Slashdot Log In
A Peek At Script Kiddie Culture
Posted by
timothy
on Sat Mar 06, 2004 09:03 PM
from the culture-is-a-strong-word dept.
from the culture-is-a-strong-word dept.
Brian Bruns writes "NewsForge is covering an article on the Script Kiddie Culture, in an interview with my co-admin Andrew Kirch. It provides insight into a culture that not many people fully understand, or get to see."
This discussion has been archived.
No new comments can be posted.
A Peek At Script Kiddie Culture
|
Log In/Create an Account
| Top
| 470 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
What is there to understand? (Score:4, Insightful)
Woho! Im leet!
Re:What is there to understand? (Score:4, Funny)
(http://www.robherbert.com/)
addendum to topic paragraph (Score:5, Funny)
(http://forums.minidisc.org/)
Re:addendum to topic paragraph (Score:5, Funny)
(http://www.poptix.net/)
If in doubt, search google. This "SOSDG" is hosted on someones cable modem, yet claims to run DNSBL's used by "Hundreds of government sites including
In conclusion, I have my own IRC logs:
[28/1806] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1809] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1812] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1812] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1812] [msg(trelane)] this is great stuff, keep spewing
[28/1812] [msg(trelane)] funny stuff
[28/1812] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1814] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
[28/1814] [trelane(trelane@adsl-68-78-10-171.dsl.ipltin.ame
(Despite their rantings, they can only hop on IRC and point fingers when their cable modem gets attacked)
Re:addendum to topic paragraph (Score:4, Informative)
(http://www.poptix.net/)
not many people fully understand, or get to see.. (Score:5, Funny)
(http://www.frognet.net/~chris)
Re:not many people fully understand, or get to see (Score:5, Interesting)
If Joe Average's cable modem bandwidth is getting sucked up by some kiddie script, he should care. Especially when his ISP sends him a warning letter saying hes using up too much bandwidth when the most graphic intense site he's visited that month is CNN.com.
Bob Businessman definately should care as well. That dedicated T3 line he uses at work is being used to get information to his consumers. If the site starts to get slow due to a worm causing him to download hundreds of gigs of pr0n, not only will his consumers get angry but his employees may suffer in effeciency...
Re:not many people fully understand, or get to see (Score:5, Funny)
(http://www.obscurereality.net/ | Last Journal: Sunday January 11 2004, @02:37AM)
because they are wanking off to said 'pr0n'
Re:not many people fully understand, or get to see (Score:5, Interesting)
(Last Journal: Tuesday February 11 2003, @06:42PM)
Are you kidding me?
I mean, I know we're all techies here, but lets break out of our shells for a second. This matters to people who make over 40k a year. Joe Average works in a factory and lets his kids use the internet for schooling. Do you think Joe Average, who was raised on libraries and encyclopedias, cares even for a second about whether his ISP goes down for 6 hours? Joe Average has to deal with bills, healthcare, school, drugs, gangs, crime, etc. etc. Joe Average needs tax dollars spent ensuring the welfare of our society, not the welfare of Bob Businessman's T3 lines so profit margins remain high.
Putting feds on the case of script kiddies is taking away from money and manpower that our society desperately needs. We need more concern over corporate accountability and less for corporate profits.
Re:not many people fully understand, or get to see (Score:5, Insightful)
(http://baby.boondock.org/ | Last Journal: Friday August 04 2006, @11:41AM)
Generally I agree, except...
Bob Businessman is Joe Average's boss's boss's boss. When his T-3 line for the site that sells whatever widgets Joe Average is putting together gets sucked dry, it costs the company money. Six months later, when they have a shareholder meeting coming up, that expensive worm might cost Joe Average his job in a layoff.
It's important to recognize that the resources needed by some people aren't the resources needed by everyone. But by the same token, it's also useful to recognize when the resources sucked up by one abuse end up costing others important resources down the line.
Let us bandy words, shall we? (Score:5, Interesting)
Anywho...with that said here's my $.02:
I think that everyone posting above me has their own valid points which I shall paraphrase here.
1. We don't want money being thrown away to fight a battle that may or may not be won, if winning is even a real possibility.2. We can agree that the actions of these "script kiddies" is to some degree detrimental to business. Seeing as how s#it rolls down hill, it can also have an impact on us blue collar folks. I think it's accurate to say that the negative impact will grow and become more noticeable as time passes.
So, what kind of happy medium can be found amidst the viewpoints which say either "It's a waste of resources to fight." or "Something must be done."?
Should officials not try to trim the fat from current programs and then allocate the new resources to fight this growing problem? I'm responding here off the cuff so I sheepishly admit I don't have a prepared list of potential candidates for severence. But, therein lies my question; Where is the government and general law enforcement concentrating that is perhaps irrelevant.
