Defense Expert: Hire Hackers and Wage War 157
Phoghat writes "A top defense and cybersecurity expert says the U.S. should stop trying to take aim at expert hackers and start doing a better job of recruiting them. 'Let's just say that in some places you find guys with body piercings and nonregulation haircuts,' says U.S. Naval Postgraduate School professor John Arquilla . 'But most of these sorts of guys can't be vetted in the traditional way. We need a new institutional culture that allows us to reach out to them.'"
I got first post :P (Score:4, Insightful)
I am guessing that culture doesn't want to be vetted, by any means, traditional or non-traditional.
Re:I got first post :P (Score:4, Insightful)
Want to reach the hacking culture? It's like hiring tribes people to help log the Amazon rainforest. Corporations should learn from the mistakes made in those senarios before even thinking of strategies such as this.
The irony here is although the Govt started the Internet as an official project, it has always rested on the shoulders of academics and the talent of the hacking community, corporations come further down the list.
Re:I got first post :P (Score:4, Insightful)
Want to reach the hacking culture? It's like hiring tribes people to help log the Amazon rainforest. Corporations should learn from the mistakes made in those senarios before even thinking of strategies such as this.
What the corporate MBAs would immediately deduce is that the tribespeople had been improperly incentivized, and should have been offered different shiny stuff. Numerous case studies would then be performed to find the optimum lowest-cost shiny stuff to offer to induce tribespeople to wreck their environment. Devastation of the rainforest would not be abated, while corporate profits and MBA bonuses would increase grotesquely for a few quarters.
Similar dysfunctional thinking would be applied to recruiting hackers.
There's NO opportunity (Score:3)
Like the opportunity to destroy AmeriCIA from within!
Re: (Score:2)
From what I see, if the US government has to reach to the hacking culture, they need to "atone" for Operation Sun Devil. Right now, at best, they can get contractors because of this. Unlike China where their citizens will happily go to a computer room and start doing their work.
The pogrom against Steve Jackson Games and other sites forever made any person with non-tivial skillz not interested in any way to work for the US, just for fear that they will be labeled a "terrorist" should something happened, an
Re: (Score:2)
Indeed. Any "hacker" worth his / her salt is already being actively scouted by various interested parties offering may more money and morally-casual environments than the Defense industry.
Distrust and lie paved way to these hacks (Score:4, Insightful)
Most of these hackers inherently distrust the government, that's why they are hacking them. So what is the benefit in hiring them?
Re:Distrust and lie paved way to these hacks (Score:5, Insightful)
That's the idea, anyway. I think in practice any good hacker (As opposed to a conventionally, formally trained engineer) is going to be driven half-crazy by the highly conformist military culture, and those that can stick with it are going to need constant micromanaging to keep them on their assigned mission ('You want me to disassemble yet another possible Chinese worm? BORING!') rather than using the available resources to do what they think is best ('Ohh, I'll write a virus that installs HTTPSeverywhere and blocks RST packets! That'll totally screw with China's filtering!').
Re:Distrust and lie paved way to these hacks (Score:4, Informative)
Re: (Score:2)
That's the idea, anyway. I think in practice any good hacker (As opposed to a conventionally, formally trained engineer) is going to be driven half-crazy by the highly conformist military culture, and those that can stick with it are going to need constant micromanaging to keep them on their assigned mission ('You want me to disassemble yet another possible Chinese worm? BORING!') rather than using the available resources to do what they think is best ('Ohh, I'll write a virus that installs HTTPSeverywhere and blocks RST packets! That'll totally screw with China's filtering!').
I know they, the military, didn't drive me crazy as I was already there! On the other hand, I do know I drove my command structures more than a little crazy; military behavior was the only down item on my evaluations which were characterized with 4.0's (2.0 in Military Behavior). What I did have was very, very high-level protection. That was the result of turning an (potentially multi-million dollar) IT disaster-in-the-making into a success. After that, if you needed weird, well for the time, from the s
Re: (Score:2)
Principles can be overridden with money. Doesn't even need much.
Hmmm... are you thinking about US hiring Russian hackers?
