[This was originally published on Hacker News Network (HNN) and mirrored on attrition.org.]
You sit down at your work computer, ready for another day of work and Internet. Logging into your secure Windows NT machine, you check the daily mail and see that everything is smooth. No users forgot their password, no security alarms were tripped. You fire off mail to your boss ensuring him that sending the financial plans via email for next year is safe. No one but you and the other CEO can see it. Opening a ‘telnet’ session, you log into a partner companies server to check things out. Thanks to the time tested security of the TCP/IP protocol and no snooping eyes, your work day is assured to be stress free.
Now you are ready for another day of browsing the web. Logging into Hotmail you want to see if your buddy mailed you. Your password of “blinky” is yours and yours alone. No mail from Frank, just your monthly bank statement. Netscape takes you to another auction site where you safely type in your credit card number and address over secure 40 bit encryption layer. Sheesh, who needs a full 40 bits!
If hackers were smart, this might be a real scenario.
Hackers? Crackers? There would be no distinction. No articles in main stream press like CNN, Forbes, Wired or NBC. No hacker specials on 20/20 or MTV interviewing shadowy figures with muffled voices. No security books written by ‘anonymous’ claiming to be the end all reference on security. No hysterical rantings from law enforcement claiming hackers will shut off phones, down power grids, and turn off airplane flight towers. If hackers were smart…
The dozen or so defaced pages in 1995 that are so well known (Nation of Islam’s home page, MGM’s “hackers” prank), to the over 600 hacked web pages in the first half of 1999 would be mostly unheard of. Since defacing a web page leads to hackers losing system access, that would serve a counter purpose to the smart hacker. Occasionally you might see defaced pages on child pornography servers, political messages with no signature left on other high profile servers, but it would be infrequent at best. If hackers were smart…
Bugs in Cold Fusion (1), count.cgi (2), Novell Netware (3), Internet Explorer (4), Solaris (5), Irix (6), Sco (7), several IDS products (8) and more, would all stay mostly undiscovered. Consumers would go on using products with the illusion of security. Highly vulnerable Operating Systems would litter every corporation and every desktop, all presumably secure. The amount of advisories released from security companies would be cut in half if not more. A good half of all reported bugs would never be talked about, or filed away in corporate security databases. If hackers were smart…
Almost any software could not truly be trusted. Well known public archives like Tucows would not have been defaced. Instead, smart hackers would have backdoored hundreds of popular downloads ranging from Netscape to ICQ to shareware games. Commercial operating systems like Sun Microsystems (Solaris), Cisco (IOS), or FreeBSD would most certainly contain hacker spawned backdoors. These would allow full control over your machine, and you would never know. Every key you press would be read by these smart hackers.
Machines on just about every subnet would be compromised. Each would contain subtle and difficult to remove backdoors. Hackers could move around on the machine and never be discovered because of the depth of their penetration. Large servers, routers, dedicated home machines would all be under the control of someone else. Every unencrypted keystroke would be silently logged elsewhere, ready to be used later by these silent intruders. The backbone routers that control some 90% of Internet traffic would become monitor points for your activity. If hackers were smart…
If one hacker wanted onto any of these machines, it would be a matter of one polite request. The flow of information about servers, logins and passwords, tools, tips and methods would all be openly shared. New vulnerabilities would circulate quickly so that the network of hackers could compromise a few of the servers left on the “we don’t own” list. Each hacker would control so many systems, giving up a dozen here or there would make no difference.
Machines would have a lot less downtime, and a lot less problems in general. Most hackers are quite familiar with systems and know how to run them. Systems with problems tend to be noticed by the legitimate administrators. In an effort to keep prying admin eyes away from these machines, the hackers would take care of administrative problems and keep the servers running quickly and quietly. The legitimate admins would enjoy stress free lives and enjoy that myth called “free time”. If hackers were smart…
Each and every machine that has been compromised would be rigged for high end remote distributed computing applications. Challenges like the RC5 Cracking would find itself with over ten times the computing power it currently enjoys. Imagine over half the Internet all working toward a handful of computing goals and the power behind it. If hackers were smart…
I think it is fair to say that the state of the net doesn’t quite match the description above. There are a handful of talented hackers out there capable of everything I described. These individuals bring new meaning to “one with technology”. But, for the most part, the hacker scene is a cesspool of little ignorant kids, hiding behind a legendary veil called ‘hacker’. They have problems compiling exploits written by other people. Sheer luck allows them to break into domains you never knew existed. They run around defacing no name web sites with poorly written flames against other hacker groups you’ve never heard of. Their HTML is full of errors causing the page not to load sometimes.
Or maybe these supposed “kiddie” web defacement groups out there right now are only there to distract you from the real hackers.. the smart hackers. They are out there, silently doing everything I described above and more.