Self preservation

[ech0]

Alright, me and a friend both have spare boxes. Were setting up a VPN connection between us and starting to get into some war games with each other for bragging rites (war games as in exploiting each others machines, bragging, then explaining how it was done. This is all being done internally and we both know the other person is doing this. Now my question to you gurus and other bored members is. If I were to ask some security related questions from an offencive perspective would I get negged for it? I would google and do my own research so my questions wouldn't be "how do I hack named" but more precise. Any thoughts?

[Aspman]

You're a newbie in term of the site so it's certainly more difficult for you to ask these sorts of questions without getting negged.

Just be detailed I suppose, what you are doing, the exploit you are planning to use and the information you've gained on your own from google/bugtraq etc.

And don't ask how to hack hotmail, not for a while anyway

Might be worth recording what you are doing and in the future you could post a wargames tut.

[rowdy_yates]

#1 - why should site memebrs believe you that you will only use this knowledge to attack your "buddy"?

#2 - what is to stop any 3rd party by from reading your posts and replies and gathering that information to attack other peopl?

you will be better serverd if you stay around the forum, make yourself useful, help others, make some friends with the gurus and then maybe converse in private on attack methods.

[MrLinus]

Personally, I see nothing wrong with doing wargames and encourage you to do so. I like the suggestion that Aspman has put forward -- it would be interesting to see what you discovered worked and didn't work as well as what things you would do to improve the wargames experience.

I'm a firm believer in full disclosure in that you should understand how an attack feels and how it is done if are to better defend against it. (much like an immune system knowing what a germ is like -- our society is too germ-free these days). A lot of it, however, does boil down to some responsibility. Those lovely words -- "If you choose to do this for illegal reasons, you're on your own" -- are ones that you may need to pepper your posts with.

Best of luck.

[Egaladeist]

Hi ech0,

The problem is, as rowdy mentioned, that any information posted on the forums can be used by OTHER people as well...people who may not have the same intentions as yourself...

my advice is to get yourself known...then invite people to a conference room where you can discuss this matter in private.

Eg

[MrLinus]

The problem is, as rowdy mentioned, that any information posted on the forums can be used by OTHER people as well...people who may not have the same intentions as yourself...

So, an ethical ponderance/Devil's Advocate for you: if I posted instructions on how to drive a car and someone uses that to mow down someone else (eg., think of the shows COPS, CSI, Law and Order, etc. and what they show regularly), then I shouldn't post instructions on how to drive because someone could potentially use it for illegal purposes (even if I warn that people should take precautions and drive within the limits of the law)??

[Egaladeist]

Hi MsM,

Not the same thing...now if you were to compare hacking to instructions on how to build a bomb...I still say it's better done in private and not in an open forum.

Eg

EDIT: I'm not saying it shouldn't be discussed...just that it should be done responsibly, in such a way as to protect people from harm.
I'm assuming that was the intent of these conference rooms...to discuss potentially sensitive or private matters.
I would not teach a 10 year old or a criminal how to build a bomb...so why should we teach them how to hack?

[MrLinus]

And how would anyone know that those in the private discussion are in fact as ethical as they claim?

[Egaladeist]

Hi MsM,

You can't really know...so it's an individual judgment call...still...it's best done in private where it will do the least harm.

Eg

[MrLinus]

it's best done in private where it will do the least harm.

Well, to each their own. Personally, I think the greater risk is the lack of education to those that need to know (e.g., other admins). As I like to paraphrase Ignorance is bliss but it ain't no defense.