Re: (Score:1)
If this is about cyberwar, (Score:2)
I say it's awfully childish. Do we really want the Internet to be an unstable place? Because it's going to be so easy for others to retaliate, and the losers will be those who lose their rights.
Re: (Score:3)
Re: (Score:2)
To have the Defense industry bankroll a witch-hunt to find these individuals, so they can be forced to sign up for a cyber-tour of duty and bureaucratic nonsense which burns their skins, so various corporations / interested parties can hire them away with better offers to engage in industrial espionage? In the name of patriotism and the American way, I'm sure GM / GE is willing to crack into foreign firms and lift their intellectual property.
The bigger problem here, of course, is that these people are not g
Re:If this is about cyberwar, (Score:5, Insightful)
I say it's awfully childish. Do we really want the Internet to be an unstable place?
It is far more childish to think that if we just play nice, everyone else will follow suit. The Internet will not be made secure by covering our eyes, crossing our fingers, and praying. It will only be more secure by making sure that those interested in its security have bigger "guns" than those interested in its instability.
Re: (Score:2, Insightful)
tl;dr offense is easier in the real world than it is online.
Re:If this is about cyberwar, (Score:4, Interesting)
Internet Security is a fantasy. Allowing anyone and everyone access to the network makes it almost impossible. I can't believe that servers with secure information would ever, under any circumstances be connected to something so untamed. For starters all my secure computers would never run a disk based operating system. The entire OS would reside in ROM and when it was time for an upgrade I'd burn a new chip. Expensive? Not as expensive as having 1.5 billion dollars worth of research hacked. I don't think network security is nearly paranoid enough.
Re: (Score:3)
The entire OS would reside in ROM and when it was time for an upgrade I'd burn a new chip. Expensive? Not as expensive as having 1.5 billion dollars worth of research hacked. I don't think network security is nearly paranoid enough.
What makes you think you're going to write an OS without a single security flaw that could be exploited?
Burning it to ROM is just ensuring the exploit lingers in the wild longer than it should.
Re: (Score:2)
It makes it impossible to rewrite the software. No worries that your files are infected. Flawed software can be rewritten and another ROM burned. But at least you know that any malware on the chip is your own.
Re: (Score:1)
This is why we have file permissions, read/append/no-exec only filesystems, and file integrity checking. If there is a 0day vulnerability it's as though your systems are already compromised. Also where are users going to store their documents, emails, databases? What about software that makes changes? Do you really want to rewrite a rom for each system in your enterprise and have some dude walking around swapping it out?
Re: (Score:2)
This is a system for extreme security. For average stuff I'd say no. If I have a billion dollars in research on file I can't think of any reason not to spend huge amounts of money to keep it safe. Think about it, for 100 grand the local bank is sufficient, how about 1 billion dollars? You want it there or somewhere with loads of guards and high fences.
Re: (Score:1)
Granted.. once the stakes get high enough it is probably worthwhile.
Re: (Score:1)
I don't think writing an OS to rom has a good cost/benefit ratio when it comes to computer security, not anymore anyhow. There are 100 other things that you could be doing first that are going to go further giving you bang for your security buck. Also I want you to consider the logistics of replacing all these chips, having a tech walk around and upgrade these machines is going to expensive and time consuming. Also you're going to have to account for human error in this process unless you have each one
Re:If this is about cyberwar, (Score:5, Interesting)
If you hand out bigger "guns" and the internet becomes a warzone, everyone loses. The only way to keep it civilized is by handing out better "armor", making "guns" as ineffectual as possible. Since the military isn't interested in armor only and i don't trust them to use "guns" in a reasonable way (if there actually is one) i don't know why i should put me under their command.
Re: (Score:3)
What do you mean "We", white man?
Re: (Score:1)
Re: (Score:3)
An organic system is inherently unstable - this is why the global network is so resilient against targetted attacks (such as wide-scale DNS poisoning [xelerance.com], root name server outage [codeseekah.com]...). The system will route around the dark spot. Whether or not it's "what the man wants" is irrelevant. If "The Man" wants the Internet to go dark permanently, all "The Man" has to do is cause a global, total and simultaneous blackout of every node, domain and name server, webserver - anything with a CPU and internet connection.
