|
NOTES FROM UNDERGROUND AN INTERVIEW WITH SE7EN BY RICHARD THIEME At DefCon IV, the annual hackers' convention in Las Vegas this July, they called him "se7en." He's twenty-eight years old, an old man of the hacker scene, and he has just "come out" into the public eye after seventeen years underground. It's the second day of DefCon and Se7en has already given more than a dozen interviews to television crews. The attention is wearing him down. "Don't call me se7en," he said as we entered Spago's, an upscale restaurant in Caesar's Palace for dinner. "I don't want to be hassled." "What should we call you?" I said. "Nine?" Before he could answer, a young waiter approached our table. "Good evening. Are you all here for a convention? Yes, we said, opening our menus. The waiter leaned closer and said in a conspiratorial whisper, "I understand the elevators at the Tropicana [site of DefCon III] still don't stop at the right floor. The blueprints for the Monte Carlo [this year's hotel] disappeared two weeks ago. The management is in a panic." So much for anonymity. Waiters, taxi drivers, desk clerks -- everybody in Vegas knew DefCon was back in town. Why did se7en come out? Why did he leave the hacker underground and tunnel up at the age of twenty-eight into the bright lights of camera crews, the blank pitiless glare of the desert sun? "I'd been playing around with the idea of retiring for a long time. I wanted to come out before I retired. There are a lot of things I want to say, a lot of people I want to know -- I didn't have a game plan, exactly, but I wanted to be above ground for six months before I dropped out. At DefCon I wanted to meet a lot of people whose email addresses I had seen for years." ? Does it weigh on you, being underground? "It does, yes. It's very isolating. You don't quite know what else is going on out there, you feel like you're in your own little world, and as your world starts to fall apart, as mine did -- people going above ground, people retiring -- my world was getting a lot smaller. We needed new talent, more than the little group we had left, and I was getting older. I wanted to mentor some of the younger hackers. Help them the way others helped me." [In the world of hacking, a generation lasts about a decade. Many hackers go on to work as computer professionals in security, intelligence, or business. Participating whole-heartedly in the community of hackers, with its rigorous code of ethics, networks of mentors, and accumulated expertise, is often the only way to learn what no school knows how to teach.] "There's a lot to be learned from people, not just in the hacking underground, but life in general. In respect to the technology and the knowledge I had, it was limiting to relate to so few people. There were new things to learn, new perspectives - so much to get being out there and I was missing that. It was isolating." ? How old were you when you got into computers? "I was eleven when I got my first computer, a TRS-80. Seventeen years ago. First thing I did was play games. Remember, this was new to the entire world, and all you could do was play games at that point. I had no interest in programming then. The computer was a fancy expensive toy. It wasn't something to use to balance your checkbook or use as a communications device." ? When did you become aware of communications as a possibility? "About 1982, using an Apple IIe. I heard of modems, that you could use them to call up other computers and talk to them. That was exciting. I was into game cracking before bulletin boards. We were messing around with Apples with machine language, just screwing around with very little knowledge of what we were doing. We cracked our first game by accident. We started playing with different call registers, and next thing we knew, we had something. Copy protection was very simple then so it was not very impressive as a technical feat but when you're eleven years old and you cracked your first game and it was an accident on top of that ..." ? It was a power rush, wasn't it? "That's what it was. A power rush. There was a big apple computer store that opened then in my home town. It was mom-and-pop store, not a franchise or a chain. They hosted Apple clubs. One group talked about new hardware, another about software, arguing about language and coding, then there was a little circle of warez kiddies copying games they had cracked. We were a precursor to hacking groups, phreaking groups, 2600, No one thought of it as crime then. It was a new technology that was like a great big toy. The difference between cracking games, cracking programs and cracking systems was very little. They were all part of a big complex puzzle we wanted to solve. It was just a question of how big a chunk of the puzzle did you want to tackle? We wanted to break games, that's what was interesting to us then, Engineers wanted to break the whole system. They wanted to know everything about it. These were people that by every definition of the word were hackers. They never called themselves that, but they were going to get into that system, no matter what. The words that are feared today -- crackers, phreakers -- were never brought up in the press back then. The TRS-80. the apple IIe was still brand new to the world. Very few people had them,. It was not like Nintendo today where everybody gets one. They were expensive game machines. They were new and people didn't know quite what to make of them. The only people who really knew them were people who used them at work." ? When did you become conscious of yourself as a hacker or phreaker? "Not for many years. I had my own group of friends through bulletin boards or school, we were just doing our own thing. We never thought of ourselves as hackers or crackers or a conspiracy or the underground or trying to be elite. We thought of ourselves as friends. We kept to ourselves and didn't cause trouble. We never consciously thought of ourselves as hackers or crackers but in retrospect we fit the definition. We were our own little mini- software piracy ring. No one ever questioned photocopying something - obviously not defense secrets or corporate secrets, of course. But what we meant by "information wants to be free" is, we would email it to ourselves or send a friend a disk. In seventeen years of hacking I never made a cent until I made a speech this week." ? What kinds of speaking are you doing? "I define the various types and sub-types that the media labels hacker, cracker or phreaker. I describe the types of people in each group, their motivations, how they differ from one another, their ideologies." ? Do you discuss technique? "No, these [his recent talk was for engineers in a space program] are UNIX-heads. They know UNIX is inherently weak. One joke I heard when I came in was, "UNIX and security are an oxymoron." That made me feel good, because I knew I was talking to people who knew that you can't fix security in UNIX. The public is screaming, "Oh my god, hackers are getting in, they need to fix security," but they're clueless! UNIX is insecure, period. End of story. The engineers' concerns about security were twofold: (1) Their approach to security has been to be as obscure as possible. They wanted to be invisible. They had very few problems because their systems aren't even on the books. At this point, they don't exist. Now their program is about to get a lot of press and they will no longer enjoy obscurity, so they want to tighten their system up as much as possible. They know that some people will still get in, but if people are going to get in, it will only be people who are talented enough to do it. Not someone who accidentally got in or used a simple hole to get in. (2) When they do catch a person inside the system, how do they know what their intention is? The biggest fear of hackers and crackers everywhere is, what is their intention? You find one, you don't know what the hell they're doing and that scares the hell out of you. They felt a lot more comfortable after I told them the basic types of hackers. Now, they see someone in their system, they're more likely after a few minutes of tracking them to know who they are, what they're after, whether to worry about them or not. You can usually tell what a hacker's after from what they do when they get in. They start to look for directories like "nuke" and "secret" that might be a problem. But then again it might not. These guys knew the concept of "trophy-grabbing." There might be a kid who downloads the plans for a Stealth fighter to his computer and puts them on a diskette and throws it up on the wall. 'Hey, I got a trophy!' He isn't going to sell it to a spy. He wouldn't know who to sell it to if his life depended on it. To him, it's just, 'Hey, I got a copy of a stealth fighter sitting on my bookshelf!'" se7en was a well-known phreaker who knew his way around the telephone system. I asked how he got into phreaking. "My introduction to phreaking was being taken around by someone a few years older than me who said, hey, we're going to go dig in the trash of the telephone company. I was like, well what the hell for? He goes, 'Trust me. This will blow your mind.' Well, it did, it blew my mind for the next ten years. We went through the trash, and in my eyes, all we had was a bunch of paper. I was not impressed. But he was sorting them and saying, OK, these are good, these are bad, these are good. He was trying to get me interested in something I saw no interest in. I was young,. I was about fifteen years old. To me it was basically worthless, looking at a hunch of food and trash, and it wasn't until I went over to the guy's house the next night, and he says, remember these five or six pieces of paper I grabbed? He fires it up and boom! there we are, we're in the phone company. 'We're in the phone company?' Yeah, he said. I can do anything I want in here. He had found a dialup. He already knew quite a bit about the phone system. But he warned me, Don't be one of those punks or lusers that makes free phone calls. Learn how it works. Be one of the people who learns how it works. That was our goal: to understand how things work. The things we did used to be considered normal teenage behavior, remember, teenage pranks, Now it's a felony. Now you're part of a conspiracy. It's more complex today. Even if they don't send you to jail, they'll confiscate your equipment. They like to scare the hell out of you. You become an annoyance, they'll take your computers and you'll never get them back, no matter what you do. That's pretty good for knocking a lot of kids out. But it can have the opposite effect. Some people like the Legion of Doom or the other hackers that have gotten busted, the government did that to shut them up, but they all came back and they came back angry. The last thing the government needs is someone they don't understand coming back with an agenda. There were a lot of great discoveries through the years, but for me, the greatest was how I grew in knowledge and power in my own eyes. The giant telephone company and many of the all-knowing corporations really had very little clue as to what they were doing. The government, the