The White Hat Spirit

I presented the spirit of white hat hacking, as I understand it, in an article I published in the Autumn 2012 issue of 2600 The Hacker Quarterly. Here is a reprint:

Hackers Indispensable for Volunteer Groups

In the low-budget, not-for-profit world, hacking is a necessity. I live in a small, sub-arctic community and I belong to three local community groups and one provincial group. Staff members are mostly volunteers and, in their roles with the groups, they focus on their group's mission and not the technology that makes the gears turn. Computers are donated clunkers that usually arrive broken and/or infected (why else would the owner give it away). The internet modem comes with WEP-encrypted wireless and a dumbed-down interface that locks-out features. Web sites have forums that become toilets. Charger cords fizzle out or disappear and a new one is $300 (if available). A mother board capacitor is smoked. A scanner has a 25 pin DIN connector. Etc, ad-infinitum, etc.

There are a hundred of these low-budget community groups within any given population of 200,000 persons. None of them has an IT department or a soldering iron. There is a solution. There are thirty or so willing hackers within any given population of 200,000 persons: people who like to learn, play, and solve problems, and who have a useful level of creative ability, pattern recognition skill, research aptitude, and a tenacious refusal to be beaten by limitations.

It's a lot of time though. Computers in the group office, and laptops in the volunteers' laps, are the most time consuming. Once the solder has been applied, the memory replaced, the BIOS re-flashed, and an OS installed; the work (fun) begins. For example, our community's nature lodge has a computer that is used by visitors and volunteers to view presentations, search the web, use web-mail, etc. The network also has an IP camera that is focused on the bird feeder and is available on the internet. The camera is also accessed by a program on the computer that captures images when motion is detected. The network is exposed to the internet (for the IP camera, updates by ssh, and remote desktop).

It is used by random persons with unpredictable skills and caution levels. Visitors/staff don't want to develop new computer skills at the lodge and they will ignore admonitions on sticky notes attached to the monitor. They will install tool bars, delete system files, navigate to fake anti-virus sites, download offensive materials, bookmark maleware sites, etc. “Help”, they say every week; “I can't get my files.” Managing a system like this can be a time consuming headache, even for a hacker. Volunteer computer managers often have to “fix” the machine on each visit... never really knowing what problems they may have missed. As always, there is a mitigating hack using a template virtual machine.

A (VBox) virtual machine is inherently restorable and can be comprehensively backed-up. We use fresh-daily clones from a stable virtual machine template. We use Linux for our native OS and run Windows in a virtual machine (but you can use this approach if your VM is Linux or if your host is Windows). In a startup script, a clone of a template virtual machine is made each morning. The previous day's clone is erased just before each new clone is made (new tool bars and 100 dirty pictures vaporized). Daily permanent storage for users is done with a thumb drive (a weak point if the drive is infected). Is this a hack? I think it is because it generalizes the VM concept in a such a way that it controls the entropy of a stochastic and dynamic system... volunteer community group computers.

There is only about one willing hacker for every three small non-profits. He/she is very busy. Even periodic updates for a dozen or so computers will use your gas money and keep you in a deserted group office at 1:00 AM (instead of home in front of your computer). Enter ssh. But wait, the VM guest is Windows so I'll need remote desktop. Humm, I'll tunnel RDP over ssh. But wait, I'll need to get to the host too so I can overwrite the template. Humm, I'll ssh into my Linux host too, perhaps using a VNC tunnel. I wonder how I can port forward my virtual NAT adapter rather than giving access to my LAN through the VM? How will I conveniently manage and use fifteen ssh connections/keys from my home computer? Any one of these elements has a discoverable, tab-and-slot workout, but making them all sing together requires “critical thinking, creativity, inquisitiveness, problem solving skills, and a hunger for knowledge.” (ternarybit, 2006, V29-1, p. 26)

What's the point of all of this? As I read my issues of 2006, I often recognize an undertone of concern with the “optics” of hackerdom. We know we're (mostly) good but some think we're evil? Volunteer, non-profit groups from 4H to the Women's Federation provide essential services: social, environmental, educational, etc. For every dollar they socially engineer from funders they generate ten dollars of service (usually anyway). In our “electronic/information” age they are enabled by hackers. So, when your boss asks; “what are you doing with that hacker magazine on your desk,” show 'em this page.

...markb