Suspicious Minds

Matrix: The Magazine for Leaders in Education, Sept, 2000 by Stephanie Brenowitz

Even Chatting with Hackers Can Be Hazardous

There's a new brand of delinquent in this digital millennium--a 15-year-old in a leafy suburb of Canada who is accused of bringing down the CNN Web site, or a Filipino college student who is accused of releasing the "Love Bug." And don't forget the Russian going by the name of "Maxus" who stole 350,000 credit card numbers from an on-line CD store.

Who are these cyber-bandits, lurking on the information superhighway to steal your password, your e-money, or your e-mail?

First Off, Don't Call Them Hackers

According to the lingo of this virtual underworld, a hacker is a very skilled programmer who may be breaking the law by entering your computer network, but who would never take anything of value. The hacker ethic is decidedly against theft and destruction--they prefer to call those types "crackers." That name is reserved for the ones who infiltrate in an ingenious way, not the "script kiddies" who just copied other hackers' programs to shut down sites such as CNN and Yahoo earlier this year.

"We feel sorry for the major Internet commerce sites that have been inconvenienced by the Denial of Service attacks. Really, we do," wrote the editors 2600, The Hacker Quarterly.

"But we cannot permit them or anyone else to lay the blame on hackers ... How convenient. An unseen villain. No need for any actual FACTS to be revealed, but plenty of blame to be cast on hackers everywhere."

Because of all the blame that's been handed out, hackers on the net are very suspicious. Here's what they had to say when I asked for interviews for Matrix's computer security articles:

(Please excuse the grammar--the hacker jargon requires that shorthand be used and spell check software shunned).

A university hacker: "Most hackers have a code of silence about what they have or havent done. This is because hacking is of course an illegal activitie, and because many times stuff like this is some sort of crappy set up by the fbi. they think that we are little kids that cant help but to brag to everyone how comp literate we are and what we can do."

A writer for the Hacker News Network (http://www.hackernews.com/): "remember i never said that i was a hacker orhave ever done any hacking before."

Trickey Doe: "Im not sure whether or not to trust someone that I dont know."

Hacker from Austria: "i do not like telephone communication.... just keep it mostly anonymous ..."

Those are the ones that responded in writing. Then there are the thoughtful denizens of chat rooms such as "hack" and "crack" who simply prefer to send you hundreds of viruses or worms before you have even identified yourself as friend or foe.

But most cyber-defenders say hackers and crackers are more of a nuisance than anything else: "They are not after any asset," said Scott Conti, network operations manager at the University of Massachusetts at Amherst.

"They just want access. They don't want to destroy anything. If they leave anything behind, it's just to thumb their nose at you."

That's what ytcracker, a Hacker News Network writer we contacted through e-mail, said he was doing when he left his digital signature on the Web site of his home town, Colorado Springs. The 17-year-old, who agreed to speak anonymously, said he was arrested in May in connection with his virtual graffiti on that site, as well as for his break-ins at, among other sites, the National Aerospace and Aeronautics guided flight Web site. He is expected to be ordered to pay back more than $30,000 in damages. Details of his cracking have been covered in the press, although the courts don't release the names of juveniles in such cases.

But ytcracker said the Whole thing is "kind of funny" because he swears he is just a "grey-hat hacker"--he uses cracker techniques, such as breaking into networks and defacing Web pages, but just to point out to universities, companies, and government agencies that their systems were weak.

"I back everything up that I change, so no one loses anything, and then I let the system administrators know that their systems are weak," ytcracker said. "If the holes are closeable, I tell them how to do it."

He said he once gained access to a major retailer's entire database of credit cards from Canadian customers, so he tried to notify their system administrators of the hole.

"It's not like they are going to listen to some 17-year-old calling them up," he said. "That's why sometimes I have to mess with their Web sites, so they listen and realize they have a problem."

Ytcracker said he, like other net infiltrators, cut his teeth on university systems because they were the easiest to get into.

"You are talking about dealing with a system administrator who is probably a college student and knows less about computers than I do," ytcracker said.

"Between the two of us, it's more like a game than anything else. Universities don't have a security mindset and they never come after hackers. But it's not like anyone is stealing anything--universities don't have a lot of valuable information that anyone else would want."