Famous Hacker Groups

With the recent attack on Dropbox, PlayStation Network and a bunch of high-profile websites, computer hackers are back in the limelight again. Hackers and hacker groups were quite famous in the 80’s and 90’s but their popularity started fading since the Y2K days. Today, we are once again witnessing hackers threatening to take on giant corporations sending chills down everyone’s spine. According to Abhishek, a regular TechSource contributor and a long-time FOSS advocate, hacker groups are on the rise and bring with them devastating effects. W have already featured here some of the most infamous black hat hackers of all time. This time, we will take a quick look at some of the most notorious computer hacker groups that ever existed:

Masters of Deception

This New York-based group was responsible for notorious acts such as downloading confidential credit card histories of stars like Julia Roberts, breaking into AT&T’s computer system and stealing credit card numbers. Founded by hackers Acid Phreak, Scorpion and HAC, Masters of Deception or MOD, was a mockery of LOD (Legion of Doom), its archrival and a hugely popular hacker group at that time. MOD claimed that Legion of Doom had lost its direction, which also resulted in the famous hacker Mark Abene (a.k.a Phiber Optik), a former LOD member, jumping ship and joining Masters of Deception. The group operated during an era where C64s and TRS-80s where the hottest gadgets around, that is the late 80s. MOD’s days of glory however, ended when FBI and Secret Service forces arrested their members and put them behind bars.

Legion of Doom

MOD’s biggest enemy Legion of Doom was a famous hacker group founded by a hacker called Lex Luthor (real name: Vincent Louis Gelormine). Apart from hacking, LOD was renowned for publishing Legion of Doom Technical Journals consisting of hacking knowledge and information. In 1990-91, this Texas-based group went on war with MOD resulting in a conflict so famous and epic that it is known as The Great Hacker War. The war consisted of both sides attacking each other across the Internet, X.25 and telephone networks. Such was the rivalry that LOD launched a security firm to assist corporations that were victims of attacks by Masters of Deception’s hacks. As for the great hacker war, Masters of Deception emerged victorious in the end.

Chaos Computer Club

CCC is a hacker organisation based in Germany and other German-speaking countries. CCC has been active since 1981 and it describes itself as — “ a galactic community of life forms, independent of age, sex, race or societal orientation, which strives across borders for freedom of information.” Contrary to what its name suggests, the aim of this group is not to create chaos but to bring more transparency in governments and promote freedom of information, and human right to communication. CCC was founded in Berlin in 1981 and it has since then gained itself a lot of popularity. Its most prominent activities include hacking into U.S government computers and selling their operating system source code to Soviet KGB. Its most famous attack however, is Project Blinkenlights wherein a building in Berlin was changed to a giant monochrome computer screen. The attack was to celebrate the group’s 20th anniversary and similar attacks have been carried out in France and Canada. In 2008, the group came into limelight again when it acquired German interior minister’s fingerprints and posted them online. The group regularly publishes a quarterly magazine and hosts a two-hour radio show that is aired on a local radio station.

Milw0rm

This hacktivist group’s shot to fame was perhaps the most debated moment ever in hacking history. In 1998, Milw0rm hacked into Bhabha Atomic Research Center (BARC), the main nuclear research facility in India. They managed to obtain email and data on recent tests, and destroyed all data in 2 out of 8 servers. Milw0rm, a group of teenage hackers had managed to download about 5 Megabytes (this was 1998) of information from BARC. The attack was part of their anti-nuclear agenda, which warned the world that placing nuclear power in the hands of India and Pakistan could result in World War 3. This attack received a lot of international coverage with debates being broadcast questioning the morality of the attacks. The fascinating part of the attack was that it was carried out by a bunch of teenagers with the youngest member being merely 15 years old. After BARC, the group managed to carry out further high-profile attacks on sites of World Cup, Wimbledon, Ritz Hotel, Drew Barrymore and the Saudi Royal family.

Red Hacker Alliance

This is the largest group of hackers in the world boasting about 80,000 members. Red Hacker Alliance was started in 1998 by a group of patriotic youth opposed to the ethnic riots in Jakarta, Indonesia. They operated under the alias China Redhackers thus giving birth to a new type of hackers called red hackers. The group, mainly consisting of Chinese hackers, is responsible for carrying out attacks against CNN.com in 2008. The group has a huge following and reach with more than 250 websites linked to Red Hacker Alliance. Also, a prominent hacking group called Honker Union has recently merged with Red Hacker Alliance making the group even stronger.

