A Summary of Hacking Organizations, Conferences, Publications, and Effects on Society

Alisha Cecil [acecil19@yahoo.com]

Abstract

Table of Contents

• 1.0 Introduction
• 2.0 Hacking Sytles
• 3.0 Hacker Etiquette & Ethics
• 4.0 Hacking Groups & Individuals
  • 4.1 Open Source & Free Software Hackers
  • 4.2 Security Hackers
    • 4.2.1 Chaos Computer Club (CCC)
    • 4.2.2 Legion of Doom (LoD)
    • 4.2.3 The Mentor
    • 4.2.4 cDc Communications
    • 4.2.5 Shadow Crew
• 5.0 Hacker Conferences
  • 5.1 Chaos Communication Congress
  • 5.2 SummerCon
  • 5.3 HoHoCon (or Xmas Con)
  • 5.4 DEF CON
  • 5.5 Hackers on Planet Earth (H.O.P.E.)
  • 5.6 Black Hat Briefiengs
• 6.0 Hacker Publications
  • 6.1 2600: Hacker Quarterly
  • 6.2 Phrack
• 7.0 Hackers Effects on Society
• 8.0 Summary
• List of Acronyms
• References

1.0 Introduction

Before beginning the discussion on the different groups, it is first important to be aware of the different styles of hacking that exist.

Figure 1: Hacking History [Timeline07]

Back to Table of Contents

2.0 Hacking Styles

Now that the different styles have been described, it is important to understand the high-level theories to which there actions can be derived.

Back to Table of Contents

3.0 Hacker Etiquette & Ethics

• "Access to computers - and anything which might teach you something about the way the world works - should be unlimited and total. Always yield to the Hands-on Imperative!"
• "All information should be free."
• Mistrust authority- promote decentralization."
• Hackers should be judged by their hacking, not bogus criteria such as degrees, age, race, or position."
• "You can create art and beauty on a computer."
• "Computers can change your life for the better."

The difference between how these principles are put to use is all in how they are construed. For example Black Hat hackers may read the first principle, access to computers, as right to obtain access in any way possible from any system in the world at any cost.

The Jargon File, a glossary of hacker slang created in 1975 from multiple technical cultures, also provides a definition of hacker ethic [HackerEthic].

• 1. "The belief that information-sharing is a powerful positive good, and that it is an ethical duty of hackers to share their expertise by writing open-source code and facilitating access to information and to computing resources wherever possible."
• 2. "The belief that system-cracking for fun and exploration is ethically OK as long as the cracker commits no theft, vandalism, or breach of confidentiality."

More generally, hacker ethic "is that almost all hackers are actively willing to share technical tricks, software, and possibly computing resources with other hackers" [HackerEthic]. The groups and individuals discussed below have done exactly that. They have shared knowledge in the form of new software suites, vulnerability detection, as well as general computing information with the rest of the world.

Back to Table of Contents

4.0 Hacking Groups & Individuals

4.1 Open Source & Free Software Hackers

Programmers working in the academic culture will modify existing code or resources to achieve their end goal. Major contributors to this group include Linus Torvalds, creator of Linux, as well as Dennis Ritchie and Ken Thompson, creators of the C Programming Language. Richard Stallman, founder of the GNU project, is also a contributor to this group. Stallman also founded the Free Software Foundation in 1985. Table 4.1 below is a list of some of the more popular free software products that exist. To view a complete list of products visit http://directory.fsf.org/.

In the late 1970's, with the availability of the MIT's Altain, hobby hacking became popular. Members of this home computing genre, Hobbyists, focus mainly on commercial computer and video games, software cracking, and modification of computer hardware and other electronic devices (modding). The creator of Apple I and II series computers, Steve Wozniak, and the co-founder and chairman of Microsoft, Bill Gates are two individuals that prospered in this era [Hacker07].

All of these individuals worked under the realm of definition one of the Hacker Ethic of the Jargon File, unlike their counterparts the security hackers who more closely followed definition two.

