Space Rogue: How the Hackers Known as L0pht Changed the World

Hacker Space Rogue to Release Book on Hacking Group L0pht Heavy Industries in February

Space Rogue gives a behind the scenes look at the famous hacking group, their senate testimony, and how their legacy continues to shape the security of the online world today.


PHILADELPHIA, PA, January 11, 2023—The memoir of world-renowned hacker Cris Thomas “Space Rogue: How the Hackers Known as L0pht Changed the World” is available for pre-order now. The new book, to be released on February 16, 2023, will cover the influential hacking group L0pht Heavy Industries, the hacker underground of the 1990s, the L0pht’s rise to prominence, their testimony in front of the US Senate, their claim of being able to “take down the Internet”, and how their legacy continues to shape the security of the online world today.


“Cyber security has become a critical part of today’s world. The L0pht was there at the start. We helped shape the cyber industry, and form the online world we all live in today.” –Space Rogue


In May 1998, the US Congress invited the seven members of the L0pht to testify on the state of government computer security. Two years later, that same group rode the dot-com bubble to create the preeminent security consultancy the industry has ever known, @stake. Along the way, they stood up against tech giants like Microsoft, Oracle, Novell and others to expose weaknesses in those companies’ premiere products. Despite the L0pht’s technical prowess, the group could not keep what they had built together as money and internal politics turned friend against friend. Look inside L0pht Heavy Industries, or simply The L0pht, one of the most influential hacker groups in history. From formation, to congressional testimony, to going legit and the aftermath that followed. Follow the hacker ‘Space Rogue’ as he takes you on a journey through the magical hacker scene of the 1990s.


The L0pht hacker collective no longer exists, but its legacy lives on. L0pht set the standard for how the cyber security industry now releases vulnerability information. Famous hackers that were once L0pht members, Mudge, Weld Pond, Kingpin, Dildog, Space Rogue, and others have done even more impressive things in the following years. The hackers and consultants hired by @stake and indoctrinated into the L0pht way of thinking have now become giants in the industry. All the hackers who read security information off the L0pht’s website, downloaded software from the Whacked Mac Archives, or watched the Hacker News Network and became inspired have changed the world more than the L0pht could have ever done alone. The L0pht’s message of bringing security issues to light and getting them fixed still echoes throughout the industry and is more important today than ever. The L0pht’s dire warning of an increasingly dependent culture on a fragile Internet made during their testimony twenty-five years ago still holds true. In fact, the Internet may be in even be worse shape today. Is it too late to listen?


About Space Rogue (Cris Thomas)
With over two decades of experience, Space Rogue (Cris Thomas) has testified before the U.S. Senate Committee on Homeland Security and Governmental Affairs, and has been interviewed by Wired, CNBC and even MTV. He created the wildly popular websites the Whacked Mac Archives and Cyber Squirrel 1. He produced the weekly podcast SpiderLabs Radio, and the critically acclaimed weekly news video program the Hacker News Network. His writing has appeared in Network Computing, New Statesman, The Hill, and the Christian Science Monitor. He has spoken at security conferences such as Def Con, Blackhat, and Shmoocon. Space Rogue currently works as the Global Lead of Policy and Special Initiatives for the legendary IBM X-Force.


The book is available for preorder today and will be released on February 16th in hardcover, paperback and eBook at better books stores everywhere. Distributed via Ingram Spark.


https://books2read.com/spacerogue


To schedule an interview or to receive an advanced editorial review copy, submit a request to
spacerog @ spacerogue . net For more information visit https://www.spacerogue.net


ISBN 979-8-9870324-0-4 (hardcover)
ISBN 979-8-9870324-1-1 (paperback)
ISBN 979-8-9870324-2-8 (eBook)

Posted in L0pht | Comments Off on Space Rogue: How the Hackers Known as L0pht Changed the World

Stick This! Review of Five Sticker Vendors

Stickers are an underappreciated ephemeral art form. While closely related to stamps, stickers have their own unique styles and uses that differ from stamps. While stickers may have evolved from stamps, the first stickers were created by R. Stanton Avery in 1935. Initial uses were mostly utilitarian, but in the 1970s Forest Gill created the first ‘bumper sticker’ to put on the back of your vehicle. The bumper sticker rose in popularity as potential politicians used them to great success every election year. Stickers quickly became a merchandising collectable as companies would put out a series of them for people to collect.
As the cost of production dropped, the sticker became an additional creative outlet for niche communities. Music bands found them as an inexpensive item to provide fans either for free or a small fee. In the late 90s and early 2000s the ubiquitous of the laptop computer, with the large flat real estate of its top cover, just invited people to place stickers on it. The IT/cyber/hacking communities quickly grabbed onto this trend and began producing stickers specifically for people to place on their laptops.
In the 90s costs drove many aspiring designers to produce stickers by photocopying their design onto a standard size sheet of sticky paper and manually cutting the stickers out with a pair of scissors. While crude by today’s standards, it was inexpensive and quick. Production costs have continued to drop and today a few hundred vinyl full color die-cut stickers can be professionally printed for the cost of a mediocre meal.
With ease of ordering, the question becomes where to order your stickers? I was planning on doing a largish run of a set of stickers and decided I should test out the top recommendations. After posing the question on Mastodon, I came away with five contenders. I ordered the same sticker from each vendor or as close as I could get based on the options they offered.

I ordered fifty 2.5 inches square black & white stickers with the cheapest shipping offered from each vendor.

Sticker Packages

Sticker Robot
Sticker Robot used to be my go-to sticker supplier. A generally inexpensive and high-quality silkscreened sticker. However, they use a gang run printing process, so lead times can be quite long. Their website quotes 3 to 4 weeks and I was okay with that when I was ordering from them. Until this one time… it took me six weeks to get my order. While I was waiting, I ended up ordering the same sticker from another vendor and had it within a few days. I haven’t gone back to them since. If you don’t mind waiting, Sticker Robot might be a good option for you.

Sticker Mule
Sticker Mule was my go-to for a long time. Quality stickers, quick turnaround, cheap prices couldn’t get much better. However, I began hearing accusations being levied against the owner that he supported far right political groups, and then just as many denials of that involvement. I don’t know which side is accurate, but decided it was better for me to put my money into a different company. However, for the sake of this comparison, I did a small run with them, anyway.
50 @ $66.78

Sticker Guy
Sticker Guy came with a few recommendations and I was excited to try them out. However, it looks like the reason they are so inexpensive is partially due to long lead times (possibly due to gang printing like Sticker Robot?) and only printing a few standard sizes. They did not offer a 2.5-inch square in black & white (or if they did, I didn’t see it). I almost didn’t order from them at all but then at the last minute I found the color sticker button and could order 50 color stickers to be printed in Black & White.
50 @ $44.95

Sticker Giant
Slick website made ordering a breeze. The minimum ordering quantity of 125 seemed rather high. They do have an option to order a sample pack but who wants to wait for a sample. When you need stickers, you need them NOW!. Sticker Giant shipped the stickers in a box as opposed to a simple envelope, but that was likely because of the larger quantity that was ordered.
125 @ 114.72

Sticker App
Sticker App came highly recommended and has a slick easy-to-use website. Sticker App tied with Sticker Mule for fastest shipping, both arriving within a few days of ordering.
50 @ $44.52

Vinyl Disorder
One person recommended Vinyl Disorder so I figured why not. Website is very busy and can be a little confusing to the first-time sticker orderer. For example, it says you have quantity 50 stickers in your cart but when you go to checkout, it has changed to quantity 1 because it is one quantity of fifty stickers. Yeah, made no sense.
50 @ $41.90

Stickers


Shipping
Sticker Mule tied with Sticker App for fastest shipping arriving within a few days of the order. Sticker Mule shipped from NY and StickerApp from MD to my PA address. Sticker Giant was third to arrive just a few days later after shipping from CO. Vinyl Disorder took about a week and half to arrive after shipping from CA. Sticker Guy took the longest to arrive at over three weeks, shipping from NV. Sticker Mule used a padded envelope while the rest used a cardboard envelope (except for Sticker Giant who used a box). Not sure how much added protection the padded envelope offered but it is definitely not as easily recyclable as the cardboard.

Print Quality
Despite being a simple black and white sticker, there is a wide variety of printing quality among the different vendors. StickerGuy, while acceptable quality, is definitely the worst overall as the black letters on the white background are fuzzy and the black is not very black, almost as if it was printed by an old inkjet printer. The quality of the other four were all very close but I’m gonna give the win to Sticker Giant. The black color really seems to pop a bit more and the lines are just a bit crisper.

Vinyl Quality
I am not a vinyl expert by any means but when I first started ordering stickers one of the places I ordered from touted how their vinyl was tougher than the competition because you couldn’t rip it in half. So I gave them all a rip test, Sticker Guy was the only one to fail. Ripped right in half.
Vinyl Disorder and Sticker Mule seem to have the thickest feeling vinyl but Sticker Giant, while feeling slightly thinner than the other two, has the best overall feel. Yes, this is completely subjective but I feel what I feel.
One other note about vinyl quality. I have ordered tens of thousands of stickers of multiple different designs from Sticker Mule. I have several on my car and old stockpiles of others. This may be an issue with all vinyl but Sticker Mule stickers shrink over time, not a lot, but they do shrink. This can leave a sticky glue border on your car window or a white border of the paper backing showing through. This might happen with all stickers but definitely happens with Sticker Mule.

Design Quality
Both Sticker Giant and Sticker Guy rounded the square corners of my design. I don’t remember if that was specified when I placed the order or not but it was a surprised when I opened the packages. Vinyl Disorder actually shrunk my design and added a small white border around the edge of my sticker. Again, this might have been mentioned during the ordering process, but not something I was expecting when it arrived.

Conclusion
There are a lot of things in this brief experiment I didn’t test for, color accuracy being the primary one. Kiss cut stickers being another one. Each vendor also offers unique features, like back label printing or sticker sheets or something else, none of which this little experiment looked at. Hopefully, though there was some information here that might help you decide which vendor to use without having to place five different orders. I am really surprised that I don’t have a clear-cut winner. Each vendor brings their own strengths. Going into this I really wanted to like Sticker Giant or Sticker App but my results are inconclusive to me so I’m not sure who I will order from.

Posted in Uncategorized | Comments Off on Stick This! Review of Five Sticker Vendors

Cyber Squirrel 1 Dataset Released

Cyber Squirrel 1 has existed for nearly eight years now. Eight years of cataloging power outages caused by squirrels but also birds, snakes, raccoons, rats, slugs, sharks, jellyfish, etc… The overall data paints a pretty bleak picture of the fragility of our electrical transmission infrastructure While most people seldom experience a power outage, there is probably a power outage somewhere for every minute of the day. Our fury, and some not so fury, friends cause many of those outages. By comparison, anything coming close to resembling a cyber attack cause a miniscule fraction of one percent of these outages.

I created Cyber Squirrel 1 as a humorous tongue-in-cheek effort to counter the increasingly scary rhetoric surrounding the prophesying of nationwide power outages caused by cyber attack. We never claimed that a cyber attack could not cause a power outage, in fact there are now several examples of that occurring. However, the doomsday scenarios of wide scale power outages lasting for days or weeks is so unlikely that mostly it is not worth worrying about. Yes, there is a risk, (information and physical) security at most power companies is pretty appalling, a cyber induced power outage is possible, but the risk of a major wide-scale outage is nowhere near the level of hype that cyberwar hawks have been spouting.

As an end cap to the Cyber Squirrel 1 project, and to officially close it out, we are releasing all the collected data, charts, graphs, documentation, etc… under the Creative Commons Share-Alike 4.0 license. The dataset measures 17MB .zip and can be found on the Internet Archive here.

#cyberwar4ever

P.S. Try your hand at the new Cyber Squirrel 1 video game. https://robidev.github.io/CyberSquirrelOne/

Posted in Commentary, Current Events | Comments Off on Cyber Squirrel 1 Dataset Released

Book Review: cDc The Long Version

I wrote this long version a year ago after I posted the short version of my review of “Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World” by Joseph Menn and I received fair bit of criticism from some cDc members. I was called a troll, a self righteous prick, an asshole and other choice names. As a result I felt it was necessary to detail my many issues with the book. So, here is the long version.
Continue reading

Posted in Uncategorized | Comments Off on Book Review: cDc The Long Version

Book Review: Cult of the Dead Cow

TL, DR: It’s a good story, not a history book. If you are looking for a good story with a message, read it. If you are looking for a nuanced description of what was happening in history, look elsewhere.

The NYTimes called “The Cult of the Dead Cow: How the Original Hacking SuperGroup Might Just Save the World” by Joseph Menn, a great piece of storytelling, and I will agree, it is definitely a story. This is not a history book. While I only found minor factual errors, that which can be attributed to twenty years of fog, the facts that have been used only tell part of the overall story and are used to paint the picture that Menn wants the reader to see. But this is the job of any good author, and Menn pulls it off masterfully. However, as someone who lived through and participated in many of the events mentioned in the book, actually reported on them at the time through my own news outlet, and was and still is close friends with many of the characters, I see Menn’s story for what it is, a story.

Anything written about the Cult of the Dead Cow that uses members of the group as its primary source material needs to understand the group’s history. For most of the group’s existence the cDc wasn’t really about hacking. Yes, the group existed online in the before time, in the long long ago, and so most of its members were very technically adept but the group wasn’t really about hacking. It’s all right there in the group’s publications, the t-files. There are a few early files that could be considered hacker related but for the most part they are shock value human interest pieces. The group was about public spectacle, at least that’s how it appeared to other non-member hackers. Just look at the huge productions made of the Defcon releases of Back Orifice and BO2K and of course the completely made up Hong Kong Blondes. Even one of the group’s taglines ‘global domination through media saturation’ suggests the group was just in it for the glory. Menn knows this as he calls the cDc a ‘performance art group’ (page 2), the ‘liberal arts section of the computer underground’ (12), ‘the arts wing of the hacking community’ (21), ‘successor to the Merry Pranksters’ (23), ‘more of a social space’ (25), ‘they were an enormous inside joke for hackers’ (47) etc… Menn knew that was cDc ‘playing with the media’ (58) and that they would ‘jam information to see how far out it would go’ (59). As such, and Menn alludes to this in the book obliquely, anything the group says to a reporter or an author needs to be taken with a grain of salt.

Menn seems to take liberty with which facts he includes and which ones he decides to omit or quickly gloss over. Obviously he can’t include everything or the book or it would easily be five or ten times longer and his big story would get lost in all the other little stories. But there are major important facts that should not only be included but expounded apon and explained in order to give a complete and accurate picture to the reader.

For example the transition of The L0pht from hobby space to LLC to VC backed firm didn’t just happen, it wasn’t just a one person idea. (56) It was a was a huge deal, It was not the first time a hacker group had tried to become a company but when you are the first legal LLC in the state and making the move from quasi underground organization to paying taxes I would think it warrants more of a mention than just ‘newly incorporated’ (56) Especially among other hackers where accusations of ‘sell out’ were often heard. Another important yet glossed over part of the story was the explusion of Count Zero. He wasn’t kicked out because he didn’t want to transition (56) but because he wasn’t respecting the space, not following the communal house rules, and kept mostly to himself.

Not only has Menn omitted major events, which admittedly could be simply an authors prerogative, he has confused the reader on more than one occasion. For example this book review was unable to distinguish between members of the Cult of the Dead Cow and members of the cDc Ninja Strike Force, which while closely aligned were two separate group’s. There is also an extreme blurring of lines between cDc and L0pht. Menn goes so far to label L0pht as the cDc’s East Coast base (59), despite later claiming that at least two cDc members (Veggie and FreqOut) (49) along with the group’s servers where on the other side of town at Messiah Village, which had nothing to do with The L0pht. Yes, cDc, Messiah Village, Hell House, Sin House, L0pht and others were all friends and knew each other (Boston was a glorious hacking place in the mid-late 90’s) but we were separate distinct group’s, Menn’s book seems to treat everyone as one large homogeneous cluster that happened to be in Boston and it was anything but.

Menn treats the entire Hong Kong Blondes debacle, which was pointed out as fake and labeled as a ‘media hack’ years ago, as some sort of glorified civil rights cause by Menn. That somehow lying to multiple news organizations for years to highlight human rights abuses (Menn isn’t clear as to how) was a just and moral thing. If such a thing happened today it would either be called Fake News or aired on FOX. It is unclear what good exactly came from these efforts and Menn does a poor job of explaining it to the reader. In fact if you read too quickly you may not even realize that this was anything more than an attention grab by cDc and that the HKBs had no basis in reality. I feel Menn does a serious disservice here by not flat out labelling the Hong Kong Blondes by what they actually were, lies.