No big
Re:If this is about cyberwar, (Score:4, Interesting)
Do we really want the Internet to be an unstable place?
What makes you think it's stable now? Although I think "Cyberwarfare" is more media drama than actual warfare, networks could be doing a lot more to make them more secure. We don't becuase, users. Users don't want inconvenience. Users don't want two passwords (one email, one login). Users want their desktop on their mobile device. Users want access to confidential data on the same PC their kids play on. Don't get me wrong, without users there's no need for a network but things have gotten way out of hand with security.
I think it's a good sign that some places in the tech industry are starting to realize they could be doing better. Maybe they will finally get around to listening to real experts instead of paid-for marketing shills.
Time to stop the backdoor culture (Score:1)
That's how they killed it. (Score:3, Interesting)
Re:That's how they killed it. (Score:5, Insightful)
It's sorta funny to read this type of bleating in a Slashdot article that appears on the same day as one that says the Chinese government has backdoors in 80% of Telecoms to sniff information.
Look, ya dumb sheep.
They are already waging war against us, enemy and "friendly" states already use their government resources to steal intellectual property and wage industrial espionage against the United States. You obviously don't actually run any internet-facing services or you would see this shit in your logs.
The fact that our government doesn't do it aggressively too is the odd part. It's time to man up and fight back or your children (assuming you manage to breed) will be speaking Chinese and working for Russian mobsters for a daily loaf of bread.
Re: (Score:1)
Better dead than Red.
Re: (Score:2)
Haha... you really need to take a good look and consider who are the sheep and who is the shepherd!
Do you honestly believe that the US Govt. doesn't have backdoors / access to backdoors in 99% of US telecoms tech?
Re:That's how they killed it. (Score:4, Informative)
> The fact that our government doesn't do it aggressively too is the odd part
How do you know our government isn't already doing the same?
Look at Stuxnet... we have the capability.
Re: (Score:1)
Off-topic, I know... (Score:2)
But climate is now demonstrated by data to have been HOTTER in Roman and Medieval times, than now.
This is in the journal, Nature. If you pardon the pun, this isn't a hotbed of "deniers".
http://www.nature.com/nclimate/journal/vaop/ncurrent/full/nclimate1589.html [nature.com]
Re: (Score:2)
It was hotter before - at least twice - and the Anthro-Co2 hypothesis does not accommodate the findings.
The claims about rate are unsupported by any observed evidence. Only by extrapolative models, with assumptions that are unproven and being challenged by actual observation data.
Easy (Score:5, Funny)
This is nonsense. (Score:4, Interesting)
Some of the most talented technical people I know are also the most clean-cut and athletic. Some of the worst, show-offs who know the talk but little else, fall into your usual hacker stereotype with their appearance. I think the former is more realistic, and the latter is more romantic fantasy— brought on by people who idealize Gibson. In other words, why bother? The first group is more likely to give you a well-rounded individual who actually knows her material. The second group is a total crapshoot.
Re: (Score:2, Insightful)
I know a few nerds who are also fitness geeks but you're highly delusional if you think that most hackers fall into that category. Most of us are not fit, unhealthy, and are weird looking.
Re: (Score:1, Insightful)
The clean cut guy is clearly more of a conformist, likely less hostile towards authority, and because of that potentially less likely to be a whistleblower.
hackers (Score:3, Funny)
Most of those guys are clueless about the outside world so they may be hard to motivate. Maybe sex will work. Hire some hookers.
Re: (Score:1)
I am only interested in the "interview" involve in cracking an encryption while getting a blow job at the same time.
Re: (Score:2)
Offer them free Mountain Dew and Skittles.
Re: (Score:2)
too salty, need sweet and tangy.
It takes one to know one (Score:5, Insightful)
The problem is that vetting the ethics of a hacker needs someone who has insight in the cultural framework as much as the technical capabilities of the person under review, and that is MILES beyond your average HR setup.
