Your Views On Hacking People

Quote:

---

Originally posted here by pooh sun tzu

When I circumvent a network, I keep a firm documentation of what I saw, what needs to be fixed, and the holes I find along the way. This documentation is either sent off to the admin via a forge smtp through a proxy, or I take care of the security personally, preform all the fixes, and then notify the admins. Each situation calls for something a bit different, and how I think the admin will react decides how I will handle the situation. This does NOT (all the scripties listening?) entail DoSing the hell out of the network because the admin is a *****.

---

While you may consider your motives honourable, you are still breaking the law.

Do not be suprised if you end up in a cell wondering if it's safe to pick up the sope.

Steve

Quote:

---

Originally posted here by steve.milner
While you may consider your motives honourable, you are still breaking the law.

Do not be suprised if you end up in a cell wondering if it's safe to pick up the sope.

Steve

---

I am well aware of the risks and that it breaks the law, but I am more aware of the benifit it has on the internet as a whole. The media has thrown together the idea that any form of hacking is illegal, to which it is. The part they error on, and the bait you took, was the level of illegality and tolerance. A system admin, and yes this is from first hand experience, is much more friendly and open to work with you if you show them you damaged nothing, altered nothing, and present a mature approach to helping him/her improve their network security... rather than a DoS, rm -rf /, or backdooring them. Doing any of the previous is downright immature and thus results in hefty fines, and an admin that won't listen to you.

The line is fine, but existant. An understood action that helps an admin do their job on things they may never have noticed. On a personal note, I've never come across a single admin that was not thankful for me showing them how it could be secured, improved, and protected against someone who would use those holes to destroy or steal from.

I understand your point, very much so, concerning the bookwork of it being illegal. But I understand how it works on a deeper sense in reality from the wisdom I've gained through time. I apologize if I come off rude or harsh in my responce, but it seemed that your origonal post here was trollbait, and I did bite. Thank you for your comment :)

uhh can anyone tell me where to find information about hacking?????

[blur]Please[/blur]

Quote:

---

Originally posted here by pooh sun tzu
A system admin, and yes this is from first hand experience, is much more friendly and open to work with you if you show them you damaged nothing, altered nothing

---

In your earlier post you mentioned that you sometimes fix the vunerabilities, which is different to atlering nothing.

As you say, altering nothing is more likely to get you a firendly response, but fixing vunerabilities is likely to land you in gaol.

You may wonder why, but consider this:

Suppose I am using a version of *nix within my organisation that has a kernel vunerability that allows any logged on user to escalate priveledige to root.

You hack^w penetrate my network using another vunerability and then use the prevelidge escalaition vunerability to gain root. You then decide to fix my vunerable systems, the second of those vunerabilities you fix by upgradding the kernel on a number of internal *nix servers.

And after doing that my regional stores are suddenly unable to trade because their EPoS software is not compatible with the new kernel and my company is now loosing $1M per day

This would rightly be considered a mailicious attack.

As an admin I'm likely to be fully aware of the vunerability, have estimated the risk and the cost/time associated with resolving the vunerability and decided not to do that untill I have fully tested the effects of any change, adhereing to my company's change management process.

Quote:

---

The line is fine, but existant. An understood action that helps an admin do their job on things they may never have noticed. On a personal note, I've never come across a single admin that was not thankful for me showing them how it could be secured, improved, and protected against someone who would use those holes to destroy or steal from.

---

The line is fine, and also the line is never in the same place twice. What will or wont land you in gaol in each situation depends on a massive number of variables (like the situation mentioned above) that you will have no knowledge of nor ability to influence.

If it goes wrong and damage is done telling the feds that you were trying to help wont cut any ice.

The 'eggshell skull principle' will apply

Like I said, if you do this king of thing don't be suprised if it you end up in gaol.

I'm sorry if I'm labouring this point, but AO has a responsibility to ensure its members and guests understand this and everyone needs to understad that breaking the law, even with good intentions, is still breaking the law.

Quote:

---

i am mainly in disgust of M$'s anti-competitive practices, not products.

---

These anti-competitive practices are also reffered to as good busisness. In every industry on earth, there are anti-competitive practices. For example, what about the car commercials that say "our car has so and so more features for this much less than our competitors car". Do you really think that Ford wouldnt put Honda out of busisness if they could. What about Taco bell commercial that say "think outside of the bun". I'm sure they would be delighted of McDonalds went out of busisiness (like thats gonna happen) The important thing is choice. As long as you have the choice yo use *nix or Mac, there is no reason you need to complain about microsofts "Anti competitve practices" when it is really just good advertising.



slick

Quote:

---

I was pointing out that most self proclaimed "hackers" want nothing but a name for themselves or just being a small part of a over crowded scene of 13 year olds is good enought for them. But I think if someone has a true interest in computers then crap like that shouldn't even matter to them. If peaple would stop worrying about a label, status, or position inside a scene then not only will peaple learn more if they stop wasteing their time on trying to look cool as quickly as possable... but they would also be into computers for better reasons other than stupid and trivial garbage.

---

Indeed, what's all the fuzz about being a hacker, just do your thing and stop whining about who's the hacker and who isn't. It's just a waste of time.

i agree with el-half. you shouldn't worry about what other people are doing. what they do is their business. the only time you have to worry about hacking is if you're doing business or accounting online or on your computer. other that that, don't waste your time worrying.

Point well taken, slick. I just get tired of using a great product, and then having M$ gobble it up and scrap it or ruin what I liked about the app. I guess that's just something I'll just have to deal with. That's how capitalism, as well as the rest of the world, works.

Also, while I agree that ethical hacking is OK, there is a very, very fine line. If you wish to penetrate a system you don't own, pooh sub tzu, I would recommend that you contact the admin first and get their permission. Explain your intentions, etc.

Don't think it will be sucessful, but at least it will keep you out of the legal pitfals steve mentioned. Scanning the system for vulnerabilities os ok IMHO, as long as it goes no further than scanning, you don't exploit any vulnerabilities, and you notify the admin of the vulnerability with instructions on how to patch it (it's best to reference vendor info, but I wouldn't use links, as I know I wouldn't click a link from an unknown source.)

Given how little an outsider would know about why certain ports are open or things are configured a certain way, making any changes without the permission of the people responsible for those servers is irresponsible as well as illegal. You do not know what it will affect, the company could very well lose quite a bit of money because of those changes and will most likely be more than happy to prosecute. Depending on what the system in question is involved worth it could go beyond financial losses.

As I've said before, if you want to play professional..be a professional. Put together a real proposal and approach the company to do a real test and consultation to help fix things. You don't have to charge a dime if you don't want to and if done properly it can cover your ass legally.

I couldn't take the time to read all the posts on this thread but I did read the first few. And it's a very good topic.

I found this website while doing a report for school and found it quite interesting and decided to sign-up, since then I've been checking the website everyday. There many hackers who do have only malicious intents uppon other computers. I do not consider myself a hacker. I consider myself as a normal user of the internet. I try to learn as much about security and try to prevent those hackers who try to hack into my computer. So far I haven't been hacked and I try not to draw a lot of attention on the internet to try to prevent myself from becoming a target.

Those who try to figure out the security flaws of other computers I believe just use that as an excuse to hack into a computer because why would you try to help somebody elses security flaws, maybe you are trying to be helpful but it's as n00bie says, you might just end up getting somebody fired. What you should do instead is try to secure your computer and try to hack it from another of your computers to test out the security on your system and apply for a job somewhere on computer security.

Script kiddies in my opinion are just newbies who claim to be hackers by using programs made by others instead of figuring out how a computer and the internet works. I don't think you can get a job being a script kiddie, so what is the point in being one? You aren't going to hack any major company with somebody else's tools because those tools were designed for their personal use. Instead of being a script kiddie, they should learn about security and get a job. Will probably pay more than what they are already earning.

I use what I know (which isn't really much) to help my computer be safe and secure my friends computers when ever they need me to help them secure it. There many "blackhat" hackers who have a big future ahead of them and ruin it by going into hacking and getting themselves a crimal record. I admit all of us are curious but in front of a judge that won't be an excuse. So if your curious hack yourself not anybody else.