Hacker News Reader

Comment by aaza | Hacker News Reader

Years ago when DDoS tools were being distributed on 4chan I fixed a bug in one of them and redistributed it there.

My fixed version also had the handy feature of having a 50% chance of wiping the user's entire drive if they actually used it as part of a DDoS.

It was pleasingly brutal. First it would zero out and delete all files in the user's home directory, and then if it had access to the hard disk device it would overwrite the sectors directly from the start onwards. If not, it would iterate through all other files and corrupt whatever it had access to.

I'm satisfied to report that hundreds of script kiddies had their data irreversibly destroyed before my handiwork was noticed. I hope it was a valuable lesson to them.

View on HN

Was this a particular tool that required charging up a lazer, by chance?

If so, I might have been one of the people you taught a lesson to. :D

How did you feel about it? Were you dissuaded from further script-kiddieing?

Well, yes and no. I was more interested in what it did and how it worked rather than 'using' it, I just remember it causing a lot of problems. But yes, this was around the time I learned not to run random executables I found on the internet.

I was going to ask you the same thing as wrs, and would have answered similarly. Overall I am grateful for people like aaza for helping others to understand how it felt to be on the receiving end, and also a lesson about trust and maturity. "There is no honor among thieves" is a facile interpretation, but over time I've come to feel like this is necessary tough love for certain problem kids who might be too clever for their own good at certain points of life.

I hope you realize what a god complex you had at the time thinking you had the right to harm others just because they were doing the same. This code of ethics is the source of hate in the world. I guarantee these people didn’t learn their lesson but instead started doing the same thing to others even less powerful than themself.

It depends on your world view. There was also harm prevented, so that might cancel it out. You could also see it as a punishment, though not delivered by the judicial system. Your solution seems to be to do nothing. That can be construed as silent approval. So it really depends on your world view.

This depends on who the DDOS was targeting, otherwise the DDOS was legitimized by this logic (targeting bad people) and this becomes bad again (harming good people to aid bad people).

Of course, that was never considered nor was collateral damage because the ethical justification is just a pretense to excuse harming others.

"god complex" is very reaching. No one got physically hurt in this scenario. Also unlikely you can "guarantee" this didn't teach anyone any lessons.

> No one got physically hurt in this scenario.

This is not certain.

Anarchic dickbaggery is brand 4chan behaviour. You don't go there expecting ethics.

More to the point, I don't understand why you want to spank them for this now. Kids do stupid stuff and this is far less stupid and dangerous than a lot. Indeed a lot of no-effort hackers get burnt on this stuff and stop. I know people who tried and failed. Adding peril to the process scares off a lot of would-be bad behaviour.

> I guarantee these people didn’t learn their lesson

Your argument totally falls apart here, because you’re just outright wrong. There are a ton of kids who are curious would-be hackers that turn away from the dark side forever after getting pwned while trying to do something sketchy.

> There are a ton of kids who are curious would-be hackers that turn away from the dark side forever after getting pwned while trying to do something sketchy.

... How do you know?

Feel and vibes. Or anecdote of 1.

Zeroing out home, the boot sector, and everything else would cause no harm by the same ethics logic that a DDOS causes not harm. It is just information. This seems like the poster is a hero, because he prevented wrongdoers from causing harm to potentially innocent people. There's not an ethical way to execute a DDOS. It targets someone, and the botnet is compromising and stealing compute from someone.

It taught them a valuable life lesson about trust and humility, and maybe even ethics and the risks of criminal activity in very mild fashion. Recovering from being hacked might stir feelings of empathy for their victims and lead them to learn valuable forensics skills.

Stories like this are part of the personal evolution of a lot of white hats. I think aaza did a real service to the world.

You're bragging about a cyber crime.

One wonders how many parents-of-script-kiddies were affected, having their data or work destroyed by blind retribution for having naive children.

Fucking up the family computer is a formative experience for many techies.

Amen! I still remember the time I tried to install fedora in the late 90’s and set a bios password in the boot loader then forgot it. I was like 11

One wonders how many parents of non-script kiddies were affected by these destructive criminals, or how many of these script kiddies are professionals making a living.

This story concerns 18,000 script kiddies. Imagine the scale of impact we're talking about when magnified to their victims.

I think you just can't compare those 2 scenarios, 25 years apart.

Back then: We got the 2nd computer in the household in 97, exactly so I would not have to use the family (actually business) computer anymore.

Now: I mean ok, maybe it's already swung past a certain point that there is actually only one non-mobile device in the home, but the chance that it is the targeted script kiddie's machine (and not the important family computer) is so much higher.

why does this logic make sense to anyone, ever?

someone does something bad -- by all means that gives whoever carte blanche to do whatever is just as bad or equally so to the victimizers.

This doesn't make sense -- even less sense when you realize that 'script kiddies' is anyone who ran an executable from an image board; you couldn't ask for a lower bar.

Half the people who downloaded the thing probably didn't even know what the fuck an IP address is, they probably shouldn't be the ones saddled with taking on the entirety of repercussion that was meant for the person(s) who wrote the tool.

tl;dr : I bet half of the '18,000' people were 11 year olds who typed 'google.com' or their least favorite AIM screen-name into the target criteria of this already half-assed 'tool', yet people act righteous for wiping their hard-drives as if they were the real culprit.

read : wiping the not-culprits parents hard-drives in many cases, I would bet.

