Hacker News Reader

Comment by peterwwillis | Hacker News Reader

The standard hacker stereotype is of kids in basements, which the author seems to propose here, but most hackers who commit crimes are in their 20s-30s. (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens) The bravado thing is less a factor of being young, and more that a ton of cyber criminals have comically inflated egos.

View on HN

> (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens)

According to Wikipedia, the ages of the people arrested in connection with LulzSec were (sorted): 16 17 18 19 19 20 21 21 23 24 24 29. Plenty of teen representation there, and even low 20s is still pretty young. (Those ages are at the time of arrest, but most of the arrests were in 2011, the same year LulzSec was founded, so they would have been about the same age when they committed the crimes - albeit likely younger when they first got into the 'scene'.)

Similarly, Lizard Squad: 16 17 17 22. (Main activities were in 2014; ages adjusted based on the number of years between then and the news articles specifying the ages.)

Neither of those groups were terribly sophisticated (mainly performing DDoS attacks), but neither is the person(s) in the present case, who just culled passwords from old leaks and got the media to make a fuss.

Anyway, getting arrested ≠ committing crimes. To get arrested, you have to (a) go after a high-profile target and (b) successfully attack them (where DDoS counts as an attack). Lots of kids do things like DoSing personal rivals (and their Minecraft servers), which is definitely a crime but unlikely to result in an arrest. The younger, the more petty...

There's also an element here that should be studied in more detail: These are arrests, not participants. What if the older hackers are just better at not getting caught and it's the kids that make mistakes that get them busted?

Yes and no. LulzSec and Lizard Squad belong to a very specific subset of hackers: people who hack big targets simply because they enjoy it. People in this group tend to be relatively unskilled, and less emotionally mature, hence skew younger. And they also are a lot more likely to end up in the news, and in people's imaginations.

The majority of hackers in the modern day do what they do for financial gain. Among that group things are more even. But the skilled hackers, those that develop and use 0days, will skew older because it takes time and experience to reach that level.

Most hackers would also recognize that demanding ransom from Apple in exchange for not wiping accounts isn't likely to be very effective and may have some negative consequences (e.g. being caught and getting beaten half to death by their victims). I have no trouble believing that the culprits here are likely to be pretty young.

The threat of wiping accounts was silly in the first place. The hackers have user passwords, not access to Apple infrastructure. So they log in as the users, delete files from iCloud... and Apple restores files from yesterday's backup. They could cause a lot of hassle for the users and Apple customer support, but not wipe accounts.

Or they issue a "lost device - remote wipe" via find my iphone / find my mac. No restoring from that for mat: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...

It's a shame you can't have Find My Mac active without also allowing remote wipe. So I disabled Find My Mac for myself.

Did you just link to a 5 year old story?

Has the situation changed?

Most hackers don't commit crimes, because most of them aren't stupid. But some are. (I have known those stupid people, and they were in their 30s, did really stupid shit, and are now doing time)

I would posit that most people engaged in cyber crime are not hackers, from the botnet owners who literally paid for and downloaded a tool with instructions, to the people who install skimmers, to carding merchants, people running protection rackets, email scammers, etc. A small number of people actually "hack" into a system using any form of advanced skill in order to do things like extract accounts like those in the article.

> Most hackers don't commit crimes

What definition of hacker are you using here? I know we're on Hacker News, but in the cybersecurity context hacker refers to someone who hacks into a system, which would mean hackers commit crimes by definition.

EDIT: I pasted the wrong thing

No, in a cybersecurity context a hacker is merely someone who knows about or is involved in security hacking. This includes, for example, researchers and government employees. It also means people who self identify as a hacker, and again, they usually don't commit crimes. The vast majority of DefCon attendees, for example, don't commit crimes, and then there's all the corporate shills at BlackHat.

Reply on news.ycombinator.com