Re:Not official

[KhabaLox]

Quoting another slashdotter: "This is just a reporter's opinion sourced from conversations with people whose names he won't reveal at times he won't reveal..... he details the exact contents of a meeting that consisted of president Obama, vice president Biden, and CIA director Leon Panetta. For him to have this conversation, it means he has interviewed either the president, the vice president, or Panetta on this. Fat fucking chance. It's probably true, but no it's no way in hell close to "offical"."

You could say the same thing, more or less, about Woodward and Bernstein and Deep Throat. It could be Biden or Panetta instructed an aide to leak the story at (or not) the President's direction.

Cool

[Offensive Hacker]

This is right up my alley.

Me me me!

[evilviper]

Pentagon Contractors Openly Post Job Listings For Offensive Hackers

People always say that I'm highly offensive...

Clearance Interview

[dloolb]

I bet the clearance interviews are interesting and probably resemble a job interview. Have fun with the EQIP form!

Re:Clearance Interview

[ackthpt]

I bet the clearance interviews are interesting and probably resemble a job interview. Have fun with the EQIP form!

RESUME

IMA HACKER

221 C BREAKER ST

LONDON, OH

Hai! I hakked vidio gamez, mobile fones, ipadz, and, can crack most browzers easly with some scriptz. Hire me or mi botnet will dsetroy you're company!

MEMO: Ms. Swanson, hire this one, let's see what she can really do. Starting salary $90,000.

Could be just the "in" Annonymous has been ...

[gatesstillborg]

...looking for! :)

Nothing New Here

[Anonymous Coward]

M00v^g 0N

not to mention that 5 sided building in DC

[RobertLTux]

what would be the nearest "bird farm" to Redmond?? or maybe the nearest Jam Factory??

I have severe body odor

[Anonymous Coward]

Do I get the job or do I have to cuss like a sailor, give every client the finger, dress gaudy, and be generally uncouth as well?

Afghanistan mujahideen

[jjohn]

I don't need to explain why training terrorists might not be the best idea for our long term interest, right?

Re:Afghanistan mujahideen

[rgbrenner]

I don't need to explain why training terrorists might not be the best idea for our long term interest, right?

Yes! Why didn't the pentagon think of this? Training hackers is a terrible idea.

Oh no.. it's worse than that. It looks like they are also training people how to use guns, fly airplanes, and use armed ships

Re:Afghanistan mujahideen

[Anonymous Coward]

Seriously? If cyberspace is or were a no-holds-barred battleground that would actually probably be true. Networks and other infrastructure would be a lot more secure as a result of battle-hardening rather than from security-by-fiat and treaty. Doesn't do much for lawyers, cops, and despots, but then that's always been a problem with "anarchy". The nanny state of course has a different take.

Looks to me like there's pretty much been a full scale cyber war going on for a while now anyway. I did a little mental calibration using the Wayback machine yesterday, and Google's starting to look the way Usenet did after the spammers turned it to total shit. I always thought there was some larger design behind that, too.

Re:Afghanistan mujahideen

[Anonymous Coward]

Also, I do a little Ruby terminal hand-holding for a convenience store customer. Seems a certain gasoline retailer's payment processing network keeps going down. I wonder...

Re:Afghanistan mujahideen

[ThatsMyNick]

And yeah we should stop training our military too. Training them in offense would turn them into terrorist too right?

Re:Afghanistan mujahideen

[Anonymous Coward]

Except, for civilians, it's easier to get a computer, than to get a F/A-22, or a Nuclear submarine.

Re:Afghanistan mujahideen

[rgbrenner]

true.. but I think the real difference between soldiers (computer techs or otherwise) and the mujaheddin is that they are US citizens. It would be very difficult for the mujaheddin to operate if the US gov knew their names, SS #s, etc, and could raid their homes right now and toss them in prison for the rest of their lives. The US gov has that ability with US citizens.. it doesn't with the mujaheddin.

Of course

[Sparticus789]

Leave it to the government to use outside contractors which demand a ridiculously high salary for this, when they could just develop more offensive capabilities with the people they already have. There are hundreds of military people who could perform this task with a little training and education, but the Pentagon, in their infinite wisdom, would rather those people sit on mountain tops playing Guitar Hero.

