Mike var en av mine hovedinformanter, og jeg ble kjent med han via de månedlige 2600 møtene i Citicorp- bygningen.
Teksting (transkribering) av filmen
Stig: Who are you?
I am Mike Hudack.
And what are you doing?
Right now I am working at a computer security company, doing research into new products. I am chief scientist over here; I do a lot of computer security research and development. In the past I’ve maintained a computer security website and was frequently known as a hacker
Do you consider yourself a hacker?
I’d say so, yeah.
What is a hacker?
It’s a very difficult and touchy definition. I would say someone who loves computers to the extent that computer are much of his or her life, has the ability to do much of anything with computers, whether it would be breaking security or making it. Making programs or breaking them. I mean, although often the breaking part is emphasized over the making part, I think that’s pretty wrong. The original source of the word was MIT where they were making things, not those people who call themselves hackers nowadays who don’t really makes things, they just destroy things, and I think it has been twisted quite a bit by quite a few people.
Which people twist?
First of all people who call themselves hackers and do nothing but destroy things. I don’t know how it became so popular to call oneself a hacker, but I can tell you there is a lot of people who call themselves hackers who really aren’t. They have the ability to deface a website or anything [they like] and they call [themselves] hackers, while really they are defacers or they’re … one popular term that has again been twisted is cracker. Again that was originally meant as a somebody who circumvented programs and broke copy protection et cetera. Now it basically refers to any malicious hackers. And hackers can certainly be malicious, but it’s a very fine line that people walk.
DVD-case
The DVD case is very interesting. When DVD’s first came out, they weren’t really well at all. I forget exactly what encryption they were using, but it was certainly not fantastic. It was pretty much inevitable that someone would figure it out how to get past Macrovision, and how to get past other protections in place. It was just a matter of time, and the studios knew that. When you release any new format, whether it be VHS or CD or DVD, there will be pirating. And to some extent releasing the information about how to pirate it; it wasn’t necessary released as an information on how to pirate it, but simply how horrible the protection was, I mean it was really a joke.
When you go in to protect something you don’t use the weakest encryption you can, you use the strongest encryption you can. Apparently those companies that came up with the DVD standard just didn’t understand that or didn’t want to understand that, or didn’t want to spend the extra time rolling out the format.
I think the case against Emmanuel and the others who’ve released the DVD crack is ridiculous. You don’t sue people when they post vulnerability to bug track, you thank them! Granted DVD is a bit different, because you cant go out and update all these DVD players. At the same time it was a vulnerability that was discovered, and when a vulnerability is discovered, public disclosure is the way everyone has traditionally gone in the computer industry, and just because they’re [a] different industry, the media is still used with computers, the media is still a computer medium…They didn’t expect it, and they should have
Misunderstanding?
I think once you release a standard like [the] DVD into the public domain, I mean that what’s essentially been done by distributing the discs for a fee, distributing the players for a fee. Once you buy the disc, once you the player, its yours. That which went into creating it, still belongs to the company that released the player and released the disc. But you still own what is yours, what you paid for, and I think while what is gone into making it it is a corporate secret or proprietary I think its pretty ridiculous to assume that people aren’t going to copy things, and that people aren’t going to defeat those things. In fact, it is actually a favor to the MPAA and the others that somebody who … that Emmanuel and everyone else distributed the code because there would be a couple of copiers, [a] couple of pirates out there who’d be doing it, and no one would be knowing how. There be assumptions but the corporations that released the DVD wouldn’t be able to improve the next format that much, for knowing how it was done and at least in this way when the next format comes around whatever it might be, they will have learned their lesson just like they learned the lesson with VHS
MPAA wins?
I couldn’t tell, I hope they don’t. These areas are very shady legally. And it’s a very difficult to determine what a court would say. I think the law is on the side of those released the source code. I mean they are quite blatantly simply suing people for linking to the source code; they will certainly not win that! Its been upheld … there’s numerous decisions that state that you cant be held liable for linking to something. It happened to Ticketmaster, it happened to other companies, it happened with Sidewalk. And its been upheld that you cant be held liable for linking to anywhere. And as such, these people will certainly not be found guilty.
On the other hand, publishing the information firsthand mayor way may not be illegal, and that’s something that has to be decided in the courts.
When did your computer interest start?
