Warning: What follows is my uneducated rant on plagiarism and the effects I think it’s having on information exchange within the InfoSec community. I don’t claim to have all the answers, but I do have questions! Take it as you will…

pla·gia·rism

[pley-juh-riz-uhm, -jee-uh-riz-]

–noun

1. the unauthorized use or close imitation of the language and thoughts of another author

     and the representation of themas one’s own original work.

2. something used and represented in this manner.

source: dictionary.com

Maybe it’s just me, but over the last year or so I’ve seen more websites, blogs and news articles talking about plagiarism than ever before! We’ve seen everything from sites being scraped and content reproduced in it’s entirety, through to information sources plundered for content for low quality books… and copied word for word, without thought or care!

In an age were we’re already seeing a serious decline in active blogs in favour of short 140 character tweets, we can hardly afford to be killing off the enthusiasm of those bloggers we do have left! The InfoSec community has always been built on open information sharing. In this industry we live and die by the information we have to hand. Wether that’s something we research ourselves, or something shared in-kind. For every piece of research somebody shares, there were hundreds more they could rely upon being made freely available. This unspoken information sharing pact has made the InfoSec community what it is, and helped to make the most of the researchers time, skills and dedication.

(CC BY-NC 2.0) by jobadge

Not everybody can reverse engineer the latest Zeus Trojan, but you always knew somewhere, somebody would, because that’s what they did! However that information sharing is lessening as the people really doing the research have their hard-earned work stolen out from under them, and posted on one of a myriad of copy sites… without permission.

Those behind the plagiarism, at least those that have a shred of decency (few and far between), talk a lot about giving credit. What they don’t seem to understand is that regardless, taking someone’s hard work, without their permission, and using it for your own uses is plagiarism, full stop. The problem comes when trying to prove these issues in an Internet, and therefore global, context. As an English citizen, living in Austria, with hosting based in the US… who’s laws (if any) are broken when a third-party takes your content? I’m not a lawyer, so I have no idea. All I know is, I didn’t give you permission…

The Internet is a wonderful thing, filled with great information and sources… copying other people’s hard work, research and abusing their dedication to this community is beyond low.

Resources on plagiarism .:

• http://www.copyscape.com/
• http://www.plagiarism.org/
• http://www.plagiarismchecker.com/
• http://www.makeuseof.com/tag/4-easy-ways-avoid-plagiarism-blog/
• http://www.subhub.com/articles/fight-online-plagarism-copyright-theft-abuse

Note .:

Although I’ve occasionally been the target of plagiarism in the form of copied blog posts from these pages, I’m not writing this rant for that reason. There’s no point. I really see this issue as one of the biggest threats to the InfoSec community currently, and it needs to stop. The only problem is… those who are plagiarizing have no respect for the InfoSec community. They’re just out to make a buck, or ten, on the backs of the hard work done by others… History repeating itself in the digital age! Who’d have thought!

</rant>

Feel free to plagiarise this blog post.. it serves to prove the point!

Note 2 .:

After a spirited discussion on Twitter about this post, a friend of mine, @krypt3ia, was nice enough to propose a logo to show your disgust at the increase in Plagiarism… I think it’s a good starting point, so include it here for your use! spread the word!

Yes, yes I know… I’ve been a slacker. The FIRST conference and running the BSidesVienna conference really took a lot out of me (far more than I’d thought possible).

Still, I’m starting to get back on track with things now. slowly

I should have recovered just in time to once again ruin my liver at Blackhat/BSidesLV/Defcon… some would call that good timing. I can almost hear my liver groaning!

I’ve shied away from doing a predictions type posts, because most are nothing but rubbish from start to end. Filled with buzzwords from the last few months, with no real substance, and very little point to them. Right now we don’t have the solutions… just a whole heap of problems. So how can anything change? Everything will stay just about the same… companies will fail to secure themselves and the bad guys will keep in winning. Sad but true!

Anyway, as I sit and look back on last year and what I want this year to be, I want 2011 to be a year of firsts for me, as 2010 was in many ways.

2010 (Ghost of Christmas past)

• I began to finally look at Python scripting
  • About darned time! How did I ever cope without scripting things?
• My first Python tool was released (UA-Tester)
  • Followed by a few simple Python PoC scripts…
• I gave a lightning talk dressed as a pimp
  • A moment not to be forgotten easily
• Eurotrash Security Podcast reached it’s 1st Birthday and is going strong
• The blog reached the 3 year mark
• LIGATT
  • What more is there to say!

2011 (Going boldly….)

It’s hard to say what the industry will do in 2011… I couldn’t tell you what the latest buzz words will be by the time DefCon rolls around, but I can at least say what I intend to achieve… or at least try to achieve!

• Have my first Metasploit module accepted into SVN
  • A number of SAP modules are already waiting for the final go!
• Reply to the CFP for at least 1 conference
• Give at least 2 more lightning/fire talks in various subjects
• Put the LIGATT issue to bed
  • I’m tired of it, you’re tired of it… time to put a nail in that coffin
• Teach developers about security through workshops
  • Already in the works with 1 company, and hopefully more to come!