I know plenty of people here can come up with a long list of things our government wastes money on. Furthermore I'll bet'cha we can get over half those involved in the discussion to agree to the slashing of this or that. What say ye pantheon of knowledge?
---
Re:Let us bandy words, shall we? (Score:5, Insightful)
(http://twentiesretirement.com/ | Last Journal: Thursday July 22 2004, @05:55PM)
Unfortunately...
The liberal voters here will say that the tax cuts for millionaires are what we should get rid of.
The conservative voters will say that services for the poor (welfare, etc) are what we should get rid of.
Neither side will agree with the other.
Re:Let us bandy words, shall we? (Score:5, Insightful)
Re:not many people fully understand, or get to see (Score:5, Informative)
(http://dotfuturemanifesto.blogspot.com/)
The point of DDoS is that it hits everyone. Sure we get huge numbers of DDoS attacks at work, sure none has ever taken us down. But the check that we have to write to ensure that is huge, millions a month.
Here [blogspot.com] is a take on this issue from Phill Hallam-Baker: [blogspot.com]
OK so a second bite at the same article, lets take a look at those DDoS schemes.
According to the article the ISPs are unresponsive to take down requests, the FBI do not take notice. I know that people keep making this complaint but there are high tech crimes units in the major cities and they are looking to takedown these guys. And at the moment the demand is such that DDoS is being treated as if it was a littering offense.
I think we need a better primer on how to prepare a case for law enforcement. I guess it is possible if you read the article carefully that the desk guy thought this particular person had been getting evidence by hacking.
We can't expect to do this with law enforcement in the loop every time. Lets change the model, law enforcement only get involved if the ISPs fail to act, and instead of just going after the hacker there is a liability for the ISP.
This is consistent with fire department model of government security regulations. You can do pretty much anything to your house decoration wise. Government only gets involved when safety is the issue. In particular the fire dept won't let you build a house that is a fire-trap, in part because it might set fire to buildings arround it.
Here we have ISPs that are forwarding bogons. It seems to me that this should not be that difficulty to prevent. A $500 box performing passive listening at the cable head end could sound an alert when there is a bogon attack. You don't have to look at every packet, all you need to do is to look at a sample. If you see an ethernet MAC spewing bogons you shut it down.
Another approach would be to push the bogon prevention right to the cable modem. Why on earth would these let bogon injection take place in the first place? Sure there will be some hacked modems, but DDoS is comming from hijacked machines.
Cable modems, NAT boxes and the like should have limiters built in to prevent the creation of ridiculous numbers of SYN packets or outgoing UDP packets to reserved system ports like DNS. It is pretty easy to think of numbers that should be no inconvenience to any legitimate use, and there could be an option to turn them off in any case. But why give every home user the equivalent of a loaded machine gun when they don't need or want one?
Reduce the value of your machine to a hacker, reduce the probability of attack?
How is this a 'culture'? (Score:5, Insightful)
I think people watch too many movies. Or is defining 'script kiddies' as a culture an attempt to rationalize the level of ignorance we experience when trying to comprehend all of computing technology? Since nobody can be good at everything, is it a mental safety valve to create uber-computer users, who 'get it', who can do 'cool things', who are 'in the know'? Isn't this the same thing as creating Gods to explain otherwise unknown natural phenomena?
Re:How is this a 'culture'? (Score:5, Funny)
Re:How is this a 'culture'? (Score:4, Insightful)
Re:How is this a 'culture'? (Score:5, Interesting)
most of us then were total geeks that either couldn't hold his own at a jock party or was too nervous around girls. the one thing that we did have was power when it comes to telecommunications. and that power, because it wasn't to be enjoyed outside the computer, made us all arrogant little assholes.
i see nothing has changed.
of course, then we didn't call them script kiddies (which i find appropriate), we called them 'kidhacks'.
On a similar note... (Score:5, Funny)
(http://hoodlumzproductions.com/)
Re:How is this a 'culture'? (Score:5, Insightful)
(http://www.booksunderreview.com/ | Last Journal: Friday August 29 2003, @09:38PM)
The people who actually know what they're doing are much more dangerous, generally on the grey to white side of the law and don't bother with DDOS on somebody's little website, since if they really wanted to, they'd just take entire nations' Internet access down.
I mean, I could think of a 1/2 dozen ways to wipe out a whole country's internet access completely for a day or two (no, I'm not going into details here, but if use BGP in your work life, you can probably think of a few also), but most people who've spent the time to learn at that level also are mature enough to realize that there isn't much of a point to wanton destruction.
Re:How is this a 'culture'? (Score:5, Interesting)
The script kiddies we're talking about are those who are copy-and-pasting 0day hacks. A hack that the White Hats don't know about yet, and even most black hats don't know about yet. The big mysterious question: Just how did these kids get into the web-of-trust it takes to have this tool before the "good guys" do?
