nCircle.com >> 360 Security

« cansecwest/core06: "final notes on day2" | Main | SCADAGard SIG To Be Established »

The Anti-sec Movement: Why?

Some folks out there might not be aware of something called the 'Antisec' movement. I don't know enough about it to state the size of it or the organizational structure, but I suspect it's not particularly large or well organized. If I had to guess I would say it is a mirror image of the hacker culture that it is a part of; loosely organized, chaotic, and flexible.

But it appears to be unlike hacker culture in a very important respect: they want to keep information secret. Without digressing into the problems of defining the word 'hacker', suffice it to say that I'm using it in its first, proper and pure sense: a person who loves exploring and gaining new knowledge.

I've been trying to figure out the motivations of the Antisec movement. It's not as simple as it might seem because the issue boils down to philosophy. And when you get that low level, minor variance in thought can be a world of difference (Look up the Athanasian and Arian schism in the early Catholic church if you want an illustrative example).

I admit at first I wanted to get on this topic because the whole idea of the Antisec movement bothers me. I believe (with some exceptions for personal information) that information should be free. Especially anything of a scientific and technical nature. I don't respect people that discover info and keep it 'close to their chest'; 0 days should be put out as soon as you find them. Embarrassing people into action is a function of a free press, I think - so when you take information and confine it to a small cabal of people, you're slowing the progress of the human race, whether you like it or not.

Then I read the "Stop aiding an industry which just hurts humanity" article at this url: http://antisec.wordpress.com. I don't agree with all of it, but they did make an interesting point. Security can be used for oppression. We can see it in totalitarian regimes such as China, and too many other places. Sadly, North America seems to be creeping ever closer towards a corporate driven police state so it does bear heavily upon us to keep this issue in mind if we want to preserve our shrinking freedoms. The author wasn't necessarily writing about something in a far-away land.

Otherwise, I think the author is wrong. Security, in my mind, can be treated as a tool. It is neither good nor bad in and of itself. It is the motivation of the human wielding it that makes the difference, and the results that human achieves. Much like people that that say silly things such as knives and guns being bad. No, they're not. They are impotent lumps of matter that do nothing until someone picks them up. Security is similar. That same encryption that lets people hide sick trash like child porn is the same encryption that lets political dissidents in countries fight for freedom and smuggle their families to safety. Just like a gun that kills someone during a robbery could be a gun that helped bring the USA it's independence.

As for people that bemoan the commercialization of the security field, I'm still rolling that one over in my mind - not entirely sure what to think. I can see why people might think it sucks, but it's also been good in some ways. There's alot more people in the field now which means that there's alot more friends to be made. Alot more knowledge to be produced. And alot more stuff to be hacked and challenges to be had! Now that there's more and more cash in this space, look at it as a new Golden Age! There's going to more tech coming, faster than ever. More exploration to be done - how is that a bad thing?

Sometimes I think the whiners in the Antisec movement might be the criminals bemoaning the loss of tools and information that made it easy to steal and behave in a dishonourable fashion. I guess if my identity and/or income were derived from lameness such as selling 'sploits for cash I'd be upset. I guess if I defined my whole sense of cool by having more 31337 info than some other dude in IRC, I'd be upset. But that's juvenille. If you really care about Antisec from an honourable and philisophical perspective, why aren't you making tools that fight against oppression? Why aren't you breaking into networks and securing them? Why aren't you making the world a better place? Pretending to be one of the authors of CANVAS and posting to our blog as an agent provocateur, to discredit someone or start a fight is weak, dude. You can do better.

Antisec folks, please stop attacking people personally. It's weak and cheesy, and only makes people want to fight harder against you.

Comments (11)

weev:

This post demonstrates a complete misunderstanding of the antisec philosophy which by the way had nothing to do with my fucking hilarious Dave Aitel impersonation.

"It is the motivation of the human wielding it that makes the difference, and the results that human achieves."

