October 27, 2001
Dance with the Kiddies
 
 
Script Kiddie. 1. [very common] The lowest form of cracker; script kiddies do mischief with scripts and programs written by others, often without understanding the exploit they are using. Used of people with limited technical expertise using easy-to-operate, pre-configured, and/or automated tools to conduct disruptive activities against networked systems. Since most of these tools are fairly well-known by the security community, the adverse impact of such actions is usually minimal. 2. People who cannot program, but who create tacky HTML pages by copying JavaScript routines from other tacky HTML pages. More generally, a script kiddie writes (or more likely cuts and pastes) code without either having or desiring to have a mental model of what the code does; someone who thinks of code as magical incantations and asks only "what do I need to type to make this happen?" - The Jargon File

    Having a web site used to mean you had a window on the world, where you could pass notes back and forth with the entire world and get your message out there, whatever it was. For a brief time, I am told, it was a paradise of personality and pornography, instead of the swamp of corporate suck it is today. While you can still get your message out to the world via the Internet, these days having a web site basically means you will be cracked by Script Kiddies.
    In a previous column I talked about web logs. Web logs tell you who's been visiting your site, where they came from, what browser they're using, etc. I look at my web logs recently and I see stuff like this:

/scripts/root.exe?/c+dir 
/MSADC/root.exe?/c+dir 

    This means that someone is trying to exploit Microsoft Windows or IIS Web server security vulnerabilities to get access to my web site - or, more probably, access to the server which hosts my web site. The fact that this won't work because the server which hosts innerswine.com is a Linux server running the Apache Web Server underscores the point: the person trying to crack me must be a Script Kiddie.
    ‘Script Kiddies' is a term which describes people, usually juveniles, who try to crack computer systems using precanned software they did not create, and which they usually don't understand. They have a limited concept of computer science, and generally only have a single talent: finding precanned cracking software to use against you. The idiot who emails you ‘joke.exe' with a trojan file within it is probably a script kiddie trying to take control of your PC. They are generally nothing more than ignorant vandals  -they can do damage, but not through any kind of superior knowledge or experience. If this idiot had any knowledge, they wouldn't be using Microsoft-based exploits to try to crack an Apache server.
    The thing is, I shouldn't have to worry about this. Having a web site ought to be about communication, not defense. It ought to be about attracting potential readers and entertaining the readers I do have. I shouldn't have to worry that someday I'll wake up and my site will display something weird and offensive - it just isn't fair. Not that the Script Kiddies give a shit what I think is fair - if they do crack my site they will display something that is either amusing to them, or some political statement they feel I ought to be expressing - maybe. Most likely they will use the site to distribute illegal files, shielding their actions from their own ISP accounts and web sites. Bastards. But that's what you're dealing with: teenagers. Remember what it was like to be a teenager? Now imagine that one has the power to fuck up your life. That's what it is to have a web site these days.
    Why does this matter? It's just one more thing I have to worry about in bringing my brand of Swine-flavored wonder to you. The bulk of responsibility for securing my web site lies with my web host, Hosting For Humans, but some of it lies with me, mostly in a best-practices kind of way. As long as I use a good password on my accounts, which I don't give out to anyone, as long as I don fuck up my configuration or run any odd scripts, my web host has a fighting chance to keep my pages up.
    Still, when I have crap like that in my logs, it worries me. is this someone with a vendetta against me, who will eventually try something mor effective? Or is this just random hammering at my site? And when I can't get my site up at work one day, has it been cracked, or is it a local DNS problem? I don't know, so I have to email my web host and endure his dry response. This is all more shit I gotta do, and its annoying. And if they keep pounding at my site, they might someday manage to crack it. Which would suck.
    Oh well, it's just the sad sign of the times, I guess, and too bad for all of us with web sites. I'm glad I pay someone to worry about this, rather than trying to host my own web site - considering my technical skills, that would be disaster. I'm kind of a Script Kiddie myself, just a benign one. 
    I promise a more interesting column next time. Maybe. Until then, email me if you want.  


Jeff