all-powerful government -- starting wars, controlling your life -- did not have a clue as to what a computer is or what it can do. The realization that all these people that as a kid you're told to respect and fear, in a lot of ways you have it more together and are a lot smarter than many of these people.... It's a power rush, that's what it is. You find out there's absolutely nothing special about these people. Here you are, some little fifteen or sixteen year old kid, you can do things that the phone company can't even do, or the government can't even do. The phone company doesn't even know what you're talking about when you tell them something you've been doing for years. That's the greatest discovery. ? Today the real power belongs to people who have knowledge, who know how to do things. The others are hiding behind an illusion of power? Behind smoke and mirrors? Exactly. (c) Richard Thieme 1997. All Rights reserved Se7en: The Sequel Richard Thieme Se7en is out in the light and air now, up from seventeen years underground. He's one of the new variety of human being -- homo sapiens hackii -- who has learned from working with computers at every level, from code language to point-and-click, to think in ways that fit how computers organize information. Se7en is on the road now, delivering seminars to technicians about hackers -- how they think, how they behave. He works with organizations that are favorite targets of hackers because of their work or status. He speaks to groups of 30-50 people at a time, cross- disciplinary groups consisting of engineers, security personnel, administrators -- people who deal with the Internet on a daily basis. Naturally, they're concerned about security. On his first round of talks, he discussed basic security, making his clients aware of what's out there. He helped them distinguish hackers in search of trophies from thieves working for governments and businesses. On his second round of seminars, Se7en is focused on the details of security, the technical end. The technicians are set up in networks and shown how to scan their own services, searching their networks for security holes. "Basically we set up our own network of fifteen machines and taught them how to break root, showing them how easy it was with UNIX. It was important for them to get hands on experience, get the feel of it. We showed them how to grab a password file and run it through Crack. We introduced them to SYN flooding and explained the concept behind it. We showed them some of the scripts that are NOT available out there. We didn't launch an attack, because that would have been lethal, but we got them to the point from which they could launch it." They set up encrypted Internet sessions and ran them through the whole gamut of hacker behaviors. It was all hands-on, technical training. The engineers are learning a lot. They return to work more capable of securing their systems and also better equipped to talk to the managers who make decisions. Se7en believes as a result of his experience on the road that the hands-on technical people who work on the front lines of the Internet and understand it are seldom promoted into management positions where decisions are made. So managers often lack experience on the front lines. Because they don't deal with the issues on a day to day basis, they often don't understand the problems brought to them. Ironically that makes them hesitant to promote technical experts into management positions. They would leave no one to fix things when they break. Se7en is seeing similar problems at all of the places he visits. Most come from outsiders scanning the system, port- sniffing, testing for vulnerabilities. It's a big inconvenience. The systems operated by multi-national corporations or government organizations are immense, incorporating numerous protocols and computers. They're too complicated for fledgling hackers to penetrate as a rule. Even more experienced ones have trouble getting in. That means that the ones who do break through are seriously talented hackers. The ones to watch are the ones you never hear about. Se7en thinks hackers in the "visible underground" make an essential contribution to computing. He laughed at some of the conversation among technicians about firewalls, because he knows that systems always have holes. Hacking organizations such as the LOpht, TNo, and the Guild (the current publishers of Phrack Magazine) release UNIX security vulnerability scripts to the public all the time. Their research into SecurID's (a one-time password hardware product) and most recently, the SYN flooder script, have been devastating. Now they're looking into Windows NT. They promise results. These genuinely "elite" groups have friendly script wars with one another. They compete to see who can release the most scripts the fastest. The LOpht in particular has promised to put out five new vulnerability scripts per week. They accumulate scripts, waiting until they have about a dozen, then drop them in one big bombshell. Companies like Microsoft know, of course, that there are numerous holes in their operating systems, but don't know what they are. As applications are developed, working versions are periodically compiled for testers. The testers try to find as many bugs as they can, but the testing environment can never reveal the problems that will be found in the real world. A million people using Windows NT for a year will turn up bugs that a controlled environment will never find. Mainstream hackers keep the global network as clean and secure as it can be kept. It's a yin