Tag Archives: Ethical Hacking

Ethical hacking: The card game

Whether you are a precocious youngster brought up on classic hacking films or a seasoned professional at the top of his game, Control-Alt-Hack, which has been developed by the University of Washington, is a card game that is worth a try.

The game is based on the pursuit of ethical hacking, which is, in short, the activity that sees individuals, on behalf of an organisation, attack or infiltrate a system in a controlled way so as to establish what weaknesses there are.

Now then, we are quite sure we’ve piqued your curiosity here, so allow us elaborate further. The theme is based on the Information Security industry and attempts to paint an accurate picture of what ethical hacking, sometimes referred to as white hat hacking, is all about.

The premise is that you, along with your fellow players, work for a Hackers Inc, an elite company specialising in network security and data protection. The motto of the company, brilliant by the way, is: “You Pay Us to Hack You.”

“Your job is centred around missions – tasks that require you to apply your hacker skills (and a bit of luck) in order to succeed,” the designers of the game explain.

“Use your social engineering and network ninja skills to break the Pacific Northwest’s power grid, or apply a bit of hardware hacking and software wizardry to convert your robotic vacuum cleaner into an interactive pet toy…no two jobs are the same. So pick up the dice, and get hacking!”

It all sounds very exciting and aside from the fact that it is, in part, a game, the authenticity of it is not to be underestimated. After all, the developers, Tamara Denning, Tadayoshi Kohno, and Adam Shostack, are all computer security experts. They have wanted the game to mimic reality, and thus it has as much “juicy and accurate” content as possible.

While the developers and the university are keen to point out that it should not be mistaken for a being educational – it is, above all, designed for entertainment – the unfolding narratives of the game nevertheless reveal important information security concepts.

Consequently, it can therefore be used as an educational tool, be it in a school session informing the next generation of potential ethical hackers of some of the things they might be involved in, or as a genuinely engaging and fun way of conducting training sessions in a professional capacity.

The game might be fun and a little bit dramatic, a quasi-fictional representation so to speak, but it can be instrumental in triggering new ideas, discussion points and strategies in a decidedly novel way. In this, the efforts must be applauded. Although it is not out yet, professionals, academics and instructors can sign up here for notification.

Before go, we thought we’d elaborate on those timeless hacking movies we’ve all come across. There’s a ton, that much is true, but, for some reason, what came to mind instantly was WarGames with a young Matthew Broderick, the Net, with, well, young Sandra Bullock, and Tron, with Jeff Bridges. And yes, he is young.

To name and shame

Let’s call it a concept. To name and shame, it goes without saying is an interesting moralistic tool, used to punish those who are purported to have committed a crime or wandered off the path that keeps society together.
Like those Ronseal adverts, name and shame does exactly what it says – in this case – on a metaphorical tin, it punishes those that affronted others by revealing what their misdemeanours were.
So, for example, earlier this month, Anne Widdecombe, the former Conservative MP, said she wants to name and shame those who get excessively drunk on the weekend and breach the peace.
“Then people going out specifically to get drunk would risk finding themselves in court on the Monday with their names and photographs in the papers,” she explained.
The idea being, of course, that having experienced public humiliation, people subsequently clean up their acts. It acts as a deterrent.
On the flip side, the argument against it is that it can be construed as a sort of witch-hunt, unjustly embarrassing people. For example, last month, students at a school in Oxfordshire went on protest after such a policy was introduced. Larkmead School felt that putting up a notice board with the photos of underperforming students. Needless to say it backfired.
In our industry, such a thing is going to be piloted by the Trustworthy Internet Movement (TIM), a non-profit, vendor neutral organisation that looks to bring innovative solutions to the many tricky problems that exist in the digital world of the internet.
What it is proposing to do is publish the names of websites that perform well in terms of security and those that fall short of what TIM deems to be acceptable. The obvious outcome, it hopes, is for those who are grace the “wall of shame” to remedy whatever security faults they have.
It aims to focus the initial testing on a website’s use of secure sockets layer (SSL) to encrypt data between a user’s web browser and the website. Or, in short, it obfuscates some of your internet traffic. As the BBC reports, it is often used to protect, for example, sensitive data that people want kept private for obvious reasons, like credit card numbers that zip along the virtual highway when people purchase goods or access a service.
The reason for choosing SSL as a barometer of a website’s security is because it is “one of the fundamental parts of the internet,” explained Philippe Courtot, founder of TIM and chief security officer at the security firm Qualys. Indeed, it’s a fair point, we can’t argue much with that.
Using ethical hacking techniques, TIM will ethically hack selected websites to gauge how secure they are, the results of which, good or bad, being published online for everyone’s perusal. The web being the web, you’ve got a global readership. This will matter. After all, when you have a rep to protect, it pays to ensure one’s name lives up to it.
Do let us know what your thoughts are on this blog and whether you think naming and shaming in this context is an innovative step forward or a sort of misadventure that might fuel animosity if anything.