The Bright Side of Being Hacked
Source: SOMINI SENGUPTA and NICOLE PERLROTH
Hackers operating under the banner Anonymous have been poking a finger in the eye of one private company after another for two years now.
They steal files from inside corporate computer systems and occasionally, as in the case of Stratfor last week, dump company e-mail online for all to see.
The Stratfor hack, in which Anonymous claimed to have joined forces with WikiLeaks, drove home a clear lesson about the era of ubiquitous “hactivism,” or hacking as a form of protest.
Despite the arrests of dozens of suspected members of Anonymous and its offshoots worldwide, it is far from diminished. Nor have most of its corporate targets been irreparably damaged by the attacks.
Rather, what Anonymous has done, experts said at the big RSA computer security conference here last week, is raise the alarm about the unguarded state of corporate computer systems.
By and large, the Anonymous break-ins take advantage of gaping computer holes and gullible human beings. The hackers ferret out weak passwords and take advantage of unencrypted e-mail stashes. They persuade company employees ― one is all it takes ― to click on rogue Web sites or divulge a confidential piece of information, in an exercise known as social engineering.
“Anonymous is a wake-up call,” said Roger Cressey, senior vice president of Booz Allen Hamilton, a defense and intelligence contractor that was attacked by the group last summer. “Any company that is patting themselves on the back and saying that they’re not a target or not susceptible to attack is in complete and utter denial.”
More to the point, a company that is a target of Anonymous may also be the target of a far more potent adversary. The social engineering tactics that Anonymous members have repeatedly used are often similar to those used by criminal hackers and state-sponsored actors who penetrate company systems in order to steal valuable secrets, whether for monetary gain or competitive edge.
Anonymous draws public attention ― and by extension, that of executives and shareholders. It puts a face ― or rather, a mask ― on a far more pernicious problem: online espionage.
“The attacks by them pale in comparison to the nation-state stuff and the criminal element,” said Eddie Schwartz, chief security officer for RSA, the organizer of the computer security conference and a maker of security tokens, which was itself the target of a highly publicized breach by suspected state-backed hackers. “There is an awakening. There is a lot more visibility in the press.”
An Anonymous attack can leave a measurable toll. In 2010, its activists broke into Sony’s systems, exposing names and credit card numbers of millions of customers; Sony said last May that the cleanup would cost it $170 million. Last year, Anonymous extracted the password of an executive at the security firm HBGary and helped itself to a pile of internal company e-mail.
News of the breach at the geopolitical analysis firm Stratfor began trickling out on Christmas Eve, when the company’s site was defaced. At first, a group called Antisec, an Anonymous offshoot, claimed responsibility, announcing that it had penetrated the company’s network. It posted the names, addresses and credit card details of 75,000 people who subscribed to Stratfor newsletters. Soon came a dump of credentials for 860,000 user accounts, not all of whom may have been paid subscribers.
Mary Landesman, a senior security researcher at Cisco who has closely studied the Stratfor breach, said the attack appears to have been twofold: a relatively commonplace attack, known as an SQL injection, on four servers that stored e-mails dating back several years, as well as a breach of a vulnerable third-party e-commerce system that Stratfor would have used to process its paid subscribers.
A company’s vulnerabilities, whether human or machine, are far easier to spot, Ms. Landesman pointed out, if a sprawling army of thieves is plotting the break-in. “The more eyes, the greater chance of success,” she said.
Soon the paid customers found themselves having to deal with purchases made with the stolen card numbers. Then they began receiving e-mails that purported to be from George Friedman, Stratfor’s chief executive, and came with malicious software attached. Mr. Friedman announced that Stratfor had not sent out the e-mails, and the company stopped charging for its subscriptions, which had been its principal source of revenue.
A class-action lawsuit followed, accusing the company of negligence in securely storing its customers’ information and failing to promptly notify them of the theft.
In its response to the lawsuit, Stratfor said it had informed the FBI as soon as it learned of the breach on Dec. 7.
The most recent salvo in the Stratfor hack began last Sunday, when WikiLeaks began releasing the contents of the company’s internal e-mail communications. Stratfor for its part refused to distinguish between e-mails that it said may have been “forged” and those that were “authentic.”
Stratfor declined requests for an interview.
Law enforcement officials at the RSA conference expressed frustration with their inability to squelch the rise of such attacks. Those who participate can be hard to find. And often they turn out to be minors who are not prosecuted as aggressively as adults.
The head of the Federal Bureau of Investigation, Robert Mueller, struck an ominous note about the threat of digital attacks on corporate America. “There are only two types of companies,” Mr. Mueller said in a keynote speech at the conference, “those that have been hacked and those that will be.”
Oddly enough, despite the stream of attacks and a security industry that is eager to sell its services, a survey of the largest American companies shows that neither their top executives nor their board members are directly involved in decisions about the security of their data.
According to the latest results of an annual survey by Carnegie Mellon University, released last week, more than 70 percent said they occasionally, rarely or never reviewed their top information security policies or staff.
How the attack will damage Stratfor in the long run remains to be seen. If HBGary is any yardstick, it may pull through. HBGary suffered an embarrassing blow last year when thousands of its internal e-mails were dumped on the Internet.
Aaron Barr, the chief executive of its sister company, HBGary Federal, who provoked the ire of Anonymous by boasting of having penetrated its anonymity, resigned. But in late February, despite the hacking, HBGary was acquired by ManTech, a giant Virginia-based defense contractor, which itself had been hacked by Anonymous last August.
| }
|