Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
News

Bizzare Answers from Cult of the Dead Cow 247

Monday's questions for the Cult of the Dead Cow ranged from serious-tech to silly. Various members of the Cult answered appropriately. Great stuff! One warning: if you are offended by strong language or are a hacker under 18, you should not read this Q&A session. The Cult is one of those groups the assorted nanny-censor programs try to keep away from deity-fearing, good-citizen, mass-average folks because they're commie anachist no-gooders. Or something like that. (And we like them that way!) Click below to learn why these people are A Danger to the Established Order(tm).

tdsanchez asks:
How has the 'mission' and/or purpose of cDc changed as the years have passed, especially with the advent of pervasive internet connectivity and the 'death' of classic dial-up BBS's?

cDc answers:

Obscure Images answers:
cDc's mission has never changed. We are still primarily motivated by the desire to dominate the world. I think that if anything, the growth of the internet has just been part of our plans for your tomorrow.

G. Ratte' answers:
The mission has never changed... it's always been about us trying to do cool stuff. The Internet has just made it easier to communicate and it's a lot less hassle than when you had to worry about how fresh your long distance codes were, back in the day. Call my dead BBS! Demon Roach Underground, 806/794-4362. 2400 baud! Apple II, baby!

Nighstalker answers:
The whole point of cDc is to communicate. While T-shirts and watches and BO2K are the glitz, the core of cDc is communicating to and with the world. The venerable T-File is the heart and soul of cDc and we will never abandon this most basic and venerable facet of the telecom/computer demimonde

Tweety Fish answers:
We are currently in the process of training our massive, highly secretive ninja army.

M1000 asks:
How would you define the implementation of security on the major OS today?

  • Windows95 / 98
  • Commercial Unix
  • Linux
  • FreeBSD
  • NT
  • Windows 2000 (NT5)
  • etc.

cDc answers:

Nighstalker answers:BR> If it's from MS, the security is crap. everything else is better by comparison. Linux is pretty good if you're a Linux guru. Same thing with any other flavor of UNIX. But no matter how good you are, there's someone out there who is better than you.

"The price of secure connectivity is eternal vigilance!"
--
DilDog answers:

  • Windows95 / 98 - Shit happens
  • Commercial Unix - Shit happens over RPC.
  • Linux - When shit happens, you fix it.
  • FreeBSD - Shit would happen, but there's no driver for it yet.
  • NT - Shit wouldn't happen if you'd just spend a few months performing 300+ modifications to our default installation, you lazy sysadmin. Get your MCSE.
  • Windows 2000 (NT5) - Shit happens over DCOM.
--
Tweety Fish answers:
Except for Window95/98, which I would characterize as sucking ass across the board, there's no simple answer to that question. All of those operating systems are (resonably) securable, in theory, but if you want to make the job of securing a box easier, why not run OpenBSD?

xmedar asks:
There is an episode of South Park with cows worshipping a cow clock, and when it is removed by the people, the cows all jump off a cliff, now I've heard that refered to as the Cult of the Dead Cow episode, is it anything to do with cDc or are cults for dead cows just in fashion right now?

cDc answers:

Obscure Images answers:
We would like to believe that we were inspirational to the creators of South Park, but we will defer to the obviously natural call of bovinity.
--
Reid Fleming answers:
Our lawyers will not permit us to comment upon the episode in question.
--
G. Ratte' answers:
Sure. I hear the next round of Calvin Klein ads will feature Kate Moss munching a big greasy cheeseburger as Kari Wuhrer cleaves an axe through a cow's head. And a roomful of Italian boys with no chest hair look on in quiet desperation. It's a scene straight from one of our industry convention parties.
-- Nighstalker answers:
The universe is a chaotic system. If Ratte had been screwing around in a sewage treatment plant, rather than an abandoned slaughterhouse, we cound have been called the Cult of Recycled Shit. That the guys from South Park had cult of suicidal cows may be our fault. maybe not.
--
Tequila Willy answers:
I know this episode well, and I've spent a lot of time studying the various interpretations of this episode. Though the Cult of the Dead Cow interpretation is a very plausible and popular connection to make, there is another very plausible interpretation that I think you will find interesting. The hands on the clock are metaphors for the phallus. The removal of the clock represents castration. The removal of the phallus limits sexual options and limited options are bad. The cows demonstrate their adherence to their principle of "maximum freedom or death" by jumping off the cliff. You might ask yourself, xmedar, whether you have any principles that you would be willing to die for.
--
Tweety Fish answers:
TV writers (comedy writers especially) tend to be unrepentant fanboys with computers and tight deadlines... you decide.

Effugas asks:
To the various illustrious(translation: I've worshipped you guys for the majority of my life) members of the Cult of the Dead Cow:

Moo.

That being said, I'd like to know what have been the most surprising events in the computer industry for you. Anything's fair game. What just came out of nowhere and knocked the Cult flat on its ass?

cDc answers:

Obscure Images answers:
We haven't been knocked on our asses yet by anything that has happened in the computer industry. We're great at believing that whatever we see is directly caused by our underground efforts. We would be knocked on our ass if we didn't believe that. Oh yeah, Linus Torvalds is a cDc simulacra unit.
--
Reid Fleming answers:
www.realdoll.com
www.jerkcity.com
--
GA Ellsworth answers:
http://www2.promisekeepers.org/
--
G. Ratte' answers:
I'm mostly surprised by what hasn't happened. I thought floppy disks would get bigger and bigger 'til they became a 3-foot square, and you'd use 'em for kites when they went bad. I thought for sure bubble memory was going to take off, and pen-based OSes would rule the industry, and I'd have an Amiga clipboard computer running MS's BOB right now. It should have been Atari, not Microsoft.
--
Nighstalker answers:
Cheap powerful computers. Looking at the list prices of all my Commodore 128 gear shows me that the whole system cost more than a new iMac. Also, PDAs are pretty surprising, how they just suddenly seem to be everywhere.
--
White Knight answers:
What surprised me most about the computer industry is how much less attractive Kiki Stockhammer is in person.
--
Tweety Fish answers:
You know they got these things now that can take a picture and put it on the screen thingy? That's so cool!

sinatra asks:
A recent article (forgot the reference) characterized codc members as a bunch of social juveniles bound by no particular ideals, and lacking in both trust and personal respect for other members as well as the (cr|h)acker communities at-large. The evidence presented in the article however was limited to on-stage behavior and a virus of unknown-but-suspicious origin on a distributed CD. The codc archives paint an equally murky picture, depending on the reader's perspective.

So is there a codc code of ethics? Could such a thing ever be enforced?

cDc answers:

Obscure Images answers:
I can't answer for everyone, but I will say that I am a moral relativist. I think that the morality of an act is dependent on the context of that action. As for a cDc as a group, we are a very close knit group, very nearly a family, and to think that there would be someone amongst us who would turn on us is an absurdity. The article in question was written by a well known fool who would fit in better at a meeting of the John Birch S ociety than a computer convention.
--
Reid Fleming answers:
No and no.
--
G. Ratte' answers:
Lacking in trust and personal respect? I wish I knew the article you're referring to, 'cause those are some pretty strange assumptions. But that's funny, that's interesting. We're the kids the newspapers used to write about being diagnosed with "Pac-Man elbow." We're the kids with the sore thumbs from Atari joysticks playing "Combat" through our adolescence. We're the first generation to grow up hearing a modem squeal every day after school. So if there's any lack of trust and respect for the (cr/h)acker community, it's self-loathing and it's all in the family. Familiarity breeds contempt. The only ethic is to not be, uh, k-lame. Spreading viruses is not good.
--
Nighstalker answers:
I read that article. The author is an ignorant twat.

For what it's worth, I trust my very life with any cDc member. I trust them implicitly.

I suspect that cDc individually and as a group is far more ethical than Microsoft. Anyone emails me, they get an answer directly from me, not some flack from marketing.
--
Tequila Willy answers:
Dear Sinatra,
Who's codc? I've never heard of them.
--
Tweety Fish answers:
The nice thing about cDc is we're all cool enough, and all moral enough, that there really is no need for us to enforce much of anything. Personally, I'm constantly entertained by everything every other cDc member ever does, and I'd much rather have that than the 1700 page cDc Moral Guide.

Incidentally, the author of that article also thinks that Richard Stallman should be arrested and charged with monopolistic practices, so, you know, you shouldn't believe everything you read.

[bog-oh] asks:
You folks have been around for so long, surely you've seen the evolution of both terms. Are you quick to take a stand on misuse of either, or do you just take it all in stride? Some of the older security folks out there are damned sure that "hacking" is still purely malicious, and "Cracking" simply means breaking software registrations and the like. What do you feel each term represents these days?

cDc answers:

Obscure Images answers:
We would like to take a stand on this nonsense once and for all. We are of the firm opinon that the qualification for being a hacker is not something that can be stated on clear moral grounds. As far as we are concerned, crackers are something you eat.
--
Reid Fleming answers:
The term "cracker" is divisive, insulting, and should be considered inappropriate in mixed company. Same for "honky" and "caucasian".

"Hacker" on the other hand, is perfectly fine for most social situations. As in: "Hey, you! Hacker! Suck my dick!"
--
G. Ratte' answers:
Personally, I never use the term "hacking"... it's all just messing around to me, and some of it could get you into trouble. Whatever. "Cracking" means removing software protection, and a "cracker" is a white boy. I don't know when people starting fussing over the terms and using "cracking" to mean system intrusions, but I think it all carries the stench of journalist-invented nonsense. Same with all that "white/black hat" crap. Nobody in this situation uses those terms, and they readily identify the user as an outsider.
--
Tequila Willy answers:
Dear Bog-Oh,

Your sensitivity is to be applauded in these times largely characterized by egocentric thinking. I appreciate that you've taken the time to ask me what I *feel* about these terms. I feel good about what each term represents. Thank you for asking.
--
Tweety Fish answers:
A cracker is somebody who cracks warez, and/or a pejorative term for a white person. Any other meaning is never going to catch on in the media, nor with the old school. It's just too complicated to remember the distinction all the time. The people who are hackers by anybody's definition have done some... uh... mischevious things in their time; it's part of the nature of the beast. To say that "a real hacker would never break into a computer system" indicates - to me - a lack of understanding of the original meaning of the word. Of course a real hacker would break into a computer system, if it was an interesting enough problem and they didn't anticipate anybody having a problem with it. I agree that the media should widen it's definition of what a hacker is, but that's not the argument I usually see, especially here on slashdot. I see a lot more of "they aren't a real hacker, because they break into systems and/or do security stuff", which is plain silly.

Personally, I refer to people by whatever term they would like me to use, unless I don't like them.

Besides which, if you are doing something unexpected, unforseen, or disallowed to any system (which is my pocket definition of hacking) somebody is always going to think it's bad, until you laboriously convince them otherwise, on a case by case basis.