Yes, and I put my tools in the hands of honest revolutionaries while you whore yourself out for the allmighty dollar. You know nothing of real ethics as your only perception of right is economic might. To resist is to exist.

"If you really care about Antisec from an honourable and philisophical perspective, why aren't you making tools that fight against oppression?"

I have been actively involved in the production of many such tools. Whitehats only have seen a couple of them, those plagiarized by traitors to the underground who hoped to leverage the publicity to gain themselves jobs with an ethically bankrupt industry.

I spend my time guided by the ethics of the classic Greek philosophyers, doing what is right and not what gains me the largest profit windfall. Can you say the clients of your employers are doing the same?

Byron Sonne:

No, I can't say the clients of my employers are doing the same. I don't know them well enough, but I would guess you're right in a significant number of situations. I'm not a fan of capitalism myself.

And I'll take you at your word that you really have created such tools and put them in the hands of people that matter. Maybe these people were revolutionaries. Maybe these people were mass-mudering terrorists. Like Tamerlane, one man's national hero is another man's villain. And like it or not, as a participating member of society, you're contributing to the very machine you're fighting against. So get off your high-horse; you're helping to destroy the planet along with the rest of us.

Mind you, I'm not a whitehat, blackhat, greyhat or whatever. Lables are stupid. I'm in it for the thrill of the exploration, and the money is secondary. I just like learning neat things. Truth be told, I don't need this job. But I want it.

You can claim to be as classically guided as you want, that's great. But you, like the rest of us, are still looking at shadows on the cave wall and can't perceive reality any more deeply than the rest of us. And might I remind you that the ancient greeks also produced the Sophists, so be careful from whence you claim guidance. Aristotle was a rampant misogynist - do you follow him too?

If you want to keep knowledge secret, out of the hands of people, you show an improperly formed understanding of the underlying, guiding principle of the ancient philosophers. I can buy philosophy books off Amazon.com too, ya know.

Clearly, by the phrase "You know nothing of real ethics as your only perception of right is economic might" you have no idea how deeply wrong you are. Granted that I do whore myself out for money (how do *you* pay the bills? I don't see you sitting under the Bodhi tree); life is imperfect but I try to follow the Tao where it takes me and try to do the least harm possible. Clearly you've never read anything else I've written here. Dig it up - I'm probably closer to thinking like you than you want to realize.

I also suspect you might want to have used the word 'morals' instead of 'ethics'. 'Morals' are the principles, and 'ethics' is the system built around them. It's entirely possible that I *do* know 'real ethics', it's just that my morals differ from yours. Not that I'm a moral relatavist; I think moral relativism is crap. Some things are right, and some things are wrong. But I digress.

I didn't find your Dave Aitel impersonation particularly amusing. It's a coward who won't stand up and attack someone in the open using their real name (unless your life is under threat, and I don't think that's the case here). When I took issues with Immunitysec.com, I used my real name. Could *your* self-image survive without a nom-de-guerre?

So, if I'm ignorant of the antisec philosophy, then tell me what *you* think it is. If you're really, truly interested in enlightening people, that is. I promise you that you will find an audience that will listen to you.

weev:

"(how do *you* pay the bills? I don't see you sitting under the Bodhi tree)"
I spam and produce tools to facilitate the actions of Internet criminals. Assisting in annoyance or destruction is the only honorable profession one may have these days.

"'Morals' are the principles, and 'ethics' is the system built around them."
No doubt your concept of ethics has been poisoned by exposure to modernity without proper perspective. The classic Greek philosophers thought not of ethics as a mere system of rules and regulations, but as a path in and of itself. The only path to a fulfilling life. The descriptive view is of ethics is a modern monstrosity wearing a deceptive mask of empiricism. It allows people to justify serving an system that has long abandoned any notions of justice or liberty. Putting social dynamics in the perspective of classic analytical ethics makes any justification for rule of law fall apart.