[I’ve] always been fascinated by them. About, I guess, four or five years ago I got my first computer. It was an used 486sx 33. Didn’t even come with a cd-rom drive, I had a little 13 inch monitor. I paid about $800 for it. I loved it, I really did. The first thing I did when I came home, I took the thing apart and put in a cd-rom drive. I was like 11-12 years old, and it was the first thing I ever did before turning it on. And I just feel in love with them, I mean its something I absolutely love to do. After that my computer eventually broke. My mother got a computer, a Dell Pentium 200 with all of 32 megs of RAM and Windows98. And I started playing with it, and I started changing literarily everything; she would wake me up in the middle of the night and yell at me, because her computer wasn’t working. But I loved it, and I just kept working on it. And eventually I got to the point when I realized I needed to get something on my own. I built myself a Pentium II several years ago and [brought?] Linux on it.
And I … just loved it that and security started calling. I mean it was just a natural progression for me, it was … the most difficult thing to do and I started playing with security and just eating everything I could on the subject, reading every book, reading all the how-to’s and … everything, their requests for comments, and I just got so fascinated by it that I started up a website on the subject. Lots of news about, lot of methodology, I had a lot of people writing for me. And I just loved it, and I started working for some companies I am not allowed to name doing security audits. The reasons why I am not allowed to name; they make you sign a contract when you start work for them that basically says ‘you did not work for us’. They do this for security purposes, so that people don’t know they’ve had an intrusion in the first place. So I did some work for some companies, and I just loved it.
Hacking methods?
Yeah it is. Generally what I’ll do is what is generally referred to as Tiger Teaming. Basically you, or a group of people work with you, to try to break into the computers. And one day I walked into a CEO’s office of a very large company, and I gave him a folded piece of paper. He opened it up and looked at it; his eyes bulged out, and I said, ‘sir, is that your password?’
I had a lot of fun with these things. Basically once they’ve been broken into, they realize they’re vulnerable and they decide to hire someone to find where they are vulnerable. And to take care of it. I know a lot of people who do this, it’s a relative common employment for those who call themselves white hat hackers.
White hat hackers?
Well, its pretty much the difference between a malicious hacker and a real hacker. The white hat hacker is generally someone [who] is considered as a security expert and works for companies securing systems. He’s a hacker because he possesses the Hacker Ethic and all those good things and he’s working in a legal sense securing things.
Black hat hackers [are] generally someone who goes around breaking security. One could even argue he’s not a hacker because his ethics are generally not the best.
[indecipherable] … that’s not always the case, there are a lot of people who call themselves gray hat hackers, the L8pt being a case in points. They do a lot of consulting but at the same time they play around in the gray areas that cant really be classified as white hat or black hat, its just not that clear cut.
The east-coast scene?
I’ve talked to the L8pt quite a bit back when I was running my website. I communicated with Space Rogue on a daily basis about the news and so on. Talked to a lot of people in the area, lot of people I cant really talk about who have done things they shouldn’t have done, whether they be gray hat, black hat or white hat. Some of whom have been arrested, some of whom have not. It’s a difficult area to be in, especially because more often than not FBI will assume you are guilty before proven innocent and therefore a lot these people keep a very low profile; you won’t see most of the more skilled people at a 2600 meeting for instance. And its [a] good reason for that; its because they are not … it’s a saying that the best hacker is the one you’ve never heard about, and its very true. They are not going to be out there. While you and me may have talked to them, they are not going to go out in the public and say ‘you know, I am a hacker’. Because if they are white hat hacker, that’s no problem. If you are a gray hat or black hat its basically points a big bulls eye on your back.
Anonymity vs hacking fame
How do you thread that line? Its very difficult. Generally rout wars, the most popular way to do it; you network a bunch of machines and secure each machine and the... You know each person has [his] own machine on the network and you try to break into someone else’s machine. The last person to be breaking into, or the last person not broken into, is the winner. You know, that’s the winner of the rout-war, he’s the most elite as someone would say or the best.
Do rout wars take place often?
They sometimes takes place on the net; most conferences like Defcon or Turcon [?] have rout wars. Problems at times is that there is some legalities surrounding this, illegalities surrounding, because you have to get [the] expressed permission to break into the machine and more gray areas. I mean these are not against the spirit of the law, but some times they are against the letter of the law, and it’s very difficult to balance.
Will you attend H2K
Hopefully I will be speaking at H2K [and] be attending Defcon. My boss may very well be speaking at Defcon, and he’ll be speaking at Turcon as well.
What are you going to talk about?
Much of it’s a corporate secret at the moment. We will be releasing some products in the future that will be discussed at these conferences. For the most part, I cant speak to that issue.
Why Linux?