4.2 Security Hackers

With the release of the movie War Games in 1983, public awareness was raised to the idea that national security could indeed be compromised by computer security hackers. This concern materialized when a group of teenage hackers in Milwaukee, WI, known as the 414's, broke into computer systems across the United States and Canada. The 414's received extensive news coverage, which in turn caught the attention of Congressman Dan Glickman. As a result, he called for an investigation and for laws to be established in the area of computer hacking. On Sept 26, 1983 a member of the 414's, Neal Patrick, was called before the US House of Representatives to testify about the dangers of hacking. In turn, six bills on computer crime were introduced by the House later in the year [Hacker07].

The groups below have been major influencers to the security hacking environment and to those which are entering the hacking scene.

4.2.1 Chaos Computer Club (CCC)

Aside from their security risk demonstrations, CCC also hosts Europe's largest annual hacker conference known as the Chaos Communications Congress. In addition to the Congress, they also host a Chaos Communication Camp every four years in a city that is near Berlin (cities change each camp). Other undertakings of CCC include the quarterly magazine, Datenschleuder ("data catapult"), and a monthly radio show in Berlin called ChaosRadio [CCC07].

While CCC is an international hacking organization that contributed to the hackers of today, the US was also home to some of the more influential groups as well.

4.2.2 Legion of Doom (LoD)

They gained their fame from their creation of the first invitation only hacking based BBS. The BBS had a security system that caused the system to remain idle until a primary password was entered. LoD's BBS was also the first to engage in behaviors such as social engineering. To ensure the high quality of message content, access was only allowed to highly knowledgeable users. The members of the group also tried to stay very low key and therefore only traded info to select BBSs and via personal telephone conversations.

Like the CCC, LoD published a semi-regular electronic magazine, The Legion of Doom Technical Journal, which contained files and other items of interest to the hacking community. Copies of the Technical Journals can be found at http://www.textfiles.com/magazines/LOD. Its name is a parody of the ancient and honored AT & T Technical Journal [Sterling]. Only three journals were ever published. During the making of the fourth issue several members were raided by the Secret Service and similar organizations, which put a halt to its publication.

A couple different opinions of the LoD have evolved over the years. One opinion is that in its years of operation, the LoD may have entered tens of thousands of systems, and peeped into credit histories and monitored telephone calls, but caused no direct harm to the phone systems or networks they took over [Phrack-LoD]. On the other hand, many members were raided and sometimes successfully prosecuted for causing damage to systems and reprogramming phone company computers [LoD07]. Among the members arrested was Loyd Blankenship, who went by the alias of The Mentor.

4.2.3 The Mentor

The manifesto gives an insight into the psychology of early hackers. It is said to have shaped the hacker community's view of itself and its motivations. In the manifesto, hacking is explained as a way to learn when you are bored in school and smarter than other students. It is more than just selfishness or the desire to exploit and harm others, it is a technology that should be used to expand the horizons and try to keep the world free [Manifesto07].

As a member of the LoD, he ran a BBS known as The Phoenix Project from his home. It was a local meeting place for elite members of the LoD. It became one of the most infamous BBSs due to its involvement in the E911 Case. For more information on the E911 case visit, http://everything2.com/index.pl?node=the%20E911%20Case. The Phoenix Project was a target in the E911 investigation due to its reputation in the underground hacking scene and due to Loyd's prior hacking arrest. On March 1, 1990, after the Secret Service raided Loyd's house and workplace and confiscated equipment and computers, the BBS was effectively forced offline [Phoenix05]. Blankenship has since retired and now works as a freelance game developer and electronic musician.

Just as Loyd Blankenship and LoD were well known for their participation in the BBS community, cDc Communications also made an appearance in the BBS scene as well.

4.2.4 cDc Communications

Back Orifice was designed for remote system administration. Its name is a pun of Microsoft's BackOffice Server. The user can control a computer running Windows from a remote location. It was debuted at DEF CON 6 on Aug 1, 1998. Its purpose was to demonstrate the lack of security in Microsoft's OS Windows 98. cDc later debuted Back Orifice 2000, in 1999 at DEF CON 7. Despite its legitimate purposes, there are other factors that make it suited for more malicious activities. The server is capable of hiding itself from the users of the system. It can be installed without user interaction, and can be distributed as the payload of a Trojan Horse. Once installed it will not show up in any task or program lists and is rerun every time the computer is started. Some of its features include logging keystrokes, monitoring network packets and logging plaintext passwords that pass, the ability to redirect incoming TCP or UDP ports to other addresses and ports, as well as any other capability that the user sitting at the machine has [BackOrifice][cDc07].