I have criticized how other tech books have handled footnotes and I will do so again with Menn’s book for completely different reasons. In my review of Kim Zetter’s excellent book Countdown to Zero-Day I said that including the footnotes inline on every page detracted from the main story, especially when they took up half the page in a tiny font; for that book I would have preferred the footnotes at the end. The exact opposite is true for Menn’s book. There are key footnotes that Menn sticks in the back of the book because they don’t fit in nicely with his narrative. For example the footnote on the origin of hactivism (215). In the footnote Menn claims that previous research on the origin of the word is irrelevant and yet makes a major claim in the main text that cDc not only coined the term but attempted to popularize it. Additional research as to the origin of the word would seem appropriate to include in the main body of the text so that the reader can frame the ensuing paragraphs appropriately. Then in footnote 54 (218) Menn mentions that Mudge is prone to exaggeration. Mudge and I shared an apartment for a year, I heard all his stories more than once, I am intimately familiar with his story telling tendencies. (This is not a bad thing, they are great stories!) Considering that Mudge is Menn’s primary source for all the stuff about L0pht and features prominently in three chapters of the book it would seem that his tendency to tell tall tails would be important information that should be prominently shared with the reader and made it into the primary text, and not relegated to page 253.

There are numerous points throughout the book (as in several per page) where I remember things differently. In many cases what I feel are very relevant facts have been omitted and in others there are minor factual errors that impact the overall meaning. There are entire sections of the book that have little to nothing to do with The Cult of the Dead Cow, like the VC funding of L0pht, but are included anyway to support Menn’s overall story arc. I may try to go through and document each one of these if I can find the time, or I may not.

Much of this book dealt more with the L0pht than with cDc, and while there was some cross pollination we were two separate group’s each with its own accomplishments and goals. Unfortunately as a book about L0pht there just isn’t enough here, there are many more aspects to what the L0pht accomplished and did. Evidently Menn felt that large parts of the L0pht story are somehow relevant to cDc when they really aren’t. That being said this book is a very fun read, a fun romp through memory lane (even if the lane doesn’t follow my own memory exactly) and in the end it’s a great story. But it is just that, a story.

Posted in Commentary, Current Events, L0pht | Comments Off on Book Review: Cult of the Dead Cow

Revisiting L0pht testimony – 20yrs later

Here is a copy of my introductory statement from the May 22, 2018 briefing where L0pht revisited its historic Senate testimony of twenty years earlier. (supporting links at the end.)

Good Afternoon, I’m Space Rogue. Twenty years ago, out of fear of corporate retaliation through lawsuits Space Rogue was the only name I used. Today I also use the name Cris Thomas, although not as frequently, and I work as the Global Strategy Lead for IBM’s X-Force Red which is the offensive security services part of IBM Security.

We are here today to talk about how things have changed in information security over the last twenty years. When we were here twenty years ago a lot of people said, we were a voice of reason attempting to warn people about just how much risk was inherent in our critical systems. A lot of people in information security, or I guess we call it cyber security now, that’s one change right there, will tell you that nothing has changed, that we still have issues with passwords from password reuse, to weak passwords, to no passwords. We still have organizations who ignore the problems either through ignorance, ambivalence or just greed. And we still have people who try to blame users for technological failures.
Continue reading

Posted in Current Events, L0pht | Comments Off on Revisiting L0pht testimony – 20yrs later

The Best of DEFCON 7 (HNC Network) (1999)

Best of Defcon 7 - HNC Network 1999

Posted in Uncategorized | Comments Off on The Best of DEFCON 7 (HNC Network) (1999)

A Hacker at the Polls

On the second Tuesday in November I burned a vacation day, woke up at five in the morning and drove to a church down the street from where I live. I sat at a long table for thirteen hours and looked up names in a book. While I wasn’t at the church to pray I still felt as though I was cleansing my soul in some way. Over the years for various reasons I had amassed what I felt was extremely high level of personal voter debt and I felt this was a way to at least begin to pay some of it back.

