Feb 11
7

Return to your Root

13 Comments

Disclaimer: this article isn’t directed at everyone, obviously. However; if you read this, and you think that I’m full of shit and that I don’t know what I’m talking about and this article is wrong; then congratulations, you’re one of the assholes that inspired me to write this article.

“I am a Hacker, and this is my manifesto.” What emotion do those words evoke in you? Stop reading. Really think about it for a second. What do you feel when you hear those words?

I AM A HACKER, AND THIS IS MY MANIFESTO.

Let me tell you a story.  The story of how I got into infosec.  One short year ago, I was your average, run of the mill, hometown tech guy.  The guy who got the label “computer whiz kid” because I knew how to alt+tab.  Like most of you, I was completely self-taught.  There were no computer classes in my area at the time, and my parents viewed the PC as just another game console.  My knowledge stemmed from adventuring into the virgin file directories and settings.  Exploring every corner of my system and inevitably breaking something.  Something I would need to fix before my parents found out.

Fix and break.  Fix and break.  Disassemble and reassemble.  This was my life.  Eventually I got good enough that I wasn’t breaking things anymore when disassembling them.  So I began fixing the problems others had caused.  I knew more about computers than most, but I wasn’t satisfied.  I had hit a plateau.  I had no more problems to solve.  It made me feel empty.  I didn’t know how much I didn’t know.

I don’t remember how I found it, I just know that I did, and it changed my life forever.  I identified with this document so wholly, so completely, I felt as though I could have written it myself, had I only been inspired to do so.  This document was The Hacker Manifesto; written January 8, 1986 by The Mentor.  I know every one of you has read this document at some point, but I implore you to read it once more.  [Cue 2112 Discovery by Rush]

Another one got caught today, it’s all over the papers. “Teenager Arrested in Computer Crime Scandal”, “Hacker Arrested after Bank Tampering”…

Damn kids. They’re all alike.

But did you, in your three-piece psychology and 1950s technobrain, ever take a look behind the eyes of the hacker? Did you ever wonder what made him tick, what forces shaped him, what may have molded him?

I am a hacker, enter my world…

Mine is a world that begins with school… I’m smarter than most of the other kids, this crap they teach us bores me…

Damn underachiever. They’re all alike.

I’m in junior high or high school. I’ve listened to teachers explain for the fifteenth time how to reduce a fraction. I understand it. “No, Ms. Smith, I didn’t show my work. I did it in my head…”

Damn kid. Probably copied it. They’re all alike.

I made a discovery today. I found a computer. Wait a second, this is cool. It does what I want it to. If it makes a mistake, it’s because I screwed it up. Not because it doesn’t like me… Or feels threatened by me.. Or thinks I’m a smart ass.. Or doesn’t like teaching and shouldn’t be here…

Damn kid. All he does is play games. They’re all alike.

And then it happened… a door opened to a world… rushing through the phone line like heroin through an addict’s veins, an electronic pulse is sent out, a refuge from the day-to-day incompetencies is sought… a board is found. “This is it… this is where I belong…” I know everyone here… even if I’ve never met them, never talked to them, may never hear from them again… I know you all…

Damn kid. Tying up the phone line again. They’re all alike…

You bet your ass we’re all alike… we’ve been spoon-fed baby food at school when we hungered for steak… the bits of meat that you did let slip through were pre-chewed and tasteless. We’ve been dominated by sadists, or ignored by the apathetic. The few that had something to teach found us willing pupils, but those few are like drops of water in the desert.

This is our world now… the world of the electron and the switch, the beauty of the baud. We make use of a service already existing without paying for what could be dirt-cheap if it wasn’t run by profiteering gluttons, and you call us criminals. We explore… and you call us criminals. We seek after knowledge… and you call us criminals. We exist without skin color, without nationality, without religious bias… and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try to make us believe it’s for our own good, yet we’re the criminals.

Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for.

I am a hacker, and this is my manifesto. You may stop this individual, but you can’t stop us all… after all, we’re all alike.

Was…was this what I was meant to be the whole time?  I had also been bored with the non-challenges presented to me in grade school.  So bored that I had to go out and find my own challenge in the (relatively infant) field of technology.  I hated the constant “show your work” badgering in middle school when the problem solved itself so easily in my mind.  For the first time, I felt like I wasn’t alone.  That there were others out there being labeled smartass and shunned by teachers.  That there were others whose default state was to ask questions, to not trust authority, to explore beyond the scope of the task at hand.  If there were others, did that mean that there was a place where this behavior was not only accepted, but encouraged?  I had to know.

My experience on the internet thus far told me that the best place to start on any unknown subject was Wikipedia; and as usual, it did not disappoint.  I spent the next week sorting through the ridiculous number of tabs that I’d spawned from the “Hacker” Wikipedia article.  Hacker.  White-hat Hacker.  Cracking.  Kevin Mitnick.  Social Engineering.  Cross-site scripting.  SQL injection.  DARPA.  Metasploit.  All of these new terms, a vast sea of knowledge that I had yet to reach the shores of.  While I didn’t learn too much from those articles during the tab-explosion week, I did learn the most important thing of all.  I was finally able to fathom how much I didn’t know.

Ladies and gentlemen, I have never written an 0-day exploit.  I don’t know any programming languages.  I have never broken into a network that was not in my home lab with or without permission.  But I tell you this now, ich bin ein Hacker! Over the last year, I’ve located fellow hackers in my area, I’ve attended meeting after meeting, read book after book, and endless online articles.  I have uncovered for myself a grand new set of challenges that need solving.  I am a hacker because nothing excites me like the prospect of solving those problems.  My favorite definition of a hacker is from the jargon file and it reads as follows: “One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations.”

THAT is the true mark of a hacker.  Anyone who believes otherwise has lost sight of their roots.  I personally believe that there is nothing more harmful to the community as a whole than the ideal of the so-called “uber-leet hax0r.”  Which is why when I see things like this:

Following the link in the tweet results in the UrbanDictionary definition below:

I’m filled with extreme rage.

If you agree with that definition; and think that the word “Busticati” (or similar) should be put into common use, you are what is wrong with this community.  You are everything that the outside world hates about us.  You are the reason new, bright, young individuals shy away from the hacker community.  You push away those who would learn the craft when you should be embracing them.  It is because of you that (outside of the criminal implications) there is such a heavy social stigma attached to the title: Hacker.

This kind of elitism cannot be allowed to stand.  But who am I to you?  You who believe that only the pr0est of the pr0 deserve the right to have their opinion heard.  If you won’t listen to me, maybe you’ll listen to Chris Nickerson of Exotic Liability who said in a recent talk at Dojocon,

"This is the definition of a Hacker. If you don't agree with it, fuck you, you're wrong. Sorry, it doesn't mean writing 0-day and being leet and cool and jerking off on stage because of how leet your stuff is." - Chris Nickerson

So next time you come across someone who doesn’t know as much as you know, someone who is struggling with a concept, someone who has limited themselves to making “led throwies,” approach them, and teach them.  Because to sit back and poke fun at someone who isn’t as “leet” as you are just makes you an elitist asshole and you are not worthy of the title “hacker.”  Hackers are all about community.  Let’s usher in a new golden age of hacking.  Make collaboration cool again.  Shun those who would keep the so called “glory” for themselves, for they weaken us as a whole.

For another take on this subject, watch Chris Nickerson’s Dojocon talk, “The State of (In)Security” below.

Chris Nickerson The State of (In)Security from Adrian Crenshaw on Vimeo.

This entry was posted on February 7, 2011 at 5:34 pm. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Posted in Blogs by Kris 13 Comments

13 Responses to "Return to your Root"

  • finn_mccool says:
    February 7, 2011 at 7:33 pm
    Reply

    As someone who at the age of twenty-eight bought his first computer and now needs to know everything well said. Thank you.

  • caseyjohnellis says:
    February 8, 2011 at 1:14 am
    Reply

    “No, Ms. Smith, I didn’t show my work. I did it in my head…” – love this… I used to write garbage on the page just so it LOOKED like i’d worked it out on paper

  • caseyjohnellis says:
    February 8, 2011 at 1:18 am
    Reply

    …and having now read through the rest of this, I totally agree with you.

  • raid says:
    February 8, 2011 at 2:19 am
    Reply

    I like your post. I appreciate the sincere intent in this article. I believe the community should be welcoming, and willing to help newcomers grow. That being said, I am undoubtedly worthy of your congratulations for being “one of the assholes who inspired me [sic] to write this article”, as I am responsible for the Urban Dictionary definition of “busticati”, and one of the people present during the discussion which lead to the creation of the word.

    I do not think you’re full of shit, and I am not here to chide your efforts.
    I do, however, believe you are confused about the term “busticati”.