I almost sort of choose Minix [?]. Are you familiar with Minix? Minix is the predecessor of Linux and it’s a lot more difficult to set up. A big reason why one chooses Linux is because it’s a challenge, it’s a lot of fun. I mean it took me a couple of days to set it up on this laptop for instance. With Windows you are insecure, its installs in twenty minutes, it’s a processor hog, it’s a memory hog. You cant run many good programs, you cant have secure shell access, you cant have a FTP deamon running. With Linux you can do all these things and a lot more. It’s a huge difference. I might have chosen Berkeley Unix, main reason why I didn’t is because Linux is just … to backtrack a bit, a little bit more user friendly. X-windows is a little bit more friendly on it so and so forth so … I chose Linux as a compromise. Most of our machines in the office run Linux actually
TAPE RUNS OUT – CHANGE OF TAPES
What did we discuss last?
I think it was the hacker community? Is there a hacker community?
Yeas and no. I think that … first of all you have to understand how things got started. You hung out a lot with 2600 and like 2600 got started from another group which was an offspring from the MOD-LOD wars. Emmanuel Goldstein was kind of a guy who hang around at these meetings and so and so fort.
After MOD and LOD got busted by the FBI, the group broke up and Emmanuel went off and started his own which people followed him into.
It … there always been something of a community; hackers tend to be loners, but only in society in general. When they are with other hackers [they are] not loners at all. I mean, I got quite a few friends who are very computer savvy, kind of haven’t a lot of friends who aren’t computer savvy! I just don’t…there isn’t much to discuss, I mean hence the stereotype of hackers being loners and programmers being loners and technicians being loners. I mean there is a definite community but I think the community is more made up of people who wish to be hackers that it is of actual hackers, the public community at least. When you see these people at 2600 meetings and the like, they tend not to have the skill that someone who legitimaly would be called a hacker would have.
They’ve seen the 2600 Magazine at Barnes & Nobles and decided to go to a meeting. Generally speaking, real hackers will have a community and it will be … maybe it will be something like 2600, but it wont be public, it wont be advertised. It will be ‘invited or don’t-bother-come’ deal.
The MOD-LOD wars?
Oh the MOD and LOD wars. Uhm, about … sometime ago there were two opposing groups, MOD and LOD. Masters of Destruction and … I don’t … I haven’t studied my history well enough, but nevertheless it was two groups, one in Texas and one in New York, who were constantly fighting each other, and at one point they got busted. Uhm, you may wish to speak to Ellen, she hangs around 2600, her brother who were in LOD I believe.
The MOD-LOD wars made 2600?
Ah yeah, they spawned 2600 but my history isn’t all that great, there’s a couple of books on the subject uhm…there’s one called ‘MOD – Masters of Destruction’ uhh, and there’s another one, I cant even think of the name but those would be suggested reading to anyone who wants to understand the wars.
Ellen’s brother was a member of the MOD?
Yes, I believe he was in LOD. And I actually went dumpster-diving with [the] co-founder of MOD!
What is dumpster-diving?
Dumpster-diving is looking through paper-garbage, not real garbage but you know papers, discarded papers, for any kind of information. We found things like … Ellen, Mark and I went out dumpster-diving. We found a lot of stuff, we found the entire payroll for Bell Atlantic, we found confidential patient information, people who had AIDS and so on. Credit cards bills, medical records of people who could not afford to pay their medical bills and were subsidized by the DEA. Generally speaking, shred your garbage!
Dumpster diving is the main way people get into systems and hackers get into systems. You’ll find a discarded piece of paper with a username and a password on it, and that’ll get you in, then you are …
What happened to the papers afterwards?
It was originally for a project I was doing for ParisTV. Eventually we just discarded them, just like … earlier, we didn’t feel much of a need to shred them considering they weren’t shred in the first place.
What is social engineering?
Social engineering is being a very nice person and calling up and say ‘hi, how are you doing?’ My favourite technique has been calling up and saying ‘Hi, how are you doing? We just had a bit of an intrusion [and] we need to change our passwords. We would prefer it [if] you would change your password through us, we’re at the facility right now. If you change your password through your computer it’s a chance that it’ll be intercepted by the people who still may be in the network. Give me your current password and the password you wish to use in the future, that’ll be great.’
Nine times out of ten they’ll give you the password and they’ll give you the new password. You’ll change the password to their new password and there you go, you have access. Incidentally this is not me, I’ve never done this!
Political issues?
There’s quite a bit! There’s everything from CDA, the Communications Decency Act, to [the] MPAA and DVD, to government control over the internet, such as the Internic [?] Ah…all of these are issues that are very close to the heart of pretty much every hacker out there. And often there are … and of course Kevin Mitnick is another good example. Often, unfortunately, there are defacements and other acts that attempts to influence these issues. Ninety nine out of a hundred times they have absolute no effect and simply cast more of a shadow on hackers and make people think that they are even worse than they’d previously thought. Uhm … these political issues there are ways to take care of them, defacing sites is not one of them. It might raise awareness but its not going to do much else.
