5 ms·

This could very likely be a carefully (and cleverly constructed) identity. This girl might not exist; but because we all really really want a 16 year old girl

by ErrantX 16y ago

This could very likely be a carefully (and cleverly constructed) identity. This girl might not exist; but because we all really really want a 16 year old girl to be the hacker the discrepancies are glossed over (the art of a good lie is not giving too much detail and letting other people's imagination fill the gaps). On the other hand the personality strikes me strongly as female, so if it is an facade it is a very well constructed one, which the imposter empathises with. But, on the whole, the setup "feels" wrong (and I tend to trust my instincts in such matters).

nkassis 16y ago
Hiding in plain sight is also a good trick. She might be what we think she is or not, doubt gives her/him some protection.
weego 16y ago
Indeed, and there are 2 references in the various tales of a good understanding and practice of social engineering, and anyone with that understanding would not go around telling the press genuine background stories that could start to be pieced together. But then of course the smartest ones are the people no one will ever hear about, so who knows.
- noonespecial 16y ago
  Oh.. I know this one. It turns out to be Kevin Spacey in the end.
bballbackus 16y ago
I fail to pickup on how the personality in the interview seemed strongly female. Could you give an example?
- ErrantX 16y ago
  Not just from this piece, I did a little more digging and my impression was that this person comes across as female (based on the sort of language used, areas of interest etc.).
  - deadmansshoes 16y ago
    Sorts of language used like "Perl, Python and PHP"? Areas of interest including x86 assembly and the Linux kernel? Yep, all girly..
Estragon 16y ago
Not to mention, it must be humiliating for HBGary to be thought of the world as hackable by a 16 year-old girl.
- jrockway 16y ago
  Why? Kids are smart and have time. 16 is not that young. I knew how to do SQL injection and buffer overflow exploitation at that age, although I also knew not to use those skills against someone who didn't ask for it. Basically, everyone is excited because she's a girl.
  - chc 16y ago
    As one or two articles have pointed out, that kind of skill is generally lacking in girls in our culture. So it is somewhat noteworthy, I guess.
    - nostrademons 16y ago
      Her father is a software engineer, though. It's much easier to learn pretty high-level skills in a field when you're young if you have a parent in that field.
famousactress 16y ago
Yeah, it's interesting to guess.. There are mild grammar errors in each longer sentence she's quoted with.. and two of them conflict strangely (she uses 'into' correctly once, but not again). I'm just playing detective, but either smells like someone young.. or like someone intentionally peppering grammar issues to sound it. I dunno. If I had to vote I'd call BS. I think it's someone older.
noahc 16y ago
When I had a lot more time, I would go into Yahoo chat and basically phish for pedophiles usernames/passwords. I can tell you that a "hehe" after anything will set the hook. I could on average phish about an account a minute and I was never figured out. I only fell out of character once to warn an 18 year old kid, that talking to 14 year old girls sexually online wasn't the best use of his time. He freaked out and thought I was a cop! It's relatively trivial to do this, most people will ignore minor slip ups provided you have the right context. I would set context by doing the following: 1. I would set my profile to the geolocation of the room I intended to work. I would then find a school and neighborhood to say I was from. 2. I would suggest I was home sick (and thus alone). 3. I would use an innocent, although, sexual name in my username like "booty" 4. I would use emoticons and "hehe" on probably 75% of all messages sent. 5. I would let them contact me first. If you contact them they get scared. If they contact you, they feel like they are in control. For example, I could tell them the wrong name and many wouldn't notice, or if they did simply saying, "Oh, that's my middle name" is usually sufficient. With all that said, anyone know of a way I could use my experiences and ability at social engineering online in a legit manner?
- eli 16y ago
  That is... pretty creepy.
- awj 16y ago
  > With all that said, anyone know of a way I could use my experiences and ability at social engineering online in a legit manner? See if Chris Hansen is hiring?
- nyellin 16y ago
  Interesting. What was your motivation?
  - noahc 16y ago
    I'm big on systems and testing and generally more interested in people than the technical nature of technology. I just wanted to see if it would work. I did this off and on from the time I was 14 to 17 or so. I lived literally in the middle of nowhere, where the nearest town had about 27 people. It was an interesting way to spend time in high school. To me it was a big experiment to maximize conversion and minimize detectability. The biggest take away from this is that I realized that social interactions have formulas and you can take advantage of those formulas. You can also find shortcuts to the formula or make certain parts of the formula more important or less important based on context.
redthrowaway 16y ago
I've hung out in the anonops irc quite a bit, and `k certainly comes across as female. I hadn't linked her to the Kayla > YOU spam before, but that was almost 3 years ago, now. If it is a constructed identity, then it's been carefully cultivated. It is an awesome story, though. Regardless of whether it's true or not, it's effective at both rallying the neckbeards and shaming opponents. It's funny to see how much deference is paid to her on IRC, although I only started going there after news of the HBGary incident broke, so she already had quite a lot of cred. `k may or may not be a 16 year old girl, but it's a hell of a troll if she isn't. I'm not aware of many anons who could pull something like that off for so long. There were a few back in the day who had managed to become trusted enough at anontalk to get promoted to wiseguys, but that took a couple months, not a couple years. For that reason, as well as her general demeanor, I'm inclined to believe her.
iuguy 16y ago
On a more technical note regarding the described background, "Kayla" apparently started by learning how to break software and exploit bugs by her dad and grew up learning about the Linux Kernel... then moved to SQL injection. That last bit makes absolutely no sense. It's easier to learn SQL injection than the many, many different ways that memory management can go wrong. References to her memorising Windows Opcodes sound like a random phrase thrown in for credibility (you do after a while remember certain functions - 11 years after writing my first ARM shellcode I still remember it, even though I'll probably never use it). The whole description of how she progressed just doesn't sound right. You can be up and running with SQL injection in less than an hour, learning buffer overflows and understanding them properly probably takes about a day and a bit at best (and that's assuming that you know C, how to use a debugger and how a compiler works). The Micro-SD strategy also seems a little extreme (but is viable, our testing gets done under a VM, there's no reason why that couldn't go on a micro SD card). I'm calling BS on Kayla being a girl, mainly because the story just doesn't fit right compared to the application of Occam's Razor - that this is someone else trying to cover their tracks.
- sophacles 16y ago
  When you have an expert parent (or other adult influence) you can, and frequently do, learn things in a "weird" order. Further study after study from teaching land shows that "the natural order" to learn things is not nearly as fixed as one would think, the order you learned in is not the only way. The order you were taught in is not the only alternative way. I remember I started learning in C, reading security and working on perl all the same time. I didn't even know about SQL for a couple years after that. This was in the late 90's and early 00's tho, things were a bit different, but it isn't improbable nor impractical to have this learning curve in a semi-self taught way. It is even less improbably given that her dad probably taught what he knew best, C and Kernel stuff. When I was a kid, my grandfather was an electrician. I grew up learning about house wiring, and how to do it properly and quickly. I learned how to solder and do stuff with wires long before I ever did basic electronic theory stuff. It never occurred to me that 120VAC was any more dangerous than a small fire. Imagine my surprise when in college I first encountered these professors who were terrified of wall current ('of course it will hurt you, just don't be stupid' is still how i think of both fire and electricity, the stuff isn't magic). I was confused when we went over stupid "this is how a dpdt switch works" and annoyed that we never played with any circuits more advanced than I grew up doing for over a year. I had never had any basic electronic theory at that point. So: do you disbelieve me because I didn't learn in some natural progression as an electrician apprentice would? Because I didn't learn in the order the courses laid out in college? tl; dr -- the idea of a "natural progression" in learning is just bunk.

by ErrantX 16y ago

nkassis 16y ago

Hiding in plain sight is also a good trick. She might be what we think she is or not, doubt gives her/him some protection.

weego 16y ago

Indeed, and there are 2 references in the various tales of a good understanding and practice of social engineering, and anyone with that understanding would not go around telling the press genuine background stories that could start to be pieced together. But then of course the smartest ones are the people no one will ever hear about, so who knows.

noonespecial 16y ago
Oh.. I know this one. It turns out to be Kevin Spacey in the end.

bballbackus 16y ago

I fail to pickup on how the personality in the interview seemed strongly female. Could you give an example?

ErrantX 16y ago
Not just from this piece, I did a little more digging and my impression was that this person comes across as female (based on the sort of language used, areas of interest etc.).
- deadmansshoes 16y ago
  Sorts of language used like "Perl, Python and PHP"? Areas of interest including x86 assembly and the Linux kernel? Yep, all girly..

Estragon 16y ago

Not to mention, it must be humiliating for HBGary to be thought of the world as hackable by a 16 year-old girl.

jrockway 16y ago
Why? Kids are smart and have time. 16 is not that young. I knew how to do SQL injection and buffer overflow exploitation at that age, although I also knew not to use those skills against someone who didn't ask for it. Basically, everyone is excited because she's a girl.
- chc 16y ago
  As one or two articles have pointed out, that kind of skill is generally lacking in girls in our culture. So it is somewhat noteworthy, I guess.
  - nostrademons 16y ago
    Her father is a software engineer, though. It's much easier to learn pretty high-level skills in a field when you're young if you have a parent in that field.

famousactress 16y ago

Yeah, it's interesting to guess.. There are mild grammar errors in each longer sentence she's quoted with.. and two of them conflict strangely (she uses 'into' correctly once, but not again). I'm just playing detective, but either smells like someone young.. or like someone intentionally peppering grammar issues to sound it. I dunno. If I had to vote I'd call BS. I think it's someone older.

noahc 16y ago

When I had a lot more time, I would go into Yahoo chat and basically phish for pedophiles usernames/passwords. I can tell you that a "hehe" after anything will set the hook. I could on average phish about an account a minute and I was never figured out. I only fell out of character once to warn an 18 year old kid, that talking to 14 year old girls sexually online wasn't the best use of his time. He freaked out and thought I was a cop! It's relatively trivial to do this, most people will ignore minor slip ups provided you have the right context. I would set context by doing the following: 1. I would set my profile to the geolocation of the room I intended to work. I would then find a school and neighborhood to say I was from. 2. I would suggest I was home sick (and thus alone). 3. I would use an innocent, although, sexual name in my username like "booty" 4. I would use emoticons and "hehe" on probably 75% of all messages sent. 5. I would let them contact me first. If you contact them they get scared. If they contact you, they feel like they are in control. For example, I could tell them the wrong name and many wouldn't notice, or if they did simply saying, "Oh, that's my middle name" is usually sufficient. With all that said, anyone know of a way I could use my experiences and ability at social engineering online in a legit manner?

eli 16y ago
That is... pretty creepy.
awj 16y ago
> With all that said, anyone know of a way I could use my experiences and ability at social engineering online in a legit manner? See if Chris Hansen is hiring?
nyellin 16y ago
Interesting. What was your motivation?
- noahc 16y ago
  I'm big on systems and testing and generally more interested in people than the technical nature of technology. I just wanted to see if it would work. I did this off and on from the time I was 14 to 17 or so. I lived literally in the middle of nowhere, where the nearest town had about 27 people. It was an interesting way to spend time in high school. To me it was a big experiment to maximize conversion and minimize detectability. The biggest take away from this is that I realized that social interactions have formulas and you can take advantage of those formulas. You can also find shortcuts to the formula or make certain parts of the formula more important or less important based on context.

redthrowaway 16y ago

I've hung out in the anonops irc quite a bit, and `k certainly comes across as female. I hadn't linked her to the Kayla > YOU spam before, but that was almost 3 years ago, now. If it is a constructed identity, then it's been carefully cultivated. It is an awesome story, though. Regardless of whether it's true or not, it's effective at both rallying the neckbeards and shaming opponents. It's funny to see how much deference is paid to her on IRC, although I only started going there after news of the HBGary incident broke, so she already had quite a lot of cred. `k may or may not be a 16 year old girl, but it's a hell of a troll if she isn't. I'm not aware of many anons who could pull something like that off for so long. There were a few back in the day who had managed to become trusted enough at anontalk to get promoted to wiseguys, but that took a couple months, not a couple years. For that reason, as well as her general demeanor, I'm inclined to believe her.

iuguy 16y ago

On a more technical note regarding the described background, "Kayla" apparently started by learning how to break software and exploit bugs by her dad and grew up learning about the Linux Kernel... then moved to SQL injection. That last bit makes absolutely no sense. It's easier to learn SQL injection than the many, many different ways that memory management can go wrong. References to her memorising Windows Opcodes sound like a random phrase thrown in for credibility (you do after a while remember certain functions - 11 years after writing my first ARM shellcode I still remember it, even though I'll probably never use it). The whole description of how she progressed just doesn't sound right. You can be up and running with SQL injection in less than an hour, learning buffer overflows and understanding them properly probably takes about a day and a bit at best (and that's assuming that you know C, how to use a debugger and how a compiler works). The Micro-SD strategy also seems a little extreme (but is viable, our testing gets done under a VM, there's no reason why that couldn't go on a micro SD card). I'm calling BS on Kayla being a girl, mainly because the story just doesn't fit right compared to the application of Occam's Razor - that this is someone else trying to cover their tracks.

sophacles 16y ago
When you have an expert parent (or other adult influence) you can, and frequently do, learn things in a "weird" order. Further study after study from teaching land shows that "the natural order" to learn things is not nearly as fixed as one would think, the order you learned in is not the only way. The order you were taught in is not the only alternative way. I remember I started learning in C, reading security and working on perl all the same time. I didn't even know about SQL for a couple years after that. This was in the late 90's and early 00's tho, things were a bit different, but it isn't improbable nor impractical to have this learning curve in a semi-self taught way. It is even less improbably given that her dad probably taught what he knew best, C and Kernel stuff. When I was a kid, my grandfather was an electrician. I grew up learning about house wiring, and how to do it properly and quickly. I learned how to solder and do stuff with wires long before I ever did basic electronic theory stuff. It never occurred to me that 120VAC was any more dangerous than a small fire. Imagine my surprise when in college I first encountered these professors who were terrified of wall current ('of course it will hurt you, just don't be stupid' is still how i think of both fire and electricity, the stuff isn't magic). I was confused when we went over stupid "this is how a dpdt switch works" and annoyed that we never played with any circuits more advanced than I grew up doing for over a year. I had never had any basic electronic theory at that point. So: do you disbelieve me because I didn't learn in some natural progression as an electrician apprentice would? Because I didn't learn in the order the courses laid out in college? tl; dr -- the idea of a "natural progression" in learning is just bunk.