Anonymous

Anonymous is not technically a hacker group but is in fact an Internet meme that originated on 4chan boards. Perhaps, the most feared group of hackers today, Anonymous has gained notoriety for hacking into Sony’s PlayStation network. The attack on Sony, called #opsony was a part of Operation Payback which was a coordinated attack on opponents of Internet piracy. The motive behind this attack was to protest the lawsuit filed against a hacker named Geohot who hacked or rather unlocked the PS3 system and posted the process on YouTube. Sony, apart from filing the lawsuit, also demanded YouTube to hand over the IP addresses of all the people who watched Geohot’s videos or visited his social links. This infuriated not only hackers but also many Internet users who deemed it as a violation of privacy. As for the damages of the attack, Sony is still busy licking its wounds. Operation Payback on the other hand, was in retaliation to the Decentralized Denial of Service (DDoS) attacks on torrent sites carried out by anti-piracy organizations. The massive attack also consisted taking down websites of banks that had cut ties with Wikileaks. Apart from Operation Payback, a lot of attacks have been carried out under the moniker Anonymous. The more famous ones include the attacks on the Church of Scientology websites, HB Gary Federal and Westbro Baptist Church. The group’s protest against the Church of Scientology, called Project Chanology received a lot of media attention. The unrest began when the Church of Scientology decided to take down a video by Project Chanology citing copyright infringement. This led to massive protests outside Scientology that centers along with the hacking of their websites. As of now, the Anonymous group is going strong and big media companies are on the edge of their seats wondering who’s next.

LulzSec

Lulz security, more commonly known as LulzSec is a hacker group responsible for carrying out several high-profile attacks recently. The group, consisting of six members, was formed on 15th May 2011 with a motivation of having fun by causing mayhem. The word Lulz is a neologism derived from the Internet slang LOL, which stands for laugh out loud. LulzSec’s first attack was on Fox.com’s website which included altering several employees’ LinkedIn profiles, leaking passwords and contact information of 73, 000 X factor contestants. The major attack however, came when they infiltrated PBS’s website. PBS had earlier aired a documentary about Wikileaks and Bradley Manning. LulzSec hacked PBS’s web page and changed the main story to Tupac being alive in New Zealand. They also attacked Sony and Nintendo’s websites. In the Nintendo attack however, no user data was affected. The group is also responsible for routing telephone numbers to various support lines like World of Warcraft support and FBI Detroit Office. On 20th June, LulzSec announced that it had teamed up with Anonymous group and launched a new operation called Operation Anti-Security. The operation consisted of hacking into, stealing and publishing classified government information from sources like government websites and banks. The operation was declared successful when the group took down the Chinese and Brazilian government’s websites using DDoS attacks. LulzSec’s other prominent attacks include the ones on sites of Bethesda Game Studios, Minecraft, League of Legends and The Escapist (online magazine). The group finally broke up on June 26, 2011 and released a final ‘50 days of Lulz’ statement.

The Top 10 individual Hackers

In two lists, some of the most famous, and infamous, hackers and hacker groups, are presented. This week, the people, next week the groups. Just like nowadays, these people entered the world of hacking either through computer or telephone systems and used these systems according to their own wishes, due to their knowledge and technical skills. The top 10 Hackers of the world who wrote the History are:
1. Konrad Zuse
It all started with Konrad Zuse, the very first computer hacker. He might not be in the literal sense, but no hacker could make a difference without his work at all.
Zuse developed the Z3, the first programmable computer in the world. He actually began with the Z1, which he constructed in the living room of his parents and completed in 1938. The Z3 was completed in 1941. Often regarded as inventor of modern computer he laid out techniques for making computer do some bizarre things.

2. John “Captain Crunch” Draper
John Draper started hacking computers before they really went up the hill. He implemented the programming language Forth and the first word processor for Apple computers, called “Easy Writer”. In the 1970s, Draper worked with hacking techniques and was a pioneer of circumvention of technical barriers. He made the first phone hack – phreaking using the well known Blue Box, so one could make free calls to analog telephones. At that time the system was controlled by analog tone sequences, with which one could also initiate free long distance or international calls. This hack technique was called “phreaking”. One of the most important tools for phone hacking was a Pennywhistle from the cereal box of Cap’n Crunch. Draper developed the Blue Box, a device with which one could produce numerous control sounds of telephone companies.

3. Steve Wozniak
Wozniak is a contemporary of John Draper and knew phreaking as well. After Draper published in a computer club meeting the details of his Blue Box, Wozniak built his own version. Steve Jobs recognized the market potential of the device and the two Steves started their first company. From the sale of Wozniak HP calculators they gained enough revenue to build the legendary Apple I.

