week 6 (October 15-21), topic 11
Find and blog about an illustrative case of hacktivism.
I would describe the case from the movie "
Web warriors" (
there is also Estonian version - movie is in English with Estonian subtitles and comments at the beginning).
This is the true story about Michael Calce aka
mafiaboy - highschool student from
Montreal and member of Russian hacker group TNT/Phorce. In this film all are talking about
hacker but I would say
cracker. Why? As we know, the hacker is clever programmer but cracker is cyber criminal. In previously mentioned movie there are three categories of hackers spoken:
- white hats are good guys - virus hunters and/or your office IT-specialists
- grey hats - they work both sides of the street: for good and bad guys. They are doing e.g. penetration testing hired by companies. Good example is Donnie Werner aka Morning Wood
- black hats are bad guys - writing viruses or they are crooks - e.g. trying to steal your credit card numbers
I would say, that these
black hats are crackers :) But e.g.
Wikipedia thinks different. I respect what
ESR says - hackers are good, crackers bad.
Internet was never designed to be secure - not to keep your bank accounting information etc for what we are using it today. So - why not to leave mission critical systems disconnected? For business efficiency it is quite impossible - systems needs to be remotely accessible to manage them faster.
We would say, that there is no secure computer or its network. As our famous hacker Michael Calce says - everything, what is online - it can be shut down (it means take control over the internet and if wanted - also shut down).
In the movie, hacker Donnie says that one week for research and one day to take down - power supply, switch off communication and basically turn off that military power we know - basically it paralyzes the country....
I would say, that I've seen myself, how Donnie does it. That international flight booking web portal has same weaknesses, what also some other systems have, which are created by same person - this wasn't mentioned in the movie.... Donnie demonstrated in the movie and also to myself, that less in 5 minutes he could get in (with one arm!) into one international flight booking system. The most worse thing is, that this system creator doesn't listen Donnie and don't fix these bugs. So - there might be several flight booking systems in the world, which are vulnerable for crackers...
It was honour to take part from two of Donnie's courses, where he showed a world alternative. This was awesome experience and this was actually just smelling that world... We made some penetration tests and noticed, how vulnerable MS Windows is... This would be an example for decision makers, who still thinks, that MS Windows can be secure operating system... The only reliable prevention is to move some free
UNIX-like system (like
Linux), which at least is
designed to be secure system...
Nowadays there is one of the biggest hackers conference called
DEFCON, which is most exciting event in this area and probably quite dangerous place to visit... There you can pay only with cash and no banking cards. This is actually good idea - in the place, where are approximately 7000 hackers over the world, isn't the place, where use your credit card :)
But Michael just prepared the weapon against another hacker group and didn't mean to attack any company or mission critical network... But he had to test it and choosed Yahoo, then CNN, Amazon, E-Bay, Dell... But when CNN were shut down - also 1200 other connected sites were disappeared... All these attacks were based on Pentium-133 computer.... That most damaging computer virus called
Blaster... Antivirus for that virus was invented at F-Secure lab in Helsinki, Finland.
During few seconds approximately 50 million peoples remain without electricity - even some nuclear powerplants were shut down... There were approximately 100 powerplants shut down. In New York City emergency state were announced... Phone and water systems were not working, thousands of people were trapped into subway and elevators. Trains, aircrafts, ships were stopped. This all happened 11th to 14th August 2003, when largest blackout in history causes 6 billion USD in damages. Official cause was: overgrown trees on power lines... But there was much more than just trees...
Finally Michael was arrested due to swanking. He spent 8 months at youth prison. But he was actually first person,who showed that emperor has no clothes - how vulnerable internet is. Suddenly internet wasn't so nice place to do business.
Then Microsoft put announcement online, that they will give reward 250 000 USD for every arresting and conviction of dangerous virus writer. There are enormous collection of documents, what are collected by one MS Word macrovirus - this might be named also as spyware. My suggestion - use
free and open source software and open data file formats - then you are much less threatened.
TJX - one of the largest online company (more than 2000 representations over the world) announced on 2007 of stealing their customers credit card data and other personal information. This attack maybe happen through WiFi connection (used
wardriving) and known as largest stealing of personal and credit card data over the internet - probably more than 94 million people were influenced...
Nowadays there are so called hacker toolkits in internet, which are bundle of carefully choosed programs and gives even for beginners opportunity to be small cyber thief. You can just tell, which virus you need and program will write it to you. This is very dangerous and makes easy to be criminal even by accidentally for some youngers.
In the end of the movie Michael says, that even 8 years later situation is almost same and he can repeat same attack if he want to... This makes me worry - how is situation today...
I have same opinion - mission critical systems should use separate network and not internet. We surely realize, that building similar network like internet is quite resources consuming, especially time and money.
So there might be also considered to use strong encryption, user authentication (ID-card or similar), asking confirmation code over SMS and/or special app at smartphone etc - multiple level of security.
But as we know - locks are created by humans and can be also broke by humans. So separating mission critical systems physically would be the best solution.
Who knows - perhaps
Internet2 would fill that gap, what is needed to establish secure future. When every step would be traceable in time, every person who enters the internet will be known - perhaps it disciplines people to behave nicely.
Similar attacks by crackers might trigger cyberwar and possible
WWIII. Therefore is very important to pay special attention for security with sensitive data and mission critical systems.
Some links:
