Hacker-smasher: White hats join forces to build bot-beating weapon In Hollywood, the good guys nearly always win. In information security, the bad guys ("black hats") often win, in large part because the bad guys know how to collaborate much better than the good guys ("white hats"). Until now. From Lulzsec to Chaos Computer Club, hackers increasingly band together to spring sophisticated …
It would be interesting to know how the white-hat teams aim to avoid eventual infiltration. OpenDNS is apparently open to almost anyone who cares to contribute; I went nosing around after a local "gay and lesbian choral group" found themselves blacklisted as if they were some sort of a porn site (because, you know, "gay" and "lesbian") . Near as I can tell, some of the "contributors" to OpenDNS are just running keyword-driven bots, and as soon as three or so of those agree, well hey, that's consensus, right?
On some topics, these "contributors" had a false-positive rate higher than 95% (i.e., I reviewed 20 of their flagged websites, and all were wrong).
if you get enough users checking each others work (i.e. set the same task to 10 people and compare their results) then you instantly have a fairly good method for getting the right answer, of course the more users you have the more likely this system is to work reliably (if 99% of your users are truly black-hat then you're screwed)
over time you can use past performance to apply a weighting to each users result, i.e. fred bloggs has reported 85% of his tasks wrongly but john smith has reported 85% correctly, simplest method would be to say that before a decision is made there needs to be 1000 votes, John's vote counts as 85 but Fred's vote only counts as 15.
in this way it becomes quite hard to game the system because the more somebody goes against the majority the less significant their vote becomes.
"If you get enough users checking each others work (i.e. set the same task to 10 people and compare their results) then you instantly have a fairly good method for getting the right answer."
Presumably a similar method to ensure the "right answer" will be in use in the trial of Pussy Riot, and that the more such individuals "go against the majority the less significant" they become.
As others have pointed out, in some situations hat colour depends on the viewer's political orientation.
"if you get enough users checking each others work (i.e. set the same task to 10 people and compare their results) then you instantly have a fairly good method for getting the right answer, of course the more users you have the more likely this system is to work reliably"
Because that approach works so well for Wikipedia.
Really would make a bad film if you know much about BDSM and understand that interest in it is not generally a result of childhood abuse (or that most people who are into it don't have mental health problems, see Secretary for details) and that a BDSM relationship needs communication and understanding of the participants limits and desires, let alone emphasis of the importance of safety and respect.
(Sorry about the hijack, but 50 Shades of Drivel is giving a lot of people the wrong idea about BDSM)
For someone supposedly well-connected, this piece is astonishingly provincial. Well, not that astonishing, given how his well-connectedness appears to end entirely when leaving silly valley, but I digress.
Anonymous is more a moniker than an organisation, so isn't "well-organised" by any means. The CCC is an actual verein, a legal entity and everything, much like 2600 magazine is an actual magazine, with offices and everything. Oh, the CCC publishes a periodical too. Might as well paint everyone who reads either a "black hat". Or people who attend CCC meets, like the annual congress. Plenty of people who go there also end up on HOPE or on various other "infosec" congresses.
Who's a "white hat" and who's a "black hat"? Apparently the only difference is whether you get paid and pay taxes on those proceeds. Maybe not even that. The real scum aren't hackers at all; the people doing the grunt work of actually exploiting, building botnets, filching low-hanging fruit, selling on the data, cashing, muling, that sort of thing. Very little innovative skill involved, but a lot of organising and making sure you don't get caught. Or maybe it's the people that build really big databases tracking all sorts of things, and then selling their big brother services to any government (the US by preference). Or, well, how many species of pig-or-man or man-or-pig do you want?
Since Matt seems to get definitions entirely from press releases by companies selling "research" that really isn't worth the time to read it, I'll point out that the CCC puts out press releases too. And so does Anonymous, of sorts. See? White hats. Sorted. And next time, read a little more before you stick your foot in again, please.
No, I'm no member or either, I don't particularly like them and they don't like me (I have that on file somewhere), but it still doesn't do to just jot down some base libel to glue together the weekly el reg deliverable from someone else's self-serving press releases gushing useless numbers and how relevant they are (not). Then again, maybe it's just Matt who lacks relevance. He dangles just below ceerow, after all. What, low blow? How so?
I quite agree.
Another couple of issues he seems to have 'overlooked'.
"What's in it for us?"
For businesses this is perfectly understandable. They are not charities and running any kind of business is a damned expensive affair these days.
For government bodies, NGO's and volunteer groups there is no such excuse. They are *supposed* to be sharing this information. It's the very reason for their existence in most cases. Yet they repeatedly hold back vital information in order to 'make the announcement' themselves.
Part of the reason for this is that these organisations are often run by (and/or stuffed full of) academics who's standing amongst their peers is measured by the number of publications which carry their name.
And then of course there is the appalling lack of social skills so prevalent amongst InfoSec 'professionals' at 'the sharp end'. In far too many cases these people are simply not capable of co-operating with others on technical matters. The "I'm right and you're full of excrement" Syndrome as I once heard it described.
One case in point is our 'technical types' who have to be 'reminded' not to bring inappropriate items into the office on a fairly regular basis. Pointing out that it doesn't look very professional if a client comes in and half their desk is covered in a neat array of 'Action Figures' simply falls on deaf ears most of the time.
CCC, most defiantly not black hats. The club is very open and has a huge member base. So yes, there are the occasional black sheep's. But from a public representation they are more on the white-ish side of things. They often get invited as expert witnesses, for example by the constitutional court.
No. But once we stop thinking in strict black and white terms, the really question is where on the grey scale they are. And I would argue that they are pretty much on the light end of things. They are very careful to operate within the law.
For the Bundestrojaner, it was the government who broke the law, not the CCC. And at the conference 2 years ago, they actually obtained a license to run their own GSM network, so they can show how to hack it, as it would be illegal to hack an operational one.
But overall, most of the active members are really more the old-school type of hackers with a soldering iron. I really loved the "Not your Grandfathers moon landing" http://media.ccc.de/browse/congress/2011/28c3-4821-en-not_your_grandfathers_moon_landing.html oh, and there is also the laptop in space thing or Building a Distributed Satellite Ground Station Network - A Call To Arms http://media.ccc.de/browse/congress/2011/28c3-4699-en-building_a_distributed_satellite_ground_station_network.html
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