I know from my own experience that the best reviewer for tech is someone who is either a former hacker him/herself, or has a personality that borders on Aspergers. You cannot understand technical people if you do not have the required mental tools, and especially the brighter hackers do not exactly conform to the standard employee model.
So, use one to know one, and forget about your average corporate HR droid doing anywhere near a sensible assessment. Oh, and forget about standard management techniques either - not only does it take one to know one, it certainly takes one to manage them.
Re: (Score:1)
Solution: Use the usual HR droids that tech companies use, but go through the discard pile of applicants instead.
Re: (Score:3)
Actually, that's how I got hold of the first security admin for a company I had just helped setting up. After an internal move (prior to official launch) I inherited a desk that was obviously HR. It had a stack of CVs in, all with "no" across the top. 4 CVs in I see the perfect candidate, so I got him in. He stayed there for 3 years or so..
Re: (Score:3)
> forget about your average corporate HR droid
So what you are saying is these aren't the droids we're looking for?
stereotypes (Score:3, Insightful)
While we're at it, could we please also *not* assume that l33t hackers come only in one visual package (piercings, ink, etc.)?
Re: (Score:1)
I know that the vast majority of "hackers" are script kiddies.. but to say they're less skilled than our offering of security professionals is not true. Talk to your average CISSP you'll see that the skill distribution on the other side of the fence is equally matched. It's funny because most CISSP study material provides these frauds their excuse for lacking technical knowledge by chapter one.
Golden nuggets like:
"I don't need to know the details because I'm a manager"
AND
"Saying hackers are going to prov
Alternative (Score:2)
from hackers (Score:1)
FUCK YOU
Lets See... (Score:4, Insightful)
Take highly competent tech people who are generally speaking somewhat anti-authoritarian, give them the tools to do nasty things to the nations enemies via hacking, malware programming etc, and expect them to keep their mouths shut about it. :P
A lot of people don't trust the government - and often with very good reason - why would they want to hack for it?
How long until the complete log files of everything they and everyone they associate with are sent to Wikileaks?
Find technical people who are not anti-authoritarian and get them to do your hacking - just hire them for ability and knowledge rather than the traditional military virtues that most military organizations look for. In fact, hire them as civilian contractors and then keep them away from the rest of the military
Re: (Score:2)
How do these principles differ from the art of recruiting old-fashioned, y'know, spies?
Re: (Score:2)
Same problem for both groups. (Score:2)
The problem with the Government hiring those "shady" hacker types is they have a hard time trusting them.
Ironically enough, hackers seem to have that exact same problem with "shady" Government types too.
No surprise a story like this comes out this close to Black Hat/DEFCON...again, it's not a matter of finding hackers...
And we'll wage a "kick ass" cyberwar.... lulz (Score:1)
So they want to hire the people that are currently at war with them. A good idea, but not very realistic.
Maybe they could try and pass some more laws like SOPA or dodge the democratic process with ACTA-like treaties and see if that drums up more recruits.
The people they will get will be the "retired," mediocre to average hackers who are now married and have too much too lose and can be bought with cool toys.
Comment removed (Score:5, Insightful)
Re: (Score:2, Insightful)
"be all you can be" is not just a powerful message, it is a threat. Realise that what government is really saying there is that all you can really be is only achievable at this point if you are part of that government institution, and people that this message is aimed at cannot get government jobs as press secretaries, congressional staff or even regulators in an executive office. This is a threat and the reason government can issue it is because it is the very institution that creates the conditions, und
Re: (Score:3)
Be all you can be - kill some people.
That is the message. If that's not 'evil', then what is?
Re: (Score:2)
"be all you can be."
knowing is half the battle
FTFY
What I just heard you say is that they need to stop putting out commercials and need to start producing more military-themeed cartoons with public service announcements embedded in them [youtube.com], that way they can brainwash the next generation of kids to become adults who support the military.
Transcending to a new paradigm (Score:2)
"all its done in the past 40 years is act as an engine of misery, destruction and sorrow across the globe."
