CS854 Commentary -- Week 2: Hacking


  • All TA comments written in red.

    Hacking is akin to trying to enter a building without proper permission. If a good side (i.e. benign reason) can be argued to exist for it then it would probably be along the lines of identifying security vulnerabilities so that they can be fixed before someone else with malicious intent exploits it.

    There was nothing benign about the intent and purpose of Onel de Guzman's rejected thesis proposal. Stealing the "Internet accounts of the victim's computer" [3] in order to relieve the burden of others to spend their own money for their own Internet accounts is like breaking into another person's house to borrow their phone or watching the cable TV that was accidentally (1) left on. I imagine that de Guzman's reasoning is that this "borrowing" only takes the otherwise unused idle time when the service isn't in use and since a flat fee was paid for a monthly service, the "borrowing" doesn't really harm the supposed victim. While that may be true the main point is that the person whom is having their service used never consented to that. Inviting someone over to your house to watch TV is far different from someone walking into your house, while you are away, and watching the TV you left on (and presumably left the front door unlocked and opened). Likewise so is stealing a person's password to take advantage of their unused Internet access time.

    (2) There can be no justification what-so-ever for worm releasing. On the individual PC level, the damage to the system is often minimal with users inconveniencing other people they e-mail to and by other people they get e-mail from. The main problem is just that it is another form of a denial of service attack: by creating a virtual traffic jam, computer's have a harder time talking to each other and can't get as much done.

    There are really two (3) approaches to combating this problem. First, stop rewarding "these guys [with] fame, and often even job offers, after releasing a virus" [2]. Then again, vandalism is illegal but some people do it anyway.

    A more effective approach would be to make it harder to become a victim by changing the attitudes and expectations of users. Teach users to avoid the situations that lead to virus proliferation, educating with them common-sense notions equivalents of "not to [packing] irreplaceable possessions in a checked suitcase or [walking] in an urban park after dark" [1]. Users should also demand and expect a higher standard of security from software vendors. People would not tolerate a telephone with an auto-dial feature if it were possible for someone else to call telephone, record a message, and instruct it to call all the numbers on the auto-dial list and to do the same thing. Most likely they would abandon that manufacturer for a better one. (Americans, in particular. would likely sue any company that sold them such a product.)

    References:
    1. David Freedman Information Warfare
    2. Michelle Delio Why Worm Writers Stay Free
    3. Onel de Guzman's rejected thesis proposal at AMA Computer College


    Well done - you make some good points, and your examples are creative and effective. My only suggestion would be that you discuss the possible solutions in a little more detail - see 3 below.

    (1) I like this analogy! It illustrates your point very well. I agree with you that a key consideration is that the internet users affected by Guzman's proposal would not have consented to have their accounts used.

    (2) ... except perhaps "Hacktivism", if you are convinced by Manion and Goodrum's article.

    (3) Are there only two? You don't discuss the approach that seems to be the most commonly thought of: treating hacking as a crime, and concentrating on apprehending and punishing hackers. Do you think this approach is appropriate?

    9/10

    Back