HowtoHireaHacker.docVIP

Reprinted from Ziff Davis Smart Business Magazine (formerly PC Computing) July 2000 How to Hire a Hacker By Christopher Null Jack Stevens knew his company was being hacked. Someone was snooping around in sensitive information on the company network. So Stevens (not his real name) called John Klein’s Rent-A-Hacker (), a security consulting firm. Klein leapt into action. Klein logged onto the client company’s network and quickly sized up the situation. The intruder had exploited a common Solaris server bug. Klein immediately found what had gone on. “The trick was not just blocking them out, but finding out who they were,” Klein says. “But it’s delicate. It’s like a chess game: First mistake loses.” Klein employs some 300 freelance computer security experts-better known as hackers- throughout the world. He handpicks a specialist to fit each call he gets. In this case, he tapped Kelvin Wong, a top operative who also happens to be his company’s chief operating officer. Wong back-traced the intruder’s connection to a Canadian @Home network, which tracked him to his cable modem. To confuse his pursuers, the offender launched several denial-of-service attacks. But eventually the intruder lost the chess game and was handed over to the Royal Canadian Mounted Police. By acting quickly and returning the attack against its intruder, the victimized company foiled the hacker and prevented any real damage. In the dot-corn era more than ever, the best defense is a good offense. Hired Guns In the wake of recent security fiascoes like the theft of 350,000 credit card numbers from CD Universe and the rampant distributed denial-of-service attacks on top Web sites this spring, hacker-for-hire services are thriving. Andersen Consulting, IBM, Pinkertons, and even software developers like Internet Security Systems are offering what they call security auditing and other ethical hacking services. So who needs a security consultant? Everybody. “Ninety percent of all systems are