Why get caught up in semantic arguments when you could be doing cool things and get noticed for THAT, instead?

phray01 asks:
please be honest

  • (1)boxers
  • (2)briefs
  • (3)panties
  • (4)thongs
  • (5)nothing
  • (6)orange
  • (7)Hemos the Hamster

cDc answers:

Obscure Images answers:
All of the above, though not necessarily at the same time.
--
Reid Fleming answers:
sacred vestments
--
GA Ellsworth answers:
Boxers for me..
--
G. Ratte' answers:
I refuse to answer this question, as I don't want to encourage your gross masturbatory fantasies. What I choose to cover my massive, pulsating tool swinging handily between my taut legs is my business, and my business only. What should the touch of soft fabric brushing the tender head of my otherwise steely rod matter to the likes of you? Disgusting!
--
Nighstalker answers:
Sheer to the waist black seamed pantyhose for formal affairs.
--
DilDog answers:
All of the above.
--
Tequila Willy answers:
Dear phray01,

The etiquette in this case actually depends upon whether you were east or west of the Mississippi when this unfortunate accident occurred. East of the Mississippi, the gas station attendant should remove the dog's head from your windshield wipers when cleaning the windshield. However, please be prepared to tip for this service. West of the Mississippi, it is usually considered bad manners to expect gas station attendants to remove any animal bits that have been wedged in your car parts. Thank you for asking.
--
Tweety Fish answers:
I actually try not to wear any slashdot operators that close to my skin. Makes my pants look funny.

Foogle asks:
Let's face it - most people regard the cdc as a bunch of script-kiddies looking for some limelight. The BackOrifice software really made this worse, because it was seen, not as an admin tool, but as an application meant to propogate cracking. How does this make you feel? That is, what are your personal thoughts on the cult's activities and how do you think they should be viewed from the professional side of the industry?

cDc answers:

Obscure Images answers:
cDc is not a group of script kiddies. We are united in our interest to hack the world, be it though computers, words, images, sounds, politics, money, or sex. Those who consider us to be script kiddies ought to shut the fuck up and write their own tools. Using tools doesn't make someone a script kiddie, what makes a script kiddie is the use of other people's tools to accomplish things they have no interest in understanding. It is understandable for professionals to be concerned with our reputations, but that is why we've been completely open with our tools. We have software that can be used as very effective tools.
--
Reid Fleming answers:
Most professionals get it. The trojan horse problem was considered to be low priority a year ago. Things have changed as a direct result of Back Orifice and Netbus.

(By the way, you ever notice that sometimes journalists turn to Russ Cooper for an "independent" perspective on Microsoft? And you ever notice how often he agrees with the Microsoft position?)
--
G. Ratte' answers:
It's somewhat frustrating when something a lot of effort has gone into is totally misunderstood by so many people. A lot of people seem to have an aversion to the big picture and how BO fits into a larger whole. As for 'the industry,' . Rah rah venture capital, rah rah IPO. "We've got this great new site, Hats4Cats.com, a brave new world of headgear for our feline friends! We're seeking the perfect partners to get this off the ground right, and if you'll just look over this media kit at your leisure after the convention, we'll have someone call you in the next few days about some great opportunities!" That's 'the industry.' 'The industry' can kiss our collective cDc ass.
--
Nighstalker answers:
Most people couldn't plug in new RAM to their machines or install an application with the aid of an installation wizard. More so for the people that write about the digital underground who are not a part of the digital underground.

BO was released to show up the miserable security of Windows, in the hope that MS would do something other than issue press releases and that users would be made aware of the pitiful security on their machines, particularly when connected to the Internet. BO2K was released in response to the pleas of countless IT professionals who needed a powerful admin tool. --
DilDog answers:
I don't feel one way or the other about it. I write code to fill a void whenever I find I need something that doesn't exist. Hence, BO2K.

What Linux is to Commercial Unix, BO2K is to Commercial remote admin tools. I mean, what kind of sick and twisted hax0r would want to use FREE and POWERFUL software without having to pay out of their ass for it.
--
Tequila Willy answers:
Dear Foogle,
Thank you for being concerned about my feelings. However, I disagree with the metaphysical assumptions of your first question. I believe I choose how I feel and that the reaction of "most people" cannot make me feel any particular way. That being said, your second question seems more appropriate. The Cult of the Dead Cow should be viewed as what they are, namely, experts in global domination.
--
Tweety Fish answers:
So the technical definition of Script Kiddie is one who uses pre-made scripts or tools to hack sites, instead of developing their own tools.. by that definition, how could we possibly be script kiddies?

In the larger sense of BO2K being an application meant to propagate cracking, yes, that might happen, but the way we're doing it does serious work to raise awareness of these issues. I think we're perfectly aware that this can be hard to understand, and we're perfectly willing to keep hammering our message home until people start to get it, and start working to fix these problems.

An_onymous Coward asks:
First of all I've got to say I think cdc is pretty damn cool. I was digging their .txts since I got my first dialup shell account long ago. Now, with you guys being so security minded and all, there's only one question I could think of for you: If you were to build your ideal network, with telnet, ssh, www, ftp, pop3, smtp, file & printer sharing, bind, etc... what would be your ideal configuration to maximize security? Please be specific about Network OSs, routers, network policies, protocols, filesystems, permissions, daemons, firewall rules, and anything else that comes to mind.

cDc answers:

Reid Fleming answers:
Dedicated fiber lines in a star configuration. Ultra low tramissions, only a few quanta, to foil optical taps. One-time pad encryption for each packet. All plaintext messages composed in an alien language unknown to anyone but the participants. The actual content of the messages being hidden in subliminal channels too sensitive to be mentioned here.
--
DilDog answers:
For cryin' out loud. My ideal network doesn't have half of that crap running. It can all be done with DCOM and HTTP. Just kidding!

I -know- this is a Linux crowd, but I'm tellin' ya, take a look at OpenBSD for PROACTIVE security when it comes to that mission critical firewall box, network monitor, webserver, etc.
--
Tequila Willy answers:
Dear onymous Coward,

First, thank you for your compliments. However I am left wondering how many of our text files you have actually read. All of your questions have already been addressed in detail in our text file, Wet Mount Slide.
--
Tweety Fish answers:
DUD3 Y3R TRY1N T0 B3 4LL SN34KY 4N' S0C1AL 3N1N33R US AN' SH1T A1N'T Y000? B3TT3R US3 NM4P INST3D!@$#!@%

If you want a genuine answer to that question, I'm sure the l0pht would be able to answer it as specifically as you need for a small fee.

Freshman asks:
Since BO is/was a big deal, I'm wondering what kind of companies have tried to contact you and what they had to say. Did Microsoft ever give you guys a buzz? The DoD maybe? CIA? If so, what did they have to say?

cDc answers:

Tweety Fish answers:
We've been in constant communication with the CIA, NSA, and MOSSAD to make sure that the government-specific backdoors built into BO2K meet their tough standards for EoE (Ease of Eavesdropping).. we value the contributions the US and other governments have made to these products, and look forward to working much much more with them in the future.

Microsoft hates us, I think.

rikek asks:
I've always wondered... what does a group that produces "script kiddie material" (no offense intended, it's inevitable whether you want it or not) feel about their work? Every now and then I'm plagued by contact with an "3R33+ H@X0R", who is most likely some 14 year old without anything better to do who is causing some minor damage, without a clue as to what a TCP/IP packet is. The ratio of clueful hackers cracking to script kiddies cracking has gone way down over the few years, and products like BO are likely to blame. So what do you guys think about this... would you rather this turned around, or do you feel that distributing tools to nameless masses is a good method at getting back at the real evils?

cDc answers:

Obscure Images answers:
There will always be people who ride on the work of others. That's all that script kiddies are, poseurs, trendies or what have you. Back in the old days after War Games came out there were floods of "hackers" out there and these same comments were made. In the end, there is always a shakeout process. Most of the current script kiddies will abandon their activities, leaving the hardcore still in place.
--
Reid Fleming answers:
I suggest reading the section on Evolutionarily Stable Strategies in The Selfish Gene.
--
G. Ratte' answers:
It's tricky, and I refuse to get into the kind of age/experience penis-size wars that always come up with this "lamers are running around with dangerous scripts" thing. Back Orifice is distributed the way it is to force an issue. A hell of a lot of people should be upset their computers are wide open. I've always hoped that people interested in our tools would seek out our other material and read up on what we're about. And that they'd be smart enough to figure out that bumming some hapless person's day by screwing up their computer is not a good way to spend an afternoon. The end of all our text files from the last few years says this: "Save yourself, go outside, DO SOMETHING!"
--
Nighstalker answers:
Virtually anything can be used for evil, as virtually anything can be used for good.

One thing about BO2K is that the author deliberatly made it more difficult for clueless script kiddies to use. They're the ones who constantly plague us with badly mis-spelled complaints about how BO2K doesn't work. The IT professionals sing our praises about the power and ease of use of BO2K.

BO2K is forcing evolution to accelerate in the world of computer security. we regret the damage that is done with BO2K. In the long run, we will all be the better for this.
--
Tequila Willy answers:
I think you have raised an excellent question. However, I am doubtful that good products like BO can be identified as the cause of the diminishing number of hackers in comparison the the number of script kiddies. I believe that each individual must take responsibility for the character traits that they choose to cultivate in themselves. If the number of script kiddies continues to grow and more individuals choose to take the path of becoming a script kiddie rather than pursuing hacking skills, then this seems more plausibly interpreted as a sign of laziness or a short attention span on the part of those who choose this path. I don't think that BO could be blamed for such a result. That being said, I would prefer to see more hackers than script kiddies but only because I respect the skills of hackers more than the skills of script kiddies. And I would rather participate in a society populated by individuals I can respect. However, I believe your question should lead us to thinking more about what sort of behaviors should or should not be tolerated in cyberspace. And before we can address that question, it would first be helpful to conduct an inquiry into the metaphysics of hacking. I believe that many of the laws regarding computer security issues are misguided because they make fundamental assumptions about the nature of the computer hacking environment that simply are erroneous.
--
Tweety Fish answers:
The ratio might have changed, but the total number of people with a clue has increased, not decreased. Some 14 year old might get their start by messing with bo2k at school, and then they might start writing plugins, and then they might need to do something stranger, so they'll mod netcat to do suit their needs, and then they might realize how horribly insecure their own system is, and install linux or freeBSD to mitigate that somewhat, and then they might get out of school and go get a job securing corporate networks with all the knowledge they've gained.

Kids will be kids. If computer security was a real priority for operating system vendors, Joe Random 14 year old would need a lot more than something as general purpose as BO2K to start trouble. He'd need... uh... a car, say, or some bleach and ammonia, or a lot of beer.

yoshi asks:
What should application and OS designers do to build systems which are more secure?

cDc answers:

Reid Fleming answers:
For starters, they should spend more time and energy on security than UI design, documentation, or product packaging.
--
Nighstalker answers:
Learn from the mistakes of the past and the solutions of today. It's not that hard to impliment security. It's just easier for lazy coders and indifferent beancounters to blow it off by saying that, "This is not something our customers are demanding in our product."
--
Dildog answers:
Proactive security measures. Encrypt everything. Eliminate HTTP and go right to HTTPS everywhere.
--
Tweety Fish answers:
Make security concerns and security audits an integral part of the development.

Alpha42 asks:
Okay.. Here's my question.. what ever happened to Obscure Images?! I haven't seen anything from him in AGES... Don't get me wrong, I thought BO was good and all, and I'm sure it's generated 99% of the PR lately.. but I miss the original cDc stuff.. the files! :) And Obscure?! OH man...

cDc answers:

Obscure Images answers:
Hey, I'm still here, and I am as active as I have ever been. I've never been gone, just acting back in the shadows. I do what I can to help plan and implement our projects. Most of it comes without the glory or press attention, but it has to be done for us to be successful. Over the past 10 years I've gone to school, gone out into the world, gotten married, and started to go a bit grey. Not related to my marriage, I assure you. There will be more files from me, it's just a matter of finishing them. Keep your eyes open, your mouths too.

As far as my poetry goes, I have an excuse. It was 10 years ago, I was a typical late teen with clinical depression and the idea that I could write poetry. I stand by my stories, but would rather see the poems fade away like my youth.

Oh yeah, you have seen me, everytime you see our Paramedia Cross logo.
--
Tweety Fish answers:
Near the end of the cold war, Obscure Images was captured by a splinter faction of the KGB, and forced to write polemics, in verse, in a futile attempt to turn the people of the former Soviet Union back on the true path to communism. He's back now, and doing fine, except for that twitch.

Effugas asks:
What tools, in your minds, would you consider the most useful but least acknowledged tool in your security analysis collection? When backed into a corner, unsure how to whip something into shape, what obscure and strange network(or even non-network!) utility popped into mind and either performed some amazing function you couldn't imagine coding yourself or gave you the necessary cluephone ringing (via source code peek) to pull it off yourself?

cDc answers:

DilDog answers:
lsof. Use it.

Anonymous Coward asks:
My question is simple:

When will you start to do productive things ?

Ok, here is some context for the question. I know about BO2K ; and saw miscellaneous software at cDc site.

But on the other hand, the cDc has existed much longer than Linux itself, the FreeBSD team, NetBSD, and for probably as long as the FSF itself. One one hand you have a wealth of software (for instance here or here), on the other hand, after 15 years, you have a handful of cracking tools, one Windows administration package, an unorganized set of information, and stickers + temporary tatoos for sale.

In particular, it is a total mystery why since all that time, you haven't done one of the following:

  • Review, summarize existing security systems, document and implement a robust security model. Unix model is total crap ; even Multics (design: 1963) was better (Multics achieved B2 security rating).
  • Audit publically a freely available Unix (today done by OpenBSD instead).
  • Write automatic assembly code analyzer to search for bugs (or at least for C). Commercial tools exist by now, and last time
  • I tried to see if a free one existed, all I could found on cDc site was a "Tao of Windows Buffer Overflow" (a re-hash of techniques found for instance in Morris' Internet Worm in 1988. See Spafford's excellent report, and the Worm's FAQ).
  • Lent a bunch of your machines, to hold contests such as "the best security model for Linux/BSD, running almost all possible services/servers, CGI, ...".
In this context, when will you stop selling temporary tatoos, and start real programming (other than BO2K)?

cDc answers:

Obscure Images answers:
While cDc does some programming, this is not the sole focus of our efforts. To compare us to the other groups you mention you have to realize that we have different goals, as well as methods. We don't feel obligated to do anything for anyone. Our work is directed by our desires and our goals, not the desires of the community. Everything we do is productive in our eyes. We like to think that we've done work every bit as important as any of the above groups. It's all a matter of perspective. We have no problem with the people who have given their time and energy to these other projects, but we are not like them. We do things when we want to, in the way that we want to.
--
Reid Fleming answers:
Temporary tattoos are a CRITICAL ELEMENT of our security strategy. To suggest otherwise is sheer lunacy.
--
G. Ratte' answers:
Wow. I don't know when I'm going to be productive. Mom wants grandkids, too. Why should we do those things? Maybe we will, maybe we won't. Why don't you? We do other things. As far as "lend a bunch of your machines to hold contests..." that's funny, what bunch of machines? None of us are wealthy. You looked at our site and blew it off as a "handful of cracking tools & an unorganized bunch of information." That's the first electronic magazine ever, starting in 1984. It was a big deal to me when I was fourteen and bored in a small town, and I was doing something new and exciting and fun. I don't necessarily want to satisfy your weird little computer fetishes. I've got a dog and a cat and a screwy relationship and my picture in SPIN and no job and I'm busy.

Too busy for you.

To quote from cDc #300:

THE POINT
by Bryan O'Sullivan
you could spend an hour counting the petals in a flower
it might take you a year to count the veins in each petal
if you spent ten lifetimes, maybe you could count its cells

but you'd have completely missed the point
you fuckhead

--
Nighstalker answers:
And this comes back to my first answer. cDc is NOT ABOUT PROGRAMMING!

Programming and computers are only a means to an end. --
Tequila Willy answers:

Dear Anonymous Coward,

Your question seems very serious and as such seems to be counter productive. The Cult of the Dead Cow exemplifies the very attitude that ought to be cultivated considering the absurd nature of existence. Take a moment to contemplate your death and your own concerns about what counts as productive behavior may shift. You may think to yourself, "I am merely a mortal who will die, but I must live responsibility for the sake of those who will survive me." But of course your friends and family will die and there will come a time when no one alive will even have a memory of your existence. And if that weren't enough, at some point our own Sun will supernova, and when this occurs, human life on earth will be destroyed. At that point, human beings will not even exist to contemplate the fates of those like yourself who died long ago. From this perspective, all human actions seem to take on an equal importance: our concerns are absurd! To live freely and responsibility, a mature human being must realize this point. Having fun, living and loving well, being playful (and hence flexible in your living): these actions take on much greater importance than behaving in a serious (and hence rigid) manner. Your question is foolish because it is not asked with a foolish spirit.
--
Tweety Fish answers:
Read our files. Read our press releases. It's all about style, jackass. Incidentally, the first of your suggestions is a primary goal of the OpenBSD project, like you said. The second suggestion is a fine idea, why don't you do it? (re: spafford's paper and the internet worm, the internet worm didn't run on win32, now, did it?). As for the third suggestion, gee, that's a great idea. Why don't we kick down a couple hundred thousand for a semi-trailer we can turn into the cDc hackmobile, and load it up with all these high-end systems we have sitting around, and hire somebody to drive it around the country so people can mess with it for free!

We do what we're interested in, what's fun, and what's within our resources, plain and simple. And we try to keep it funny.

Descriptions of who these people are are at http://www.cultdeadcow.com/members/.

This discussion has been archived. No new comments can be posted.

Bizzare Answers from Cult of the Dead Cow

Comments Filter:
  • by jelwell ( 2152 ) on Friday October 22, 1999 @08:00AM (#1594033)
    Using Dennis Chao's work as a base I implemented an interface for the Linux Back Orifice client in Doom! Now you too can Play Doom while you Blow up Windows Machines!
    http://www.geocities.com/doomhack/ [geocities.com]
    Joe.
  • Some people love 'em. Some people hate 'em. I congratulate them on doing a job no software firm wants to admit even exists: finding serious flaws in seriously flawed products.


    ---
  • We do what we're interested in, what's fun, and what's within our resources, plain and simple. And we try to keep it funny.

    Well said!! It was this kinda attitude that got me into the Internet long ago and it's this kinda attitude that the web needs more of.

    Reading this article made me realise how much things have changed in the last 5 years. On the one hand I'm making money creating coroprate sites - on the other hand I miss the days when every time you turned your head, you found another FTP repository of bizarre text files ranging from Blue Box plans to ideas for wolrd domination.

    (Whatever happened to the idea of paving the earth anyway??)

  • This article gives us one more reason to "b0w to the c0w". I'm impressed. Thank you, cDc-ers and thank you Slashdot.

  • "When will you start to do productive things ? "

    I find it amuzing when people say "it wasn't really productive". Productivity is objective. I can sit all day and not "accomplish" anything physical, yet in my mind I have sorted out many things. Sure, people would say I'm lazy and using excuses. But I'm not.

    The cDc has been "productive" as long as I have known of their existance. Whether playing practical jokes or coding BO or other hacks. They have contributed, at the very MINIMUM, fear to the software society. Enough fear to make SOME software vendors actually test their products before shipping. Aside from that, I could go on for hours on what they have done "productively", but that wouldn't be very productive now would it? *grin*


    SL33ZE, MCSD
    em: joedipshit@hotmail.com
  • by Signal 11 ( 7608 )
    Absolutely amazing - most of this article was contradicting itself. For example - they denied that they were script kiddies and such, and then went on to say they didn't "consider programming to be the focus" of their group. Well, which is it? For a closely knit group, you guys sure have alot of conflicting answers. (yes I'm aware that I only included one example - this is for brevity)

    Also - after reading this article I have no sympathy for cDc getting the shaft by several anti-virus makers - when your image includes swear words and thinly-veiled slams on serious questions about your group - it's very difficult to take you guys seriously.

    --

  • by Anonymous Coward

    Second:

    Personally, I refer to people by whatever term they would like me to use, unless I don't like them.

    This is Politically Correct Liberal fascism! TRUE FREEDOM means accepting one's invariable obligation to be as rude as humanly possible to everybody at all times, except to like, uh, you know . . . white guys and Christians. And rich people. Rich people especially. Except Oprah, 'cause she's a chick and she's black so it's okay to be rude to her even though she earns more in a week than you'll earn in your life. If you're rude to xians, white guys, and rich people other than Oprah, you're viciously persecuting an oppressed minority. If, on the other hand, you're polite to "minorities" and chicks, then you are ALSO viciously persecuting that same oppressed minority (white/xian/rich-but-not-Oprah) all over again! Terrible, isn't it?


    Contempt for simple decency and good manners is a sign of a dying culture. Period. Kudos to this cDc guy for grasping some faint shadow (at the very least) of that fact.


  • Now, truly, the open source community has reached its pinnacle. :)

    Seriously though, I think that programs such as these that allow users to visualize more complicated computer concepts in a simpler form are truly a great idea.

    You wouldn't have to train anyone to use a word processor if the word processor could be abstracted to the (virtual) user picking up a pen and paper and starting to write. Drawing a line under your text is much more intuitive than highlighting the text and clicking Format . . . Underline.

    Similarly, if you want a bigger font, just write bigger.

    JohnnyO
  • when your image includes swear words and thinly-veiled slams on serious questions about your group - it's very difficult to take you guys seriously.

    judging from their responses i really doubt they're going to loose a lot of sleep because you don't take them seriously.

    you appear to have missed the point entirely. they don't want you to take them seriously. its all a joke except when its not, if you can't figure out when its not then that's your problem.

  • ...i guess i am just a looser who digs programming and farting around and such with hardware and code...The things like cDc, Phrack, and PLA feed my soul. Their fresh, truly cynnical and brash way of answering questions and writing about items of interest really click with the way I view myself and others like me. Ya know, finding people who like hacking computers and stuff is so fskin hard that seeing people like me--except for way much cooler--get in the limelite is just cool. enough said...
  • Reading this article made me realise how much things have changed in the last 5 years. On the one hand I'm making money creating coroprate sites - on the other hand I miss the days when every time you turned your head, you found another FTP repository of bizarre text files ranging from Blue Box plans to ideas for wolrd domination.

    Aye. In maah deh, y'cud phown t'gels on chatlahn, crack t'lettest version of 'pache and still 'av tahm for a kebab on way home.

    moo! [instinct.org]

    --

  • From the interview...

    NT - Shit wouldn't happen if you'd just spend a few months performing 300+ modifications to our default installation, you lazy sysadmin. Get your MCSE.

    Which is completely unlike the statement "Shit wouldn't happen if you'd just gone to Red Hat's ftp site to download the latest patches, trolled the newstgroups to find the appropriate HowTos, read BugTraq for three weeks prior to installation, been running the correct firewall, never opened any ports other than 80, never installed anything that had a 'd' at the end, and had Linus Torvalds personally supervising the installation. You stupid BillG-loving Windoze Luzer."

    I would like to know how cDc can make blanket statments about WinNT5/"2000" security? Security issues are the primary reason OS's get delayed from ship at Microsoft. Are they basing this statement upon how difficult it was to crack RC2, which is a beta? I'm assuming they at least have used win2k...

    -konstant
  • "The Horrors of Ivan"

    Coming soon, to FOX TV!



  • by RyanP ( 8861 )
    After meeting bits of cDc at DefCon 7
    (Us: Hey G. Ratte, we heard BO2k is going to be open source...
    G.Ratte: Open Sores! Ahhhhhh! {runs out of room yelling})
    and seeing the BO2k presentation, I must say that you guys are crazy. Yup, crazy-pants. But BO2k is an extrodinary sys admin tool (tunneling throgh ssh makes me weep with joy) and the T-files are...interesting. Keep up the good work!
  • Anyone know where he was?
  • I'm not really sure that the cDc is interested in being taken "seriously". I think that's the whole point. Lighten up.
  • by bgarrett ( 6193 ) <garrett@memes i s . org> on Friday October 22, 1999 @08:24AM (#1594051) Homepage
    I don't see that as a contradiction. "Script kiddie" and "programmer" are not opposites -- the kiddiez are the ones who don't want to UNDERSTAND, not those who don't want to PROGRAM. There is a distinction, believe it or not.

    And as for taking them seriously, the idea that swear words and slams will somehow cancel out the talent and effort that the cDc has demonstrated is laughable. They're not going in for a job interview. They aren't modelling this year's fashionable clothes. They don't need presentability because they aren't trying to pass themselves off as anything but a bunch of guys having fun being elite.
  • the difference is that redhat shipped a reasonable secure operating system, then posted patches as updates became avaliable.

    nt ships in a configuration the needs roughly 300 modifications before you can start to consider it "secure".

  • by pen ( 7191 )
    For a closely knit group, you guys sure have alot of conflicting answers.


    Yeah, especially for that underwear question... what's up with that?

    --

  • hehe Seems to me like the cDc are having fun as Anonymous Cowards...
  • hehe Seems to me that the cDc are having fun on this thread as Anonymous Cowards... Maybe trying to break the moderation system? ;)
  • Also - after reading this article I have no sympathy for cDc getting the shaft by several anti-virus makers - when your image includes swear words and thinly-veiled slams on serious questions about your group - it's very difficult to take you guys seriously.



    Then you MISSED THE POINT!! They don't want to be taken seriously! They are doing what they are interested in and DON'T GIVE A SHIT about you or your opinion. Just because they don't consider programming to be the focus of the group doesn't make them skript kiddies. Programming isn't the main focus of my work either, does that make me a script kiddie? NO! It makes me a fucking Tech Guru. Just because someone isn't a programmer doesn't mean they can't program or should be considered a script kiddie. The CDC developed a useful tool and gave it away. That was just a side affect of their normal lunatic activities, which is exactly the way they like it. Don't blame them for not being 'Suits' just because you think they should be all stodgy and corporate.

    Kintanon
  • Could someone please clarify something about BO2k for me? In the interview with reference to Back Orifice, they state:

    A hell of a lot of people should be upset their computers are wide open.

    Now, as I understand it, Back Orifice will not run unless the victim (excuse me, "remote client") voluntarily installs it or is tricked into doing so. cDc also repeatedly emphasizes that BO2k can be used as a legitimate administration tool.

    Are cDc suggesting that if I can write a remote administration program for an operating system, then that system is "wide open"? On what system is this impossible? If there is such a system, isn't that a failing of the OS rather than a security plus?

    I know very little about cracking, but it seems to me the only security compromise in the BO2k scenario is social engineering. "Click on this c00l zip file, dude!"

    Where's the security flaw? The fact that, once I have user permissions, I can do bad stuff? I thought... well isn't that obvious???

    -konstant
  • by aheitner ( 3273 ) on Friday October 22, 1999 @08:36AM (#1594059)
    Win2k crashes on my friend's machine when you exit Unreal Tournament.

    Oh, and the RedHat update thing? (the RedHat 6 boxes we code on have been up since the beginning of the semester).

    More like, "You go to RedHat's website, download everything in errata (1 command on any decent ftp client, try lftp), and upgrade everything you have installed (also 1 command).

    If you do read BugTraq, you'd know that both RedHat and MS have a pretty decent record for acknowledging security holes quickly. The difference is that MS recommends a cheesy workaround and says "wait for the next Service Pack" (which break things more often than not; ZD's Tips for NT Admins include not applying Service Packs unless you know you need them, which is sad). RedHat meanwhile posts the URLs for updated packages in their messages.

    You are of course free to run whichever you feel is easier to maintain in a secure state.
  • BO and the 2k is a series of abilities already present in windows software. -just made so ANYONE can use it. Not just microsnot. The point is that Microsnot puts it in the system in the first place, and nobody knows or cares. BTW, Ive known and hung with these guys in the past, they are right. Dont read the fine print, look at the big picture of what they are trying to tell everyone, and act on it.
  • If you do read BugTraq, you'd know that both RedHat and MS have a pretty decent record for acknowledging security holes quickly. The difference is that MS recommends a cheesy workaround and says "wait for the next Service Pack" (which break things more often than not; ZD's Tips for NT Admins include not applying Service Packs unless you know you need them, which is sad). RedHat meanwhile posts the URLs for updated packages in their messages.

    Right now I am browsing Microsoft's "Security Update" website with a new install of Win98:

    http://windowsupdate.microsoft.com [microsoft.com]

    I count eleven security patches that are not placed in SR's. Now I am browsing Microsoft's Office Update website:

    http://officeupdate.com/ [officeupdate.com]

    The first four links are for security patches that are not in an SP.

    I do not believe you are stating a fact.


    -konstant
  • I'll be honest, I enjoyed this Q&A session. I like the cDc boys - Can't say I've ever had more fun than sitting in front of my computer on the school's network (back in HS) and ticking everyone off - I especially love opening/closing the cd-rom multiple times. Even better, say you have a game of quake2 going and there are no more spaces for you. In comes bo to save the day!

    Anyway, I applaud cDc for doing something creative with their time and being open enough to share it with /.
  • Also - after reading this article I have no sympathy for cDc getting the shaft by several anti-virus makers - when your image includes swear words and thinly-veiled slams on serious questions about your group - it's very difficult to take you guys seriously.

    No, the cDc should be applauded for being intelligent and competent without trying to be conformist or "serious" in the eyes of management, bankers and other hellspawn. Any idiot PHB can clean up his act and his language, and because of that the rest of the world are hostages to these ridiculous customs. Fuck em.

    -
    /. is like a steer's horns, a point here, a point there and a lot of bull in between.
  • Can someone more clueful than I please define/describe lsof?
  • BO and the 2k is a series of abilities already present in windows software. -just made so ANYONE can use it. Not just microsnot. The point is that Microsnot puts it in the system in the first place, and nobody knows or cares. BTW, Ive known and hung with these guys in the past, they are right. Dont read the fine print, look at the big picture of what they are trying to tell everyone, and act on it.

    Since you've hung out with them, maybe you have an insight I dont. However, Microsoft does release software tools that administer Windows remotely, under the name Microsoft SMS (System Management Server). Their website is:

    http://www.microsoft.com/smsmg mt/default.asp?RLD=263 [microsoft.com]

    I do not believe you are stating a fact.
    -konstant
  • by Anonymous Coward
    Where's the security flaw? The fact that, once I have user permissions, I can do bad stuff? I thought... well isn't that obvious???

    Mmm, yeah, that is the problem. Let's say you're on a UNIX box as a "normal user." Try to trash the system or load something like BO that allows others to remotely mess with your system. Pretty hard without root access, isn't it?.

    Now get on a Winbox as a "normal user" and try to trash the system or install something like BO that allows others to remotely mess with your system. Pretty easy, isn't it?

    Of course, all the Windoze weenies will respond with "Well, duh, if you have root on a UNIX box you can do anything you want! It's no better than Windows you loser!" To which my response is, "Yeah, if you have root. Isn't that what I said?"

    The next response is then "Well you CAN secure NT!" to which my response is "Yeah, maybe, but you can't secure 95/98 and how many more people use that compared to NT? Maybe you don't care, but it bugs me that my parents dial into the 'net with their horribly insecure little Win95 box; not that they have anything urgently secret to hide, but I do believe they have the right to a certain amount of privacy that Win95 just doesn't give them if someone just felt like cracking their box out of sheer boredom or just for fun. And sure you can sort of secure NT but the differences between UNIX and NT security is that UNIX systems make the assumption that only root can do anything and you have to try hard to break that; NT comes with the assumption that anyone can do anything and you have to work hard to fix that."

    Ok, enough ranting...
  • by Enoch Root ( 57473 ) on Friday October 22, 1999 @08:50AM (#1594069)
    Sig, you're being uptight about this. How does saying that their focus is not programming imply that they're script kiddies?

    As far as I know, the cDc members are great programmers. BO2K is clever code. No script kiddie could come up with this. However, script kiddies use it aplenty (see their comments.)

    Additionally, I don't think that having conflicting views goes against a group's unity. If anything, they seem to work well with diverse opinions. Isn't that exactly what the Open Source movement is, as a whole? You can't get two coders to agree on anything out there (e.g. KDE vs. Gnome, BSD vs. Linux), yet we still seem to work as a cohesive whole when the movement comes under fire.

    Finally, I think anyone judging a product by the images or words it includes - as a deliberate slam, no less - deserves to miss the point. They claimed BO2K was a statement from the beginning, and it actually makes sense. Did you notice how much Microsoft security is coming under fire lately? I'm starting to get pro-Linux jokes from non-hacker friends in the mail. I don't think they've ever seen a Linux login prompt, much less know what ls does. But still, they're being critical of commercial products because of the sheer amount of macro-viruses and other crap that's been out.

    I take the cDc guys seriously for one big reason: BO2K. They proved a point, however juvenile you think they are.

    "There is no surer way to ruin a good discussion than to contaminate it with the facts."

  • But the big difference--and this just goes to show you're completely lacking that Golden Clue--is that if a problem pops up with a Unix system (fuck redhat and fuck rpms, too) we can actually fix the goddamn thing ourselves.

    I don't believe I said anywhere that Microsoft was better than Linux did I? I didn't mean to imply that.

    Do you really personally fix the source code yourself when your Linux box gets hacked? You have a lot more skill than I do. I wouldn't know where to start.

    -konstant
  • Whether you believe it or not is irrelivant. The SMS is the same type of thing, but with a name and price. If you've ever back-engineered the operating systems, you would know what is there. -Not only that, but you probably would hold a different opinion of those guys at MS.
  • You've completely missed the point fuckhead. I am sure Microshaft is willing to make things a bit more secure to suck down that fat $100 bill from your wallet. Al least with linux/BSD/Unix, you can fix it right... FOR FREE. You sir obviously have more money than brains.

    I have very little money.

    Microsoft releases SR, SPs, and even the entire "Second Editon" of Win98 (sort of a glorified SP) for free. Microsoft does not require that you pay for security fixes. If you are having trouble finding those patches, they can be located at:

    http://windowsupdate.microsoft.com [microsoft.com]

    or, if your security issue is in Office, from:

    http://officeupdate.com [officeupdate.com]

    I do not believe you are stating a fact.

    -konstant
  • by Ledge Kindred ( 82988 ) on Friday October 22, 1999 @08:56AM (#1594074)
    lsof - 'LS' Open Files. Shows you what files are opened by what processes on a UNIX box. Great for finding out why you can't unmount that partition because some zombie still has a file handle, who's trying to read /etc/passwd, why the hell you can't open /etc/passwd in (rw) mode because someone else has it locked, etc, etc...

    Find here: ftp://vic.cc.purdue.edu/pub/tools/unix /lsof/ [purdue.edu]


    -=-=-=-=-

  • lsof - LiSt Open File Handles....
    sort of an ls that gives you a listing of open filehandles, instead of a directory/file listing...
  • Now get on a Winbox as a "normal user" and try to trash the system or install something like BO that allows others to remotely mess with your system. Pretty easy, isn't it?

    Ok, that makes sense. Once you get into the Windows box by having the victim install back orifice, you can trash the machine. However, I was under the impression that these problems were well understood before BackOrifice came along.

    What I was wondering was what makes BackOrifice itself revolutionary? What does BackOrifice expose that we didn't already know?

    Or is it just supposed to be a toolkit, something like root kits in Linux?

    -konstant
  • by Enoch Root ( 57473 ) on Friday October 22, 1999 @09:00AM (#1594078)
    Well, that was a very nice interview. I've read on the cDc before, but this was the first time we could perceive directly their opinion of Slashdot and the people on it, and how we as a group fit in the whole of the hacker community out there.

    For once, we seem to be the self-conscious hackers, the ones who want a proper media image and good public relations, and wish our movement would receive more public recognition. This is exemplified in the hacker/cracker debate that will rage on on Slashdot for years to come, I think.

    The cDc are techno-anarchists with a slant for educating the masses despite themselves. I believe them when they say they release Trojans in order to raise awareness. I also believe it's working, to a degree, and that the sacrifice to pay for that is that the hacker image as a whole suffers.

    I get the feeling our positions are at odds with one another. We both dwell in the "digital underground" (sounded like a buzzword to me, but hey, the cDc guys used it). We both want to "educate" the masses and show them that consumerism is not the best technological solution.

    However, the cDc does so at the cost of their image, and we do it at the cost of efficiency. However, I think that the hacker world needs both kinds: inflamatory anarchists who take nothing seriously, and ethical workers who communicate with the world.

    They're right on one thing, though: a cracker is something you eat with cheese on top.

    "There is no surer way to ruin a good discussion than to contaminate it with the facts."

  • Yeah I also love the way they "proove" NT sucks by installing BO server on a NT system. As if you couldn't do the same thing with a linux trojan? Security is 25% patches, 75% brainwork. Don't install software from untrusted sources, that's the #1 rule of safe computing. Of course hordes of Linux kiddies will run forward and scream "We're smarter then NT kiddies, so we wouldn't do something this dumb"
  • I didn't see them say Linux was the end-all be-all for everyone; they stated several times that they were aware that this is a primarily Linux crowd. Go look at FTP installs of OpenBSD and then get back to us.
  • Reading these guys' statements, I couldn't help but think of something I read last winter, Hugo's Les Miserables. They fit so well with the group of revolutionaries from that, with the varying viewpoints and personalities all united in a weird way towards a common purpose of changing the world to a better place. I just hope the cDc fares better than Hugo's revolutionaries did.

    That said, this was definitely a good interview. Lots of interesting stuff from a well known yet secretive group. Those of us who've come a bit late to the world of hacking can do very well to learn from the various different ideals of all the different communities out there. Thanks.
    -Mike
  • Respectfully, I think I can reply to this.

    Contempt for simple decency and good manners is a sign of a dying culture. Period.

    Speaking as an Anthropology minor. In general, cultures don't "die out." They change maybe, or get assimilated by another culture. And maybe a culture will get wiped off the face of this planet by some grand catastrophy. But they don't generally "rot from within," as some people put it.

    In other words, common decency and morals are completely relative. There is no universal standard. I'd bother to illustrate this, but most Anthropology text books do very well, so you might want to just look up cultural relativism. It's very interesting, insightful, and admittedly has some of it's own pitfalls.

    On the other hand, AC raises some good points about the various catch 22s that exist in the U.S.'s current cultural climate. But his reactionism simply reduces his words to flame bate. He uses terms, such as "Politically Correct Liberal fascism," that are only really meaningful if you come from the same subculture as he does. Let's ignore those, and translate:

    Because certain groups of people, called "minorities," are attempting to shrug off oppression, and other certain groups of people have given them a voice (academics, media, polititians, activists), we have something called "Political Correctness." The problem is that no one can quite agree on what is "Politically Correct." This is because each individual in any said "minority" has had a different experience. This is probably because our country is so incredibly big. In any case, this breeds conflicting messages, and these conflicts are extremely frustrating.

    This, I think, is quite true. But it will work itself out, somehow.

  • Was there a reason you called him a fuckhead?
    Or are you just doing your best to be a moronic jackass hiding behind the AC curtain?
  • After Lopht released it's notorious Lopht Crack program, I had hoped to see better things coming out of Redmond this time. Having talked with Muhamed Kadeeb, a Senior Developer on the Windows 2000 project, I think I have come to the conclusion that they can delay Win 2K as long as they want, and it still won't mean a damn. The basic security structure of Windows NT BEGS to be hacked and with these MCSE wielding "sysadmins" that think that having a piece of paper means something, just clicking the 'Next' button on an Install Shield script without thinking about what's going on, installing all sorts of shit on their servers, programs like BO will always find a home.

    Also, I think that a serious look should be taken from a different perspective in the OS war. Lets think about the people that are admins on an NT run network vs. people that are admins on Linux run networks. Now I don't think I'm being to stereotypical here when I say that Linux admins are going to be FAR more likely to actually go through the steps necessary to secure that box than an NT admin. We are talking about the difference between a hacker (in the code hacker sense) versus an MCSE peon. Both systems need work to secure. Granted Linux systems are going to be secured tighter thanks to a host of reasons that I won't go into here, but there's always work to be done to get a network running well.

    It's not always about the program. Remember there's always a person behind that computer and a lot of this depends more on them than the program.


    Dissenter
  • by Anonymous Coward
    What I was wondering was what makes BackOrifice itself revolutionary? What does BackOrifice expose that we didn't already know?

    Does it expose anything new? Yes and no. Re-read the message you responded to. cDc wants BO and BO2k to make more obvious the fact that normal users can trash a Windows box because of the broken Windows "security model."

    You keep pointing out that you have to get BO/BO2k onto the machine before you can take advantage of it. How many exploits have we seen in the last 6 months that give you the opportunity to execute random code from IE or Outlook? Lots. What's worse is that if you take advantage of these exploits, you can take advantage of them if the user you're busting is a normal user with no administrative priviledges once again because of Windows broken so-called "security model."

    And this is all completely overlooking all the standard windows API calls that BO/BO2k use to do things like "retrieve all cached passwords from the system as unencrypted strings."

    I'm not trying to be insulting here, but are you purposely being dense or do you truly not get it? Try reading the cDc's BO/Bo2k site - they almost certainly explain it better than anyone here would be able to.
  • After reading some of the cDc answers, I am supprised that they were posted. I know that we were warned, but I see the intellgence and wit of a A.C. post.
    Had this been posted at any other time, it would have been moderated so far down that nobody would have been anoyed by the answers. I am not looking for censorship or even decency, just that slashdot stay consistent.
  • "$.78 or I piss on your flowers!" etc., etc.
  • 'There is a difference between mere cleverness and true insight.'

    -- Jaco Pastorius, musician

  • Logic would dictate that if this were a consistent censorship area, like you would like, then you would miss information. If truth needs a place to be unleashed among fantasy or lack of understanding of the truth, then consistency is irrelevant. What matters is truth, no matter what form. (or if it gets a 1 on moderation) :)
  • That is the most hysterical thing I have seen in a long, long time.

    Props to you.
  • What the fuck do you want MS to do?

    How about coming through on their promises to build a robust, stable operating system that won't crash because of errant applications. Oh, my bad...they can't.
  • Thank you! (damn. I thought it was just me.)
  • My post addressed their wanting to be taken seriously by the industry (ie: releasing a useful software product for administrators) instead of a bunch of l335 d00dz (ie: releasing a trojan horse to take over remote systems). In this case, image is everything. Shades of grey, my friend.

    I didn't say I agreed with it. I didn't say I like how the system works. But I have no sympathy for people that understand it yet ignore it, and then whine about how nobody takes them seriously. In the media, not only is image everything, it is the only thing. Why do you think linux isn't making as much progress in corporations as it should? Image - it's young and immature. It has nothing to do with the technical merits. Witness again a young CEO being denied entrance to comdex... the "image" that most people have about the under-18 crowd is why that happened.

    --

  • Do you really think those guys would worry about posting as themselves? Get real dude.
  • by technos ( 73414 ) on Friday October 22, 1999 @09:27AM (#1594096) Homepage Journal

    I normally don't expect references to Richard Dawkins out of a hack group.. However, I believe that EVERYONE should sit down with a copy of 'The Blind Watchmaker' once. I've forced it onto most of my friends over the years, and have yet to hear a complaint. Insightful and about as gripping as any book on the sciences can be. Full of well-honed arguments and real-world cases to illustrate them. You'll want to read 'The Selfish Gene', too. They're both in paperback and still in print, so snag a copy off Barnes & Noble.
    (I advocate the boycott of Amazon.com, and will until they stop all this obvious patent sillyness)
  • WHAT? Um, dude, what are you smoking? That's one of the weirdest tangents I've ever seen.

    Do us all a favor and wake up on the OTHER side of the bed tomorrow morning.

  • I'm almost finished reading it as well, loved the reference.

    The ESS can be applied beyond genes, though. Wasn't it an economist who introduced it? Doesn't it figure into game theory?

    --
  • It is absolutely NOT free. They are asking $19.95 for it plus shipping.

    https://order4.microsoft.upgrade.com/scripts/sta rtwin98se1.asp?

  • Your question is foolish because it is not asked with a foolish spirit.

    *laugh* i like that line!

    some people take themselves far too seriously.
    but then again, i suppose different things have different measure of importance to different people.
  • Small vocabularies? Are there any special words you would like to see in play? Let us know, we'll try to work them in somewhere.

    We're all grown up, and what we do DOES have a higher purpose, but as far as masturbation goes, I'm analogue. Then again I suppose it could be digital, since I'm using digits. Think about that.

    I may have a small vocabulary, but I can spell masturbation.
  • Sig, you're being uptight about this. How does saying that their focus is not programming imply that they're script kiddies?

    I want to know what their focus is if it isn't programming. So far the only answer that I've seen is "we do whatever the fsck we want, and worry about the explanation later". That's the message I get. Go to a site like securityfocus.com - then look at cDc's site. Both of them are in the same "business" - computer security. Yet one gets the addition and respect of a corporation, and the other is rejected as a bunch of ranting teenagers. Gee, how could this be? I don't think they're script kiddies - they have a solid understanding of how things work.. but there isn't a term to describe somebody that's between a programmer and where they are.

    And why does it take the release of a product that can covertly spy on a system everybody already knows is inherently insecure to make you take them seriously? I appreciate them giving MS a kick in the ass.. but I'm not going to take them seriously for doing that alone.

    Any idiot can get up on a soapbox and say he's bucking the system.. but it takes alot of dedication, research, and friendly professional-like conduct to get you taken seriously by the mainstream. cDc doesn't want to play the Mainstream Game.. so in an ironic twist - my parting words are: fuck 'em. Come back when you're willing to walk the walk and talk the talk.

    --

  • by Hard_Code ( 49548 ) on Friday October 22, 1999 @09:41AM (#1594106)
    Barnes and Nobles, after their recent purchase, is now BOTH the largest retailer AND the largest publisher in the US (I believe). They put many small book shops and publishers out of business every day. I don't feel sorry for them. On the other hand, Amazon.com is a CUSTOMER of these small bookshops. Order a book in Great Britain and it comes from the tiny bookshop down the street. That's money that goes into small businesses pockets. That's more choice, and a much more open system. Sure the Amazon "patent" might be silly, but I'm not going to cry for Barnes and Nobles.
  • Not that I'm so sober or anything, right now...
    But it seems to me that cDc must've missed something about /.

    • Random people ask random question, but this being a slashdot forum, the questions get a bias towards linux/un*x, to start with.
    • Some people then moderate the questions with a bigger bias towards linux/un*x.
    • cDc then answers the moderated questions...
    Where's the flaw? O.K. cDc may not have time to sample their own questions, being busy hacking/cracking/whatever... So my question is, redaing the questions that were answered, why haven't you sampled your own batch of questions?

    Was your intent pleasing the l*nux community? I don't think so reading your answers,,,, and it didn't look either like 'Your questions are so futile I laugh at them'

    I don't get it, but then again, I don't get muych when I'm pissed either... (pissed is british english for drunk...)

    Cheers,

    ---

  • thank you, i agree. -goin' all the way back to 52k ram in 1982.
  • I agree with your statement, when truth is censored, truth is lost. In this case, though, it isn't the truth that bothers me, it is the rest of the responses. If I walked up to you and told you what I heard somebody say about your mother, you would have wished that it had never been said, regarldess of stating a simple fact, this is what I heard.
    Censorship is a dangerous issue. Facts should not be censored. Peoples comments, maybe, depending on the relevance of what they say. Just because there is a nugget of truth in somebodies answer does not make it a proper statement to make.
    My problem is less with slashdot as it is with the cDc. I hope that they are more intelligent than what some of there comments leads one to beleive.
  • ahh the pleasures of courier...

    while yer at it mr taco, couldn't you set the bgcolor to "#000000" and the text to "#00ff00"?

    Seriously though, you can't underestimate the creativity it takes to look at a cga monitor and imagine world domination. (domination=hercules graphics adapter, baby!).

  • I still don't know much about cDc itself. Are your identities secret? Do lots of people know who you are or do you lead two lives or something like that?

    Has the cult grown much over time, or is it a group of core members that have been around since the begining?

    Do you see each other often, or at all? Or do you just communicate over the net using aliases?

    Are you guys geographically separated, or do you all live in one area? Where do you guys live? Is the cDc in the US?

    --
    grappler
  • And you are the type that makes the BOFH what he really is... a prick.

    Exactly, if you're going to be an idiot I'm going to be a prick. If you have some desire to learn more than how to call me to fix your problem I'll be much nicer.

    Kintanon
  • I can understand your perspective, however when a point is made with passion, several things occur. Either hands flail, or volume increases, or different words are used to express the passion behined the statement. I know these guys, and they have matched their vocabulary to fit the image and audience. The intellegent ones look at the facts. The adrenaline seekers see the passion. The chosen blind see nothing.
  • I want to know what their focus is if it isn't programming. [...]

    I don't think they're quite clear on this, either. The impression I get from cDc is that they're people who like to play with cool toys, and in that sense they're hackers in the oldest sense of the word.

    Is the focus of a hacker programming? Well, I don't think it is. I don't program for programming's sake, because then I'd be doing tons of totally useless stuff just because they're cool things to do. (Wait, I do tend to do this... Nevermind.) A hacker uses programming to enrich his understanding of computing, including security. What they say is that a program is a mean to an end, and not an end in itself. I can live with that fact.

    So, I guess the word to describe what they are is, quite simply, 'hacker'.

    And why does it take the release of a product that can covertly spy on a system everybody already knows is inherently insecure to make you take them seriously?

    Hmm? Everybody? Would that be every hacker, or every single computer user? People still think Hotmail is secure because it asks you for a password. They figure Win95 is secure because you can put a power-on password.

    What they've done is take an abstract concept, Windows is insecure, and proved it with a concrete example that made the world panic. What is more effective? Pointing out a security hole or exploiting it? Companies scoff when you point out they have open ports. But when a stupid script kiddie comes in and defaces their websites, they all go in a panic and upgrade their security.

    The cDc, though clever code, forced the corporate world to acknowledge Win95's security was non-existent. It takes good programming skills, and it takes guts. Two qualities I can admire in a hacker.

    Any idiot can get up on a soapbox and say he's bucking the system.. but it takes alot of dedication, research, and friendly professional-like conduct to get you taken seriously by the mainstream.

    They're taking the easiest path, but they're shaking up the computing world fastest than you could in years of dedication and putting on a suit and tie every morning. In a world of images and reputation, you can either, as you say, walk the walk, or decide to just run into everybody.

    I wouldn't do the things the cDc does, but perhaps for that they deserve my respect.

    "There is no surer way to ruin a good discussion than to contaminate it with the facts."

  • it's spelled masturbation. you fuckhead.
  • Oh! M-a-s-t-.....I get it! You spell it A-P-P-L-E!, dont you? :)
  • Absolute;y. They posted my question (which I made polite despite myself) and answered it in the most pretentious way. Who do these guys think they are? Revolutionaries my ass - there's nothing creative about what they do. the CDC is just a bunch of programmers who have a chip on their shoulder and think that they somehow have the right to crack. And before anyone jumps on me for saying that, I don't care if they say that they built BO[2K] to cure cancer: they're full of shit.

    BO[2K] are not administrative tools. Keep telling yourself that if you want, but they were built as cracker-toys. They're made to hide themselves so that "31337 |-|4x0Rs" could trick people into running them and then fuck with their those people's systems. The whole idea disgusts me.

    Windows has some shortcomings (heh) but there's no security hole that BO exploits. The fact is, Windows is a single-user OS. It's not built to have permissions and security like a UNIX machine does. So to hear these crackers saying that they're just bringing to light what MS is trying to hide is ridiculous. The average users doesn't want to deal with logging in and whether or not they have permissions for a file. It's a trade-off that most people are willing to make for the sake of simplicity.

    Oh forget this: The CDC can all go fuck themselves. They make me sick.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • You wouldn't have to train anyone to use a word processor if the word processor could be abstracted to the (virtual) user picking up a pen and paper and starting to write. Drawing a line under your text is much more intuitive than highlighting the text and clicking Format . . . Underline.

    You need to 'train' people to write with a pen already, although it usualy happens in elementary school. Anyway, if a person wanted the exsperiance of using a pen and paper, then they could just use a pen and paper...
    "Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
  • > cDc doesn't want to play the Mainstream Game.. so in an ironic twist - my parting words are: fuck 'em. Come back when you're willing to walk the walk and talk the talk.

    > I don't think they're script kiddies - they have a solid understanding of how things work

    so which talk, and which walk, are you talking about? They understand the tech side of things, so that's clearly not it ...

    I have a great deal of respect for anyone who can enjoy life, do what they want, and get by without playing the mainstream game. And I see very little reason why tech people, in particular, should give in to the mainstream game if they don't want to.

    I'm not into the things CDC is into; i'm one of those evil developers for whom security is a buzzword for nap time. But I think it's incredibly cool that they can stay who they want to be, do stuff that they love, and not be forced into a grey suit and a tie.
  • by DLG ( 14172 ) on Friday October 22, 1999 @10:35AM (#1594135)
    The thing that was clearest in this Q&A session was the overwhelming difference between the 80's hacker and the 90's netgeek. The days when hacking meant figuring out how shit works, and when the morality of it was based on information must be free without any real other goals or intents was never as clear as it seems. There were always kids who attacked other sites for no good reason but a desire to show their stuff, wave their dick, be assholes without being caught. The same vandals who would egg a passing bus might take down a bbs using 99e99 or p1tt...

    Hell, the notion that there were switches between me and the longdistance call was cool. The fact that you knew that somewhere there was a computer keeping track of billing was cool. The fact that you knew that it wasn't just magic was a big reason why hackers did what they did. To show that all the things that we take for granted are really exciting if you look at them, and the tricks you can do once you do that are amusing too!

    Still I can't forget red blue rainbow black white lemonscented boxes that were supposed to do any number of things if you just followed these instructions and had a soldering iron. Script kiddies of the past.

