Black hats, grey hairs
A shake-up in the hacker underground and fresh attacks suggest change is coming to computer security
Aug 6th 2011 | from the print edition
AN 18-YEAR-OLD with 16 computers in a small house in the Shetland Islands: that is where a police hunt ended for the global nerve centre of LulzSec, a group of hackers whose exploits include defacing or disabling the websites of Rupert Murdoch’s media empire, the CIA, a bunch of gay-bashing American Baptists, and Britain’s Serious Organised Crime Agency. Active from May to late June, when it claims to have disbanded, LulzSec’s hallmark was prankish attacks accompanied by public mockery. As well as officialdom, its targets included computer-security and online-gaming companies regarded as pompous, complacent or hypocritical.
在英国设德兰群岛上的一间小屋里，有一个十八岁的孩子守着十六台计算机，这就是警察搜寻到的LulzSec 的全球控制总部。这个名叫Lulzsec 黑客组织的战绩包括，攻击破坏罗伯特默多克媒体帝国的网站，美国中央情报局网站，美国浸信会中攻击同性恋的网站，还有英国重大组织犯罪署的网站。一直从五月活跃到七月末，它忽然宣布解散。LulzSec特点就是在公众的嘲笑下恶作剧般的攻击。它的目标包括那些自大骄傲虚伪的计算机安全公司和在线游戏公司，还有官僚做派的组织。
In geekspeak “lulz” means to laugh at a victim; “sec” is for “security”. But lately the misfortune has mostly been the hackers’ own. Of LulzSec’s six presumed core members, police have arrested at least two, including, in late July, the (now bailed) Scottish teenager Jake Davis. The most expert, who goes by the alias Sabu, is still at large. About 15 members of Anonymous, a shadowy collective of skilled, politically motivated hackers, are also in police custody worldwide, according to Gregg Housh, a Boston man who ran computer servers for it but denies involvement in illegal hacks.
Authorities in America, Australia, Britain, France, the Netherlands, Norway and elsewhere are arresting high-profile hacktivists and threatening them with real-life jail (without, horrors, internet access). Old-fashioned policing, such as less severe sentences for those who snitch, is proving effective: “These are criminal networks and there are known techniques for dealing with criminal networks,” says Nils Gilman of Monitor 360, a consultancy.
Amid this pressure the hacker underground, riven by squabbles and splits over personality and policy, has turned on itself. Cyber civil wars have broken out, with rivals attacking each others’ computers and attempting to discover and reveal their real-world identities. LulzSec itself emerged from such a row a little more than three months ago when it broke off from Anonymous. The quarrel, about which targets deserved attack, was particularly bitter, says Mr Housh.
Upon forming, LulzSec distanced itself from its parent. The older group had been launching computer attacks against MasterCard, Visa, PayPal and others that had blocked donations to WikiLeaks. The LulzSec team of self-described “evil bastards” wrote in a press release that it preferred to abuse more ordinary folks and organisations for “a jolt of satisfaction”. Devilry seemingly trumped high-minded politics: the aim, says Mr Housh, was entertainment, “screwing with a person until he can’t take it anymore”. But some more puritanical hackers have turned vigilante, trying to disrupt LulzSec. Its antics, they say, encourage official crackdowns on internet freedoms.
Not in it for the money
Groups such as Anonymous and LulzSec are not motivated by money, but they can still wreak financial havoc. Following the theft of roughly 100m online gamers’ account details in April, Sony shut down its PlayStation Network for nearly a month at a cost of about $171m. A loss in consumer trust has added to that toll. Anonymous and LulzSec often post stolen data online to brag and attract potential recruits. But others can and do attempt to cash in on the loot. David Pérez of Taddong, a Madrid-based consultancy, says stolen bank-account or credit-card details often end up in online black markets. Illicit software automates many of these bourses, says Gordon Snow, assistant director of the cybercrime division in America’s FBI. Sellers and buyers need not communicate directly, so closing deals is less risky.
Lately LulzSec has changed tack, branding itself a champion of the oppressed, perhaps to shake off accusations of political indifference and sadism. A grandiloquent statement issued after Mr Davis’s arrest said: “We are sick of the twisted corporatocracy that controls us…united, we can stomp down our common oppressors and imbue ourselves with the power and freedom we deserve.”
Even as the hacking underworld has splintered, new threats are emerging. The agenda for Black Hat USA, a security shindig this week in Las Vegas, ranges from the perennial flaws of Microsoft’s software to newly discovered weaknesses in Apple laptops’ batteries, in mobile devices running Google’s Android operating system and in wireless water-meters.
The growth of “cloud” computing makes life harder for hackers overall (because firms that run cloud systems will on average have better security) but when a breach occurs, it offers bigger gains. LulzSec recently claimed (on flimsy evidence) that it had made Apple “our bitch for life” by pillaging passwords and source code from the iCloud servers built to dispatch photos, music and other data to customers’ iPhones, iPads and computers. As mischief has become easier, the hacker crowd has burgeoned and mutated. Ilias Chantzos of Symantec, a computer-security company, says it has far outgrown its nerdy roots in a subculture of brainy social outcasts fuelled by pizza deliveries and fizzy drinks.
The lower technological barriers to entry—no matter the motive—have led to what the FBI’s Mr Snow refers to as hacking’s “industrialisation”. Supporters of Anonymous and LulzSec have stoked the fire, he says, thanks to the spread of new easy-to-use software called “hacking toolkits”. These automate attacks and can be configured to deface or crash a website, or even snatch goodies ranging from credit-card details to industrial designs. Some toolkits also offer “drive-by download”. This turns a website into a trap that hijacks visitors’ computers (or phones), even if they have not clicked on anything.
The hacktivists may do most damage by providing cover for more sinister efforts. A report this week by McAfee, a computer-security company, reveals the results of a five-year probe called Operation Shady RAT, examining attacks that use “Remote Access Tools” to inveigle access to computer networks. It does not name the perpetrator (some fingers are pointed at China) but lists 72 victims, from sporting authorities to the governments of America, Canada, India, South Korea, Taiwan, and Vietnam, plus defence contractors and many other firms. Dmitri Alperovitch of McAfee describes the intrusions as “the biggest transfer of wealth in terms of intellectual property in history”. Kenneth Geers of NATO’s cyberwar centre in Estonia says the hacking boom makes it easier for cyber-spies to pass off their work as the handiwork of a misguided rebellious teenager. Not so funny after all.