Afterall, the first "good guy" who gets this tool will hand it over to the white hat experts who will start the work on the patch that makes the hack worthless. So, the web of trust on these things has to be tight... so again, how do the new script kiddies get in the club?
Nice question! (Score:5, Insightful)
(Last Journal: Thursday December 08 2005, @11:00PM)
And like the messenger, they are more likely to get shot by the good guys when the let a hack loose into the wild.
Could it be that a few black (and possibly white) hatters find that they serve a purpose?
Yes (Score:5, Interesting)
(http://www.meowpawjects.com/ | Last Journal: Monday December 18 2006, @09:12AM)
People will assume they are safe from the big time terrorist dude becouse "I'm not a sereous target".
DDoS attacks against major targets use hacked cable modem users desktops.
Spammers use Worms to establish a spamming network.
ID theft resulting from the simplist of mistakes.
That stuff happening today.
When telling people how important security is:
With out script kiddies
"Why would anyone attack me?"
"Your system can be used as a launching point for all sorts of attacks"
"Yeah right."
It's hard for a person to picture how "they alone" could be be a target and they'd be right becouse they aren't alone. But the details sound like SiFi to most people and they tune you out.
With script kiddies.
"Why would anyone want to attack me?"
"Becouse your an easy target. Script kiddies need no other reason"
Re:How is this a 'culture'? (Score:5, Funny)
(Last Journal: Friday November 30, @04:45PM)
I think they're appointed by the president, and after a confirmation hearing, they're in.
Re:How is this a 'culture'? (Score:5, Insightful)
Re:How is this a 'culture'? (Score:5, Interesting)
(Last Journal: Friday August 19 2005, @05:44PM)
I dont know how BGP works, but I heard that way back in the day, some dude at some ISP announced that he had a
Re:How is this a 'culture'? (Score:5, Interesting)
(http://www.booksunderreview.com/ | Last Journal: Friday August 29 2003, @09:38PM)
A well setup core router will protect your network from most bad announcements from your downstream clients, but if one of your upstream providers gives you the right bad info because their router has been screwed with, you're out of luck until a real person figures it out and takes the link down.
Then of course, all the outgoing traffic for that link cascades over to your others.... and now that many people are blocking snmp due to Cisco vulnerabilities it gets a little harder to figure problems out.
And of course, much of the incoming traffic probably still sees the downed link as a valid ASN path, and since that's beyond your control... yeah, you can get screwed pretty easily by one router on an upstream provider's network that misbehaves in just the right ways.
Truthfully, most major ISPs' NOCs are pretty fast to respond to BGP screwups, but problems caused by a mistake vs. problems caused on purpose with a little forethought and topology knowledge are two different beasties...
Re:How is this a 'culture'? (Score:5, Insightful)
I don't want to start another hacker/cracker flamewar but I think we should reserve the term script kiddies to people who effectively do nothing more than running other people's malicious scripts.
We need to find another term for describing these immature, yet skilled, adolescents that discover vulnerabilities by themselves in order to higher their social rank. (Cf article where they talk about '0day servers' with newly found vulnerabilities ready for kiddies' next war)
Re:How is this a 'culture'? (Score:5, Insightful)
(http://www.booksunderreview.com/ | Last Journal: Friday August 29 2003, @09:38PM)
Re:How is this a 'culture'? (Score:4, Interesting)
Re:How is this a 'culture'? (Score:5, Interesting)
Re:How is this a 'culture'? (Score:4, Interesting)
There's a difference between doing something, and doing something and not getting caught. Are your ideas the kind that will end up you being in a federal prison (i.e. quite pointless) or the kind where you cannot get traced (i.e. you are then in fact quite dangerous)?
there's a difference between going to the bank with a shotgun and getting a lot of money, right before being either shot dead or hauled off to prison, and figuring out some way to siphon off bank funds into your account in a way where nobody ever detects it (or only does long after you're gone).
Re:How is this a 'culture'? (Score:5, Interesting)
Also, if you've ever associated with them, script kiddies have their own rules (mostly unspoken), trends, and even something of their own language. It may all be borne of ignorance and immaturity, but the same could be said about a number of other cultures/subcultures.
Re:How is this a 'culture'? (Score:5, Insightful)
What a 0day really boils down to is a mistake that a programmer made that never got corrected and therefore got distributed, but this mistake has yet to be documented in any way. White hats announce what they've discovered in the form of a patch, or at worst a security alert to the public. Black hats announce what they've discovered in the form of a malware attack.
Really... we'd like to know what motivates black hats, because we'd like to find a way to get them to play on the white team.