    What amuses me most in seeing this dialog is the sense that there is a productivity to programming something for someone else, that doesn't exist in the explaining the basis of such programs. cDc always was about the how it works and not how to do it. It was about giving you the manual, not selling you the source. OpenSource software is built on OpenSource knowledge of underlying systems. If we don't have the information we don't have the programs. To require a hacker to program for someone else is nonsense. The way you become a hacker is by having other hackers see you can do it yourself. Then they say, "He is a hacker" and you are. If you think you can become a hacker by doing it someone elses way, then you are silly. Original thought, exploration, lack of interest in authority, and a little bit of a desire to show off to people who might actually understand what you are talking about is what fueled the 'hacker' of the 80's.

    The geek of the 90's is a different animal, with pratical usage of opensource being a commercial reality, productivity being a primary force behind contribution to a movement, love for knowledge being a real secondary. How many of the people on this channel have actually read their source code cause they wanted to know how it was done? As much as most of ya'll want to feel good because you know how to code, you don't NEED to code most of the time because someone else has done it, or done something close to it before. Hell the art of Unix is to take 5 programs that other people wrote and pipe your data through em without writing a bit of code.

    Getting on cDc for being script kiddies is a joke. I am not even sure why we call them script kiddies. Using canned software is as old as the day. Yeah when I got my first modem I had to patch the thing through my game controler port to get dial tone detection, and wrote my first comm program in basic and assembler. When AE came into my hands, I never went back. Fact is that cDc may write tools that people who couldn't normally write, might find useful. Maybe cDc drops a few trojans into the mix... Maybe Microsoft gets burned on the ass because their marketers have whipped their techs in the internal battles so that nothing works right, but atleast it has the 'features'. cDc does what it does and doesn't apologize. The question of why they don't do more is very very well returned. Why don't you!

    DLG
  • Though I disagree with your conclusions, you do make a valid point. The more "accessible" Linux becomes, through easy install, package management, newbie-friendly GUIs, and so forth, the less knowledgable ("brain damaged" to use your colorful expression) the average Linux user will be. This does bring with it a whole host of potential issues on how to preserve and improve Linux's good reputation WRT security. OpenBSD has IMHO found the correct approach, by being proactive about security issues. There is no reason this is incompatable with a system of managed .rpm or .deb packages, but it does require improvements to the underlying default configurations which have not been made yet.

    We can fix it ourselves. The beauty of it is, when a security flaw is found, someone does fix it, and the fix propogates as tarballs, .rpms, and .debs for all their various distributions. We all benefit from a level of responsiveness and security which Microsoft will be lucky to achieve sometime late in the next millenium. By adopting the improvements of other products, like OpenBSD, we can keep them green with envy until the universe goes cold, implodes, or whatever ...
  • At some point you have to pick the lesser of the evils. In this case, only a HUGE book merchant is likely to stock such an obscure book, and of the two largest online merchants one has been engaging in shady patent shenanigans this week.
  • by Foogle ( 35117 ) on Friday October 22, 1999 @10:42AM (#1594141) Homepage
    How can you say that? What "serious flaw" does BO[2K] point out? It's doesn't - it's a legitimate administration tool. Yeah, right. All BO[2K] does is give a free tool to cracker kiddies that allows them to control someone else's machine once they've tricked them into installing it. And what's more, I hate the argument that software such as pcAnywhere and Carbon Copy already exists. Yeah, it does, but it doesn't hide itself from it's user, does it?

    BackOrifice is a clever program, but it's not creative -- it's destructive. And the people who wrote it, distribute it, and proclaim long and loud what a great "administration tool" it is should be treated like the scheming anarchists they are. They shouldn't be called revolutionaries or treated like heroes. It doesn't help the situation at all.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • Go to a site like securityfocus.com - then look at cDc's site. Both of them are in the same "business" - computer security.
    I think the point was that the cDc's "business" isn't computer security. It's cDc'ing, which is defined as "whatever the fsck the cDc feels like doing." /\/\00.
  • You really don't get it, do you?

    Under windows 95/98/NT any USER can install a trojan, making the entire system vulnerable to attack.

    Under Linux, BSD, and other systems which limits common user's rights and priveleges by default, the user can only damage that to which they have priveleges -- i.e. their own private home directory. Only root can cause systemwide harm, and the root account is restricted to a limited number of people (usually just one or two), and only used for specific system maintenance. Normal users are NEVER given root priveleges in a corporate environment. Even home users of Linux are guided through the process of creating a user account to use for everyday purposes, logging in as root only to do system maintenance (which is very rarely required, I might add).

    In other words, if Joe Slacker emails Jim Clueless a self installing copy of BO[2K], and Jim Clueless opens the email on his windows box and foolishly (or curiously) clicks on the attachment, the software installs itself and the box is now vulnerable. Whats worse, some default windows installations will run the software and allow it to install without even requiring Jim Clueless to click the attachment!

    On the other hand, if Jane Slacker emails Janice Clueless a self installing (no such thing at present) copy of LinuxTrojan, and Janice clicks on the attachment and installs the software, she can at most harm her own home directory. The rest of the system, to which she does not have write priveleges, is not vulnerable, nor are the other twenty users sharing it with her.

    This is just one example of how the windows security model is fundamentally broken, and it is unlikely that any number of kludges or quick fixes will be able to repare it in a reliable manner, short of scrapping the entire thing and building a more secure system from the bottom up (perhaps using BSD code as a starting point). If the example above doesn't make the difference clear, I suggest checking out the numerouse security related web pages and news groups for in-depth analysis and discussions relating to computer security in general and Unix vs. Windows security in particular.
  • I have a great deal of respect for anyone who can enjoy life, do what they want, and get by without playing the mainstream game. And I see very little reason why tech people, in particular, should give in to the mainstream game if they don't want to.

    I pride myself on being unconventional as well. But I don't portray, or try to portray, myself as a mainstream person. cDc seems to want to be taken seriously, yet they are unwilling to invest the necessary effort to do so. For this they will get no sympathy for me. Now, if they boldly came out and said "we're unconventional - the conventional way of doing things is fundamentally flawed and we're not going to use that methodology" I'd be more supportive. But they're asking mainstream media to accept them - something that is 180 opposite of the methodology they're using. Specifically if you wanna attract the suits, you gotta put a suit on. This is how it works out there. In our community, you're judged on how well you code/hack/do neat stuff with your machine. I cannot, and will not, say that this is a better system than what the mainstream uses... they all have their tradeoffs.

    Getting out into the Big Blue Room was alot like getting tossed into freezing cold water for me. It shattered alot of conceptions I had about how the world worked. One of them is that people in general are not judged on the basis of their contributions, but rather on deference to a higher authority. Suprise suprise... that's 180 opposite of this culture - where you are judged on the basis of your work, with (a kind of) "authority" being gained solely on that.

    --

  • by richnut ( 15117 )
    You really don't get it, do you?

    Under windows 95/98/NT any USER can install a trojan, making the entire system vulnerable to attack.


    Wait a second here. Have you ever actually used Windows NT? You know they do have this thing called an 'Administrator' account, quite analogous to root on a UNIX. When properly configured you can have as much control over a user as any UNIX. I know, I run NT at home (along side my Linux and NeXT boxen) and I've had plenty of instances where I could not install something because of the fact I was not Administrator. I mean I hate NT as much as the next guy (I only run it because windows is the only non-Mac OS I can use for my apps) but we dont need to make up lies and half-truths to talk about how crappy it is. There's plenty of real reasons for that.

    -Rich
  • There's also a number of security flaws that are neglected by Microsoft and are rolled into service packs, fixed in the interim only by manual and downright abysmal workarounds. (Like "uninstall it".) A couple examples:

    MS99-043: "Javascript Redirect" Vulnerability
    "Microsoft recommends that customers add sites that they trust to the Trusted Zone, and disable Active Scripting in the Internet Zone."

    MS99-025: IIS RDS Vulnerability
    "If you don't intentionally use the implicit remoting functionality in the DataFactory object, you should disable it. Please note that you can still use RDS to invoke Business Objects on the server, but an administrator must explicitly enable access to these object by inserting keys for them in the registry."

    Even important patches are declared by Microsoft to be "not fully regression tested" and not warranted along with the core Windows 98/NT binaries.

    On top of this, NT security administrators must wait for a single company to release a single binary-only patch at their whim. Security administrators cannot analyze or audit the code, and this shows, as Microsoft has made a habit of releasing patches to their previously released patches. Remember NT Service Pack 2?

    My $0.02...
  • Please, this is not intended as flame bait.

    It seems to me, that, overall, BO2K is both a Good Thing and a Bad Thing.

    A good thing, because it helps sys admins do their jobs in a much easier manner.

    A bad thing, because there are a lot of script kiddies out there causing clueless 80 year old grandparents problems, etc.

    IMO, the benefit of the good is outweighed by the harm of the bad. For every computer system that is made more secure through the use of BO2k, there are probably countless others that are penetrated and, in some way, harmed by delinquent teenagers. (I'm a teen still myself - I'm not getting down on my generation in any way - but it seems that younger teens are the main offensive group of BO2k users.)

    The use of BO, me thinks, could be oriented so that 3l33+3 h/\X0r d00dz would not have access to it. Possible work arounds could be a corporate membership though a form of sorts. It would deter a large amount of lamers, while still allowing those who use BO for corporate purposes.

    Granted, IMHO, the people at codc seem to truly be dedicated to anarchy, and are using this "security" front as a way as to not be decapitated through flames from security personel. It could be otherwise, but this is my take. I hope it is not so.

    Also, there is the fact that there are already thousands, if not millions, of copies of the BO software already distributed, which could easily be aquired from a friend or a warez site. (And possibly newer corporate versions, if this feature were integrated. There will definately be people that figure out work arounds. Just because they use BO, they aren't necessarily stupid crap lamers. I know several very good hackers that use BO simply because it's easier that other methods.)

    A mere .02 of one of my meekest pieces of US fabric/paper currency.

    -------
    CAIMLAS

  • That's such bull and you know it - Yes, MS does position Windows as an "Enterprise-class network operating system", but not Win98. How far would BO[2K] get on an NT workstation that was decently administered? About as far as they'd get on Linux, or any other OS with permissions. I'm no fan of MS, but I'm less of a fan of CDC, because at least MS isn't passing out cracker tools (And just stop there, because I don't really care if you think that any of MS's products are cracker tools unless you're serious, which you couldn't be).

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • Thank you.

    I wouldn't normally post an "I agree" comment, but since I'm the one being accused of having never used NT and not understanding it I will add the following comments:

    - I never implied there was no Administrator account, just that any user can make the system vulnerable. This is true (as Gangr33n pointed out), and the existence of the Adminsitrator account may obfuscate that unpleasant fact, but the fact remains nevertheless.

    - I have and do administer NT boxes at work (they are thankfully being phased out in favor of Linux) and am all too familiar with just how riddled with holes the entire security structure is. There are plenty of things non-Administrator users are capable of doing which they shouldn't be, and which must be manually disabled after each install. Even after wading through countless FAQs, MS web pages, service packs, etc. you can not even be reasonably confident you've gotten everything.

