The best reference I can recommend would be Eric Raymond's "How To Become A Hacker" : http://www.catb.org/~esr/faqs/hacker-howto.html The key point the article points out is that "The basic difference is this: hackers build things, crackers break them." The teenage thrill of breaking into computer systems is certainly exciting but perhaps he will be even more enthusiastic about learning to be curious about how things work under the hood, how to do clever things via programming and how to develop a true hacker mind set. Of course all this without the risk of getting into trouble like breaking into his school's computer system. I am glad to know that he did not choose to do any major damage but nevertheless I hope he grows up to become a fine hacker and understand the true meaning of being one. Good luck and great effort on your behalf to try to advise him in the correct path!
Like most of ESR's aphorisms, this "building vs. breaking" thing misses the mark entirely, reflecting more about how ESR thinks about the world than how the world actually works.
There is lots of productive work to be done in "breaking" systems. Nobody thinks Arjen Lenstra or Paul Kocher are doing work of a lesser caliber than Alan Cox; it is (I think obviously) harder to break RSA than it is to build a new Linux virtual filesystem layer. It is only because people like ESR don't know about people like Paul Kocher that this "build vs. break" meme spreads. Let's try to kill it when it appears.
What teenagers need to have is a sense of ethics. This has nothing to do with whether you spend your time finding holes in things, and everything to do with respecting property, with not assuming that you know the impact of every action you take that invades someone else's property, and hopefully with having a productive goal.
Here's what you need to tell your cousin: nobody in the real world gives a shit about your ability to break into one computer system. Per-host network penetration testing is close to the bottom rung of the computer security career ladder. If he likes breaking things, what he should do is start picking up open source software, researching how it works, finding vulnerabilities, and reporting them.
He's going to find really quickly that knowing you could --- if you were a criminal and a moron --- break into tens of thousands of computer systems is a lot more fun than breaking into one badly-configured school computer. He's also going to learn real computer science, because really breaking systems involves really reading and understanding code, runtimes, layering, information modeling and representation, and any of a zillion other things.
Computer security is a really awesome tour of a lot of the fun stuff in a CS curricula. I've worked on compilers, crypto math, distributed commit protocols, filesystems, and language runtimes in just the last 12 months. If he likes this stuff, get him to stay with it.
You asked for books. How about:
* The Web Application Hacker's Handbook (bad title, great book).
* Eldad Eilam's "Reversing"
* The Art Of Software Security Assessment (our industry's bible)
* The Shellcoder's Handbook
* The last 10 years of Black Hat Briefings talks, which are all available online.
Books, articles... I'm afraid they're boring - they are cool to read if you're interested in the society, but that comes later on and you start to look for those things yourself. If he's interested in how things really work, then just make sure he knows the difference between exploration and breaking someone's work. The best learning material I have found are pages of people dealing with real security... stuff that you cannot find by googling "hacking".
That might both give him some new ideas, as well as show who is really considered important. For example, I always thought lcamtuf (http://lcamtuf.coredump.cx/) is a great example of a hacker of many skills (photography, network security, fuzzing, constructing robots with own 3d printer and many more random ideas). I guess you just don't have time to be a script kiddie if you have enough good ideas of your own...
Just make sure he finds securityfocus before he finds cDc :)
On the other hand you could let him know, that notifying the school officially about the security problem may be a bad idea. Typical teachers are as likely to say "thanks", as "OMG hacker! security audit to make sure you didn't change any data will cost X$/h - your parents are paying for it and you're suspended".
I have a problem with that essay. It makes good points, most of which I agree with, but Raymond states them as values to be learned without explaining why. He essentially states his own beliefs without giving reason for some of them or explaining why such mindsets are useful. (Or: he shows rather than tells.)
The phrase that stands out most upon first glance is this:
Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.
If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval.
I've found this not to be the case. Wanting sex, money, and social approval is not necessarily detrimental. Similarly, I get no thrill from solving problems per se. I don't think that that thrill is a necessity for hackers. Raymond uses too broad a brush.
From some lens, my approach could be seen as problem solving. I've always viewed it as more of a creative art: I view the things I create as concepts. "What would happen if a web site worked like this, for instance, then I create every to revolve around that central theme. Some of the stuff I do is geared at problems, but I feel that viewing mistakes as bugs is a very sterile approach and I hate it.
I don't have a lot of the traits that go alongside hackers, either. Coding languages don't fascinate me, by-and-large. When I look at a language, I figure out exactly how to get things done and then I don't look at it again. As a result, I don't find much fascination in discussions about programming, which is rare among hackers.
Messing around with things, figuring out how they work and making them do something I want them to do. It's interesting to me. Doesn't really solve any practical problem though.