The other popular tool, SMBRelay was released on March 21, 2001 at the @tlantacon convention. They claimed it took less than two weeks to write SMBRelay. It performs TCP level SMB man in the middle attacks on Windows. It was created to prove that when Microsoft continues to use protocols that have known issues for backwards compatibility, they leave their customers at risk. It has the ability to handle multiple connections at once. It collects password hashes and stores them in a text file using a L0phtcrack compatible format, so that they can be cracked at a later time. They also created SMBRelay2, which is a variation of SMBRelay that works at the NetBIOS level and uses NetBIOS names rather than IP addresses [SMBRelay] [cDc07].

In 1996 cDc Communications created Ninja Stike Force (NSF). NSF is a group dedicated to achieving the goals of cDc both online and offline. Membership is obtained by individuals who stand out in their support of the cDc and its ideals. They are recognized as being the best of the best in their skills. NSF launched its own website, http://www.ninjastrikeforce.com/, in 2006 [cDc07].

In 1999, cDc created a third spin off, known as Hactivisimo. Hactivismo is dedicated to the creation of anti-censorship technology in furtherance of human rights on the internet [cDc07]. The mission statement on their website is "To conduct and publish scientific research in the areas of information technology, communications and electronic media; and, to assist (where possible) non-governmental organizations, social justice groups and human rights entities in the use of advanced information technologies for the furtherance of their works" [Hactivismo].

Although the organizations discussed above were very influential to those interested in hacking and eye opening to those who's systems they hacked, those outside of the technology realm probably were not aware of what was going on behind closed doors. The organization known as Shadow Crew changed all that and made hacking an issue that everyone had to worry about.

4.2.5 Shadow Crew

The Shadow Crew site was a great success from 2002-2004. Although as early as April 2003, federal agents found CumbaJohnny. From that time on CumbaJohnny was working alongside the feds, assisting in gathering, entrapping, and monitoring the site and those that accessed it un-renounced to the users themselves. There were many ways that users could access the site. One was through a secure VPN set up by CumbaJohnny. Those who utilized the VPN were watched closer than others. After long secretive and careful investigation, on Oct 26, 2004, the secret service with the cooperation of police from around the world raided 28 members of the Shadow Crew (most were those that accessed via the CumbaJohnny's VPN) [ShadowCrew07].

It was estimated that at its peak, Shadow Crew had as many as 4000 members. They also had possession of nearly 1.5million credit card numbers, 18 million e-mail accounts and lots of identification documents that were being sold to the highest bidder. More than $4 million in losses was suffered by card issuers and banks worldwide [McCormick05].

Back to Table of Contents

5.0 Hacker Conferences

5.1 Chaos Communication congress

The conference encompasses the main portion of the Congress and is divided into 5 main topic categories.

• 1. Hacking- focuses on current technological development and research regarding hardware and software.
• 2. Science- focuses on the current state of research, and the basic facts of nature, science, and math that affect the initiatives of the hacking community.
• 3. Community- offers a space for meetings of the activist groups attending and developer conferences.
• 4. Society- includes any topics that are affecting the general and free software development society.
• 5. Culture- tries to present unknown things or well-known things in a different light.

The motto of Art and Beauty is "you can create art and beauty with a computer". It is described as a workshop, installation, and a happening.

The last area of the congress is the Phone Operation Center. It is a DECT, Digital Enhanced Cordless Telecommunications, system and phone infrastructure. Participants are allowed to bring their own DECT phone equipment and register it at the conference, so they can contact other participants at the conference free of charge [ChaosCC05].

While Chaos Communication Congress is the oldest hacker convention in Berlin, SummerCon is one of the oldest conventions in the United States started only 3 years after the Berlin convention.

5.2 SummerCon

Just as SummerCon was led by the infamous LoD and paved the way for H.O.P.E. and DEF CON, HoHoCon was led by cDc Communications and also helped pave the way for the more renowned conventions.

5.3 HoHoCon (or XmasCon)

At the time HoHoCon was the largest gathering of those in, related to, or wishing to know more about the computer underground. Attendees were often some of the more notable members of the "hacking" and "telecom" communities [HHC94].

Although HoHoCon was only held for four years it led the way for what is now the world's largest hacker convention, DEF CON which is still active today.

5.4 DEF CON

Besides DEF CON, H.O.P.E is the other conference that is held annually till this day.

5.5 Hackers On Planet Earth (H.O.P.E)

The conferences began by occupying only a small amount of a hotel and grew in size to occupy more than an entire floor of a hotel at its most popular events. The H.O.P.E. conferences are heavily invested in the social and political agendas that motivate and support hacker activity. At H2K2, the second H.O.P.E. conference Loyd Blankenship gave a reading of his Hacker Manifesto and provided additional insight into his writing. The list of HOPE conferences can be found at http://www.2600.com/hopes.html.

5.6 Black Hat Briefings

They also provide training that provides hands on experience with the latest security threats and countermeasures. To find more out about the Black Hat Company go to http://www.blackhat.com.

Back to Table of Contents

6.0 Hacker Publications

6.1 2600: Hacker Quarterly

2600: also sponsors meetings around the world. These meetings act as forum for anyone interested in technology to meet and discuss events in the world of technology, to learn and to teach others. The meetings are open to all age and skill levels. They take place on the first Friday of every month from 5pm to 8pm local time unless noted [2600Meeting].

2600: was the only hacker publication available for its first two years in print, until 1985 when Phrack began producing an underground ezine. Unlike 2600:, Phrack was originally available via an electronically distributed magazine (ezine) on the Metal Shop BBS and was not available in print form.

6.2 Phrack

The last issue, #63, was scheduled for release on July 29, 2005 in conjunction with the DEF CON and What the Hack Conventions. Issue #63 was going to be a hardback version to be distributed at DEF CON but when the printer discovered they were printing a hacking book they refused to print it. Two other individuals stepped up and were able to print copies in time for the conference. Within issue #63 they announced they would continue to release new issues. The most recent issue was released on May 28, 2007 and a call for papers has been put of for future releases.

There is only one official Phrack, however the name phrack has become a symbol for the entire hacking underground and is often reused by other groups to help them gain credibility [Phrack07].

Back to Table of Contents

7.0 Hackers Effects On Society

Big businesses are not the only ones that feel the wrath of Black Hat hacking. Anyone who uses a computer suffers from their works. Hackers use mechanisms such as social engineering and phishing to gather personal information from unknowing victims in an effort further their control. According to Javelin Strategy and Research, in 2005 11.6% of all identity thefts were obtained through online means. Based on the latest 2007 data, the average fraud amount per victim was $5, 720 and the average resolution time was 25 hours [Javelin07]. Computer users also spend time and resources dealing with SPAM. In 1996, a user received an average 2,200 SPAM messages a year, and spent an average of four to five seconds on each message. 28% of the people responded to a SPAM message and 8% of people purchased a product. Time and money spent on SPAM is an ever increasing number, in 2007 alone, the amount of SPAM is estimated to increase by 63% [SpamStats06].

Back to Table of Contents

8.0 Summary

Back to Table of Contents

Acronymns

Back to Table of Contents

References

1. [Hacker07] "Hacker", Wikipedia, 11/8/2007
   http://en.wikipedia.org/wiki/Hacker

2. [Ethic07] "Hacker Ethic", Wikipedia, 11/3/2007,
   http://en.wikipedia.org/wiki/Hacker_ethic

3. [HackerEthic] "Hacker Ethic", The Jargon File, version 4.4.7,
   http://www.catb.org/jargon/html/H/hacker-ethic.html

4. [FreeSoftware] "Free Software Directory", FSF,
   http://directory.fsf.org/

5. [CCC07] "Chaos Computer Club", Wikipedia, 9/20/2007,
   http://en.wikipedia.org/wiki/Chaos_Computer_Club

6. [LoD07] "Legion of Doom (hacking)", Wikipedia, 10/12/2007,
   http://en.wikipedia.org/wiki/Legion_of_Doom_%28hacking%29

7. [Sterling] Sterling, Bruce, "Law and Disorder of the Electronic Frontier", The Hacker Crackdown,
   http://www.chriswaltrip.com/sterling/hackcrck.html

8. [Phrack-LoD] "The History of the Legion of Doom", Phrack Vol 3, Issue 31, Phile #5 of 10,
   http://www.phrack.org/issues.html?issue=31

