📸 Photo

MAX VISION

dors like Microsoft that preferred to fix security holes without confessing the details of their screwups.

The full-disclosure movement spawned the Bugtraq mailing list, where hackers of any hat color were encouraged to send in detailed reports of security flaws they’d found in software. If they could provide an "exploit"—code that demonstrated the flaw—so much better. The preferred path to full disclosure was to first notify the software maker and give that company time to issue a patch before releasing the flaw or exploit on Bugtraq. But Bugtraq didn’t censor, and it was common for a bug finder to drop a previously unknown exploit onto the list, releasing it simultaneously to thousands of security researchers and hackers in the span of minutes. The maneuver was all but guaranteed to kick a software company into rapid response.

Bugtraq provided hackers with a way to show off their expertise without breaking the law. The ones who were still cracking systems had an invigorated white-hat community to deal with, armed with a growing arsenal of defensive tools.

In late 1998, a former NSA cybersecurity contractor named Marty Roesch developed one of the best. Roesch thought it would be fun to see what random attacks were crossing his home cable modem connection while he was at work. As a weekend project, he cranked out a packet sniffer called Snort and released it as an open-source project.

At first, Snort was nothing special—a packet sniffer is a common security tool that eavesdrops on the traffic crossing a network and dumps it to a file for analysis. But a month later, Roesch turned his program into a full-blown intrusion detection system (IDS), which would alert the operator whenever it spotted network traffic that matched the signature of a known attack. There were a number of proprietary IDSs on the market, but Snort’s versatility and open-source licensing instantly appealed to the white hats, who loved nothing more than tinkering with a new security tool. Volunteer programmers jumped in to add functionality to the program.