Here’s to a near year and new challenge… If there’s no challenge anymore, then it’s time to move on!

Wow… I knew spammers where lazy, but come on, at least TRY a little!

So many things happened 3 years ago, most of which readers to this blog won’t really be interested in. I quit my job as a SysAdmin in Germany. I moved to Austria. I started to REALLY learn German (finally)…. oh, and I went to India for 6 weeks.

The one thing I really remember from that time though, was getting back into things that I’d long forgotten. I spent a lot of time as a kid programming from books (just copying BASIC code from magazines and playing with it mostly). I also spent a lot of time early on in my career really playing with technology, seeing what it could do and how to make things do other more interesting things. Somewhere along the road though, I lost that drive and started to just accept things as they were. I guess using Microsoft technology for too long will force that realization on you. Wow, how depressing…

So what really turned me around and made me love technology again. I attended my first Hacker con…. and yes, it was a REAL hacker con, and not a security conference. I spent a glorious week in a field near Berlin at the Chaos Computer Camp. It was without a doubt the best thing I’ve ever done. Scary as hell… very little German language skill, no friends in the “community”, and no idea where I was going to sleep even (that was sorted by the every friendly Nick “Hackers on a Plane” Farr however…. and for that I’m forever thankful). Even though I came back thinking negative about everything (I realized how little I really knew), I picked myself back up and started on this journey into security.

A little more than 3 years and 267 blog posts on (3 or 4 of which might actually be categorized as “reasonable”), and I still feel like I don’t know anything… but at least I know why now. There’s just too much for 1 person to learn. Security is just such a big field, that you need to pick and choose your targets. Yeah, I’m still not good at that, as can be seen at how much the blog contents twists and turns between topics depending on my mood and interest at the time. Still, people seem to like it. At least the blog stats for the last few years are encouraging.

It still mystifies me somewhat that people come here to read things I write. I’m not the most experienced writer, and sometimes I look back on things I’ve written and feel an overwhelming urge to just click the “Move to Trash” icon. Still, things can only get better… after all, the way I write, they couldn’t get much worse could they

So what was this post all about? Well, nothing really. I just didn’t want to let another anniversary slip past without telling that story… oh and next year is the return of the Chaos Computer Camp (it runs on a 4 year cycle). Lets hope I come back feeling more positive this time eh

So here’s to another 3 years. Lets hope I can keep up the pace…

Flash forward to a month later and the selections are made for mentors and mentees…. so, drum roll please….. Who did I get partnered with….. None other than Jayson E. Street (incase you don’t know him… here is a picture). How ironic… especially considering my comments on Twitter when I made my application. Still, Jayson is a friend and a great guy. So I’m sure this will work out great.

So, to my first steps as a mentee…. time to change my image. It needed an update, the fat English guy look wasn’t working for me anyway. So here it is. The new mentee look…

The journey has only just begun…. there are many choices still to be made, and I’m sure Jayson will guide me through them. The hard ones however, I’ll have to make myself….

Hopefully I’ll have made the choice before DefCon rolls around!

Links

• Who’s your mentor baby –> http://blog.c22.cc/2010/05/05/whos-your-mentor-baby
• InfoSecMentors –> http://infosecmentors.com
• InfoSecMentors (Twitter) –> @InfoSecMentors
• Jayson E. Street –> http://www.dissectingthehack.com
• Jayson E. Street (Twitter) –> @JaysonStreet

Snazzy title eh… Well I thought it was apt for the story I’m about to tell. Take a seat children, this ones getting get interesting.

Now, some people in the security industry might already be aware of a company called LIGATT, run by the self proclaimed “World’s No.1 Hacker” Gregory D. Evans. If you’re not aware of him, then you’re one of the lucky ones. I’ll let you form your own opinions, because everybody should be able to make up their own minds. Still, to the point.

As part of my duties for the Eurotrash Security Podcast, I try to arrange interviews with people I think are interesting to talk to. Be that for good or bad reasons. In this case, Gregory Evans was on my list (oooh I feel like Santa) solely to address a number of questions about his recent “book” (together with the associated plagiarism claims), and a few other topics that can only be referred to as dodgy dealings, misguiding people and general nastiness. So starts the story.

– — – — – — – — – — – –

On the evening of Wednesday 16th, I called the offices of LIGATT in Atlanta and asked to speak to Gregory Evans to arrange an interview. After giving my name, I was put through to speak to Gregory to arrange the details. What followed was a short conversation where I explained who I represented (Eurotrash Security Podcast) and what we’d like… i.e. an Interview. Greg ran through what he though about the plagiarism accusations and we arrange to talk again the next evening for a full interview once the whole Eurotrash crew was assembled. When booking the final appointment with his secretary I provided her with the URL of my blog (blog.c22.cc) and she gave me Gregory’s the Skype ID (ligattsecurity) to add ready for the interview.

Less than 15 minutes later, the following comment was received on my blog under the Books (as in book reviews) section.

