Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security

If You Hack NBC, You Don't Get to Meet Tom Brokaw 343

Posted by CmdrTaco from the thats-pretty-funny dept.
subgeek writes "Security Focus Online is carrying this story about the spot that Adrian Lamo almost had on the NBC Nightly News with Tom Brokaw. NBC changed their mind after they realized the possible legal implications of filming someone hack corporate systems. NBC also seemed a bit touchy that Lamo had gotten into their system so handily. According to the article, it took him about five minutes and one guessed password to get inside NBC's intranet from a computer at a Kinko's. Lamo's comment: "It was a very full service system.""
This discussion has been archived. No new comments can be posted.

If You Hack NBC, You Don't Get to Meet Tom Brokaw More

If You Hack NBC, You Don't Get to Meet Tom Brokaw

Comments Filter:

  • In the immortal words... (Score:5, Funny)

    by swordboy ( 472941 ) on Thursday August 29, 2002 @02:46PM (#4165699) Journal
    of homer... [aol.com]

  • Proof (Score:5, Insightful)

    by chill ( 34294 ) on Thursday August 29, 2002 @02:47PM (#4165700) Journal
    Demonstrating OTHER corporations are security dumb-asses is one thing, but demonstrating THEY are security dumb-asses on nationwide television must've triggered someone's clue meter.

  • Legal Implications? (Score:5, Insightful)

    by LinuxWoman ( 127092 ) <damschler AT mailcity DOT com> on Thursday August 29, 2002 @02:49PM (#4165714)
    Sounds to me like they're more embarassed that he did it so easily and from such a public location. After all, he was invited by an NBC employee to attempt to hack their system.

  • This kind of thing happens all the time (Score:4, Interesting)

    by DigitalSorceress ( 156609 ) on Thursday August 29, 2002 @02:49PM (#4165719)
    I used to work for a television news department... this kind of thing happens all the time:

    Reporter and Vidiographer are assigned some fluff or FUD piece, but come back with a story that lands a little too close for the news director's comfort... the piece gets pulled.

    Lamo's lucky... with the way lawsuits and "terrorist hacker" charges are flung about nowadays, he should be thankful he's not roomin with some lifer named Bubba right about now.


    • In the ENG news business, I have never been called a "Videographer." In the news business all across America a News Photographer is called a "Photog."

      I would know this because I am currently a "photog." This person has more than likely never worked in a television newsroom.
      • Actually, I called it that specifically because of this: How many times have you told someone you were a news photog and they assume you meant with still cameras for a newspaper or magazine?? I used to get that

        J.Random person: "Oh and what do you do for a living?"

        Me: "I'm a News Photog at Channel 22"

        same J.Random Person: "Oh, I didn't know they took photographs too"

        Me: "No, I use a video camera... a Sony Betacam SP camcorder with a fujinon lens"

        other J.Random person who thinks they know about everything: "Oh the Beta format died years ago... too bad it was much better than VHS"

        Me: .. unintelligible strangling noises..

        THAT is why I said videographer instead of Photog... believe me or not, I don't care past making this reply.

  • Unfortunate Last Name (Score:5, Funny)

    by Ratfactor ( 15886 ) on Thursday August 29, 2002 @02:51PM (#4165727) Journal
    Perhaps they just didn't want to admit that they'd been cracked by somebody with the last name of "Lame-O".

    Reminds me of the great SNL skit with Nicholas Cage:
    "The name is Dumass, Dumass!"

    • Re:Unfortunate Last Name (Score:4, Informative)

      by Wind_Walker ( 83965 ) on Thursday August 29, 2002 @03:10PM (#4165895) Homepage Journal
      Actually, the SNL skit you're referring to had the punchline of "Azwipe".

      The "Dumass" you're referring to is either the "Thick-Headed" commercial for A&W Root Beer, or from The Shawshank Redemption tring to pronounce Alexandre Dumas.

      Not that I'm anal or anything.

    • Reminds me of the great SNL skit with Nicholas Cage:
      "The name is Dumass, Dumass!"

      That's a rootbeer commercial.

      Nicholas Cage's name was "Asswipe," and the line was "Excuse me, that's pronounced Os-wee-pay!"

      Sorry I remembered that skit recently when trying to think up a name for my unborn child. :) (Cage made every name that his wife suggested into a tease or a taunt to see if it would be appropriate.)

  • So... what was the password? (Score:5, Interesting)

    by taeric ( 204033 ) on Thursday August 29, 2002 @02:52PM (#4165733)
    So, if this guy was able to guess someones password, I am VERY curious as to what it was. If you know anything about the person, it makes guessing easier. However, if you don't know even the owner of the account, how do you guess a good password?

    My only hunch is that the password was something like 'abc123'. It cracks me up how many people have passwords such as that and are supposedly worried about security.

    It is also funny to hear what some of my friends think are secure passwords. Among them being obscure Anime characters.
    • I'm guessing he tried 'god'.
      • "Hmmm. That's odd. God wouldn't be up this late."

      • Re:So... what was the password? (Score:5, Funny)

        by Anonvmous Coward ( 589068 ) on Thursday August 29, 2002 @04:01PM (#4166291)
        "I'm guessing he tried 'god'."

        No, that only happens in the movies. Here are some other notable characteristics of fictional computers:

        - They always use fonts that are at least an inch high

        - Windows does not exist, nor does Mac, or anything else we've ever seen

        - Computer displays are extremely animated. (They're also very noisy...) Fortunately, they have plenty of hard drive space (even in the early nineties) to play back pre-rendered animations.

        - Despite the benefits of using a mouse, using a movie computer requires bursts of constant typing. The space bar and backspace keys are never used.

        - Movie computers are not capable of multitasking. All you get is the exact interface you need to advance the plot.

        ... and so on.

        The password was probably: 'password'.
        • Also...
          • They have very bright screens, in fact so bright that you can read the monitor from the face of the person in front of it
          • Text is usually displayed really slow, like letter for letter, with annoying beeps between each letter.
          • Or, if the user is a programmer/hacker/etc, it is usually scrolling down the screen in ridiculous speed
          • They never use account-based security, instead having a password for each interesting or secret document they store
          • They have internet connection fast enough to show 1600x1200x20fps video in real-time two-way without any kind of jerkiness
          • But still cannot download the secret document describing some secret government/corporation plan in less than a few minutes...
          • They are remarkably stable, and will never crash except when being attacked by a virus/worm/whatever
          • Which is usually so simple to write, that the genius hacker can throw it together in the 20 seconds it take before they have to change scene to keep the movie interesting.
        • Actually what you describe sounds kinda like setting up quake3 through an ssh tunnel at work.

          uuhhhh I mean when I saw someone else do it.... I swear |:).

    • "password" is is a good try as well.

    • Re:So... what was the password? (Score:5, Funny)

      by American AC in Paris ( 230456 ) on Thursday August 29, 2002 @02:58PM (#4165786) Homepage
      My only hunch is that the password was something like 'abc123'.

      ...or perhaps 'ABCNewsAnchorsAreWeenies'...

    • Obligitory Space Balls Reference (Score:4, Funny)

      by JohnDenver ( 246743 ) on Thursday August 29, 2002 @03:01PM (#4165820) Homepage
      NBC Executive: What a coicidence! That's the exact code I use on my matched luggage!

      What's the world coming to when life immitates parodies immitating life?

    • I remember my password at work was an obscure anime character - but I padded it with and _ and some numbers.

      When a security audit came around I was one of the *few* people who didn't get a phone call or an e-mail telling me to change my password. I use the same password on my firewall at home too and so far it hasn't been guessed.
      • You use your work password at home? I did that for about 2 days until I realized that I didn't want to get nailed with some keystroke logger at home and then have comprimised our entire network at work, on which I have admin rights on all the servers.
    • It cracks me up how many people have passwords such as that and are supposedly worried about security

      Most passwords are crap, and there's nothing you can do about it. Passwords are doomed to be crap. You have two choices - be loose, and hope people use secure passwords (result: a few people will, most people won't), or be strict and force secure passwords (result: average users write down the new password, people who use secure ones normally get pissed off and start using crappy pw's).

      I have about a half dozen secure passwords that I rotate around -- none of them have ever been cracked, and you're not going to guess them from social engineering, profiling, or dictionary attacks. I know that some of them are inherently "less secure" because they're used more commonly, and the more places they're used the more likely they'll get snarfed. When you make me exceed my normal password capacity then I'm going to use stupid things like "Abcdef1".

      About the only solution is to use something like SecureID - which annoys me since I know my pw's are solid, but at least it takes care of the 90% of people who can't remember a password unless it's their SO's name, their pet's name, or a birthdate of one of the aforementioned.