Re:How is this a 'culture'? (Score:5, Interesting)
Bored children break stuff for the sheer hell of it. To seek deeper meaning here is to completely fail to understand bored children. Distract (and that's all you can do, merely distract) child A from breaking a thing, and child B will come along and break it while you're still busy with child A. There's nothing to see here. Move along.
we'd like to know what motivates black hats
You're presuming to use logic (or something similar) to understand a non-logical phenomenon. Don't work. Human emotion is a manifestly NONlinear function and additionally changes from one state to another with about the same level of predictabliity as the position and momentum of a particular subatomic particle. Fuggabouddit.
we'd like to find a way to get them to play on the white team
That way has already been found: Let them grow up. They'll get over it. Or at least most of them will. But you can never predict with certainty exactly which ones. And every year a new crop is growing.
Re:How is this a 'culture'? (Score:4, Insightful)
(http://derekl1963.livejournal.com/)
Thank you Dr. Spock.
Re:How is this a 'culture'? (Score:5, Insightful)
(http://redhog.org/)
The only way to raise a child not triggering its "do the opposite of what you say" when you ask it not to do something that really is bad, is to never say no if it really isn't a problem, and when saying no out of rreal need, allways motivate the no with good arguments that the child just can not ignore the truth of.
Re:How is this a 'culture'? (Score:5, Insightful)
Desire to compete coupled with a strong fear of rejection. All you have to do to 'win' is be hated.
Re:How is this a 'culture'? (Score:4, Funny)
After R'ing TFA, I'd guess that the most efficient way to take away their motivation would be for the major ISPs to chip into a fund to get hookers for them.
Re:How is this a 'culture'? (Score:4, Insightful)
Give a kid a felt-tip pen and he thinks he's Bastiat, give the same kid a computer and he thinks he's Kevin Mitnick.
Two implications (Score:5, Insightful)
a) Its a culture.
b) Someone would actually want to see it.
10 years ago I did the script kid thing for a bit (before having a life). Its a bunch of kids who's parents are not really involved in their lives, and have nothing better to do than look for a digital mate by typing "A/S/L?!?!??! and talking about their privates.
I could seriously care less.
Did you miss the part... (Score:5, Insightful)
(http://youtube.com/watch?v=FCDJ0jhWKno | Last Journal: Tuesday November 14 2006, @01:31PM)
Try a little reading comprehension first.
Re:Two implications (Score:5, Funny)
a) Its a culture.
So is yogurt.
b) Someone would actually want to see it.
Somebody somewhere paid money to watch Gigli as well.
h4h4h4h4h4 (Score:4, Funny)
(http://www.infiltrated.net/ | Last Journal: Monday February 16 2004, @01:07AM)
_xXx_h4x0r3rZer0_xXx [#31337] d00d sl4shd0t p0st1d 0ur sh1zzl3 m4h n1zz73
XxX-|-Ne()-|-XxX [#31337]
XxX-|-Ne()-|-XxX [#31337] l4m3rz!@_!@
A peak at script kiddie culture.. (Score:5, Funny)
Publicity (Score:5, Insightful)
Bahh, these kids today... (Score:5, Funny)
(http://www.livejournal.com/users/k4_pacific | Last Journal: Tuesday May 25 2004, @10:16PM)
Takes the fun out of being a kid if you ask me. Hmmmpphh
WTF (Score:3, Interesting)
Just how do you stop a DDoS? (Score:5, Interesting)
An admin whose network is being DDoSed really doesn't have much hope of doing anything. Their inbound communication line to the outside world is being flooded with so much garbage information, the signals that they want to get over that line are simply drowned out. Incoming connections can't get a turn going down the pipe, so they time out. He's powerless, everything in his shop is nice and secure, but can't function without geting any useful requests. That poor admin can call his ISP... but there's really not much the ISP can do from their side of the line.
The real problem in a DDoS attack is not that the final victim's security has gone wrong, but the security of other computers elsewhere on the Internet have been compromised, and they've been turned into zombies contributing to the DDoS flood. The DDoS will not subside until nearly all those machines are all patched, but that's not something the victim's people can do. They have to wait for the Anti-Virus providers and software providers to knock down the flamethrowers that are all being shot in the same direction.
Any time you're relying on third parties who don't work for you to save your business, you're really up a creek and are throwing yourself on the mercy of the tech world. Hopefully they'll save you in time, because there's really not much you can do from your own datacenter.
Re:Just how do you stop a DDoS? (Score:5, Insightful)
Baseball BATS ! (Score:5, Funny)
Translation (Score:5, Funny)
(http://www.indignant.org)
reckognized = recognized
mne = me
Im = I'm
andd = and
gfod = god
Damn... I sure as hell hope you're not a programmer at your job. If so, I'd love to see some of your code
#!/usr/been/purl
opin(INFILE,"/etc/paswd") || die("Fil naught fownd");
Sorry about making fun of you, please don't bring your dad to my house.
Re:Translation (Scor