Because it is ironic? http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html [pdfernhout.net]
"Likewise, even United States three-letter agencies like the NSA and the CIA, as well as their foreign counterparts, are becoming ironic institutions in many ways. Despite probably having more computing power per square foot than any other place in the world, they seem not to have thought much abou
Re: (Score:2)
Which is why they are fighting them instead of recruiting. After they get a hacker, they give him a choice between an unrealistically long prison service and a slap on the wrist provided they join them. Most hackers have chosen the latter.
This is why you will never be able to recruit them (Score:1)
Re: (Score:2)
They seem to be having success in China, North Korea, and Russia.
No age rules, no boot camp, no medical disqualifie (Score:3)
No age rules, no boot camp, no / limited medical disqualifies.
Why should some who say may be in a wheelchair not be able to do work like just because of having to go to boot camp or the same thing about age rules so you have long time pros come in that may be to old to pass boot camp.
Also there are smart IT people who don't have the mental mindset to handle a boot camp as well.
Re: (Score:3)
Re: (Score:3)
Just don't hire them as members of the military in the usual sense.
Re: (Score:1)
IT / Software folks arent that special, offensive network operations aren't magic, get over yourselves. Everyone in the military learns to function as an infantry man at least at a rudimentary level for a reason.
Re: (Score:2)
so a IT / Software person in a wheelchair can't be part of this due to them not being able to be a infantry man???
Look at the AMERICANS WITH DISABILITIES ACT.
Re: (Score:2)
You can sign up for SPAWAR as a civilian... many SPAWAR employees end up becoming navy reserve officers and show up in uniform once a month so they can get extra money.
They're actively recruiting hacking events.
Do they want older hackers? (Score:1)
I'm serious, because to-date I haven't seen much recruitment effort of 'seniors', you know, like, 40+ types. But I do see a lot, and I mean a lot of things to disqualify anyone that might apply, (for all the G-Jobs I see), even though folks might apply for all the right reasons. Even people older than 40, perhaps because of their inherit threat, but what do I know? They might even be so old as to be on medical marajuana in another state, and fear drug tests and a permanent stain on their future I.T./data ce
older pros are needed as just haveing JR's (Score:2)
older pros are needed as just having JR's is missing out on people with experience know that the book says this but in the real IT systems doing it this way works better in the good IT classes aka ones at community colleges and tech schools teach like that as well as a lot of them are IT pros and know what it is right.
Re: (Score:1)
Wait (Score:5, Funny)
We need a new institutional culture that allows us to reach out to them.'
Cue MONTAGE featuring Cameron Diaz as cute "brutal" platoon sargeant yelling orders at misfis!
Re: (Score:1)
Again with the military (Score:1)
I wonder if Americans realize that in most of the world, there aren't people constantly trying to find a new military technology or advantage, and the press doesn't talk about these things every day.
Re: (Score:2)
Defense contractors and military sources get pounded with millions of probes from other states each month. And employees are regularly spied on. A couple years ago a company had a bunch of c
Re: (Score:2)
America outspend the rest of the world on what it still calls "defense".
I wonder why. Could it be for the same reason that a jewelry store outspends a hot dog stand on defense?
Re:Again with the military (Score:4, Insightful)
More like thugs with piles of corpses of corpses in their basement, that are overshadowed only by their needy desire for approval and respect, gang up on anybody looking at them the wrong way, while robbing those they claim to protect blind. Which is exactly the opposite of what you claim it is, defending something of value. It's destroying value, and for pitiful reasons.
Bill Hicks said it best, why even bother typing when I could quote that:
Bill Fucking Hicks.
And if you think a comedian doesn't count, try just about any great mind... they more or less all agree. They either didn't write about it, or they said something to the effect of the above. Anything lower than that is just mediocre BS. People lie to themselves, so they lie to you ("you" as in "the people"), and you drag that cart all the way up the hill... in it? Banal bullshit. Trinkets and lies. Coffins are being flushed down the toilet, while show tunes play.
George Orwell.
Deadstick.
Re: (Score:1)
I love when people anthropomorphize reality. Well, or think there's some evil cabal of "fat cats" forcnig the world into misery and war for profiteering purposes. I'd say both are equally idiotic.