9. [Blankenship00] "Loyd Blankenship", Everything2, 5/23/2000,
   http://www.everything2.com/index.pl?node_id=565219

10. [Manifesto07] "Hacker Manifesto", Wikipedia, 11/3/2007,
    http://en.wikipedia.org/wiki/Hacker_Manifesto

11. [Phoenix05] "The Phoenix Project", Everything2, 2/26/2005,
    http://everything2.com/index.pl?node=The%20Phoenix%20Project

12. [cDc07] "Cult of the Dead Cow", Wikipedia, 10/28/2007,
    http://en.wikipedia.org/wiki/CDc_communications

13. [SMBRelay] "SMBRelay",
    http://www.xfocus.net/articles/200305/smbrelay.html.

14. [BackOrifice] "BackOrifice, The Worst Case Scenario",
    http://www.cultdeadcow.com/tools/bo.php

15. [ShadowCrew07] "ShadowCrew", Wikipedia, 9/25/2007,
    http://en.wikipedia.org/wiki/ShadowCrew

16. [McCormick05] McCormick, John & Gage, Deborah, "Shadowcrew: Web Mobs", Baseline, 3/7/2007,
    http://www.baselinemag.com/article2/0,1397,1774393,00.asp

17. [CCCongress07] "Chaos Computer Congress", Wikipedia, 9/5/2007,
    http://en.wikipedia.org/wiki/Chaos_Communication_Congress

18. [ChaosCC05] "Chaos Computer Club Events", 22C3, 2005,
    http://events.ccc.de/congress/2005/overview.en.html

19. [SummerCon07] "Summercon", Wikipedia, 10/19/2007,
    http://en.wikipedia.org/wiki/Summercon

20. [HoHoCon07] "HoHoCon", Wikipedia, 11/20/2007,
    http://en.wikipedia.org/wiki/HoHoCon

21. [HHC94] "The Fifth Annual HoHoCon", Cult of the Dead Cow, 12/26/1994,
    http://www.cultdeadcow.com/news/h-con94.txt

22. [DEFCON07] "DEF CON", Wikipedia, 10/13/2007,
    http://en.wikipedia.org/wiki/DEF_CON

23. [HOPE07], "H.O.P.E.", Wikipedia, 9/13/2007,
    http://en.wikipedia.org/wiki/H.O.P.E

24. [BlackHat07] "Black Hat Briefings", Wikipedia, 10/9/2007,
    http://en.wikipedia.org/wiki/Black_Hat_Briefings

25. [2600] "2600: The Hacker Quarterly", Wikipedia, 11/7/2007,
    http://en.wikipedia.org/wiki/2600:_The_Hacker_Quarterly.

26. [2600Meeting] "2600 Meetings", 2600: The Hacker Quarterly, 2007,
    http://www.2600.com/meetings/

27. [Phrack07] "Phrack", Wikipedia, 11/8/2007,
    http://en.wikipedia.org/wiki/Phrack

28. [Phreaking07] "Phreaking", Wikipedia, 11/5/2007,
    http://en.wikipedia.org/wiki/Phreaking

29. [Bulletin07] "Bulletin Board System", Wikipedia, 11/8/2007,
    http://en.wikipedia.org/wiki/BBS

30. [Ezine07] "Underground Ezine", Wikipedia, 10/20/2007,
    http://en.wikipedia.org/wiki/Underground_ezine

31. [Timeline07] "Timeline of computer security hacker history", Wikipedia, 11/29/2007,
    http://en.wikipedia.org/wiki/Timeline_of_hacker_history

32. [CyberSpace02] "Hacking Into Cyberspace", 4/18/2002,
    http://www.units.muohio.edu/psybersite/cyberspace/security/focus3.shtml

33. [Hactivismo] Hactivismo.com, http://www.hacktivismo.com/
34. [Javelin07] Javelin Stategy & Research, "How Many Identity Theft Victims are There? What is the Impact on the Victims?", PrivacyRights.org, 2007,
    http://www.privacyrights.org/ar/idtheftsurveys.htm

35. [SpamStats06] "Spam Statistics 2006",
    http://spam-filter-review.toptenreviews.com/spam-statistics.html

Back to Table of Contents

Last Modified: Dec 02, 2007.