The Art of Exploitation

In this report, I will investigate different variants of open learning models and the meaning of openness. This research is carried out in order to try to develop certain types of participatory learning environments and shared knowledge spaces which are free, open, and self-organized.

This constitutes a method through which we might gain an understanding of the emergence of new forms of creativity in a society where decision-making grounds are in a constant flux, and in which learning and research now are integral parts to work as well as creativity.

In the first of these series of reports I will be examining the learning model used by Sparvnästet, specifically as it was used in our series of workshops on network and computer security. These reflections were then used as a point of comparison to the tech meetups and OpenTechSchool workshops I attended during the same time frame.

The Sparvnästet workshops

In autumn 2012, the Sparvnästet hackerspace hosted workshops that aside from the Arduino device also focused on network and computer security. These weekly workshops had been announced on our website were open to anyone and took place from August 28th to October 23rd at Hemliga trädgården and had been announced ahead at our website[1]. This announcement included directions on how to prepare for the workshops; what books to read; what online documentation to use; and what software to install. We made sure our online program[2] featured all the resources required for taking part in each workshop. The only thing required for joining in on our explorations was a laptop (preferably running Linux) 4ZM facilitated the workshops, but participants were also free to share their experience and skills. At the first meeting in late August, we started exploring different patterns of exploitation using passive information-gathering techniques and non-intrusive network reconnaissance.

The participants were divided into small groups, with the goal of collecting target data and mapping the internet presence of a random organization. Serversniff.net provided us with tools and proxies, and we used an online collaborative pad to gather information on possible target vectors. The first computer security workshop sessions, held in the wake of the successful make all event, were big successes, with a turnout so large that the semi-outdoor glazed space was packed.

This simple learning environment was very effective. Laptops, internet, and a readily accessible collection of tools and resources together makes for a great starting point in these kinds of explorations. The open, free and self-organizing workshop for learning and exploring is easy to join, and if you belong to the group of the more skilled participants, making yourself available as a resource to the other in the group is easy.

The group, guided by the facilitator, started its collective exploration. As one task was completed, the group or facilitator came up with ideas for what to explore next. Here, the practical quest is transformed into something dynamic; as the group moves on in its explorations, common goals and tasks emerge out of the interaction between facilitator and individual members. This makes for a two-sided game wherein either side is free to step in and drive the process onwards.

The format takes on the character of a collaborative lab focusing on continuous tasks. Learning by doing is a great way to learn, and in this case we managed to strike a balance between individual/collective experiences, impulsivity/freedom, and attention/planning.

This model provides us with an example of the kind of free and open self-organized participatory environments and shared knowledge spaces which I am at developing through my research. Its most important aspects include recurring events which are free and open, long-term commitment in workshops, open and negotiable plans on how to proceed, and the opportunity to take advantage of the group’s collective experiences. Here, exploration is based on readily available online know-how and open protocols which use easily accessed online tools and training materials.

It is essential to gain an understanding of the background knowledge provided by the digital environment of the workshops, including in terms of previous individual experiences, symbolic values, and what alternative pathways exploratory pathways are available. Thus, the internet becomes an epic field of knowledge, possibilities, obstacles, and questing.

During subsequent Tuesdays, a similar learning pattern is followed, only with a drop in the number of participants. As time passes from later summer to cold autumn, the semi-outdoor glazed space turns colder and darker.

Now the workshop on network reconnaissance starts to pick up speed, and we learn, for instance, how to use security tools like Nmap in order to gain a fuller picture of the target machine. When we moved on to explore the exploit suit Metasploit we started to use our own vulnerable virtual machines as hacking targets: we learned how to identify weaknesses in the target machines and attacking them using buffer overflows and the insertion and execution of shellcode.

After a successful insertion of shellcode we were able to take control over the system and its programs, and then creating a root shell, for example. 4ZM also began to write a fuzzing tool which could cause memory corruption to be used for one of the last workshops.

The season had turned dark and cold when the turn came to the last workshop, which was on the Aircrack suite, and only a core group of attendants were left. It was during this time decided to temporarily relocate to the Royal Institute of Art, where we would arrange new workshops in a more institutional setting, exploring new themes.