"I didn't find your Dave Aitel impersonation particularly amusing. It's a coward who won't stand up and attack someone in the open using their real name"
I was making a fucking blog comment, not using a stolen SSN. Get over it. Impersonation has been an effective tool in satire and parody for hundreds of years. Dave Aitel has stated that "Abad can suck my dick" so I figured I'd take the chance to make him look like the enormous douche that he is. It was spot-on hilarity, and around 30 observers on IRC msg'd me to comment on the accuracy of my aiteld portrayal.

"So, if I'm ignorant of the antisec philosophy, then tell me what *you* think it is. If you're really, truly interested in enlightening people, that is. I promise you that you will find an audience that will listen to you."
The antisec philosophy is quite simple. I can break into into powerpoint style bullet points:

1) Hacking is about breaking into networks without permission. Any whitehat attempts at turning it into some socially "beneficial" pursuit are a vile attempt at meme poisoning. Hackers develop tools and techniques intended to break into networks and systems. Hackers USE those tools. They do not publicize ways to prevent their use or sell them to the highest bidder.

2) The corporate oligarchy at large collected their assets in manners that are unethical. It does nothing but abuse the wealth and power it has stolen. It has no right to its holdings and hackers have a moral obligation to take what they can from it.

3) The first-world governments (most notably the United States government) are corrupt feudalistic shitholes that have long abandoned any notion of civil rights or free markets and need to be destroyed.

4) Based on points 2 and 3, the only honorable thing to do is assist in the damage to the corporate oligarchy and first-world governments. Anyone that is acting to assist them is part of the problem. Hacking is about ruination and destruction, Kali and Shiva, the angry vengeful God of the old testament, etc.

Byron Sonne:

Thanks for posting that; it was quite interesting. It's also nice to finally get a solid handle on what the philosophy is. I don't like not knowing things.

But I disagree with you on what the hacker ethic is. The ethic, as I believe in it, is most clearly and beautifully described in the book 'Hackers' by Steven Levy (http://www.echonyc.com/~steven/hackers.html). To me this is the true Ethic. I would be really interested if you could give the book a read and let me know what your interpretation of it is.

I appreciate the role of chaos and anarchy in the universe; we simply can't have order without disorder and vice-versa. There's no way to seperate the two, or eliminate one or the other.

My view of security, and computer administration for that matter, is that we are the active component of the universe that counteracts the inevtiable slide into chaos, the heat death, of the universe. Someone suggested that if this were AD&D, I'd be 'chaotic good' and you'd be 'chaotic evil' but I'm not sure I agree with that. Destruction can be good.

Since it appears you *do* have the best interests of the human race at heart, I wish you good fortune in your endeavours. While I vacillate between thinking the whole machine is so rotten it needs to be torn down and rebuilt from scratch, part of me can't help but feel that there must be a more constructive way to do it.

Joe Boyle:

Gentlemen, give me a break.

Byron, while you may be sated to have merely lured weev into engaging you at all, you're letting him off the hook entirely too easily. Secondly, with all due respect to your sincerity and intentions, and while you may not even identify as "whitehat", the ideology you espouse is taken verbatim from the 20th century Whitehat Official Playbook. That book is now quite dated and while it may remain historically relevant and interesting to future generations, citing from it in earnest only serves to perpetuate what has long been a frustratingly unproductive public discussion. (I mean the larger public discussion, not this blog entry.)

As jwiesz has already diplomatically pointed out, "free the information" is now the trusted motto of people who simply possess no information. "Free the information" was born of the same revolutionary spirit weev mentions, as a reaction against an authoritarian culture that sought to oppress creativity and inspiration; not in defense of lofty values, but to protect itself against embarrassment.

Whenever "free the information" was coined, there was no internet security industry. Now that there is, and now that that industry is well into its puberty, the stodgy business minded decision makers begin to sound more like the oppressors than the liberators of that information. Have I experienced that personally? No, but I know people who have, and they are deeply embittered by the betrayal of their trust, not just in that they are no longer living up to the same romantic ideals lovingly lifted from Levy, but because they now act in opposition to those ideals for money.