Now I’m usually a calm guy. People usually like me and I try to get on with everybody equally. I think I do an OK job at that personally. However I don’t like to be threatened…. and threatening my friends and family is certainly stepping across the line.

Now, some things need to be made clear. This message doesn’t give a name. However the information contained within it leaves very little to the imagination, and little doubt who the originator of the message is. This is only compounded when you look at the IP information and track back where in the world this comment originated from. Cue the WHOIS music….

So the IP Address (74.228.197.214) belongs to BellSouth in Atlanta, Georgia. Surprise, surprise, this is the same town where Gregory Evans has his head offices. The very same place I was calling not 15 minutes earlier. I’m sure that’s just a co-incidence though, right!

Anyway, lets break down these colourful words and niceties to see what’s being said.

Chris, 20Plus or what every you want to go by

I usually go by Chris… this is my name after all. It makes sense.

You dick head. I wish I had known it was you I was just on the phone with.

You did know it was me… or at least you would have if you’d a) being paying attention to your secretary, b) not been too busy raging about how you’ve been hard done by and people are wrong accusing you of plagiarism.

I see you have books listed above but you did not write any of them.

This is correct…. just like you, I’ve never written a book. I do however have a few books I’ve read and like to recommend should people want some good books to read. The CEH Study Guide isn’t on the list however. Sorry. In other news it’s also 2010!

If you think that you are better than me, then put up the money and challenge me! If not shut the fuck up! I can out hack you any day.

Sorry, I don’t have a million dollars, and to be honest if I had to sell myself to get it, I’d rather stay without. However seeing as you’ve already being taken up on your challenge by Chris Nickerson, I fail to see the issue here… that is unless you plan to dodge that response and pretend you never saw it. Here’s a screenshot incase you missed it the first few times you were told.

I will now go after you family first! You fucked up! You let me find out who you really are! Now you must go! Bitch!

Right… so by “let me find out who you really are” you mean, I told you who I was. Unlike you, I’m not hiding from things. This is my blog, I have my name on it. I also gave you my name and affiliations on the phone. You really need to concentrate more. Hacking is all about attention to detail! Feel free to use that quote on your Twitter feed… no attribution required!

I will have my friend in your home country tracked down everyone you are friends with and your family and see what you are all about!

No need for tracking me down…. here’s my GPS coordinates (48.850385,15.096588). Please let me know when you’re coming past, I’ll cook fairy cakes or something. On a side-note, we arrest people in Austria for threatening behavior. Come to think of it, I think you do that in the US too. Anyway, lets move on. There’s more!

I have more money and power than you will every have!

See how good this “nigga” is now!

I don’t see any power… all I see is the threats of a little man who’s lashing out at everything and anything he finds threatening. I pity you, really I do.

Now you might have noticed I’ve resisted saying things like “you threaten my family and my friends again and I’ll cram those words down your throat using a strangely large kitchen utensil“… not because I can’t say them, or because I’d need to waste my precious time hunting for an oversized spatula at the local flea market, but because I’m more of a man than to resort to your childish tactics and lower myself to your level.

I can accept you feeling threatened by me and others in the InfoSec community. Threatening me might have seemed like your best plan of action. Intimidate me into silence. Seems like a fair enough game to play. Still, as I said, I draw the line when it comes to my friends and my family. I suggest you think about what you’ve done, take a timeout and re-evaluate your life.

Hope you enjoy the book list, and there’s more to come as I go over my backlog of items.

What I love about this advert is the tag line… “The Thinking Machine of th Business World“. If only they knew how far those “Thinking Machines” would really go! 

LIFE International (1954)

 

 We can only wonder where we’ll be in 2054 ? 

In honor of the past and the future I’ve made a few (subtle) changes to the blog. Gone is the änal security guy (long story, ask me over a few beers) and I’ve gone back to using a nickname that I’ve not used in 5 years or so, catch22 (catch for short). That too is a long story, but at least the domain name c22.cc makes a little bit more sense now. Oh and I won’t have so many problems with badly programmed web-filters marking the blog as porn (hence the ä in the old title).

So what’s to come for me in 2010 ? It’s going to be another busy year I think. Lots of conferences planned already, and lots of things to get done. I’ve also come up with a few new years resolutions, and I plan to stick to them (this time). By posting them here you guys can all hassle me and call me a big fat liar if I don’t come through with the goods as well. No pressure

• Diet –> Because too many cons have taken their toll on my once slender and toned figure
• Friends –> I’m notoriously bad for losing contact with people and spending too much time locked in a room alone… time for a change
• Read more –> I keep getting new books, so time to read more and …
• Watch TV less –> To make room for the books, friends and …
• Projects –> Finish some, instead of leaving them half-finished with a blog post promising “more on that later”
• Charity –> Life’s been good to me even through tough times. So it’s time to give back !

So, if you see me at a con this year and I’m breaking any of these rules, I give you the right to tell me to my face that I’m an idiot…. trust me, with my willpower, I need all the help I can get !

Happy New Year everyone, and lets hope that 2010 is the year people realise they’re just making things worse (in security and in general).

Stop being part of the problem, and start being part of the solution.

Be good to each other !