Colorado Researchers Crack Internet Chess Club 130
edpin writes "University of Colorado at Boulder students hacked the 30,000-plus-member Internet Chess Club as part of research funded by the National Science Foundation. With guidance from University of
Colorado at Boulder computer security researcher John Black, two students reverse-engineered the service to up their ranks and steal passwords." Update: 10/10 23:05 GMT by T : Reader Bryan Rapp points out that this story duplicates the one posted last month -- sorry about that.
Stealing Passwords? (Score:5, Insightful)
They proved their point by putting themselves high up in the ranks.
A legitimate Research project should NOT have involved messing with other people's accounts.
If you want to do that, have some person known to the researchers make up an account with the express purpose of their team trying to steal the password.
dupe duke nuker? (Score:5, Insightful)
technically the story it links to is though new, but it's about an old thing.
now.. about these dupes.. just one thing makes me wonder, do the editors have extremely bad memory or don't they follow slashdot at all themselfs? since in most cases a regular reader remembers if he has seen the same story(or one with a lot of resemblance) before. and hell, theoretically they should have more time than 20 secs per a story they pass, so they could have put "chess" into the old stories search.
now, on things that need refreshing or something a 'follow-up' stories could be worth while doing, but not reporting them as totally new.
Ethical ramifications of this. (Score:4, Insightful)
Slashdot needs dupe detection for editors (Score:3, Insightful)
I wonder... (Score:5, Insightful)
Just wondering if the shoe fits the other foot.
Ask Slashdot? (Score:2, Insightful)
Re:Forget white hat and black hat... (Score:5, Insightful)
Exactly why killing a man is part and parcel of becoming a homicide detective. Errr, wait, it's not.
Yes, you have to know how crimes are committed to solve/prevent them, but committing those crimes is not the only way to gain that knowledge.
Re:Slashdot needs dupe detection for editors (Score:5, Insightful)
This is research? (Score:2, Insightful)
This is a complete waste of taxpayer money, and Dr. Black should have his grants revoked. In fact, I've been in the supposed "computer security" academic community, and it's mostly bogus crap masqueraded as "research" because people don't know better. Computer security research is the AI of our time.
Re:Another dupe, timothy? (Score:3, Insightful)
Re:Forget white hat and black hat... (Score:5, Insightful)
In all those cases, they study past cases, study current events, and don't generally have to become like the things they're acting against in order to defeat them, and I have no idea why computer security should be different - as someone who used to work in banking, allow me to testify that we didn't go out and rob banks or kite checks in order to learn how to prevent others from doing the same. And in those few cases where hands-on experience is absolutely necessary, you don't need to go out into the world and involve innocent third-parties - you set up a controlled environment where they can play on the playground without actually attacking real people. The ethics of this sort of "white-hat" hacking are non-existent - this is absolutely unethical behavior on the part of these clowns, and in no way do the ends justify the means.
hacking the honor system... (Score:3, Insightful)
How secure something needs to be depends on what it is you're protecting. In this case it's the legitimacy of a chess game played over the internet and ratings of individual players. Is their something at stake more than game fairness and an online chess rating? (prize money for example). The article mentions famous people are on the server, is Madonnas chess account being hacked supposed to make me feel scared?
The problems should be fixed of course (if possible), but it sure seems like we're scraping the bottom of the security alert barrel on this one.
Re:Forget white hat and black hat... (Score:3, Insightful)
A lot depends on the target and any perceptions of conflict of interest. Even getting nosy about academic records is most likely taboo.
Re:Meanwhile... (Score:3, Insightful)
This is really a great fraud which makes money for the people developing smart-card processing systems and the general public pay for it (well, the merchants pay for it, and they usually pass the costs onto the customers).
Re:Forget white hat and black hat... (Score:3, Insightful)
Maybe. But the problem is that in so doing, the "good guys" become morally, ethically, and legally indistinguishable from the bad guys - you've erased the difference between you and them, your altruistic motives notwithstanding. The ends do not justify the means.
But hacking a chess site is probably not so bad, since potential harm is low.
The rightness or wrongness does not depend on the level of risk to the perpetrators. Investigating the efficacy of home security systems is a worthy goal. Breaking into strangers' houses is not an appropriate method of pursuing that goal, even if you minimize the risk by making sure that nobody's home at the time. And, I suppose I should add, even if you don't plan to take anything.