      Oh, and obscure anime characters are fine, as long as you use some non-alphabetic characters at the front, end, or middle. Of course, we're preaching to the choir here. The problem is the average user.

    • Re:So... what was the password? (Score:5, Funny)

      by NanoGator ( 522640 ) on Thursday August 29, 2002 @03:45PM (#4166157) Homepage Journal
      "I am VERY curious as to what it was."

      I got a chance to see the video. It was just five asterisks.

    • ***** is the password
    • Prolly the same as the login like everyone does who can that i know, trust me our local nt admin password here is a username with the username as password. And i keep whining and i keep using it until i cant anymore ;-)
    • My college's Linux admin had(has?) a l337-type mispelling of a word for a password...It's so obvious, I have to be careful what I say...

  • Maybe they pulled his interview (Score:4, Funny)

    by Jedi Paramedic ( 587254 ) on Thursday August 29, 2002 @02:52PM (#4165739)

    because he found out the great secret of TV anchors...

    ...No pants under the desk!

  • Slashdot, the Ultimate DoS (Score:3, Funny)

    by LordYUK ( 552359 ) <jeffwright821@NOSPAm.gmail.com> on Thursday August 29, 2002 @02:53PM (#4165744)
    ::Sigh:: you dont need to hack a system to bring a corporation to its knees, you just need to post a link on slashdot...

    anyone have the text?

  • This remind me of similar case in Finland (Score:5, Interesting)

    by jukal ( 523582 ) on Thursday August 29, 2002 @02:56PM (#4165772) Journal
    one guy (I worked with him in same company for some time) broke to a governmental system in Finland in a TV show, don't remember the year, maybe it was around 1985, anyway he was maybe 16 then - just old enough to be prosecuted properly.

    His identity was kept secret in the TV show, but a few days after, the TV station was forced by police to reveal the identity of the guy to get him convicted. The incident got a lot of media coverage, because before that many or most had thought press has the right to protect their "sources" and do not need to reveal details about individuals.

    Anyway, maybe in this Lamo case, it is more about "agitating someone to do a crime", the court might see for example that part of the motivation for breaking in some system could be the fact that he would get press coverage and fame because of it - and NBC would be to blame for agitating.... or something totally different :)

    • Protecting anonymous sources is one thing, but you can't hide behind that if you are witness to a crime.

      "Sorry, I'm a reporter, I don't have to testify" just doesn't hold up.

      legally, if they witness this guy comitting a felony, they are obligated to report him to the police, or be tried as accessories.
    • after some research, the year was 1986, and this was related to FIRST real hacker (yes, they were called hackers, not system crackers for example) in Finland.
    • I find the assumption that reporters are automatically entitled to protect criminals somewhat irritating. Of course there are instances in which it is important to keep the identity of a source confidential for the good of society. All to often however protecting a source is more about the private interest of the journalist.

      There was a piece on NPR this morning where a reporter from the BBC described testifying at Milosevic's war crimes trial. She dismissed the argument that testifying might bring journalists into danger, "we bear witness".

      In the case of journalists interviewing hackers the journalist is often being used for propaganda purposes by the hackers allowing them to propagate myths like they don't try to do harm (most do). It is astonishing (OK no it isn't it is infuriating) how often the hacker's boasts are reported as fact without question. Unfortunately it appears that only the trade press bothers to call up someone like Bruce or myself for a fact check.

      What is worse is that by legitimizing hacking these reports may well come back and cause havoc. The RIAA demand to be allowed to carry out vigillante hacking to stop piracy would if implemented cause serious damage to the network. Hacking attacks frequently cause damage far beyond the immediate target.

  • Lamo is a Script Kiddie (Score:2, Interesting)

    by Anonymous Coward
    Why is Security Focus making such a big deal out of Adrian? Hes nothing more than a script kiddy except he doesn't deface websites, he goes straight to the media for some mediawhoring fame. Hundreds of people do the same junk Adrian does daily, except they don't go lookin for press attention, they report the problem to the corporation and go on with their business. Adrian on the other hand spends days or weeks behind corporate firewalls for his own personal amusement, then when he get bored he goes to the Media for some tender loving care.

  • Backed out too late? (Score:4, Insightful)

    by bgarcia ( 33222 ) on Thursday August 29, 2002 @02:59PM (#4165801) Homepage Journal
    ...network lawyers pulled the plug on the Lamo package out of concern that NBC might have acted improperly in filming the hacker committing computer crimes for the sake of the camera.
    Since they've already asked him to hack a network, and they've already filmed it, aren't they already in trouble? They shouldn't be off the hook just because they're not planning to air it, should they?
    • If I ask you to break into my appartment without breaking anything (ie, picking the lock, climbing in an unlocked window) while I'm watching, did you break the law?

      Is it different, just because it happens in "cyberspace"?
      • Is it different, just because it happens in "cyberspace"?

        Yes, of course it's different. That's why you can get it patented, right?

        (That was sarcasm, for those of you who didn't pick up on it)

  • NBC seems to think that if you hide under a rock, maybe the monsters will go away.

    Have these people never heard of TCP Wrappers and IPFW? I suspect not. All confidential information should be BOTH firewalled and TCP Wrappered (DENY) by default to all domains, then added on a IP by IP (or local domain) basis. I get the feeling of admins took the time to do this very basic thing, 90% of all cracks would not occur.

  • Maybe he's just a Geek (Score:4, Funny)

    by gelfling ( 6534 ) on Thursday August 29, 2002 @03:01PM (#4165822) Homepage Journal
    I mean this is television. Maybe they took one look at him and found out he was not the buff trim hunky reality TV piece of meat that gets on TV nowadays. Maybe he has Tourette's, who knows. Why would you want to watch his interview.

    Lamo: "Uh I haXord their shit in about 5 minutes it was Leet! they left a service password called PASSWORD on this gateway node and once I was there I forged an IP address or two...."

    Brokaw: "ZZZZZZZZZZZZZZZZZzzzzzzzzzzzzzzzzzzzz........"

    • I mean this is television. Maybe they took one look at him and found out he was not the buff trim hunky reality TV piece of meat that gets on TV nowadays.

      Another Simpsons quote,
      They're looking for tv ugly... not ugly ugly.

  • As an ex-hacker I tend to only trust Mac OS server (Score:2, Troll)

    by Anonymous Coward
    Although RIAA website was defaced yesterday, and now NBC learns it too is easily hackable, It amuses me that people keep forgetting that no MacOS based webserver has ever been hacked into in the history of the internet.

    The MacOS running WebStar and other webservers as has never been exploited or defaced, and are are unbreakable based on historical evidence.

    In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.

    That is why the US Army gave up on MS IIS and got a Mac for a web server.

    I am not talking about FreeBSD derived MacOS X (which already had a more than a couple of exploits) I am talking about current Mac OS 9.x and earlier.

    Why is is hack proof? These reasons :

    1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT

    2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root there is no false sense of security, and programming is done carefully.

    3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not.

    4>: Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not mere file name extension). File types on Macs are not easily settable by users, expecially remotely. Apache as you know has had many problems in earlier years preventing wayward execution.

    5> Macs never run code ever merely based on how a file is named. ".exe" suffixes mean nothing! For example the file type is 4 characters of user-invisible attributes, along with many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For example file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable by designof creating an executable file. The file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually. TOTAL security.

    4> Stack return address positioned in safer location than some intel Osses. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.

    7> There are less macs, though there are huge cash prizes for cracking into a MacOS based WebStar server (typically over $10,000 US). Less macs means less hacker interest, but there are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes, so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc). But some huge high performance sites use load-balancing webstar. Regardless, no mac has ever been rooted.

    8> MacOS source not available traditionally, except within apple, similar to Microsoft source only available to its summer interns and engineers, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.

    Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.

    One 3rd party tool created the only known exploit backdoor in mac history and that was back in 1995 and is not, nor was, a widely used tool. I do not even know its name. From 1995 to 2002 not one macintosh web server on the internet has been broken into or defaced EVER. Other than that event ages ago in 1995, no mac web server has ever been rooted,defaced,owned,scanned,exploited, etc.

    I think its quite amusing that there are over 200 or 300 known vulnerabilities in RedHat over the years and not one MacOS 9.x or older remote exploit hack. There are even vulnerabilities a month ago in OpenBSD.

    Not one exploit. And that includes Webstar and other web servers on the Mac.

    A rare set of documentation tutorials and exercises on rewriting all buffer LINUX exploits from INTEL to PowerPC was published less than a year ago. The priceless hacker tutorials were by a linux fanatic : Christopher A Shepherd, 3036 Foxhill Circle #102, Apopka, FL 32703 and he wrote the tutorials in a context against BSD-Mach Mac OSX.
    but all of his unix methods will find little to exploit on a traditional MacOS server.

    BTW this is NOT an add for webstar.. the recent versions of webstar sold for over the last year are insecure and cannot run on Mac OS 9.x or 8.x, and only run on the repeatedly exploited MacOS X.

    --- too bad the linux community is so stubborn that they refuse to understand that the Mac has always been the most secure OS for servers.

    BugTraq concurs! As does the WWW consortium.

    • Interesting? Please.

      This is a verbatim repost of an old troll--which, I might add, was shot down point for point for point.

      "No root user" is NOT the same thing as "always running as root".
    • He's absolutely right. Neither one of them have yet been hacked. ;)
    • I have nothing against most of your points, but I have a few little nits to pick:

      2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root there is no false sense of security, and programming is done carefully.

      Perhaps this is a philosophical nitpick on my part, but by extension shouldn't this mean that the vast majority of Windows programs should be incredibly secure? Prior to NT, all Windows developers were guaranteed that their code would be running as 'root'. That's a lot of developer-time spent in a world where everything is root. And yet, somehow, Windows still seems to have its share of security problems.

      I'm not saying that Macs are as insecure as Windows boxes, just that I'm having trouble following the idea that "always being root" somehow makes programmers more security-conscious.

      3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not.

      A buffer overflow is a buffer overflow is a buffer overflow.

      If you don't check that your destination buffer is big enough to hold the contents of your source buffer, then your code becomes a bug in search of an exploit. Doesn't matter if the length is stored at the beginning, doesn't matter if you count until you find a NUL. If you copy from A to B and sizeof(B) < sizeof(A), you're just looking for trouble.

      Yes, ladies and gents, sometimes size does matter...

      • Prior to NT, all Windows developers were guaranteed that their code would be running as 'root'

        True...how many Windows 95-based web servers are there?
        • True...how many Windows 95-based web servers are there?

          IIRC, the (admittedly cheesy) Microsoft Personal Web Server was shipped with Win95. (Don't have any 95 boxes anymore, so won't swear to it. Win 98 definitely comes with PWS.)

          Apache. (They're very open-minded. :-)

          Quick check on TuCows shows 9 more web servers supporting 9x.

          CNet's download.com has a whopping 192 entries in their Windows/Web Authoring/Servers area if you filter it down to Win95. But take CNet's count with a grain of salt...they don't seem to differentiate between server-support/test apps and actual servers. But I'm not gonna hunt through a list that size to get a better count.

          Anyways, I think it's safe to say that, strange as it may sound, there actually are Win 9x-based servers available.

          Okay, but we're starting to wander from the original "Macs are secure because they have no security" topic, which was already wandering pretty far from the "hacker denied 15 seconds of fame" topic.

          I'd ask someone to mod me down, but saying "yeah, go ahead, mod this down" always seems to end up with people modding it up to +5 Insightful because it's got that ever-popular angst-driven sound first popularized by Eeyore. (Donkey. 100 Aker Woods. Cristopher Robin. Ah, never mind....)

          Ahem... Okay people, listen up! My post is not insightful. It's offtopic! "Offtopic" might look a lot like "Insightful" in the moderator pulldown, but if you look really closely, you'll notice that they're spelled slightly differently. Yes, I know it's subtle...they both start with a big letter and have smaller letters afterwards. Just hang in their, kids...hopefully the next SlashCode release will have a picture-based moderation system.

    • "Based on historical evidence..." (Score:5, Funny)

      by volpe ( 58112 ) on Thursday August 29, 2002 @04:08PM (#4166341)

      The MacOS running WebStar and other webservers as has never been exploited or defaced, and are are unbreakable based on historical evidence.
      Based on historical evidence, my backyard shed is burglar-proof.
    • there has never been a Mac exploited over the internet remotely

      ...until this post was read by hackers...

    • why has the parent been modded as troll? It's all true, my school uses MAC OS and webstar servers and it's never been hacked (there are 10,000 people who go there as well as a large computer science department)
    • sure, it's a troll, but it's also wrong.

      http://attrition.org/mirror/attrition/os.html#AL L

      Sure, the MacOS/MacOSX defacements only represent 0.8% of total defacements, but they're still there :)

      -gleam

  • Priceless (Score:2, Funny)

    by Anonymous Coward
    PCMCIA 10/100 Ethernet Card for Laptop - $45
    Six pack of Rockstar "Energy Drink" - $6
    Network time at the local Kinko's - $2.50/hour
    Getting booted from NBC Nightly News after hacking their intranet - 5 minutes effort


    Scoring with the hot NBC Nightly News Producer because she's impressed with your k-r4d sk|llz - priceless

  • Stupid people. (Score:3, Interesting)

    by beleg777 ( 551987 ) on Thursday August 29, 2002 @03:06PM (#4165861)
    Only stupid people are more concerned with the fact that they were made to look bad than with the underlying truth. Instead of getting offended they should have put the kid in touch with their IT team. Or put him on it.
  • The media portraits "hackers":

    For his part, Lamo, who's not known for shrinking from controversy , charges the network with a failure of courage. "I can understand where they're coming from," says Lamo, in a telephone interview from somewhere on the East Coast. "But I like to think that in their place I'd take more of a risk.

    Somewhere, disguised, with computer parts laying around... It seems like Lamo didn't want to give his location, yet, there were hundreds of ways to finding out.

    Why speak of "hackers" like this? Are they still a sub-culture, marginalized?

  • I'm actually surprised. (Score:3, Interesting)

    by Mulletproof ( 513805 ) on Thursday August 29, 2002 @03:07PM (#4165876) Homepage Journal
    No, really. Given the media's track record and history of hacker over-sensationalism, this story would have been the perfect oppertunity to whip your Senator, the public and your turtle into an anti-hacker frenzy. Had this story aired, I'm sure you'd be reading Anti-hacker sediment in place of this piece your reading now. The governement would be riding the anti-hacker bandwagon with full force if they actually saw how easy it was to hack into a major corporation. They wouldn't even have to air any detail; Que darkened room, silhouette of Joe Hacker, a few comments from him about what he was doing (computer masked, of course) and that sinister Nightline narrative they use for melodrama. Toss in a few screen shots of complicated, yet meaningless clips of him navigating the network and bam-- Instant media frenzy. Who cares about Tommy boy, the fact that Lamo is willing to be used as an obvious pawn in the media spotlght is scary in it's own right. Sure, he'd have his 15 minutes... Then watch as it was used to destroy his world with laws and legistlation.

  • Lamo is my hero (Score:5, Interesting)

    by zaren ( 204877 ) <fishrocket@gmail.com> on Thursday August 29, 2002 @03:07PM (#4165880) Journal
    He got into Worldcom's systems while I was working there, and it threw the entire company for a loop - out of the blue, passwords were expired en mass on various portions of the network, and a weak VPN software package was crammed down the throats of the Windows users. Thousands of people had to get it installed, and ALL of the registration and training and configurations had to be handled through a VERY small pipe. That was an interesting time... good thing I wasn't one of the people that had to rely on the VPN software to do my job.

  • Hmm.. Deep, dark left-wing conspiracy? Or.. (Score:2, Interesting)

    by Anonymous Coward
    It could be that this just isn't news.

    I mean if he pulled off some kind of crazy technical exploit that would expose a gaping security hole in the OS that left all our sensitive data exposed, and would shock and more importantly entertain the viewing audience, maybe.

    He just got lucky and guessed a password.

    Boring.

    Its not even exciting to /. geeks. What makes you think a television audience would tune in?

  • Behind the scenes (Score:5, Funny)

    by Ilan Volow ( 539597 ) on Thursday August 29, 2002 @03:17PM (#4165949) Homepage
    Teenage intruder: See? I run nmap 234.34.53.5 and I get a list of all the ports that are open on their machine. I can then do some other stuff with libpcap...

    Brokaw: Wardrobe!....dammit, get this kid a large sleek trenchcoat, combat boots, and a pair of those $300 designer sunglasses. They're expecting neo, not urkel. Audio!...cue that "techno" music they listen to. (to "hacker")Okay, kid, your motivation is to disrupt The System, bring down The Corporate Machine that runs the government, and then make it with Carrie Ann Moss in a hovercraft.

    Teenage intruder: But I just thought I would show you how I learned about this network vulnerability in my quest for knowl....

    Brokaw: (to cameraman) Start rolling in five, four, three, two...
  • You mean those talking heads on TV are real people? I thought they were all synthetic actors [ananova.com]

  • teleprompter (Score:5, Funny)

    by Bowling Moses ( 591924 ) on Thursday August 29, 2002 @03:22PM (#4165980) Journal
    It would have been great if he would have gotten into the NBC Nightly News teleprompter and put at the end of Tom Brokaw's lines "...and in other news, while visiting a low-income daycare center Dick Cheney bit the head off an infant. Additionally, I am a turnip, vroom vroom."

    I bet he'd say it.
    • Brian Williams would. Tom Brokaw is old-school enough that he would probably read what he says first.
    • How about "...and in other news, while visiting a low-income daycare center Dick Cheney bit the head off an infant, Texas-style!!!"

      I don't know who the damn /. poster was that started that Texas-style thing, but it's been stuck in my head since yesterday.
    • Although the host that stores the script for editing may be on the station internal LAN, with little or no security, the teleprompter itself is unlikely to be networked, and if so, is most likely on a private segment, not the main LAN.

      In general, broadcast station teleprompter hardware itself is very old technology, with a simple serial cable to load the script (a text file with some very simple markup sequences to adjust speed, fonts, etc)

      Among the cheapest "professional" teleprompters are Stewert, starting around $1K. You can throw together your own home-brew solution for a few bucks, but "real" TV stations are sticking with the old, expensive, pre-MS-Windows solutions.

      Usually the producer and on-air talent will run through the script at a high speed (just barely readable without practice) shortly before going on air, so your timing would have to be just right if you want to add any extra little "suprises" with any chance of success.

      It's an interesting idea, but even for a live news broadcast, it's not likely that you would slip anything through.

  • His website (Score:2, Interesting)

    by EricMcD ( 83669 )
    FWIW, his website is http://adrian.adrian.org

  • Okay... (Score:5, Funny)

    by Orne ( 144925 ) on Thursday August 29, 2002 @03:32PM (#4166050) Homepage
    So, maybe he doesn't get his exposé on NBC about cracking NBC's networks...

    But I'll bet that ABC would be happy do do a report on cracking NBC's networks...

    Where are you, Mr. Jennings...

  • Breaking into NBC's Intranet (Score:3, Funny)

    by Mupp252 ( 263650 ) on Thursday August 29, 2002 @03:33PM (#4166062)
    Lamo's comment: "It was a very full service system."

    Ohh, Adrian. You should change your name from Lamo to Lmao with those witty one liners!
  • http://online.securityfocus.com/news/595 is /.ted, so they will send in few hours a new security report of the worst DoS they just found.

    ...to avoid the DoS attack, avoid writing anything which could be interesting to those geek/nerds/freaks that waste their whole life in...

  • Have you ever noticed that Tom is the drunkest sounding sober person you'll ever hear?

    I bet the hacker noticed that there's an IV going into him from under the desk, and electrodes attached to his nuts if he decides to do anything stupid.

  • ...to Globo (the major TV network in Brazil). No, I'm not Brazillian, but they got my name from some contacts-- long story, I don't have time to go through that.

    Basically, I got a call from a Producer (David Something-I-Can't-Pronounce) wondering if I'd be interested in coming down to their studio (I was in college in NYC at the time, and they're on 9th and 50-somethingth) and trying my hand at their system. I tried to borrow a friend of mines laptop so I could bring a sniffer, but I couldn't find him in time.

    Instead, I went down there, "borrowed" a laptop from them, and quickly installed linux. Explaining that this is what I'd use myself, I plugged into a convenient network jack and started working.

    Long story short, I chose as my victim the reporter (not the producer) who would be interviewing me later), her name was Anna Padrao Something-Begining-With-A-P. Well, her password was app426, where 4/26 was her b-day. *yawn* The only major problem was that once I was in to their BBS-like system, it was in Portugese, which I don't speak! Of course, that also let me into her email account, and she even had a shell account on their email server-- though I know she didn't even know it.

    I was going to go after root next, but we had to film, so we stopped there. We filmed the whole segment, but then some higher-up though it'd embarass the network too much, so it was pulled. I still have a copy-- kinda cool to see your own voice subtitled in Portugese :)

Slashdot Top Deals

Over the shoulder supervision is more a need of the manager than the programming task.

Close