So Byron, I have a different reaction to "the antisec movement". Unlike yourself, its existence does not want to make me fight them harder: it makes me want to laugh. Not just because I think it is often unintentionally funny (and I certainly do), but also because it is actually TRYING to be funny. Has no one else noticed the irreverent pranksterism in all these acts? The scary appearances of "the antisec movement" and the acts it perpetrates exhibit a disparity that is hard to reconcile.

Which brings me to weev, the "agent provacateur" as you called him. I think I would sooner dub him an "agent schizophrenique", because I don't think he can fully control his Jekyll, even when he clearly wants his Hyde to be taken seriously. Even in the context of a seemingly heady philosophy discussion, he is cracking wise about satire and parody being used for "hundreds of years". Does that alone invalidate his other more serious points? No, but it doesn't exactly expedite the path to resolution either. More importantly, is it funny? Yes.

weev, as for impersonating Dave Aitell, I don't know him or his mannerisms, so I don't know if that was funny or not - but if it was funny, it was funny at his expense. If it was funny, it was also funny at tk's expense, who incidentally has responded to this (and every other) little e-drama tantrum with both honesty and diplomacy. Is he then just collatoral damage? In the grand scheme of pranksterism, this is no great offense, but it reeks more of bitterness than hilarity.

Also, while you're entitled to as many voices as you want, it would be naive to expect anyone not to hesitate when taking you seriously. Your situation is not unlike Jerry Springer when he ran for Senate. Jerry may actually be an intelligent responsible person off camera (indulge me for a moment), but the only Jerry Springer anyone else has ever known has been a sensationalist media exploitation artist. In my opinion, you face the same problem.

Honestly, and respectfully, I happen to think your powerpoint manifesto is a house of cards. I also think the entire idea of engaging in philosophic debate over the alleged superiority of your moral compass is counter-productive to your stated goals. Are you on some sort of membership drive for anti-sec warriors number two and three? The anti-sec ideology you seem to be advocating is as irrelevant as the whitehat ideologies bsonne started this whole thread with in the first place. If you really want to advocate an alternative to the contemporary "research for pay" model, I suggest something a little more mature than the script to Red Dawn.

While you may say you live by some ancient greek credo, you have failed to name which credo that might actually be. (I don't recall reading about liberating the public by way of spam and poopoobbq in any of my philosophy courses.) Let's face it, your allegedly principled guerilla resistance is an exercise in anarchist dada mischief at best. Why you are trying to dress it in an intellectual gown is completely beyond my imagination.

Please, lets not take this too seriously.

antisec is dead, long live lolsec,
joe

Byron Sonne:

Joe, my initial response to reading your comment was "Ouch!" but I dug it anyways :) I love talking about stuff like this because I spend alot of time thinking about it. I don't know if it's productive or not, but to me this whole thing is merely a conversation in public, albeit one that might seem I've hit the bong or had a few too many beers first.

Sure Levy's credo might be old. Sure it might be representative of whitehat (god I hate these 'hat' terms) credo. But quite honestly, it's what I feel... although now especially, I'm coming to realize how imperfectly formed it is. But I don't see how I can abandon it. Why is it irrelevant or antiquated? Because there was no security industry at the time doesn't sound like a valid enough reason to me, although I never thought about that bit before. The constitution is a fairly noble document, is it too outdated? Good ideas are good ideas regardless of their place in time or historical relevance. *That's* why I believe knowledge should be free, both as in 'beer' and in 'speech'. Like that overused, but still accurate "those who don't know history are doomed to repeat it" bit. I just don't think humans are smart enough to know what is going to be good or bad in the long term, so let's put it all out there and make sure as many people have access to it as possible.

