5 ms·

Mr Stoll internationally traced a KGB-affiliated hacker when almost nobody had heard of the internet[0], more or less invented the long-game honeypot to catch h

Mr Stoll internationally traced a KGB-affiliated hacker when almost nobody had heard of the internet[0], more or less invented the long-game honeypot to catch him, and testified at his trial. One hopes “the community” listened at least as much to him, considering the internet security community apparently was hardly worth a damn before all this happened. [0] and was, coincidentally, basically the first person to use the term “The Internet” (proper noun, emphasis on The) in widely read non-fiction, outside of a training manual and research document or two.

neilkk 3y ago
[flagged]
- p_l 3y ago
  You mean the guys who admitted to working with KGB? I mean, I met one of them, they do not hide that part of the story (admittedly in a public interview one of them claimed it actually boosted their career in 1990s)
  - neilkk 3y ago
    Right, so it was just as much in their interest as it was in Clifford Stoll's to pretend that this was an international espionage incident?
    - p_l 3y ago
      No, it literally was an international espionage incident. Documented down to money trails, separate "verification" action by soviet agents (who were attempting to verify the data they were being sold), and specific areas of interest. We're talking very early era of internet, barely 3 years after MILNET was separated from ARPANET, and computer security was less implemented than it should be. Which is why such outrageous hack could happen at all.
      - th0ma5 3y ago
        If your items are stolen from your car, the police officer can't care, but will take the report. If you say you left your doors unlocked, you also get a lecture. No one will welcome or be impressed by any sleuthing on your part. Maybe you can find your stuff, but is it worth the risk?
        p_l 3y ago
        This is... an impressively bad analogy. As in it took me some time to even parse if it wasn't by chance something that was supposed to go somewhere else. Maybe if you're dealing with some innocent "looking" by obvious teen on unsecured system it would have a sliver of relation to what was happening. If anything, the biggest issue is that when the events happened, there were no "code of practice" to follow. Officials were even less useful than today. Checking for what the unauthorized access was used is today the basic of basics, and part of that comes from the experiences of what Germans call "KGB Hack". Especially when one works in national lab under auspices of Department of Energy, and traces intrusion (again, something I'd take for granted today, to check which way the attack comes if only to bolster future defenses) to a military contractor. The story probably would have ended there if it wasn't one of the first such cases - today I'd call up appropriate unit and led them lead the way. And even then, sometimes you have to sleuth your way if only to keep the agencies honest, because sometimes the only way to get them actually acting is to publicize what happened so that public starts asking questions. P.S. And I say that as someone who was born on the other side of the Iron Curtain and would be on short list to be vaporized under american policy of "kill as many civilians as soon as possible" P.P.S. Sometimes the police/others will, in fact, quietly mention that they might be interested in more data off the books.
        th0ma5 3y ago
        The position of the US government as far as I can tell was that this was such little fish at the time that was the reason they didn't pay much attention compared to the ongoing direct network attacks against more valuable assets.
    - fabianholzer 3y ago
      I don't think it was in their interest to incriminate themselves more than to the degree that prosecution was able to proof already.
th0ma5 3y ago
He spent a long time on Slashdot and other places speaking out against hackers of all types and it wasn't until maybe 1999 or 2000 until he seemed to concede that some aspects of hacking, such as the bug bounties of today, were valuable. Dissent around Mr. Stoll at the time is evident in Phrack and other material from the time. I have the highest respect for the gentleman of course, I'm just trying to raise awareness that he was very much against messing with systems at all, even for exploration or testing, and spent a lot of time in the early to late 90s telling non-computer people to be suspicious of anyone who seems to know too much about computers. It was very offensive to me at the time, but I do know that he did eventually see the light. From Phrack #32 ``The Cuckoo's Egg'' captures many of the popular stereotypes of hackers. Criminologist Jim Thomas criticizes it for presenting a simplified view of the world, one where everything springs from the forces of light (us) or of darkness (hackers) (Thomas90). He claims that Stoll fails to see the similarities between his own activities (e.g., monitoring communications, ``borrowing'' monitors without authorization, shutting off network access without warning, and lying to get information he wants) and those of hackers. He points out Stoll's use of pejorative words such as ``varmint'' to describe hackers, and Stoll's quote of a colleague: ``They're technically skilled but ethically bankrupt programmers without any respect for others' work -- or privacy. They're not destroying one or two programs. They're trying to wreck the cooperation that builds our networks,'' (Stoll90, p. 159). Thomas writes ``at an intellectual level, it (Stoll's book) provides a persuasive, but simplistic, moral imagery of the nature of right and wrong, and provides what -- to a lay reader -- would seem a compelling justification for more statutes and severe penalties against the computer underground. This is troublesome for two reasons. First, it leads to a mentality of social control by law enforcement during a social phase when some would argue we are already over-controlled. Second, it invokes a punishment model that assumes we can stamp out behaviors to which we object if only we apprehend and convict a sufficient number of violators. ... There is little evidence that punishment will in the long run reduce any given offense, and the research of Gordon Meyer and I suggests that criminalization may, in fact, contribute to the growth of the computer underground.'' http://phrack.org/issues/32/3.html http://phrack.org/issues/32/3.html
- bemusedthrow75 3y ago
  > Dissent around Mr. Stoll at the time is evident in Phrack You don’t say!

