The Hack in the Box security conference in Amsterdam brought hackers and software companies together
If anything is going to finish off the hacking community it's more likely to be early-onset diabetes than security agencies, given the way the assembled hackers and software company security officers demolish the cake for breakfast, lunch and tea at Amsterdam's Hotel Krasnapolsky.
It might come as something of a surprise to people who don't come to these events just how buddy-buddy hackers and software corporates are these days. Hack in the Box (HiTB) isn't an ersatz event put together by some canny event company; it's organised by hackers for the community. Indeed, over the years, nothing has succeeded in persuading the guys behind it to try to make a reasonable living out of it.
But for all the hacker cred HiTB enjoys there's no sense of cold-shouldering the suits, or in this case logo-emblazoned T-shirts. RIM, Facebook, Google and Mozilla are all sponsors and Microsoft is paying for the floating after-party on the Ijsselmeer.
Indeed, the boundaries between software companies and hackers have been growing steadily more fluid over the years. The big names are here to make friends, listen to the latest research and to recruit. Often their in-house security teams claim to have a degree of autonomy that other divisions ? such as sales, marketing and R&D ? don't. These, after all, are the guys who have to saddle up occasionally and ride out of the stockade at Fort Gates into the wild west of software. I'd say some of them seem to prefer it out there.
If all this sounds slightly counter-intuitive, bear in mind that in this particular world there are a lot of people out there with a lot of different coloured hats. Taking a lead from the visual language of the westerns there are white hats (the good guys), the black hats (the bad guys) and the grey hats (either the morally ambivalent or the guys who didn't figure out which washing machine cycle to use).
The white hats are essentially freelance security experts who look for vulnerabilities in software and who then sometimes develop "exploits" or tools to take advantage of them. If you want a visual metaphor the conference handily provides one in the shape of the "lockpick village" ? a table of enthusiasts who bring along a bag of brass or steel locks and padlocks and sit there picking away at them until they've cracked every one.
One of the major themes here is how the big software companies reward the hackers for their efforts. Different corporations respond to hackers in different ways. Mozilla, the company behind the Firefox browser, was one of the first to pay these freelancers for drawing their attention to vulnerabilities or even better for coming to them with a solution as well as a problem. Google is here to ensure the hacking community knows it is following suit and offering a bounty on every one they report. Chris Evans, who is head of security for Google Chrome, describes it as "recognition for their efforts".
Chris and Lucas Adamski, director of security engineering at Mozilla, are sharing a panel platform with senior security people from RIM, Adobe and Microsoft. The latter doesn't pay hackers for coming up with exploits.
But as Adobe senior security strategist Steve Adegbite explains, direct remuneration isn't the only way that big companies reward hackers. Most give public credit to those who identify problems, others offer paid freelance work or full-time jobs and, where freelancers set up their own consultancies, they can get big-name endorsements.
"We actually go out there and vouch for good researchers," says Adegbite. "If somebody comes to us and says 'we want somebody to look at our technology that's similar like yours', we'll recommend somebody."
His opposite number at Microsoft, Katie Moussouris, takes a similar line, saying that flagging vulnerabilities is a good billboard for hackers seeking security jobs. She uses the "teach a man to fish" adage to underscore their preference for employment over piecemeal reward. Moreover, she says, plenty are happy to make available their findings for free.
Now one can appreciate why people might contribute their time to Wikipedia. It's a community project. It's not a big moneymaking operation. Microsoft is a vast business.
Understandably, some hackers are a little sceptical. But sceptical doesn't even begin to describe their feelings towards Sony. Google pays hackers for their help; Adobe praises them; Sony sues them.
There is a feeling among the white hats that Sony isn't handling the PlayStation Network situation well. Perhaps a little more than not well. One conference-goer put his hands over his eyes and chants "there are no bugs at Sony, there are no bugs at Sony". Others simply don't believe that the Japanese giant's corporate culture will allow it to get a grip. "It's a totally different mentality", says Lucian Constantin of the tech website softpedia.com.
"Sony isn't a software company, it's a hardware giant. They make firmware. They're very entrenched into that mindset of enclosed and proprietary systems. They tried to defend themselves through the legal system and it backfired; a great deal." No data security breach causes reputational damage like loss of financial details does.
Sony may not need the hackers. Indeed Microsoft, Mozilla and Google arguably don't need the hackers as they have sizeable security teams of their own, but they do see a beneficial relationship to be had and they certainly see the downside of a hostile one. The question for Sony, given the way security challenges only serve to whet the hacking community's appetite, is whether it wants the tech equivalent of a Vietnam; an unseen and resilient enemy with no shortage of recruits and little or nothing to lose while it is big, out in the open and has a target painted on its corporate posterior.
Meanwhile, though the hackers and chief security officers rub shoulders happily through the event, come the evening they part company. The CSOs march off for a beer and a lively debate while the Hack in The Box crew repair to a coffee shop to review the day through a cloud of smoke. Well, it is Amsterdam after all.
? Jonathan Kent is a freelance writer and broadcaster who reports regularly on technology issues
Jenny McCarthy Zooey Deschanel Tara Reid Coco Lee Katy Perry
No comments:
Post a Comment