What Hicks says appeals to a certain sort of person who likes to see themselves as "above it all". All of us "squares", why we're just "Wage slaves" (I _know_ you're a user of that ridiculous phrase) while you've totally seen through it.
So by all means, sell your computer. Sell your TV. Sell everything but enou
Re: (Score:2)
I can't remember using that word ever actually, unless quoting someone. I usually just say "slaves".
Oh, so that's why you parade strawmen, and as your killer argument "you think you're better than others, wahh wahh". Because you totally could debate it, but you just don't wanna. Suuuure.
This isn't even philosophy, it's more physics and history th
Re: (Score:2)
America outspend the rest of the world on what it still calls "defense".
I wonder why. Could it be for the same reason that a jewelry store outspends a hot dog stand on defense?
A perfect example of "American Exceptionalism". Wake up, buddy, you ARE a hot-dog joint... maybe bigger than a stand, but still a fast-food establishment. You only need to look for what US tries so hard to sell [slashdot.org] nowadays... crappy Hollywood movies/music.
I will take "cyberwar" seriously ... (Score:2)
... when they recommend the US government move desktops off Windows.
Until they do that, they're not taking it seriously either. It's just a boondoggle to transfer money from the taxpayer to the military-industrial complex.
Re: (Score:1)
Let me guess, you want them to use Linux because it was magically written to be impervious to attack. A dollar say s I can crack your Linux box faster than you can crack win95, assuming you even have the skills to do that? Get past your bias.
He's got the culture clash wrong (Score:2)
This presupposes that the cultural clash between the military and the hackers is about their fashion choices instead of being about devoting your life to the more efficient killing of other people in the pursuit of enriching the already rich and powerful.
He might want to think beyond allowing non-regulation haircuts and piercings.
Re: (Score:2)
The problem is money. (Score:1)
Last I checked I'd have a hard time considering most of the people arrested by the FBI "world class" hackers. The majority of Black Hat hackers are generally scriptkiddies. Most of the best (the ones who do it to see if they can) are either Grey or White already work for a security firm which pays FAR better then the government would. If the gov wants to hire the best hackers then they need to start offering better pay then giving the excuse âoeyou get the warm fuzzy feeling that your protecting your c
I don't trust people who are not open (Score:2)
Did anyone see "Catch Me If You Can"? True story. The FBI hired a master conterfeiter and con-man. Trust? Both the CIA and the FBI have vetted guys and moved them to high posts while they were working for the KGB. With a hacker you know what you're getting. They have to decide whether they want to protect their country from enemies, foreign and domestic. Don't expect them to jump on board with massive personal intrusion, expect them to go after bad guys. They have to accept that they are going to watched, t
A Key Realisation Has Not Occurred (Score:1)
People in the US government have clearly failed to realise it's futile to recruit hackers to fight the enemy because THEY, the US govt., are the enemy.
Radical Dude!!! (Score:1)
Huh? (Score:1)
Those who fail to learn from history... (Score:2)
Vetting? (Score:2)
If your security depends on "vetting" you've already lost.
Hacking is a skill, not a culture (Score:2)
What happened in the 1980s may have been a culture, but hacking is a skill, like programming, or spying, or forensics.
You can teach it, if you find the intelligent and dedicated people.
The problem is that government alienates such people. First, it's heavy on rules and regulations (a/k/a "conservative"); second, it's designed to reward participation instead of excellence (egalitarianism, a liberal trait).
If you want to know why hackers, artists and philosophers end up alone in vans down by the river, it's b
Uhh, who do you think wrote Stuxnet? (Score:1)
It was far more likely to be the pocket protector MIT/Caltech brigade than the idiotic stereotypical "hacker" with his tattoos and piercings.
The anti-government "Anonymous" type hackers are little children compared to the people the government has access to, I doub't they're looking to slum and are too worried about being unable to hire the anti-establishment set.
Re: (Score:2)
Kill 'em all and let God sort 'em out.
Re: (Score:2)
Use them at arms length.