Meetups

During this time, I did not only participate in the Sparvnästet workshops. I also took part in several free and open workshops of a similar but different nature. This was done in order to learn more about comparable formats, thus being able to gain a deeper understanding of self-organized learning environments and shared knowledge spaces. The common thread binding all these meetings together is their reliance on the need and desires of the individual to continually acquire more knowledge. As such, they all are part of a society of knowledge which exists outside of formal education, and they all have a part to play in the knowledge-intensive context of the world of software development.

The learning format consisted of open-source software centered so-called “meetups” and workshops organized by OpenTechSchool. I attended software developer meetups on open-source programming languages like Python, the Python web framework Django, and Javascript.

Meetups are meetings organized via the site meetup.com. These are, as stated on meetup.com, about “neighbors getting together to learn something, do something, share something”. Meetup.com aims a helping “groups of people with shared interests plan events and facilitates off line group meetings in various localities around the world”. Anyone can use the site to organize a meetup on their topic of choice by creating an event and inviting people. Tech meetups are specifically focused on gathering communities around certain programs, frameworks, or interests, bringing people together to share their experiences.

Tech Meetups

These tech meetups serve to help software developers stay up to date on recent developments in the world of software and frameworks, and also aid networking activities. These free and open tech meetups generate a lot of interest – you have to RSVP as soon as the meetup is announced on the meetup.com site in order to secure a spot. There is often only seconds until the event is fully booked.

Tech meetups are based on networking and presentations on specific topics, sometimes in conjunction with workshops. Software companies with an interest in promoting certain tools and frameworks are happy to host these events in their offices during off-hours. The companies provide participants with free food and drinks – including alcohol – in more or less fancy packages in order to promote their own brand within the target community.

Spotify

Two of these meetups were especially interesting in regards to openness, free access, and the competitive business environment created by the internet. They were hosted by Spotify, a “success” story in contemporary business models, signifying a commercial “solution” to software piracy.

The fanciest meetup was on the topic of Javascript, with the more than 200 people who attended being served a luxurious buffet. I could easily discern how important such meetings are for the developer community in terms of professional networking and culture. This specific meetup consisted of a couple of presentations. While presentations might be a good way of introducing developers to specific topics and frameworks, the format as a whole was more reminiscent of a spectacle. The environment at Spotify and the free alcohol strongly emphasized the importance of instilling a feeling of being part of a culture of success.

The second meetup was a large-scale meetup focusing on Python. This time my interest was primarily drawn to the way in which the Spotify representative presented Spotify, and why the company wanted to host a meetup on this programming language. According to him, Spotify likes open-source, and Python is a great backend language. He then went on to relate the success story of Spotify, describing it as an attempt to solve the problem of piracy and to rebuild a functional relationship between consumer, artist and music industry.

To my eyes, the Spotify meetups were somewhat flawed as learning environments. Maybe this is because they do not aim at providing anything more than presentations. Or maybe it is because the strong feeling of spectacle. My attention was mainly caught by the scale of the events and the Spotify aura emanating from them.

The Spotify business model stands in contradiction to openness in my view. It is part of a system of copyright in which an imbalance of power is used to extract value from the consumer. This imbalance is created by means of enclosure, centralization, and scale. Centralization, if considered from an openness perspective, goes against the idea of general access.

Even though big companies such as Spotify have gained much thanks to open protocols and internet peer technologies, their professed love for freedom of information contradicts their business model, which is based on the centralization of power. Promoting things like open-source is probably a necessary trade-off if their chosen business model is to function, and keeping this in mind is important.

It is my belief that Spotify-like business models are [real abstractions]. The centralized system is not a prerequisite for content distribution; rather, it serves as a mechanism which exerts controls of a distributed network from up above. The centralization is a real abstraction which establishes market-based rules and rent relations on an otherwise differentiated plane of possibilities; possibilities that stem from the same openness which Spotify seemingly promotes in the open-source software development community. While there certainly is a value to Spotify’s offerings, it is a fact that they are using the underlying principles of open-source software and the internet to generate new enclosures out of content which is already available. This makes the whole question a slippery one.

It was obvious that the goal of these meetups was to oil the wheels of the mainstream economy. In choosing to host their open-source event at the Spotify offices, it seems the organizers consider Spotify an important example of success. Despite the fact that these meetups are free, open and promote the free circulation of know-how, their underlying purpose appears to be more oriented towards privatization, without any consideration for any possible bigger picture (which might involve such things as the commons and free accessibility).

What is the role of openness in these business models? Is what we are looking at here a type of openness which has been modified to facilitate enclosure? I certainly think so, and the same thing applies to other big corporations – like Facebook and Google – for which openness has been key for success (by using it to generate their own versions of enclosures).

 

Nevertheless, these services are widely used and loved. If we value diversity as an important part of internet culture, then we should try to avoid using central solutions. Such services disarm a field of possibilities by providing us with comprehensive, one-size-fits-all solutions. In a society characterized by true distribution big centralized services would not exist. As things stand now, it seems like laziness rather than any real freedom of choice is what guides consumer behavior.

In comparison with the workshops organized by the Sparvnästet hackerspace, these meetings primarily diverged in terms of their association to indirect, “secondary” success, business models, and the price which comes with these kinds of affiliations. Affiliation with success is attractive to many people, but in order to fully understand the nature of openness, self-organized models, empowerment and true access – things going beyond business considerations –must be also be taken into consideration (especially in terms of my own research project).

In regards to knowledge space, the meetup provides us with a linear and straightforward format.

The meetups attended were large-scale, featured presentations followed by short Q&A:s, and lacked any kind of hands-on workshop activities. It came as no surprise that they did not offer much more than that which had been announced in the program.

When it comes to participation, I am looking for a certain degree of unpredictability, as it seems to be a core factor in creating space for engagement.

Python meetup

A meetup focusing on the Python-based web framework [Django] offered more in terms of participatory learning environments than those hosted by Spotify. This meetup, which was hosted by the software company Omegapoint AB, was smaller, featured workshops, and left room for individual consideration in the creative processes.

Open space technology (OST)

The format chosen for this meetup – [Open Space Technology] (also called Unconference) was peer-based. By focusing on a single theme, Open Space Technology limits the interest span of the meetings in order to generate focus and engagement. Here, participants form discussion groups based on the interests of the individual participants and crystallized by means of voting.

After a presentation of the OST-model and the meetup, people were invited to come up with a list of interesting topics they would like to discuss. Everyone got to vote for one of these topics, with those receiving most votes becoming the subject of the discussions in the sub-groups. I joined a group discussing Django and security, and later sat and listened in on groups talking about Django and test-driven development.

In my view, this trust in peer engagement and acceptance of change dependent on the constellation and interests within the groups represents a quite radical way to facilitate learning. The strategy of diving bigger groups into smaller workshops results in a more focused learning environment while also making the individual know-how brought to the group available for everyone.

The OST model successfully addresses one of the problems of software development culture: how do we create engagement and find new ways to network, collaborate, and continually learn? Staying on top of new developments is vital in a knowledge-intense work environment like that of software development. Each participant is very likely to possess a wealth of knowledge which could enrich the whole group if they only were allowed to share it with them. Thus, we need to develop a model which encourages such sharing.

The software developer community seems constantly engaged in trying to develop working methods which opens up for both long-term value creation and creative work processes which are compatible with meeting deadlines, client expectations, with room for creative solutions – all at the same time.

Agile software development represents one such working method. Agile development can be considered an attempt at creating transparency in the relations between individual developer, clients, and the client’s demands by giving the development process center stage. The rigidity created in the top-down style planning of waterfall models is recognized in agile development, which was developed in view of real-life development cycles (where iterative processes are central). However, this new model for management and project planning might be used for everything from running a software project or a business to making a revolution.

The agile software development model and the OST model both represent attempts to create formats which are capable of handling the contradictions of management and planning; of creative freedom and the individual; of collective and organizational needs. They reflect the attempts we find in many different aspects of society at finding more efficient ways of organizing work and creativity through inspiration from less hierarchical structures characterized by participation and learning.

These meetups, compared to those run by Spotify, are clearly better suited at generating longer lasting learning values and creating space for social learning environments. This serves as an illustration for the fact that how we organize learning actually matters.

OpenTechSchool

During the same period, I also joined several workshops organized by [OpenTechSchool]. OpenTechSchool was founded in Berlin in 2012, and the same year one of its more active members visited Stockholm. All the workshops I participated in (where I sometimes also took on the role of teacher) were based on open-source platforms: the programming language Python, the open hardware platform Arduino, and the version control tool Git.

In contrast to the other meetups I visited, OpenTechSchool communicates a tacit pedagogical agenda and uses a clear learning format in order to teach skills. As they write on their website:

OpenTechSchool is a community initiative offering free programming workshops and meetups to technology enthusiasts of all genders, backgrounds, and experience levels. It supports volunteer coaches in setting up events by taking care of the organizational details, encouraging coaches to create original teaching material. This material is then openly shared online and can be further developed by contributions from the global OTS community. OTS’ main goal is to create a friendly learning environment where no one feels shy about asking any question. Everyone is invited to participate...

OpenTechSchool is based on the principles of openness, sharing, self-organization, inclusiveness, not-for-profit principles, learning-by-doing, empowerment, and safe learning environment through work in small groups.

As the other meetups software development companies hosted these.

OpenTechSchool actively makes sure that participants have online access to any materials necessary for following the workshops.. In addition, there were always coaches around to help anyone with questions.

Thanks to teachers, intensive workshops, and clear online instructions, the workshops I visited were successful in creating a nice, intimate and creative learning environment.

Diversity

In comparison with other meetups, OpenTechSchool featured a greater diversity in terms of age, skill-levels and gender. The fact that the group was female-led could serve as an explanation for the even gender balance among the participants. OTS did not focus on developers exclusively, but reached out to a wider group of people interested in learning about development. Thanks to a very open and welcoming atmosphere, OpenTechSchool felt like it was more accessible to the general public.

OpenTechSchool meetings also featured a more diverse crowd than those attending Sparvnästet workshops. I consider this fact essential for the development of a generalizable model of diversity and participation.

These values are not unique for OpenTechSchool, but are also recognized by the larger developer and hacker communities. The Sparvnästet hackerspace also subscribes to these values, and in many ways, the two projects are similar. Despite this, overrepresentation of (young) males still represents a problem of diversity for Sparvnästet – a problem which the welcoming atmosphere of OpenTechSchool was able to overcome.

Affiliation

When examining the OTS website from the hacker perspective, it was puzzling to discover that they collaborated with PayPal – even though I  of course the conveniency of this service. A lack of reflection is revealed in this collusion with a mega player like PayPal – a corporation not only famous for providing convenient services for the transfer of funds, but also for refusing to process donations made to Wikileaks. It might be expected that real hackers would be sensitive to such affiliations. This might seem like a minor question, but despite this, we must recognize the problem which affiliation represents for developing models for self-organization.

Branding

It was around this time that OTS turned itself into a non-profit foundation, a move which was necessary if they were to fund themselves through PayPal [link to blog]. This decision raises questions on how much consolidation an open format can take. Turning OTS into a non-profit foundation could also mean that you are introducing means and ends significantly different to the original core values.

OTS was constructed out of already readily available open principles. Despite acknowledging the strengths of their inclusive model for learning, I think there is room for critique in regards to how they are consolidating and branding a concept for open learning.

Branding brings clarity to a format and provides it with clear rules of engagement. The OTS format is successful, nicely packaged, and could easily be copied or recreated in more or less any city around the world. Even though I enjoyed taking part in OTS, I was also left with a feeling that the branding and labels they used was not really necessary.  OTS would become better still if the format could be open-sourced and lacked any attached label. Since there are no simplistic answers to the conflict between means and ends, this must be investigated further. We have reason to ask if there are better methods for making projects open and accessible. While no one could possibly own the concept of the hackerspace, these spaces nevertheless  make possible the creation of learning environments of great value.

Comments and Issues

The internet – combined with common and open protocols – has made it easier to fulfill the urge to organize and attend open learning endeavors like those described here. Both the developer and hacker culture are still young, and therefore there is a huge interest among their participants for finding new ways through which to network, collaborate, and constantly acquire more knowledge.

All of these open meetings represent essentially different practices through which local online communities attempt to come to grips with networking and learning. However, the there is great ambiguity to the application of the idea of openness, and this is something which must be viewed relative to larger flows of freedom in society – especially when it comes to research such as mine, when we explore participatory learning environments and shared knowledge spaces. In attending these meetings I took part in learning activities from a multiplicity of roles: as a hacker, developer, peer, teacher and learner.

 

In circumstances such as these, a possible way of trying to understand the concept of openness entails reflection on both the nature of the freedom which is produced by the environment – as well as the nature of the freedom which in turn encircles the environment.

Is “open” the same thing as everyone being free to enter?

Is “open” the same thing as free, as in free beer; free of charge?

Is “open” the same thing as meetings being organized outside of established institutions or companies? Or does “free” mean that you are the product?

Is “open” the same thing as self-organized meetings with independence as a guiding principle?

Is “open” the same thing as inclusivity and creation of diversity? Or “open” as in open access – for example, how much tacit knowledge or subcultural lingo is demanded of participants in order for them to enter freely?

Is “open” the same thing as an open agenda, with room for unpredictability and participatory decision-making?

Yet another question could be to ask is whether conflicts could emerge between different kinds of freedoms. Might it be the case that there is a contradiction between vertical freedom – a forward motion towards specialization and development of skills – and a horizontal movement towards diversity? If so, are there certain kinds of organization and strategies that are better equipped to handle such contradictions?

Is there a fundamental difference in the handling of freedom if you compare free collaboration between peers and planned, institutionalized learning? Do people learn, create art, or engage in hacking differently if these activities are acted out in a situation of free peers rather than under more hierarchical and rigid circumstances?

Maybe it is the case that peer collaboration and coordination, outside of any institutionalization, could help reduce thresholds represented by skills, resources and diversity, instead creating a kind of continuous space of possibilities. It is my aim to further explore these issues.

OpenTechSchool might serve as an example of how you might construct a friendly environment from the ground up. What should be considered an optimum skill-level in this exploration if the aim is to try to establish a sort of edge of diversity? What strategies or actions might be used to lower the threshold so that more people are able to participate? How can we go about creating an edge on the one hand, while on the other also creating an open, smooth space open for people to enter? The threshold between skills/learning has also been raised in relation to the hacknight make-all[3].

Enclosed communality

My research shows that openness, self-organization, and [the commons] together not only represent a means, but also an end. When talking about participatory models, we should ask ourselves whether the value they give rise to is easily recaptured by privatizing interests, and if this process is draining the commons in the process. On a related note, we might also ask if the commons we create are capable of resisting capture by the forces of privatization.

Is it possible to have things open without any requirements for [communality]? Under what circumstances is communality just a means to another end? Consider Facebook, Google and Spotify: they utilize openness and communality in order to construct restricted proprietary models, easily accessed but hard to break out of. By studying these examples we can identify negative patterns to draw lessons from.

Whitewashing

The agency of hacking might can be whitewashed and “cleaned” through commercial institutionalization because this strips it of unpredictable behavior and establishes rules for the “productive” use of hacking. The organization of hackathons by corporations is but one example of how the power of hacking can be reshaped into a tool for enabling and complementing commercial integration.

There are numerous hackathons which are organized companies who invite students to “hack”; to explore the “cool” open technology offered by the company. To some extent, this makes it possible for companies to extract free labor, but the most troublesome aspect of this is how the format functions to frame hacking as a potential of the commercial, of the private. In trying to locate creative forces, it is not this capturing of free labor that I am interested in; on the contrary, it I am looking for something that might create a peer value more characterized by an unpredictability which lies outside of the reach of enclosure.

Independence

If we are to escape the logic of recapturing and whitewashing, maybe the key is to stay away from consolidation and institutionalization altogether. Maybe peer coordination presents us with an opportunity to escape this capturing movement while still being able to organize models for learning and production.

Here, the question of how to create autonomy, how to build independent spaces – digital as well as local ones – becomes of central importance. These are spaces which cannot be allowed to be ruled by commercial processes; rather they must be based both on free infrastructures and digital platforms as well as self-taught organizational skills.

Unpredictability, self-organization and hacker ethics

Learning how to deal with unpredictability and the unknown is important both for participatory and creative processes, situations in which continuous change is the default mode.

In regards to this, it is my view that art could be strengthened by hacking; that there is something important for art to learn here. If you look at the Sparvnästet program [hacking the art of exploitation] from the outside it might look suspicious, and some people might even find it a bit scary. And in some way it is scary. But this is not because of the content, but rather a function of the unpredictable nature of hacking. Any exploration, creative endeavor and production of new knowledge must include a certain amount of unpredictability. Darkness is default in these parts, precisely because we are entering unknown territory.

Having free, creative processes ruled from above is a contradiction, and therefore we must accept this as a space in which individual freedom and ethics are the only limiting factors.

We might motivate hacking activities as a strategy of defense: if you know how to hack into computer systems, this will also allow you to understand and prevent attacks. However, the only explanation we really need is the fact that it is important to explore the unknown. There is no way to defend the unpredictability of hacking, or art in itself, other than making it into a question of free, personal agency and ethics.

Learning how to hack and be creative is something which starts out as a quest for acquiring knowledge and skills, but at the same time it also represents an ethical path of creativeness. Here, free art might learn from hackers, as these often possess a strong action-oriented ethics to guide them in a world of unpredictability.

If we are to learn how to create art or acquire hacking skills in a free society, we must make sure to allow for the emergence of individual processes. Peer-based learning might replace institutional ethics or laws with peer coordination, in which individuals actively develop their morals and skills in their groups. The behavior of group or individual should not be made subject to central authority; the unpredictable must remain precisely because it is key to the value of art and hacking.

Choosing how to use that which you have learned must be left to the individual. This means that both individual and group ethics must constantly be developed and iterated.

First and foremost the goal should be to master the unknown and foster a practical ethics. This might be seen as a necessity produced by the unknown because of the importance of learning how to adapt to it. Here, hacking takes on the form of a generalizable format, a format which will probably be stifled in other situations not welcoming to this kind of creativity. That is why self-organized learning is important.

Finding out how the world functions is a tool which should be made free in order for it to help people understand and build an ethics located between life and technology. The hacker attitude in general implies a creative attitude through which to approach the world, and in some ways it provides a clearer agency compared to that of art. However, it might be asked this makes hackers a new avant-garde, and if their techno-literacy and ethics is for everyone.

This is involves similar processes as that of art, in which the artist always has to perform a sort of risk analysis, this because the often private nature of his or her work means that conveying its message always involves interpretation. This means the addition of varying extents of unpredictability and darkness – something which the artist must be able to handle.

As we move the hackerspace to The Royal Institute of Art, the unpredictability of hacking (similar to that found in art), as well as institutional anxiety, becomes a theme to explore further.

Q:\palle\bilder\2012-07 20120918_194215

http://www.opentechschool.org/about.html#core_values

http://en.wikipedia.org/wiki/Open-space_technology

https://en.wikipedia.org/wiki/Unconference

http://blog.opentechschool.org/2012/10/wrapping-up-jsfab-stockholm.html

http://blog.opentechschool.org/2013/02/thinking-education-further-than-tech.html

blog.opentechschooacl.org/2013/05/opentechschool-is-now-a-foundation.html

http://sparvnastet.org/autumn-schedule/

---------------------------

Not Paying for It; You're the Product

a need of a knowledge hungry and a format. what am thing to find here. If You're

Long-term value is not generated by dismantling the process of production into commercially viable units, but rather the underlying skills of these processes of production plus the ways in which knowledge processes are materialized. Creativity requires personal ethics and skills in order to handle unpredictability. Just like in any other personal undertaking, this is something which must be guided by ethical principles.

The technical aspect of building a model, what technical exploration can lead to, as a way to understand aspects of the world.

In addition, and more importantly, carrying out these explorations also meant learning about network communication, machine architecture, how the internet actually works, how packets are sent, how computers handle memory, and how data is stored.

Activities that might be in a grey zone of what is legal are not conducted at our open meetings, or at least, they are not part of a manifest agenda. Nevertheless, the new hacking skills we learned in the workshop could be used for anything a person would like to put them to use for. For instance, some of the port scanning projects might have been conducted in a way inaccessible to my research process.


[1] https://web.archive.org/web/20121123231651/http://www.sparvnastet.org/

[2] https://web.archive.org/web/20130616164619/http://sparvnastet.org/autumn-schedule/

[3] http://www.articipation.se/2012/08/30/Hacknight.html