    There is no intent of being elitist. There is no plan to subdue those who are not “uber-leet”. The word merely stands to distinguish between the “offensive application of technology” and every other meaning comprising the conventional definition of “hacking”. Certainly I was ornery when I submitted the word to Urban Dictionary, and consequently the definition has derogatory undertones. Would you not be ornery too if someone was describing themselves, in passing, by throwing around a term which you had dedicated your life to? Supporters of “busticati” are not saying that _you_ are not a hacker. We are saying that _we_ no longer subscribe to that word, because it no longer fits our paradigm. We have accepted that “hacker” is too ambiguous and for the most part no longer delineates what we appreciate about “hacking” .

    I must ask, albeit a potentially offensive definition, which aspect of the definition indicated that those embracing the word busticati would not be willing to teach? Everyone I have met who subscribes to the new term loves helping people grow. Have you ever asked one of the busticati for a hand? Or reached out to one of those elitist assholes?

    • Kris says:
      February 8, 2011 at 9:23 am
      Reply

      If anyone understands speaking while feeling “ornery” it’s this guy. And if you are saying to me that the term “Busticati” was meant to be a term defining only those in offensive tech, I am completely on board with the term. I have no problem placing “busticati” as a subset of hacker. It was the tone of the definition that lead me to believe you were trying to place the busticati ABOVE the hackers. I’m very glad that you replied to this and straightened that out. I’ll add something to the post to “See comments.”

      As for the last part, I got the impression that there wasn’t a willingness to teach by the “there was one potential busticati” example. Like the rest of the people at the hackerspace weren’t even worth the time. And finally, yes, I have. If I have an issue that I absolutely cannot figure out, I will reach out to those more experienced than myself for an answer, or at least a pointer in the right direction. The “elitist assholes” in this community are the exception, not the rule. An exception that gets under my skin nonetheless.

  • _rob_d says:
    February 8, 2011 at 6:03 am
    Reply

    Let me start by saying I totally agree with your post, but I think your aim isn’t right. Now, let me clarify.
    The Busticati debate, to me, echoes with the Social Engineering debate. How many times has it been written or said that SE isn’t hacking? Main argument : it requires no technical skill whatsoever.

    In an hypothetical case, let’s say I have a network I want to break in. After a quick recon, I find a mail server that has not had system updates for approx. 1 year. Like the useless moron I am, I google the OS name and version, the mailer daemon version, find a ready made exploit that gives me a shell on the box. Or if I’m lazy I use metasploit. And I get a shell. Not even a root one, I’m just the mailer daemon.

    So I can read emails, change passwords, impersonate users. Now, were I able to identify the key players, eg: someone who has root access to the server I want to pop and who is conveniently not in the office right now, and someone from tech support likely to respond to a mail along the lines of
    “im in europe and need to ssh into the server. can you drop open up
    firewall and allow ssh through port 59022 or something vague?
    and is our root password still 88j4bb3rw0cky88 or did we change to
    88Scr3am3r88 ?
    thanks”
    Well, in that hypothetical case, I’d be root on your server in very little time, without any leet skills.
    /*Disclaimer: this is not at all an hypothetical case, and I have absolutely nothing to do with this. If you don’t know about it, google it, find the pastie link, and read the whole conversation. And to answer the question “How did they get the -possibly old- root password in the first place?”, don’t tell me you never ever send passwords in plain text in your emails.*/
    So for all the Busticatis out there : was that network “busticated”? ‘Cause it damn seems like it to me…

    But what is my point anyway? The thing that puts me into full rage mode is not the elitism of some hackers. They can do 1337 shit, they’re a great force inside the community, as essential as (warning, side point here) people with 1337 communication skills and business sense who are able to write audit reports that are understandable to the people who can actually fix things, ie not tech, but money people.

    The thing that puts me into full blown rage mode is the self-importance of some hackers. Those who are so full of themselves they have to sys.setrecursionlimit(9001).
    Those who are so full of themselves I wonder how their buffer hasn’t yet overflowed.

    They are the guys writing completely irrelevant 0-day advisories just to get their names on full-disclosure [I won't expand on irrelevant, you know who you are]. They are the guys labelling every vuln as critical to have a nice track record at the end of the year. They are the pentesters using (true) 0-day and not having a patch for the client. They are the security companies that flat out lie to their clients, burying them under jargon, because they think they will lose something if their client actually understands what they are doing to the network.

    Some days I’m tempted to let them call themselves Busticati, or whatever they want, so that I can call myself hacker and not be in any way associated with those guys. After all, they are the ITSec experts, and I’m only a student. I will be a student all my life. But they are hackers as I am. As to why this apparent divide inside the community, I’ll get to it in a proper blog post, soon enough..