I'm very aware that of course I'd be upset if someone leaked my financial and credit data, medical history, sexual predilections, etc into the public domain. I'm not usually talking about this kind of information. I know that being upset about this would make me a hypocrite, but as I'm not a public figure, politician, or a person of any kind of serious power, I don't see how that kind of info could help or harm the world.

To me, it's all about the joy and fun in exploring and gaining new knowledge you didn't have before. To strip away the authority that prevents you from getting your hands on things and seeing what you can get them to do, and how you can pervert them. And that these beliefs will make the world a better place. It's obviously a rather simplistic system, but seems to have done the trick so far. As I said before, I'm just going where the tao takes me. Sometimes that means I do bad, and sometime that means I do good.

I'm not asking people to tell me what to think, but until I resolve the inadequacies in my own belief system, I need to keep hacking away at it. My goal was very much to get more comments from weev, and comments from folks such as yourself. It's interesting, and it might do some good somewhere.

Weev, surely you must have realized that if your goals come to pass, at some point people of oppresive intents, bad folks, would seize power. I still think the jury's out on the "people are naturally good/evil" thing. If things were to go the way you want them to go, how would you prevent things from turning out the opposite of what you want? Why would things turn out any better in the long term if it was done your way/the antisec way? Is it just out of hope?

The only thing that worries me about this whole comment exchange is that I've been baited and made to look like a fool by engaging in conversation that I take seriously and that the other person (weev) doesn't. Although people probably think I'm a freak already ;) I am aware of the humour in the posts, but I chose to avoid that as I thought it detracted from the conversation. Although life without humour would indeed be intolerable.

Gah; here's hoping I haven't been played. Wouldn't be the first time :/ But If I learn something new from it, it hasn't been a waste, even if I wind up looking like an ass.

Byron Sonne:

A further question, if I may (this occured to me last night as I was falling asleep): every movement is subject to the possibility of being co-opted or infiltrated by people for their own nefarious ends. Assuming that the Antisec movement does have all kinds of 0 day and whatnot, what's to stop people from using this for personal greed, or selling stuff for cash?

How does the Antisec movement police itself?

weev:

The whole movement? I have absolutely no idea. For the groups I provide code to, I did multiple implementations of the same exploit and distributed different (often binary-only) versions to each group. The cells that did not redistribute were kept and the ones that resulted in notable disclosures were blacklisted forever. If someone from one of my cells is disclosing it results not in significant nor widespread disclosure.

As for personal greed, my statement that lives of my comrades were unabashedly Parmenidean it was completely sincere. They are all exemplary individuals unbound by avaricious chains of modern excess. Generally for every dollar we keep we anonymously donate a hundred to a list of charities that the network has approved. We all live comfortably but according to the phrase "live simply, so that others may simply live". There is no shortage of revenue; any member of the network may choose to take a larger amount of personal income if they wish.

Byron Sonne:

I think, at last, that I'm finally out of questions. Honestly, I wasn't expecting you to have put this much thought behind things; I half expected you to be an angry teenager who just picked up Marx, Kropotkin or Zeno for the first time or something.

I still disagree with you on a number of points, as they make me uncomfortable. I agree and identify with your end goals, but your methodology still bothers me (I friggin' hate spam, for instance). Nonetheless, I think I grok what you're getting at.

I don't know if I'll be fiddling when Rome burns, but I'll sure as hell find it interesting :) Maybe I'll even throw on a log and grab the marshmallows.

weev:

We aren't communists, and if Zeno wrote anything it didn't survive. You can only read about him through his contemporaries.

Byron Sonne:

Oops... yeah I fucked that up, think I meant to write 'Proudhon' instead.

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

About

This page contains a single entry from the blog posted on April 11, 2006 10:20 AM.

The previous post in this blog was cansecwest/core06: "final notes on day2".

The next post in this blog is SCADAGard SIG To Be Established.

Many more can be found on the main index page or by looking through the archives.