Hacking Ethics - A Lecture

You are walking home on a summer evening. The sun is shining and the streets are quiet. You pass by a house and notice the front door is swinging open. Do you:

(a) Ring the bell and tell them.
Or:
(b) Piss in the hall.
Or:
(c) Piss in the hall, then ring up your friends and tell them to come round quick and piss in the hall before the occupant notices their door is open.

Finding security holes in multi-user, shared systems is no big deal. It happens all the time. The novelty will soon wear off.

In the early days of computing and the Internet, exploiting security holes looked clever. Now, however, it looks like (b).

So computers are novel to you?
Get over it. Shared computers are no more novel than shared buildings.

The shared file system at DCU

You find that protections are incorrectly set, and you can delete someone's project. Do you:

(a) Tell them (or me).
Result: I believe you know something about UNIX. Good for you. The other person learns something about file protections. Good for everyone.
Or:
(b) Delete it.
Result: Deletion instruction found in some log or command-line history file. Identity of deleter reconstructed based on login times and terminals in use. Hacking scripts found in old backup tapes or "undeleted" from disk. Deleter identified or at least short-listed (and then identified after interviews). Project automatically restored anyway from multiple distributed, automated backups. Everyone's life carries on as normal. Except yours.
But even worse, it's boring.
It's (b).

Good rule:

When you are exploring, don't ever type a command that would be destructive if the system protection was flawed. e.g. Don't see if you have permission to delete a file by typing:

$ rm file

It might work! And then you're in trouble.

Most hackers attack the innocent

Contrary to the movies, most virus writers and hackers don't attack powerful corporations and the military. They attack random, innocent, harmless people.

Most hacking looks like this:

A trusts B.
B betrays that trust by attacking A.

Most virus writing looks like this:

Pick n people at random from the phone book. Powerless, ordinary people just trying to get by. And cause misery for them. Give them lots of extra work, and perhaps serious pain, for no reason.
Attack hospitals, libraries, museums and other public goods that you are lucky to have.
Find stressed, underfunded charities, and cause extra meaningless work for them.
Delete people's sentimental messages from their lovers, and laugh at them.
Make small businesses, people like your own parents, go bankrupt, and mock them as you do so.

Do something useful

If you want to be a great hacker, do something useful. Stop attacking random harmless people and get involved in the fight for free speech on the Internet.

This is a serious fight, involving ordinary people with technology defeating the efforts of governments, military and powerful organisations (like religions) around the world to stifle free speech, discussion and thought. It's a serious business around the world. People go to jail for the freedom to speak and publish on the Internet.

Example: Internet in China

Internet censorship in China
List of words blocked by search engines in China
cryptome.cn
Microsoft, Cisco, Yahoo, Google and AOL are all assisting Chinese state censorship and oppression.
- Let a Thousand Filters Bloom, Anne Applebaum, 20 July 2005, on western corporations' collaboration with censorship and repression.
- Yahoo helped jail the dissident Shi Tao.
- Yahoo helped jail the dissident Li Zhi.
- Yahoo helped jail the dissident Jiang Lijun.

Google China

From 2006 to 2010, Google China agreed to censor search results in line with the ideas of the communist government.
Google were never happy with this. In 2010 they finally rebelled by re-directing google.cn to the uncensored google.com.hk. China responded by blocking Google in China.
"Tiananmen" search in:
"Tiananmen" image search in: