Hacker Group L0pht Making a Comeback 110
angry tapir writes "The news report begins with shots of a tense space shuttle launch. Engineers hunch over computer banks and techno music pounds in the background. There is a countdown, a lift-off, and then you see a young man in a black T-shirt and sunglasses, apparently reporting from 'space.' This is the Hacker News Network, and after a decade offline it is lifting off again, this time with a quirky brand of video reports about security. Hacker News Network is one of the side projects of the Boston-based hacker collective known as L0pht Heavy Industries. They're the guys who famously told the US Congress that they could take down the Internet in about 30 minutes, and who helped invent the way that security bugs are reported to computer companies."
Comment removed (Score:5, Insightful)
Pioneers of the glamourous geek lifestyle (Score:5, Insightful)
Comment removed (Score:3, Insightful)
literature request (Score:4, Insightful)
Since I like history and dead-tree, anyone have a suggestion for a good book covering the history of these 1990s hacking/security/blackhat/whitehat/grayhat groups, and what you might call the fragmentation/dissolution of the underground? There's good material on the 80s, but much less on the 90s, it seems, despite a decade having passed.
The only one I know of with more than a passing mention is a 20-page overview in Ch. 3 ("Hacking in the 1990s") of the book Hacker Culture [amazon.com] (2003). Others?
Re:Anti-Sec (Score:5, Insightful)
L0pht history (Score:5, Insightful)
L0pht Heavy Industries went corporate [securityfocus.com] in 2000, and became "@Stake", which was acquired by Symantec in 2004, and disappeared into the Symantec empire.
L0pht, founded in 1992, was itself a descendant of the Cult of the Dead Cow [cultdeadcow.com], founded in 1984 and still around, more or less.
There have been various spinoffs and buybacks along the way, but it's been a while since cutting edge work came from that crowd.
Re:Hmmm... (Score:3, Insightful)
Assuming these guys are 'white hats', and they are not _necessarily_ the most able or l337 hax0rs out there, then why has someone not already attempted to take the internet down in 30 minutes already? For, say, 1 million dollars? I call hubris..
The statement was made in 1998 [senate.gov] when security was extremely lax with a majority of the hacking community residing in the west.
Re:Pioneers of the glamourous geek lifestyle (Score:3, Insightful)
I imagine that a substantial part of the sudden increase in society's respect for geeks, (maybe mostly their potential incomes,) was due to the glamorous press exposure l0pht received at that time.
Or maybe it's that whole Internet thing that was popping up around that time. The geeks became attractively rich. The tech stopped being black boxes hidden in white-floored, air-conditioned caves and became vehicles for wealth and ubiquitous services. And did I mention the geeks becoming attractively rich?
I doubt "society" in general paid much attention to L0pht (beyond the attention the mysterious hacker "whiz kid" usually gets). There was already about a decade of exposure to the microcomputer and the concept that it would change our lives [time.com]. And we had already seen ample exposure of the hacker to pop-culture (i.e. the movie War Games [imdb.com] and T.V. show Whiz Kids [imdb.com]). Mainstream society seemed sort of curious but not entirely impressed with the geek behind the curtain.
But when the Internet dot-boom era began, money got everyone's attention. Suddenly the geek behind the curtain got much more interesting.
Re:Hmmm... (Score:3, Insightful)
Re:Hmmm... (Score:5, Insightful)
More like they're not willing to attack a target they perceive as critical to their operation.
For example, a hacker may find it funny to send something via the Border Gateway Protocol to disable access to Youtube; other hackers might consider this good, since it encouraged productivity. If he instead disables the entire Internet via BGP, he cripples himself and can't do much until the problem is recovered. Said hacker won't be able to brag about taking out the Internet, since no computer enthusiast likes critical infrastructure being taken out.
If a hacker accidentally took out an internet when trying to demonstrate something believed to be harmless (e.g. the Morris Worm), then that's okay. We all make mistakes and gain experience not to do it a third time.
Re:Anti-Sec (Score:3, Insightful)
But what's more dangerous, the bag of tricks in the hands of a few skilled people or an open bulletin board with 0day-exploits for everyone?
What makes this question even more complicated for me is that Secunia, the people who protect us from exploits if we pay them, is sponsoring this practice.
The bag of tricks in the hands of a few - hands down. What we're talking about here is carte blanc access in the hands of a select few. We have to trust that the motives of these few strangers will fall in line with ours. And then we have to trust that the "select few" will remain few. Eventually they won't in both cases. Individuals will use these exploits to cause damage. And knowledge of these exploits will spread until even the least trusted in the underground has access to it.
We ran this gambit in the 80s. Exploits would become known within the underground. The most elite would share the knowledge amongst other inner-circle personalities. Eventually the exploit would slip to wider and wider distribution. Vendors would either be oblivious to the exploit or completely unmotivated to fix it. The general public would be oblivious to it or unmotivated to invoke any fixes a vendor might have provided. Until some amateur will do something damaging [wikipedia.org] (intentional or not) with the information.
An interesting thing to note is the nature of computer crime over the years. A good deal of it was the activities of the stereotypical exploring hacker / phreak. And there was always the insider looking for revenge or manipulating data to steal. However, there were also "classic" hackers making money manipulating systems to steal equipment. And the Mafia was a consumer of Blue Boxes.
Today, the computer crime scene has expanded to provide ample opportunities to tempt the first individual willing to hand over an exploit. You can question Secunia's motives if you want. But you should be aware that there are others just as driven with much more sinister motives.
I agree that 0day exploits on public bulletin boards breeds chaos. But it's very visible chaos. Many more people are aware of the issues presented by a publicly published vulnerability. And that gives it a better chance of being addressed and its effective life shortened.
It would be better, of course, if the vulnerability never existed. But they tend to exist. There are 0days right now waiting to be discovered. The question is how long until they are discovered, by who, and how will they be used?