    - I used NT at home for video capture before dumping it in favor of Linux, and had more opportunity to become intimate with how crappy it is.

    In short, there is nothing untruthful, or half-untruthful, about anything I said, although I do agree there are plenty of reasons for hating NT that I didn't mention.
  • Posted by Synsthe:

    Okay, I'll have to start this with the obvious here: RedHat isn't Linux.

    It's merely a distribution. We all know this, it's been said how many times, yet everybody seems to forget it on occasion when it suits their debate.

    Why not compare Debian? ``apt-get upgrade''. Ouch, that was hard. Why not ftp into updates on redhat.com, grab all the rpms and rpm -Uvh *? That's probably too hard too.

    Anybody can make blanket statements; MS does it all the time about Linux. If you don't agree with it, that's fine - at least find some valid points to rebut it with though, or just revel in the knowledge that you know better, but do it quietly.


    --
  • Any linux user can run a daemon (as long as it uses a port above 1024) and that means anyone else can get in with that users privelages.
    So then the question to ask is - can a user with non-privilaged access running their own daemon do the same things that BO does?
  • Can you explain how slashdot is in the computer underground? I for one don't see it. In my mind, for something to be part of an 'underground' it is generally one or more of the following:

    - A self-funded grassroots type of thing
    - At least semi-obscure
    - Self-glorifying, but only in its own ranks
    - Happy with being underground

    Slashdot seems to me to be a 'webzine' that wants to make it big, be recognized by major media, and IPO. Well, I guess they're a third of the way there!

    And yes, it comes down to image, which Slashdot is more concerned about than content. Gee, if everyone is so concerned about cDc not putting out more tools, howcome Rob won't even release his changes to the Slash engine to people who want to use it?

    Open sores indeed.

    The reason that slashdot and cDc might be at odds is that cDc do what they do because they love it, without expectation of reward. Slashdot people do what they do because they think somehow they're going to get their name on the front page, and people will think they're cool, someone will see their code and give them a job, or they'll get a piece of the next redhat-type IPO.
  • I've had games crash Linux too so I'm not really sure what your point is. If you're running Unreal on your server then clearly you don't care very much about performence.
    Not to sound like a zealot or anything... but name the game that "crashed Linux" (as a bonus, what exactly do you mean by "crashed Linux").

    Netscape is pretty horrible. It crashes on a regular basis. Of course, when it goes down, only Netscape goes down.

    I've had Gnome do wierd things and even had it take out my X Windows sever. That mean all X apps go bye-bye. Of course, the OS was still intact... respawned the server and invited me to log back in.

    By far the worse I've had is trying to launch Quake once and it seemed to crash, leaving me with a mangled terminal. The OS was still intact. I could log into it remotely. Of course... I couldn't get to another virtual terminal or back to my X Windows session. I'm sure there was a way to fix this (someone please clue me in if you know). I had to reboot to clear it. Of course... having said that... the OS was actually still running along (a moot point since I couldn't do much with it - probably due to my ignorance).

    So there's my worse experiences. What's yours?

    As a side note - I use linux as a desktop OS for home and work. Very nicely. The odd thing is, I have also been known to use NT as a desktop OS too. "Linux" and "WinNT" don't always mean "server". 'Course... "Win9x" does usually mean "game machine". ;)

  • by Anonymous Coward on Friday October 22, 1999 @01:35PM (#1594209)
    See my friend, it's like this... Microsoft has decided that the common mass of chickenheads that use their software, should not have to be burdened by trivial things like passwords, or user id's. And Therefore they have gone to great lengths to "protect" said chickenheads from this burden. The Scenario: Let's say that Mr. Stew Pitt is doing some online banking, and Internet Explorer caches his userid (SSN) and password, so that Stew won't have to take the trouble to type it in again... Stew thinks "Hey Great! Less to remember! You gotta love that Microsoft..." -Meanwhile- An evil malicious script puppy known as Phil Mypockets is about to send Stew a Trojan that can decrypt the cache file where IE has just saved the login and password for Stew's online banking account. Stew hears the familiar "You've Got Mail!" and sees that there is a "software update" from a helpful "AOL Support Rep". Stew quickly clicks on the attachment... seconds later Phil Mypockets activates the Trojan that has just been unwittingly installed by Stew. -yata yata yata- Phil Mypockets clicks the "enumerate passwords" button on the "trojan-control-panel", unloads Stew Pitt's bank account, and retires in Bora Bora... The Problem: Stew is fucked... he doesn't suspect for a second, the true reality of what has happened... Neither the Bank nor Microsoft are interested in investigating (or publicizing) the possibility that Stew has been "hacked"... therefore, the problem continues... Phil Mypockets tells all his pals how "They Too Can Retire In Bora Bora" and more people get fucked... The Solution: cDc releases BO... they aren't quiet about it... in fact, it's a media circus. Mass hysteria quickly ensues. It's on the cover of every tech rag, it's on the news... Sam fucking Donaldson is doing a special on the Monday evening news entitled "Is the Internet Safe?"... Microsoft gets dogged... they have to respond... yata yata yata... things get done... slowly, things change. "Evolution Morpheus, evolution." The Difference: What most people don't seem to understand is that this shit is out there, happening, everyday. The cDc just publicizes it... that's what makes them the good guys. If they wanted to, they could sit there and code these tools, and then quietly use them to fuck people over. But they don't, and that's the difference. -kill-9
  • Yes they've written some interesting software. So have alot of other people.

    One of the cDc guys even said something to the effect of "no matter how good you are, there is always someone better out there". Maybe they should listen to themselves and drop the attitude.

    What about the claim that BO2K shows how "wide-open" your machine really is? Give me a break. That's like saying "Hey - your Linux machine is wide open because I can install a daemon on it if I am root".

    Whatever.

    These guys get way too much attention turned their way just because they can spout a few bad words and act like they are l33t. I tend to be more impressed with people who contribute software without caring who notices.

    SEAL
  • "What I was wondering was what makes BackOrifice itself revolutionary? What does BackOrifice expose that we didn't already know?"

    You're right on one point: BackOrifice didn't expose any problem that we didn't know about. The revolution came when theory became reality and users have to deal with second guessing everything they do, and Microsoft has to address the problem to the media who thrives off of reality rather than theory.

    Joe.

  • If it's from MS, the security is crap. everything else is better by comparison. Linux is pretty good if you're a Linux guru. Same thing with any other flavor of UNIX. But no matter how good you are, there's someone out there who is better than you.

    And you ignored the comments from the other members totally because... ? Did you miss the part from the same member about "Linux: If it breaks, you fix it", meaning that because all the source is available to you, when something is wrong you can get in there and fix it yourself. The kernel for Linux has an official release at least every few months that I see, while the NT kernel is upgraded, what, every couple of years? And you can upgrade parts of the OS, without having to have an insecure, slow browser as part of your OS. Because NT is closed source, you have to rely on Microsoft to provide the security patchs, and Microsoft is the one responsible for the gaping security holes in the first place. Admittedly, they are getting better, but half of the security updates I get for NT are related to IE having some stupid bug in, say, the Favorites which "malicious website operators can exploit" or some such. When was the last time your Linux box was compromised in any way from visiting a web page? (Other than some shitty javascript making Netscape go nuts and break, which it can do very well by itself with no java) That is what I call some very terrible security.

    I'm not saying Linux is perfect, far from it. But Linux has the benefit of possibly millions of trained monkeys that fix things in it because they love doing it. MS has a few thousand that fix things because they get told to fix things. IIS had a bug in the FTP code that would shut down HTTP if it recieved unrecognized commands, but the FTP would keep running. The solution was to install SP5, which fixed it. That was the only problem we had with a web server, and we had to install a 50 meg patch to fix it. Not very effecient. Because everyting is so tied together, the FTP daemon can shut down the HTTP daemon under NT. We were rebooting the server approx once an hour because of that bug. A commercial server that hosts over 400 websites, that MS wont provide tech support for anymore, because then only offer support if you host less than 150 websites on a server.

    /rant off

  • Be that as it may, it's not your place (and certainly not the CDC's place) to determine what liberties/securities I will or will not use.

    You're right - it is easier to not lock the doors on your car. You'd be a fool not to use key-based security on your car. I think anyone who uses a non-secure OS is being equally foolish. That said, it's definitely not my choice to make for someone else. Moreover, if you decided to use a push-button ignition, I would not take that as a green-light to break into your car. Doing so would be just as illegal as if you'd put an electric fence around it. Whether or not it's easy has nothing to do with it.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • Oh, so some of your friends in college were tricked into installing SMS through the use of buffer-overflows or trojan horses? No, I doubt that. If, in fact, they had it installed on their machines then either they installed it themselves or their admin did it for them. Either way, although it might have been against their wishes, it was knowingly and possibly just following rules. Face it: an admin has a definite place to ADMINISTRATE a PC. A cracker over a network does not. And furthermore, SMS's installation isn't stealthy. You know when it's being installed. Its an interactive (somewhat) setup. These arguments are just picking at straws -- they avoid the real issue: BO[2K] was built to crack systems without people knowing about it. That was not the purpose of Microsoft's remote-admin software, and in fact, Microsoft's system would be very ineffective for this purpose. And that's a pretty responsible thing for MS to do.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • That's a bunch of crap. Yes, computers are used to store valuable information, but anyone who's doing so shouldn't be using Win98. And anyone who does is a moron.

    If I'm running as root on my Linux machine and I get tricked into running a trojan horse, or an undetected buffer-overflow allows someone to get as trojan onto my machine, what then? Then that trojan can do JUST as much damage as if it was on the Win98 machine.

    So what would you suggest MS do about it? User awareness of the dangers of trojans is a great idea, but it's the only thing that helps to prevent them. I don't blame MS for allowing BO[2K] to crack people's machines, I blame people for being stupid enough to run stuff like "freepics.exe". The only solution would be to make Win98 a multi-user, permissioned operating system. I guarantee you that most users out there do not would choose to stick with what they've got, rather than go through the hassle of learning about read/write/execute/ownership. Even if they knew that it would help to prevent Trojan attacks.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • So by that reasoning, AIDS isn't a problem, people who get it are. And, following the same logic, a group of people that helped to infect the public with AIDS would be seen as heroes by you, since they raised awareness of the problem.

    That's a ridiculous analogy, right? Or is it? I agree with you; awareness of trojans needs to be raised. But not by helping to spread them. You're arguing that, by writing/distributing BO[2K], the CDC is helping to prevent trojan attacks. If you believe that then I've got a bridge to sell you.

    Look, the CDC has been around long enough for us to understand their MO. They like hacking systems. Moreover, they like helping other people hack systems. They didn't release BackOrifice to stop cracking. Yes, you can use BO2K as a serious admin tool, but that's not the issue for me. The issue for me is the motive behind the release, and the stupidity that anyone in their right mind would believe the hot-air that comes out of the CDC's mouths. They're crackers, plain and simple.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

Always leave room to add an explanation if it doesn't work out.

Working...