yang kind of thing. If hackers didn't know that and wanted to keep vulnerabilities from the companies themselves, they wouldn't release scripts publically through so many different loops. When the Guild discovered the SYN flood exploit and wrote the corresponding script for it, for example, they published it in Phrack, on the Internet, and in other magazines. That's not something a hacker would do if he's looking for a way to exploit the vulnerability. The Network, then, including the Internet, is the REAL testing environment, and that's where groups like the LOpht are performing a valuable service. Either the holes will be found by groups looking for them and making them public or they'll be found by more dangerous crackers working behind the scenes. Hard core crackers, engaging in serious crime and espionage, will not publish articles in 2600 or Phrack. That's why, Se7en says, you never hear of the people who do hard crime. When someone is forced to the surface, he says, it's always someone the underground has never heard of before. After years in the business, he knows the rosters as well as anyone. Se7en described an intrusion of a particular server in detail, then went on to discuss the organizational response. He was not surprised when they responded the way Se7en and his friends responded when someone tried to mailbomb their list. The organization asked them politely to stop their annoying activity, and when they didn't, they cut them off. The best way to respond to nuisance intrusions is the legitimate way. Try to reason with the intruders, then talk to the systems administrators in charge of the computers they're using. Most often, the sysadmins don't know what's going on, and once they find out, they shut them down. Se7en lived and worked in South Africa when he was younger and thinks the "official" (i.e. non-governmental) hacking scene is just coming alive. South Africans have not generally had wide access to the Internet or hacking publications, Now everyone has access to hacker web sites, but Se7en thinks most of those are a waste of time -- links to other sites, doctrinal positioning, and a lot of old warez for "warez puppies" to download and use without creativity or insight. Contrary to the image of hackers as anti- social, Se7en is keenly aware of the social systems that keep the flow of information free and open -- frequent hacking conventions, mailing lists, magazines, and the vast informal network of contacts. Some of the resources on the Net are useful, but the good ones are harder and harder to find. Se7en finds five or six useful web sites or mailing lists in a year, and he has to wade through a lot of garbage to get there. But that's no different, he acknowledges, than the hours he spent sifting through trash in rubbish bins. Persistence! he says, sounding like an experienced businessman. "Honestly, that's what it takes: Persistence. Doing it weekend after weekend after weekend, every Sunday night, going through the trash knowing that if you miss a week, that's the week when all the dial-ins for the switches are thrown away. Eventually you'll find some gold that you can use. The same thing goes for web searches. You have to wade through tons of garbage, but if you're persistent and just keep at it and at it and at it, eventually you'll find little gold nuggets here and there." He has been impressed with the increasing number of South Africans interfacing with the mailing lists. They're connecting with people who have been hacking ten or fifteen years, he cautions. Naturally, with only one or two years experience, they have a lot of questions. He understands where they are -- he remembers being there himself -- but has some advice for those who encounter flames when they ask too many questions or the wrong ones. Basic netiquette requires that you research thoroughly everything you can before you ask questions. RTFM. Read the fucking manual. Learn everything you can FIRST, and only when you're stuck, ask a question. Do your best to answer it yourself before putting it on a mailing list going to fifteen hundred people. Don't expect others to do your homework. Tell the list you tried to find the answer and couldn't. Don't just go out there saying, where can I find this or that? That's a sure way to get flamed. In the end, it comes down to people, not technology. Ultimately, Se7en says with a laugh, computer security is a hopeless pursuit. The Internet is just too big, too complicated, too specialized, for every system to be secure. Security is inconvenient, and inconvenience makes people uncomfortable. It's always a trade off between convenience and security. The moment you allow legitimate users onto a site from outside the system, you're doomed. All someone has to do is duplicate what that legitimate user is allowed to do. The weakest link in any chain is and always has been people. "You can have the most secure system in the world, and if I call up and pretend to be from the help desk and ask for your log-in password, and you give it to me, then the best security in the world won't help you. "If you don't know anything about computers, and don't know that the System Administrator never needs to know your password, how can you know if someone's conning you?" It comes down, Se7en says, to awareness and accountability - - managers who understand the real issues and insist on accountability throughout the system for knowledge about the network and procedures that must be followed. Without that, all it takes is a little "social engineering" and the most expensive firewall won't mean a thing.