Are you a political active person?
I do my share of letter writing and the like. Written letter to the president so on and so fort. Actually got a response…
From the US president?
Well from one of his aides I am sure! It was signed by a machine you know! But I made a couple of points about encryption, encryption controls, military information being freely available on the internet, that kind of stuff.
Are young hackers politically motivated?
I think it comes later. A lot of the people who just start out, its called script kiddies. It’s a term that … most people don’t like to use. I don’t have a problem using it. Basically it means they can download someone else’s script and run it and take over someone’s site, but they cant write their own.
Generally speaking these kids don’t have any reasons for being hackers except for the thrill of doing it. And they [are] really not hackers; a hacker can write his own script. Uhm… if they are successful, if they learn what they are doing, I [indecipherable] they are going to be political, I mean the whole hacker mind set has a lot of political leanings to it.
Has the internet environment hardened?
Well one thing that is important to know is that [the] internet was not made for commercial use. ARPANET was meant for military use and research and the National Science Foundation Net, NSFNET again, was not meant for commercial use. There’s billion of dollars transferring hands on the net whether it may be purchases on Amazon.com or stock trade at E-bay. And because of this, things get a lot more serious when you deface BarnesandNoble.com or the Associated Press web site. It can cost million of dollars, and because of that the FBI is getting pretty serious about that. And despite the fact they don’t know what they are doing they probably should be serious about it.
Denial of Service Attacks, who did it?
I cant speak to that issue.
Will there be more DOS attacks in the future?
I think there’s definite possibility. There’s a lot of copycats, there have been proposals on how to stop these attacks. Slashdot, about two days ago, carried an article written about how to stop these attacks. Basically it involves multiple DNS entries and large amount of bandwith to fool the attacker. If these measures work and they are put in place its very possible that these DOS attacks will be a thing of the past. In the meantime no one can know.
I think that really covers it. Its really up to you to ask me. I think the only other thing that bears mentioning is the FBI. I have mentioned them several times uhm … unfortunately I don’t think they are equipped to handle this security problem on the net. Generally speaking when a security expert has a chance of working for the FBI, with a pay grade of $50,000 , or working in a company like [the] KPL making quite a bit more in addition to stock options, the choice is clear and unfortunately the FBI has not stepped up to the plate to attract these people. The airforce has a very good program going were they will as soon as you graduate from basic training they will give you promotion to captain will all the privileges of that rank and they will give you the pay of captain in additions to bonuses every month. And … if you go there with computer security knowledge … The FBI needs to develop a program like this, like the airforce. I can tell you without being to specific that a lot of the FBI agents, that I’ve talked to [that] have come to me for help, simply don’t know which way is up.
Do you consider the hacker convictions to be too harsh?
Yeah I really do. I think the vast majority of the people arrested, gets arrested because they are stupid. People don’t get caught if they are smart. That goes for everything, but for hacking more so than everything else. Most of the people gotten caught, didn’t do much; they defaced a website or two and most of those who get caught are young. They don’t deserve more than a slap on the wrist. If they do it two or three times maybe they deserve more, but when you arrest some kid at Greenbay who is in a group that have defaced a few hundred web pages, generally speaking he probably doesn’t deserve ten years in jail.
Hacking stories?
My favorite has always been the Yale versus Harvard game. MIT have a history of playing tricks of course, and they put in trapdoors in the field and the football kept disappearing throughout the game … it was absolutely great. A lot of other people who were for that. My other favorite one; there’s a dome at MIT which is famous. At the end of the year, the seniors will do something with it. My favorite is they put the headmasters car up on top of the dome. To this day nobody knows how they did it. Those are my absolute favorites.
There are some great ones as well, the senate defacement, [even as] I dislike defacements, [this] was quite clever. I always wondered why people … I think if you’re going to deface a website you leave it as it is, but you change subtle little details … if you are going to deface the New York Times you don’t change it, you just alter one story to say a slightly different thing. You change the amount Dow went down that day you know … and the senate hack did that, it was great. The other one I really liked was [the] AP hack defacement, because they had a shell script running which replaced … The AP webmaster kept trying to bring back the original page up, but the AP defacement kept coming back up ‘cause they had hidden shell scripts throughout the system to bring it back up. That was United Long Gunmen, very cool guys; shouldn’t do what they do or what they did, but at least they did it with style, unlike most people…
