/ 1 July 2011

Cyberspace — the fifth battleground

Cyberspace The Fifth Battleground

In late May, American media group PBS ran a strange story on its website.

“Prominent rapper Tupac has been found alive and well in a small resort in New Zealand,” it reported. “The small town — unnamed due to security risks — allegedly housed Tupac and Biggie Smalls [another rapper] for several years.”

For two reasons, this was a surprising piece of journalism. First, Tupac died in 1996. Second, the piece wasn’t written by PBS. It was planted on its site by a group called Lulz Security, a loose collective of anonymous hackers who wanted revenge for a recent PBS programme that criticised WikiLeaks.

“Greetings, internets,” Lulz wrote on its own website, by way of explanation. “We just finished watching WikiSecrets and were less than impressed. We decided to sail our Lulz Boat over to the PBS servers for further — perusing.” Above the message read the tagline: “Set sail for fail!”

On June 26, the group, which has attacked the websites of the Central Intelligence Agency (CIA), the United States senate and US broadcasters, and last week brought down the website of Britain’s Serious and Organised Crime Agency, announced that it had disbanded after one of its alleged members was arrested and charged with cyber-crime in the United Kingdom.

These are all extraordinary episodes, but by no means isolated. In March, hackers stole a database of email addresses from marketing group Epsilon, in what one commentator called the largest email-address heist in history.

Then computer security firm RSA had its servers breached, an attack that may have led to the hacking of defence giant Lockheed Martin, an RSA client. In April, an unknown person cracked Sony’s PlayStation network and stole the data of 77-million users. And in the past month, the International Monetary Fund (IMF), CitiBank, the Spanish police, Google, and the Turkish and Malaysian governments have all been hacked in one form or other.

It is tempting to consider this a kind of hackers’ high noon.

But, says Richard Clayton, a prominent computer scientist at Cambridge University, conflating these attacks is a “bit like treating knife crime as the same as burglary”.

Three kinds of attacks
In simple terms, there are three kinds of attack taking place. Hacktivism is the most prominent: raids by amateur groups such as Lulz or Anonymous (which has taken down PayPal, PlayStation, MasterCard and Visa), either for fun, “for the lulz”, or, increasingly, as an act of political protest. Then there’s the criminal kind: professionals hunting for credit-card details or email address directories, with the aim of selling them on for profit. Although the PlayStation systems were first hacked by hactivists, a second breach was made by cyber-criminals who had more commercial ends.

And, finally, there’s state-sponsored espionage, or even cyber-warfare.

“[With] Google, RSA, Lockheed Martin, the IMF, the strong suspicion is that all those were state-sponsored, or state-approved,” says Dave Clemente, a cyber-security expert at Chatham House, the international affairs think-tank. Whether it’s Chinese, or Russian, or eastern European, a lot of these hacks seem to have been given a wink and a nod of tacit approval from states.”

Are all three categories really on the rise? Well, possibly. “It’s difficult to substantiate whether there’s more going on or not,” says Rik Ferguson, the director of security research at computer protection firm, TrendMicro.

“What’s certainly true to say is that more attacks are being publicly disclosed. Victims are more willing to come forward and say ‘something bad happened to us’.” Disclosure laws obliging companies to come clean about data breaches have been in place in many parts of the US for several years.

But the real turning point, says Ferguson, came only a year ago, when Google went public with the news that it had been hacked by Chinese sources. “That got the ball rolling,” says Clemente. “It suddenly seemed more permissible to report a hack. Getting hacked doesn’t seem to have the stigma that it did several years ago and there isn’t a feeling now that you’re on your own if you get hit.”

But even if increased openness is in part to thank for the apparent hike in hacking, there has still been an exponential rise in the number of cyber-threats. In 2008, security conglomerate Symantec counted 120-million malware variants; last year, that figure had risen to 286-million. Symantec security strategist Sian John has also noted a large increase in what are known as “targeted attacks”.

A decade ago, a hacker would usually have intended a single virus to reach millions of people. Today, the average number of computers infected by an individual malware is just 15 because hackers are using a new tackle called spear-fishing, which enables them to be more specific about who they target.

“In the past, if you got a phish attack, it would be from a Nigerian offering you lots of money,” says John. “Now it’ll be from someone saying: ‘Oh, we saw you at that conference last week. Here’s some minutes of that conference.'” And contained within those minutes will be a virus.

This kind of targeted attack has become dangerous because of the amount of information we divulge on the internet. “One of the first places a hacker will visit is LinkedIn,” says Ferguson. “What do we do on there? We make our entire CV available for the world to see. You can see everywhere I’ve worked in the past. You can see all my connections, see everyone I’ve worked with, everyone I know. So a hacker can assume one of those people’s identities and reference things that have happened in my professional life. And I’m far more likely to open an attachment from your email, because it’s far more credible.”