Even in my short 8 years in the Army, I saw a complete brain dump of technical jobs. The people who replaced me keep getting more incapable, because all the capable ones get out and take contracting jobs. Then the Army can't fulfill their mission, so the contractors hire back the same former military people to fill their previous slots, with 3x the salary and benefits.

Re:Of course

[Anonymous Coward]

It's an ongoing theme where we work that the better talent gets out of the Army and makes 3x as much while the organizations that we should be investing the best people into get all the newbies.

Unfortunately our Army is a farm team for private industry. Really it should be the other way around, but nobody is going to allow lower-enlisted Soldiers to make $60+ a year through special skill pay. So get promoted, right? The promotion process has nothing to do with your technical skills. It's all based on what's important to an Infantry unit.

Really what could be done is make star MOS's out of the fields we need people in. Unfortunately however, from what I understand they have made a new MOS for cyber security that requires you to be an E6 before you are even considered for selection. Then, after you're selected, THEN you get training in cyber security.

Wouldn't it make sense to recruit the people that are interested and/or already skilled?

Personally I would do it just because cyber security is what I'm interested in, what I have been interested in for the last 17 years. I would love to transition to cyber security but the migration path just isn't there. Besides, the field I'm in has the same talent problem. They train somebody, get just enough experience to be useful and start doing good things, then they ETS. Half of them find jobs doing something completely unrelated.

Give up...

[Anonymous Coward]

There's no intelligent life in U$A...

Re:Give up...

[busyqth]

Well there are a few bonobos...

What are principal the technical skill sets?

[PerlPunk]

Now that there is an economic "boom" in offensive hacking in the US (and probably elsewhere, too), what are the core skill sets that one should have? Computer languages, networking, social engineering? Any non-IT skills, like physics, EE, etc.?

Re:What are principal the technical skill sets?

[CanHasDIY]

Now that there is an economic "boom" in offensive hacking in the US (and probably elsewhere, too), what are the core skill sets that one should have? Computer languages, networking, social engineering? Any non-IT skills, like physics, EE, etc.?

Marksmanship would probably come in quite handy at some point.

Survival skills as well.

Though I can't verify the accuracy of it, and at risk of invoking Godwin, I recall hearing about the Nazi's 'allowing' Jewish scientists to work on their military rocket programs, only to turn and execute them after project completion...

If so, history provides a great disincentive to fall prey to such governmental bullshit.

Re:What are principal the technical skill sets?

[Anonymous Coward]

The principal skill is not having to ask.

Re:What are principal the technical skill sets?

[Fnord666]

Now that there is an economic "boom" in offensive hacking in the US (and probably elsewhere, too), what are the core skill sets that one should have? Computer languages, networking, social engineering? Any non-IT skills, like physics, EE, etc.?

Arabic?

Re:What are principal the technical skill sets?

[Anonymous Coward]

Usually the work is kind of like OS development, hard-core embedded OS debugging, compiler design, and other things related to assembly. (really fun variety of devious brain teasers too) It can also be more normal client-server writing. Actually flinging the exploits is different, with cultural issues to deal with. Different people do that.

Re:What are principal the technical skill sets?

[gatkinso]

Embedded developers I would think would be a great starting point: they are comfortable at the kernel level and may already have training on the very control systems being targeted.

yeah, use big arms companies

[Anonymous Coward]

Northrop Grumman, Raytheon, Lockheed Martin... aren't these big, bueracratic arms companies? Wouldn't it be better off hiring experienced, hard core programers, from small, specialized companies? Pay off John Carmack, David Cutler, etc.

Sauce for the New York Times...

[Lew Perin]

Recently US senators and members of Congress have been demanding punishment for anyone responsible for the recent media accounts of US involvement in Stuxnet and Flame. Can we assume that there's going to be a thorough investigation of what is in effect confirmation of those media stories? Starting with the HR departments of those giant defense (or offense) contractors and going as far as the evidence leads? Are we holding our breath?

Easy Fix

[wisnoskij]

Call it the Department of Offensive Matters and it can be shortened to DOOM, which would be awesome.

Don't do it!

[Anonymous Coward]

Don't do it, hackers! Save your productive energy for the private sector, where you will produce something of value instead of bureaucratic waste.

No thanks

[codepunk]

I had one gig with a dod contractor, you could not pay me enough to do it again. Ok, I am lying but the rate would be near insanity.

No fair!