    • Kris says:
      February 8, 2011 at 9:28 am
      Reply

      Sir, that was an excellent comment and almost a blog post within itself haha. The ONLY disagreement I have with the whole thing is the “busticati” reference since the maker of the definition has commented and clarified his position. Otherwise, I think we are very much in agreement.

  • Solar Eclipse says:
    February 8, 2011 at 10:06 am
    Reply

    The whole point of coming up with the term Busticati was to disassociate ourselves from people like you who call themselves “hackers” just because your mom bought you a computer for Christmas.

    Fine, you can have that word. You can go to your hackerspaces, record your hacker podcasts, blog about the importance of building a hacker community and bluetooth sunglasses.

    We don’t care about what you do, we’re not part of your community.

    We’re the Busticati.

  • djwiteboi says:
    February 8, 2011 at 10:37 am
    Reply

    I want bluetooth sunglasses! that sounds super 1337!

  • Sam Bowne says:
    February 8, 2011 at 12:27 pm
    Reply

    I have felt the same frustration frequently, most recently as I have been focused on DoS attacks lately and I am told “DoS isn’t hacking”.

    But I think this social phenomenon is easy to understand: hackers often are social outcasts, and lack social skills. So when they finally become part of a community, and gain respect and status, they are most likely to imitate the people who cast them out earlier. It’s wrong and self-destructive, but understandable.

    I am intrigued by the idea of “social engineering” as a way to fix this problem. If a brilliant techie is unhappy at school or work, why not hack the social structure? Getting respect and status is not harder than getting root. But for some reason I failed to approach social structures as logical puzzles in my youth.

    My sister teaches social skills to medical students at Alverno college, and they have an excellent formula that intrigues me. Students practice skills like listening, following a leader, taking leadership, giving and accepting criticism, and are scored on these skills, and improve them. I’d love to see a hacker culture in which belittling someone is seen as poor skillz

    • _rob_d says:
      February 8, 2011 at 12:45 pm
      Reply

      >I have felt the same frustration frequently, most recently as I have been focused on DoS attacks lately and I am told “DoS isn’t hacking”.
      I think that it is profoundly dumb when DoSers are prosecuted on par with people who break into systems. Arguably, they disrupt the function of the system, but they leave it untouched and -mostly- unharmed. On any other point of view than legal, I totally agree, DoS is hacking.

      You’re right when you outline the sociological angle : we’re a community with great diversity, from business people to “hippies”, ex-mil to gifted teenagers, you get the drift. It’s pretty hard to think of us as sharing an identity. As I said before, that’s a blog post on its own that has been cooking for a long time.

      >But for some reason I failed to approach social structures as logical puzzles in my youth.
      I think the reason is youth.

      >I’d love to see a hacker culture in which belittling someone is seen as poor skillz
      hacker culture is supposed to have humanism at its roots. [insert here rant about young people not respecting anything anymore these days]

  • blahblahblah says:
    March 1, 2011 at 11:16 pm
    Reply

    As so eloquently phrased previously:

    The dictionary.com definition:

    hack·er1 Pronunciation Key (h k r)
    n. Informal
    1. One who is proficient at using or programming a computer; a
    computer buff.
    2. One who uses programming skills to gain illegal access to a
    computer network or file.
    3. One who enthusiastically pursues a game or sport: a weekend tennis
    hacker.

    Historically, the definitions of words in a language changes over time. I’m
    sure there is someone out there who is educated and can provide me with the
    term for this phenomenon; and whoever you are, you can go fuck yourself. I’m
    not bragging to be a scholar, because that is something that I’m not. However,
    I am a hacker, and because of this I can make the following statements.

    1) A hacker is someone who hacks.
    2) Hacking is comprimising computers/computer networks.

    A hacker is not someone who writes socalled “useful code” (operating systems,
    applications, etc). Hackers write tools to aide with the comprimise of computer
    networks. And hackers _use_ those tools; they do not sell them to the highest
    bidder, and they do not use them to make a name for theirself so that they can
    then become a “security consultant”.

    Silly rhetoric aside — the important point is this: Hackers hack.

    If you do not hack, you are not a hacker. That simple.

    On a semi-related note. . .

    Anyone who claims to be an “ethical hacker” is a moron. Hacking has nothing to
    do with ethics. There is no “ethical hacking” or “unethical hacking”; there is
    only hacking. If you have to dance around the definition of what a hacker is,
    or you have to dance around the definition of what hacking is, then what you do
    is not hacking, and you are not a hacker.

    -a PHC member

Leave a Comment