Hacker Boot Camp

abb_road writes "Business Week sent a reporter to TechTrain's ethical hacker training camp, where, for $4,300, participants spend five days working towards ICECC's 'Ethical Hacker Certification.' The camp serves companies' increasing needs for home-grown white hats, and covers topics ranging from the non-technical (social engineering and policy creation) to code-level attacks (buffer overflows and sql injections). The tuition seems a bit steep for materials that, as the article notes, are 'freely available over the web'--but where else can you play hacking capture the flag?"

4 Grand?

[hairykrishna]

4 grand for that? I wouldn't classify that as 'ethical'!

"Certification"??

[ktappe]

1. $4300 isn't chump change--someone is making a bundle on this.

2. Who out there is going to accredit this "certfication" to be sure it's worth more than the paper it's printed on?

3. Isn't one of the fundamental concepts of "hacking" to be anti-establishment? To break the rules and sock it to the man? Getting certified is about as establishment as you can get.

-Kurt

Re:::groan:: Please make this go away.

[utlemming]

How about the employability of having a cert saying your an ethical hacker? Depending on your level within a company, couldn't such a cert cause you employment problems? I am just thinking about the low network guy that gets the cert, and his boss firing him for security concerns.

Ethics in just 5 days?

[Pedrito]

Sorry, but people can't really learn ethics in a 5 day camp. Ethics begin at home and in early childhood. It comes from the people who raise you and the people you're around as you grow. A 5 day camp is going to have absolutely no impact on your ethics. By the time you're old enough to go to a hacker camp, your ethics (or lack thereof) are firmly established. 5 days of camp is simply going to give them some new skillz to use ethically or unethically.

that was my first thought

[JeanBaptiste]

how completely useless. if you want to be a hacker, you go learn how to be a hacker on your own, on the internets. if you have to go to a school for it, you probably weren't meant to hack into much of anything in the first place.

Ethical Hacker Certification...

[__aaclcg7560]

The new paper MSCE certification for the 21st century.

Re:::groan:: Please make this go away.

[lbmouse]

ICECC's 'Ethical Hacker Certification.'
...that and $6.50 will get you a cup of coffee at Starbucks.

SANS

[DaPh00z]

This appears to be similar to the highly regarded SANS GIAC Certified Incident Handler (GCIH) Course, SEC-504: Hacker Techniques, Exploits & Incident Handling [giac.org], which I attended a while back. The SANS course was excellent and is often taught by Ed Skoudis. Its challenging, but also very worthwhile. They cover how to create an Incident Handling team and then launch in to Reconnaissance, Scanning, Exploits, Keeping Access, and Covering Your Tracks. It would take too long to list out all of the different tools and tactics that they covered, but it's pretty comprehensive.
It's a great course, and I highly recommend it to anyone involved in computer security. The insight into how attackers target, gather information, compromise, and maintain access on systems has been invaluable in understanding how to then try and close the holes and mitigate the risks. You'll never be 100% invulnerable on a machine or network that you actually use for anything, but if you know how to think like an attacker and what the current tools are capable of, then you'll be able to fix most of it.

Defcon

[evenprime]

You can play at defcon, but the level of the competition would probably be a bit intimidating for people who attend a boot camp.

Hacking is a lot like life...

[Josh teh Jenius]

As a reformed "script kiddie", who once ran havok on your servers back in the 90's (sorry about that by the way) I must tell you that stories like this make me laugh. In my experience, the essence of all "hacking" is the same: the pursuit of an answer to a question.

Eventually, I discovered that the "real" hackers grew-up and got "real" jobs, so I did the same. However, like most hardcore IT people I know (not the MCSE morons), this inquisitive nature still lies at the heart of...well...me (whatever that is).

Point being: like life, hacking can't be taught, it must be experienced.

And just like life, it can be experienced 2nd-hand (via books or "training"), or, we can grow balls and go make some mistakes ourselves. The "wackos" like me will always opt for option B, and computers have nothing to do with this.

Re:What are the entry requirements?

[0racle]

Anyone can learn these tricks at any time anywhere. They don't need to go to a school to find them. If you think someone going to a boot camp is going to become some 1337 h4x0r, well you might as well also start advocating destroying the internet.

Re:Ethics in just 5 days?

[MobileTatsu-NJG]

"Sorry, but people can't really learn ethics in a 5 day camp. Ethics begin at home and in early childhood. It comes from the people who raise you and the people you're around as you grow."

So, let me see if I understand what you're saying: If a teacher makes a list of situtaions that are both ethical and non-ethical, and teaches his pupil which is right and which is wrong, this will have absolutely no effect...? Are you sure you're not over-generalizing here?

Re:that was my first thought

[compro01]

you might know exactly what you're doing, but without a certification, most employers won't know that and you have no proof.

and plus the whole thing prevents you from having to risk getting a criminal record during your "practise".

Re:sounds more like

[qwijibo]

I thought that was the point. Just like all of the people who have seminars on how to get rich. The moral of the story is that if you want to be rich and famous, you need to exploit the hopes of people who are too stupid to realize that it's a scam.