Unsurprisingly, then, Ferguson’s job involves not just infiltrating black-hat hacking communities online, but also training office workers to be more aware of social engineering ruses such as these. (Security experts have also been known to test a company’s defences by leaving infected USB sticks lying around and seeing whether anyone picks them up out of curiosity.

In 2008, US military computers were breached in this way, according to rumour, after hackers scattered USBs across a car park at a US base in the Middle East.)

‘Targeted attacks’
Targeted attacks are also popular because they enable cyber-criminals to go after individuals with access to large banks of information. “Criminals,” says Ferguson, “have realised they can get more bang for their buck if they can penetrate a large aggregation of data in one single successful attack, rather than trying to compromise multiple individual PCs.” Hence the hacking of Epsilon, which at a single stroke may have given hackers access to millions of email addresses.

The most audacious example of a targeted attack is thought to be an act of espionage rather than criminal activity. Last year’s Stuxnet worm supposedly worked its way through the Iranian military computer system with a single goal: to damage the centrifuges that controlled the country’s uranium enrichment programme. But although, according to John, “Stuxnet is the most sophisticated piece of malware we’ve ever seen”, most hacking techniques have not necessarily changed much in recent years.

“They sound rather complicated,” says David Whitelegg, who blogs at ITSecurityExpert.co.uk,” but really they are often no more sophisticated than they’ve ever been.” The malware that led to the hacking of security giant RSA may have been a “zero-day attack” — in other words, it had never been seen before — but the method of infection was nothing new. “At the end of the day, a user within that company opened an email. It went into his spam box, he opened it and that launched the attack. And that’s the way it’s always been.”

Direct denial of service attacks (DDoS) — the method employed by Anonymous to take out PayPal, Mastercard and Visa by overloading them with hits — are also nothing new. “DDoS has been around for years,” Whitelegg says. “There’s nothing you can do about it.”

But even if their methods are old, the arrival of groups such as Anonymous and its offshoot Lulz does mark a changing of the guard.

“Hactivism is definitely on the rise,” says Ferguson. “Anonymous was previously quite a cliquey underground community. But as the WikiLeaks thing unfolded and it gave its support to Julian Assange and began to attack organisations it felt were treating WikiLeaks unfairly, it has garnered a lot of coverage. It has associated itself very cleverly with V for Vendetta, a popular film with a popular image and well-known taglines such as ‘We are Legion’.”

New members have also realised how simple it is to join the group. “If they want to participate, it’s very easy for them to download a tool that hands over their computer to Anonymous”, which then allows them to take part in DDoS attacks.

Yet if their rise is partly down to greater exposure and clever associations, it is also undeniably linked to a growing political consciousness throughout the cyberspace community. The anarchist collective Deterritorial Support Group recently posted an essay titled: “Twenty Reasons Why It’s Kicking Off in Cyberspace”, which aimed to explain the recent rise of Anonymous and Lulz.

“Make no mistake,” it wrote, “this is not a minor struggle between state nerds and rogue geeks. This is the battlefield of the 21st century, with the terms and conditions of war being configured before our very eyes. At the heart of it is a newly politicised generation of hackers who have moved from a Lulz-based psychic economy to an engaged, socially aware and politically active attitude towards world events, primarily as a reaction to the way governments and multinationals dealt with the fallout of WikiLeaks.”

Such political engagement raises new moral questions. A Lulz attack on, say, the CIA, is primarily an act of protest — a web-based sit-in, if you like. “And if the police are wary of arresting people for taking part in a real-life sit-in,” asks Ferguson, “then why are they so willing to arrest people for the digital equivalent?” In other circles, however, such actions are considered less protest, more acts of war.

“Cyberspace,” read a Chatham House cyber-security report from last year, “should be viewed as the ‘fifth battlespace’, alongside the more traditional arenas of land, air, sea and space.” Significantly, the report also noted that, “in cyberspace, the boundaries are blurred between the military and the civilian, between the physical and the virtual and power can be exerted by states or non-state actors, or by proxy”.

It is tempting to think of this kind of debate as irrelevant to our everyday lives. Symantec says mobile-phone technology will be hackers’ next target and perhaps it is physical problems such as this that we should be more concerned about.

But as we increasingly live more of our lives online and as that boundary “between the physical and the virtual” is increasingly blurred, perhaps it is the conceptual questions posed by hacking that will ultimately prove more significant. —