The Crock^H^H^H^H^H Art of Intrusion

Information security professionals sometimes are looked upon as soothsayers of the digital divide. Typically the outside world cannot fathom what we do, and how we do it. There are many examples I can give you to illustrate this, but the point is that many times we are misunderstood.

Newer people to the infosec world love to try to use FUD (fear, uncertainty and doubt) to push their points home. This is normal, and it can be outgrown if the professional actually spends any real time in the field and realizes that information security is about mitigating risks, not eliminating them. The problem exists when these people get their "learning" from books written by witty hackers of the past.

If you are a Kevin Mitnick or Adrian Lamo fan, you probably are not going to want to read any further.

Still with me? Good.

The problem I speak of is wearing blinders and thinking modelling after self-professed crackers is a GOOD thing. These guys have actually stated that they had good intentions when they were breaching systems. They did it for curiosity sake and meant to cause no real damage. People like Lamo have had WorldCom, SecurityFocus and TechTV giving him praise for his efforts and promoting him as an expert. Mitnick has already written a book about his social engineering skills in The Art of Deception, regularly speaks at security conferences and has started his own company. Although I cannot deny these gentlemen have great skills, promoting yourself as an information security professional because you can relate to them is a CROCK.

Security is not a game. You will not become a respectable information security professional by 'doing a righteous hack' or simply reading a single book like Hacking Exposed or Mitnick's next one called The Art of Intrusion. Which gets me to the reason for my post.

The Register posted a good article about Mitnick calling out to the hacking community looking for good stories to add to his book on the art of intrusion. For $500, you too can be published. *snicker*

This is just dumb thinking. Profiling your attacker is one of the first logical steps when evaluating the threats you are susceptible to, and what risks you need to mitigate. What keeps me up late at night is not the nuisance from egotistical script kiddies that want glory in a book from Mitnick, or a few minutes on TechTV with Leo Laporte. It’s the professional hacker that is going to use these new blended threats we are seeing in the real world to cause real information theft or maybe terrorism on our critical infrastructure. It’s the insider attack from a disgruntled employee that will bring down an entire corporation to its knees, or perhaps destabilize parts of the economy. blah blah blah. You get my point.

You see the real hacker (evil intruder connotation here) isn’t going to tell you about his exploits. He doesn’t get caught. He treats the digital domain as a field of espionage and respects the boundaries that he plays in. (Although I use the term respect loosely here)

This is no better then the security vendors who offer money in contests to breach their new wiz-bang device. The reality is there is nothing wrong with vulnerability assessment, but this is not the way to go about it. A professional hacker isn’t going to waste his time breaching your system to gain a quick buck. If he has any real intent, it will be to make big money later if someone installs your new device in a real environment where the target is unaware, and has information resources worth something to the attacker. Typically this sort of ‘we are unhackable’ attitude comes from inexperienced vendors and professionals that are not seasoned in how the attack will work... and who will typically have very little real-world experience.

So what am I trying to say? Well, if you want to be an information security professional don’t model after these guys. Feel free to read and learn from some of their experiences, but put it into context. Misguided in their pursuits, what they did was ILLEGAL. It was UNETHICAL. And it was WRONG.

They used the guise of ‘curiosity’ to shield them from the very fact that they were TRESPASSING. The consequences of their actions had DAMAGING after effects to the target, if they knew it or not. There were REAL COSTS associated with having to deal with the cleanup of the incidents, and the time associated in the evaluation and analysis of what these attackers did. Worst of all, they continue to promote the action as something good for the security industry, when IT IS NOT.

There was a good analogy that Lawrence Walsh wrote about in a Information Security magazine article a few months back about Lamo that I thought was bang on:

You see an opulent house with many ornate windows and doors. Out of curiosity, you try to enter. By chance, you have a ladder and find an unlocked window on the second floor. From Lamo’s perspective, it’s completely acceptable to enter, rearrange the furniture and make a few long-distance phone calls, so long as you tell the owner how you did it.

That thinking is WRONG. They undermine everything an information security professional should stand for, and its right that they be prosecuted to the fullest extent of the law. I wouldn't put much faith in 'war stories' sought out with small amounts of money from the hacking community either. The quality of the information of the attack is just not there.