neilkk 3y ago

[flagged]

p_l 3y ago
You mean the guys who admitted to working with KGB? I mean, I met one of them, they do not hide that part of the story (admittedly in a public interview one of them claimed it actually boosted their career in 1990s)
- neilkk 3y ago
  Right, so it was just as much in their interest as it was in Clifford Stoll's to pretend that this was an international espionage incident?
  - p_l 3y ago
    No, it literally was an international espionage incident. Documented down to money trails, separate "verification" action by soviet agents (who were attempting to verify the data they were being sold), and specific areas of interest. We're talking very early era of internet, barely 3 years after MILNET was separated from ARPANET, and computer security was less implemented than it should be. Which is why such outrageous hack could happen at all.
    - th0ma5 3y ago
      If your items are stolen from your car, the police officer can't care, but will take the report. If you say you left your doors unlocked, you also get a lecture. No one will welcome or be impressed by any sleuthing on your part. Maybe you can find your stuff, but is it worth the risk?
      - p_l 3y ago
        This is... an impressively bad analogy. As in it took me some time to even parse if it wasn't by chance something that was supposed to go somewhere else. Maybe if you're dealing with some innocent "looking" by obvious teen on unsecured system it would have a sliver of relation to what was happening. If anything, the biggest issue is that when the events happened, there were no "code of practice" to follow. Officials were even less useful than today. Checking for what the unauthorized access was used is today the basic of basics, and part of that comes from the experiences of what Germans call "KGB Hack". Especially when one works in national lab under auspices of Department of Energy, and traces intrusion (again, something I'd take for granted today, to check which way the attack comes if only to bolster future defenses) to a military contractor. The story probably would have ended there if it wasn't one of the first such cases - today I'd call up appropriate unit and led them lead the way. And even then, sometimes you have to sleuth your way if only to keep the agencies honest, because sometimes the only way to get them actually acting is to publicize what happened so that public starts asking questions. P.S. And I say that as someone who was born on the other side of the Iron Curtain and would be on short list to be vaporized under american policy of "kill as many civilians as soon as possible" P.P.S. Sometimes the police/others will, in fact, quietly mention that they might be interested in more data off the books.
        th0ma5 3y ago
        The position of the US government as far as I can tell was that this was such little fish at the time that was the reason they didn't pay much attention compared to the ongoing direct network attacks against more valuable assets.
  - fabianholzer 3y ago
    I don't think it was in their interest to incriminate themselves more than to the degree that prosecution was able to proof already.

th0ma5 3y ago

He spent a long time on Slashdot and other places speaking out against hackers of all types and it wasn't until maybe 1999 or 2000 until he seemed to concede that some aspects of hacking, such as the bug bounties of today, were valuable. Dissent around Mr. Stoll at the time is evident in Phrack and other material from the time. I have the highest respect for the gentleman of course, I'm just trying to raise awareness that he was very much against messing with systems at all, even for exploration or testing, and spent a lot of time in the early to late 90s telling non-computer people to be suspicious of anyone who seems to know too much about computers. It was very offensive to me at the time, but I do know that he did eventually see the light. From Phrack #32 ``The Cuckoo's Egg'' captures many of the popular stereotypes of hackers. Criminologist Jim Thomas criticizes it for presenting a simplified view of the world, one where everything springs from the forces of light (us) or of darkness (hackers) (Thomas90). He claims that Stoll fails to see the similarities between his own activities (e.g., monitoring communications, ``borrowing'' monitors without authorization, shutting off network access without warning, and lying to get information he wants) and those of hackers. He points out Stoll's use of pejorative words such as ``varmint'' to describe hackers, and Stoll's quote of a colleague: ``They're technically skilled but ethically bankrupt programmers without any respect for others' work -- or privacy. They're not destroying one or two programs. They're trying to wreck the cooperation that builds our networks,'' (Stoll90, p. 159). Thomas writes ``at an intellectual level, it (Stoll's book) provides a persuasive, but simplistic, moral imagery of the nature of right and wrong, and provides what -- to a lay reader -- would seem a compelling justification for more statutes and severe penalties against the computer underground. This is troublesome for two reasons. First, it leads to a mentality of social control by law enforcement during a social phase when some would argue we are already over-controlled. Second, it invokes a punishment model that assumes we can stamp out behaviors to which we object if only we apprehend and convict a sufficient number of violators. ... There is little evidence that punishment will in the long run reduce any given offense, and the research of Gordon Meyer and I suggests that criminalization may, in fact, contribute to the growth of the computer underground.'' http://phrack.org/issues/32/3.html http://phrack.org/issues/32/3.html

bemusedthrow75 3y ago
> Dissent around Mr. Stoll at the time is evident in Phrack You don’t say!