First, parents are responsible for the actions of their children.

Second, we assign blame to the person that pulls the trigger, not the maker of the gun.

Third, these people are likely to never face any other form of punishment.

Personally, I think these facts justify this level of retribution. That doesn’t make it “legal” or “right”, but I definitely do not think it is “wrong”.

Just because something is legal it doesn't make it moral and just because something is illegal it doesn't make it immoral

> Second, we assign blame to the person that pulls the trigger, not the maker of the gun.

The analogy here is more akin to a booby trap than a gun, in which case we do assign the blame to the person that made the contraption intended to harm the unwitting user.

That aside, considering once it was discovered how the drive wiper that OP (aaza) claims to have made works, it basically just became a drive wiper that any bad actor could drop into a target system and run, “I intentionally distributed malware that I think, but have no way of verifying, only hurt The Wrong Sort Of People” isn’t just illegal and wrong, it’s stupid.

> That aside, considering once it was discovered how the drive wiper that OP (aaza) claims to have made works, it basically just became a drive wiper that any bad actor could drop into a target system and run, “I intentionally distributed malware that I think, but have no way of verifying, only hurt The Wrong Sort Of People” isn’t just illegal and wrong, it’s stupid.

Imagine copying an entire binary onto a system just so you don't have to run `cat /dev/zero > /dev/sda`

> Imagine copying an entire binary onto a system just so you don't have to run `cat /dev/zero > /dev/sda`

Imagining script kiddies using stupid software in stupid ways very clearly and easily, also imagining a script kiddie pasting `cat /dev/zero > /dev/sda` into the windows command prompt of the computer he’s controlling with sub7 and getting very frustrated

who bullies the bullies?

"when you realize that 'script kiddies' is anyone who ran an executable from an image board; you couldn't ask for a lower bar."

Wow. Just wow.

I looked at keygens and whacked an entire site of 900+. Not a single one did not have a virus, and some more than one. I kept it as a zoo to test scannets.

Astalavesta baby.

With LLMs, everybody can be a script kiddie. Imagine the scale ...

Running software from LLM output is like building a bomb with the Anarchist Cookbook.

The poster was preventing a crime against innocent parties. His "victims" were the criminals. The script kiddies were responsible for running malware and trying to launch attacks from their parents' computers in this scenario, and they would be the ones responsible for data erasure of others using the same computer.

In that sense, file deletion is destructive but honest. The poster owned the systems at this point and could have exfiltrated data or used the control of the systems for further attacks. This was decidedly mild.

Detonating a bomb is illegal in many jurisdictions, regardless of property damage or injury to humans.

The person who called this a cybercrime is more correct than people disagreeing

They are both cybercrime. I'm not disagreeing with that. But if you sabotage a bombmakers tools and they blow their own household up instead of other innocent people, is it the same thing?

Let's be very specific: "if they actually used it as part of a DDoS.". This wasn't embedded in warez or cracking tools, it was in botnet controllers, and ran when someone had pulled the trigger to execute an attack.

you are saying it was "botnet controllers" all the op said was "ddos tool on 4chan" - LOIC wasn't a "ddos" tool. it was a DoS tool. sub7 wasn't a ddos tool. BO wasn't a ddos tool. butttrumpet wasn't a ddos tool.

A "botnet controller" requires a botnet. The OP made malware. A program, when run, that would delete your files without permission.

merely having the thought of doing something illegal isn't illegal and afaik the catholics have the only guidelines on how to deal with illegal thoughts, and "delete all the files on their hard disk or otherwise corrupt their system" wasn't in the canon that i saw.

I quote:

"Years ago when DDoS tools were being distributed on 4chan I fixed a bug in one of them and redistributed it there"

"if they actually used it as part of a DDoS"

You are incorrect, they said it was a DDoS tool. You are incorrect about "merely having the thought", it required executing an attack. FAFO. Again, this is part of the personal evolution of tons of security professionals who longer do juvenile stupid shit. Or at least learned how to do so in a hardened sandbox vm.

What if the bomb maker lives in a shared house with innocent people, or even in their parents basement?

Thats a more relevent analogy here, as probably most of those script kiddies were using the family PC which had other other innocent peoples important stuff on.

One home is worth less than dozens of homes that bomb maker can damage. The same is true for script kiddies.

It’s not black and white, so I won’t argue for black or white, but an important factor to me is: ddos eventually stops and then everything is back to normal; no permanent damage is done.

Unless your doctor is waiting on the kidney biopsy, might as well remove the heart and brain.

Shall I goggle ddos attacks that have cost people their lives?

I'm going to echo the unjustly dead comment:

>Fucking up the family computer is a formative experience for many techies.

It's true, I did it myself!

There were dozens of compromised versions of the LOIC tool back at the height of Anonymous that I'm sure many kids downloaded and in their attempts to "stick it to the man" inadvertently infected themselves.

Honestly, probably at time pretty affordable lesson in thinking what you run when you download from web, and importance of backups.

Reply on news.ycombinator.com