[Anonymous Coward]

Why should the firm have to pay these guys? The Feds only have to threaten charges to them to work for the lulz. What did we spend all that money on Congressmen for? Is there no justice? Laxity, laxity, laxity!

I'm taking this up at the next stockholder's meeting!

Re:go to jail

[TaoPhoenix]

Good, you're the first one to point out part of this problem.

A lot of people learn hands on... so where are you supposed to learn this stuff legally? It kinda makes me laugh in the summary "a drying up supply of hackers". Okay, so we have 100 articles calling hackers terrorists, then you're complaining why people stop hacking?

Hire Mitnick.

[detritus.]

Hire Kevin Mitnick. He's the most dangerous hacker in the world. All he has to do is call up Iran and whistle into the phone, and they nuke themselves!

Hacker ethics

[in10d]

The time of hacker ethics comes to an end. So now - aside from White Hats and Black Hats, you will have Navy Hats stating "we do this just for greater good of America".

no can do

[Anonymous Coward]

outside contractors which demand a ridiculously high salary for this

Well sort of, but not ridiculous for the job. Very few people are capable of delivering the goods. Can you deliver? Here, you go find a zero-day exploit for each of these: Apache, IIS, Exchange, Samba. All typical OS versions must be supported, with ASLR and NX enabled. Occasional crashes are not OK. Oh, you get 18 months. Have fun!

they could just develop more offensive capabilities with the people they already have. There are hundreds of military people who could perform this task with a little training and education

OMG no. Some extremely bright people can manage to do the job with less than a Computer Science degree... for example, 3 years of MIT or Stanford. Normally it takes people with a BS degree and a decade of low-level experience, or an MS degree and a half dozen years of low-level experience.

Re:no can do

[Sparticus789]

OMG no. Some extremely bright people can manage to do the job with less than a Computer Science degree... for example, 3 years of MIT or Stanford. Normally it takes people with a BS degree and a decade of low-level experience, or an MS degree and a half dozen years of low-level experience.

First, if you had any guts you wouldn't post AC. Second, you obviously do not know any military folks who are in an IT job. That's what military folks in the IT field already have! I don't know a former military person who worked in IT that had less than 60 college credits and knew how to program at least one language. Add in the 6-10 years experience (which is harder than anything encountered in the civilian sector, so probably the equivalent to 8-12 years in the civilian world). We aren't dumb grunts, we know what we are doing. It's the Generals, politicians, and contractors that have no idea what they are doing.

lots of fun

[Anonymous Coward]

You get to creep out everybody who ever knew you going back 10 years. The FIB (not FBI, but most people will hear "FBI") will show up at their doorstep asking about you. This includes ex-wives, inlaws, former co-workers, former landlords, former classmates, college roommates, the people who lived next door to you...

Embedded Developers are in demand for this

[Anonymous Coward]

Comfortable with assemble, low level development. Device driver and kernel hacking. Embedded devs are perfect.

They have most of the baseline skills needed and can be trained up to round things out.... and very importantly probably kept their noses clean enough to get the clearance.

Truly offensive hacker

[Anonymous Coward]

I think I have this job interview nailed. I called the interviewer an asshole and then stole his credit card numbers. Then I went home and slept with his daughter.

heretics

[Anonymous Coward]

I have a particular hatred for any software that steals arbitrary peoples data. I however do not have a hatred for software that is used to take out software that steals random peoples data. Nothing is more fun than pulling out all the stops against a particular malicious person.

What would be cool, though impossible to do very effectively (don't call the huge LOIC botnets effective...), is if there was a sort of huge botnet that had an ungodly amount of people in it, opt-in only obvious, that could be used to counter the various malicious people, that would be cool. I know for a fact I could write a very effective botnet, because I have, I just won't embed it in malicious code, and I won't put anything malicious in it. I'm too smart I guess.

See, I don't know who you are. I don't know what you want. If you are looking for ransom, I can tell you I don't have money. But what I do have are a very particular set of skills; skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you let my daughter go now, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will kill you.

Because, you see, malicious people are HEATHEN!!!! They are HERETICS!. They use the skills provided to them by our JESUS, the great NSA, and they use it to THEIR OWN ADVANTAGE! GOD HATES THEM!

ok here's how my post went, i first paragraph was semi-serious, first sentence was definitely serious. second paragraph wasn't that serious at all, because i simply don't care. then i got bored because slashdot isn't very good now.