During the last election I spent a lot of time being a pundit preaching about the integrity of the voting process. I figured if I am going to keep talking about elections I should get a look at what actually happens at polling places. So a few months before this election I did a few google searches, found my county’s voter information website and sent an email to the address listed for volunteers. The district where I vote was full so they assigned me to the neighboring district. In Pennsylvania the state voting website has a few videos to help explain to volunteers what to expect on Election Day. Despite them requiring Flash, I watched them all.

Of course I had to live tweet the whole day. When I arrived on Election Day morning it was just me and ‘Mary’ the Judge of Elections. Even though there wasn’t much to see she showed me around, pointed out the coffee and the restrooms and mentioned the voting machines which were already set up off to the side. In my district we use a Direct Record Electronic (DRE) voting machine. They weren’t much to look at but I still had to fight my urges to immediately start pulling them apart. I wasn’t here to test or even play with the machines anyway.

Continue reading

Posted in Commentary | Comments Off on A Hacker at the Polls

The Continuing Evolution of Cyber

I don’t think there is another word in the English language that provokes as much of an emotional response from information security professionals as much as ‘cyber’. In fact, half of the people who just read that last sentence are like yeah, but cyber is not a word it’s a prefix. (The other half probably just started giggling.) Unfortunately for them Merriam-Webster and the Oxford English Dictionary have both recently listed cyber as a stand-alone word as an adjective with the definition ‘of, relating to, or involving computers or computer networks’ which to me is an extremely broad definition. The Cambridge, Macmillan and Longman dictionaries all still lists cyber as a prefix but I am sure they will upgrade it to full word status soon. Can official use as a noun, the cyber, be far behind?

Cyber is generally understood to have originated in the Greek word ‘????????’ or ‘kybernetes‘ which originally meant helmsman, as on a ship, which came to mean ‘to steer’ and eventually ‘to govern’. Norbert Wiener chose this word when, in 1948, he entitled his book Cybernetics or Control and Communication in the Animal and the Machine It was Wiener’s work on the automatic aiming and firing of anti-aircraft guns during World War II that caused Wiener to investigate information theory. This was the first documented use of the word ‘cybernetics’ in English.

Continue reading

Posted in Uncategorized | Comments Off on The Continuing Evolution of Cyber

L0pht T-Shirt Quilt

It is hard to work in Infosec for very long and not amass a huge number of T-shirts. Vendors give them away like candy thinking that somehow a free t-shirt is going to make you spend thousands of dollars on their blinky light solution versus their competitors blinky light solution. However, some t-shirts tend to have a great value than others. Those shirts emblazoned with logos from projects or companies that you actually worked with tend to have the most value. Then the question becomes what do you do with them?
For me, for the last twenty years or so, my most valuable t-shirts lived in a plastic box under my bed. I never wore them, because, well, I don’t wear t-shirts much and these were a little too valuable to me to risk them fading due to over use. And so they stayed in the box, seldom seen.
A few years ago I ran across a company offering to make a quilt out of old T-shirts. I thought this was a great idea! And the price was pretty inexpensive to. I almost sent my shirts in immediately but for some reason I hesitated. I started Googling and found there is more than one company making quilts out of T-shirts and way more than one way to do it. I knew nothing about fabric design or quilting, backing material, batting, stitch length, binding, etc.. Evidently there is a quite a bit that goes into a quilt and I only had one copy of many of my T-shirts. I didn’t want to risk going with a low cost option simply because it was low cost.
In the end I chose Too Cool T-Shirt Quilts. I boxed up my shirts and sent them in. They emailed me as soon as they got the box and asked me what sort of options I waned, how big of a border, any designs in the quilting, special positioning of certain shirts, etc.. 2 weeks later they sent me these photos.

L0phtQuiltFront

L0phtQuiltBack


I was pretty impressed. It looked great, especially the quilting design that showed through the back. My whole purpose for getting the quilt though was to hang it on the wall in my office at home. I ordered a custom quilt hanger from Robinson’s Wood Crafts. This allows you to hang a quilt on the wall without putting holes in the quilt itself.

L0phtQuiltWall

If you have a box of valuable T-shirts taking up space under your bed you might consider getting a quilt made, but do your own research, the cheapest option may not be the best one for you and your T-Shirts.

Posted in L0pht | Comments Off on L0pht T-Shirt Quilt