4. Robert Tappan Morris
A graduate student at Cornell University, Robert Morris developed the first computer worm. According to his own statements, he wanted to capture the size of the Internet. After he related the free software on November 2, 1988, he infected 6,000 computers – which were then about 10 percent of Internet-connected computers. Due to a programming error, the worm multiplied excessively and made sure that many computers were overloaded. In 1989, Morris was the first to be convicted under the Computer Fraud and Abuse Act of 1986.

5. Mark “PhiberOptik” Abene
Most computers experts probably know Mark Abene,. He worked at the phone company AT &T. As a member of the hacker group Masters of Deception, Abene played often around the AT & T systems. Through his hacking skills, he crashed the AT& T system and 60,000 customers remained without a phone for about 9 hours, Abene was quickly identified as the culprit. The Secret Service confiscated his equipment. AT & T had to later admit that the crash was due to an error. Nevertheless, Abene was convicted and landed for a year in jail. He was the first hacker who was detained.

6. Kevin “Dark Dante” Poulsen
Poulsen led one of the coolest hacks of all time. All the radio lines of L.A radio station KIIS-FM were compromised. This radio station promised the 102nd caller of the program would win a Porsche 944 S2. Poulsen took over all telephone lines and the transmitter and thus ensured that his call was the right one. The telephone line went out later on during the broadcast. Later, he went into hiding and was wanted by the FBI. He even landed in the American so called unsolved “File number XY … unsolved.” files. In 1991 Poulsen was placed under arrest and numerous offenses against him pleaded guilty. Later he made a 180-degree turn and worked for the elucidation of many computer crimes.

7. Kevin Mitnick

Kevin Mitnick is probably the most famous hacker in the world. Mitnick caused a lot of suffering through his selfish behaviour. He managed to be the first to get on the FBI’s list of most wanted people in the world. He broke into the systems of Nokia and Motorola and caused chaos. He hacked the punch card ticketing system of Los Angeles bus system through which he could travel in any bus throughout the state. Through a phone number given by his friend he hacked DEC (Digital Equipment Corporation) mainframe software systems. In 1979, at the age of 16, he hacked a computer for the first time and copied proprietary software. After two and a half years, he was arrested and spent five years in prison. He now runs his own security company.

8. Tsutomu Shimomura

Not all hackers are “evil”. Tsutomu Shimomura made sure that Kevin Mitnick was convicted. He helped and collaborated with FBI to get the famous hacker Mitnick arrested. In 1994 Mitnick stole some personal files of Shimomura and published them online. Shimomura managed to trace it back to Mitnick. Some authors consider his involvement in Mitnick case/arrest as dubious, but Shimomura still skilfully beat Mitnick as his own game.

9. Richard Stallman

Stallman was a student and programmer at the MIT Artificial Intelligence Lab. He was already an open source advocate but many at MIT retaliated against the restriction of computer use in the laboratory. In the university a password-protected computer system was established for students. He decrypted the passwords and sent to the users in plain text, and proposed to give up the password to again in the future to enable anonymous access. Later Stallman developed the GPL General Public License and the GNU operating system, a completely free Unix system.

10. Linus Torvalds

Linus Torvalds began his hacking career on an old Commodore VIC-20 and the Sinclair QL, which he greatly improved. On the QL, he programmed his own Text Editor and even a Pac-Man clone named Cool Man. In 1991, he got hold of an Intel 80386 PC and started working on Linux, which he first published under its own license, but later, under the GNU GPL. He was the principal force behind the development of Linux Kernel.

If you like our posts feel free to share, subscribe to our blog, comment, or follow us on Twitter. Have a nice weekend!

Cyber Warfare Weapons – Part 2

Last week in Part 1 we tried to define cyber warfare and gave some examples of what has already taken place in the recent past.

In this second part we explore what is happening in the real world of cyber warfare, and what Governments are doing to protect us.

Cyberspace and its Security
What can be done and who should act in defense of a nation’s cyberspace? The answer may be complicated. Defending cyberspace is not an easy feat, considering the number of interconnected computers, mobile devices and networks. The majority of the systems, including those regulating nations’ critical infrastructures, are interconnected and then vulnerable not only to direct attacks but also to infection by transmission. Ironically, the numerous technological advances might also pose a risk, as cyber terrorists seem to be always a step forward in identifying security vulnerabilities before security experts can patch them. Lack of recognized rules in cyberspace and difficulty to implement boundaries complete the picture.

Lacking a real global response to cyber warfare, many countries and organizations are creating structures and task forces to prepare against cyber threats. According to intelligence studies, more than 140 countries have funded cyber weapon development programs. The U.S. is particularly active and created the USCYBERCOM that “plans, coordinates, integrates, synchronizes, and conducts activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full-spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries.”

 
In 2012, the U.S. Defense Advanced Research Projects Agency (DARPA) invested $110 million in Plan X, a “Cyberspace is now recognized as a critical domain of operations by the U.S. military and its protection is a national security issue. Plan X is a foundational cyberwarfare program to develop platforms for the Department of Defense to plan for, conduct, and assess cyber warfare in a manner similar to kinetic warfare.” The program was included in DARPA’s reported $1.54 billion cyber budget for 2013-2017.
Recently, the U.S. Naval Academy also received $120M to build a classified cyber warfare center in 2016. The center will allow midshipmen to work on classified system and acquire cyber warfare skills.

 
Organizations like the European Advanced Cyber Defence Centre (ACDC), the NATO Computer Incident Response Capability (NCIRC) and the Internet Engineering Task Force (IETF), amongst many others, are working on fighting back against organized, international cyber criminals that have used cyberspace as a warfighting domain.
However, this may not be enough to avoid terrorism-based cyberwar attacks, so everyone ought to prepare proactively and effectively by securing systems as much as possible. In an Internet-connected world, every end user is at risk, either directly or indirectly. The Internet provides many different ways to attack. Internet-connected systems must be secured on a global scale.

 
With cyberspace being so vast, flexible, and unregulated, all its users are highly vulnerable to dangers from outside threats. Recent cyber attacks highlight the potential threat posed by information warfare tactics and techniques that use computer connectivity and exploit vulnerabilities sometimes caused by users’ inattentiveness or lack of basic cyber security practices.
Proper use of intrusion-detection and intrusion-prevention systems (IDS/IPS) and firewalls (a network’s first line of defense against threats) is a basic response. Through real-time analysis of network traffic—i.e., to investigate and contain these security threats—people can detect the majority of the less sophisticated hacking attacks at a user level.

 
Larger companies must be more aware than ever about their network security vulnerabilities and secure their properties with proper Advanced Threat Protection Platforms for endpoint protection and server security.
In the case of government-orchestrated cyber attacks, one of the main lines of defense is the creation of a common front against attackers. There is no better time than now to open collaboration and dialogue amongst various industries and government agencies to take action. Attacks against larger, interconnected systems might be more easily disclosed by comparing data and creating common task forces. Detection and prevention alone may not be enough to stop the attackers, each time, but at least it may inhibit future, similar threats.
The Internet might be becoming a new weapon for terrorists, so overcoming cyber vulnerability requires multiple different organizations to come forward and stop the launch of cyber threats that can manipulate the physical world while operating without international boundaries.

 

Summary
Some of the numerous larger-scale cyber attacks can be intuitively considered acts of cyber war. With many countries large and small investing in cyber warfare, it is impossible not to think of the use of “information warfare” as a new form of terrorism. Information warfare goes beyond simply attacking computers and communications networks, as a computer-literate terrorist can wreak havoc causing physical destruction and harm to populations. The Internet can be turned into a weapon used against targets by terrorists hidden in cyberspace to carry out cyber violence and disruption, while being physically located elsewhere. Computer-related crimes, as an extension of terrorist attacks, have the potential of bringing catastrophic side effects.

 
Cyberspace is increasingly becoming a place of risk and danger, vulnerable to hacks and cyber warfare. With today’s civilization dependent on interconnected cyber systems to virtually operate many of the critical systems that make our daily lives easier, it is obvious that cyber warfare can be the choice for many governments and states, especially those that don’t have access to expensive, conventional weapons of mass destruction.
So, how do we counteract such attacks? If cyber warfare is considered war, then anti-terrorism defenses must be deployed. First, though, a legal basis for responses to attacks must be defined. A legal definition of cyber war and cyber weapon, a definition agreed upon globally, is necessary to define the perimeters within which nations can operate in cyberspace. It is important to define what to consider cyber espionage, cyber war or an act of simple hacking.

 
Lacking a clear definition and a global cyber etiquette, nations are left with creating their own defense against cyber weapons and cyber espionage. Exploring real-world examples, continuously monitoring the Information Superhighway, and endorsing cyber security awareness, web security and online safety are the tools currently available for an effective international governance of the Internet.
Although the United States has not been subjective to real, destructive cyber terrorism as of today, in terms of hostile action or threat, it has identified a number of ways terrorists can use the computer as a tool for hacking or information warfare. As the job of a cyberterrorist has become more difficult to detect, in time, information control may also be critical for successful counter-terrorism and avoidance of infrastructure warfare. UK and NATO allies of the US are playing their part by increasing spending on cyber soldiers.
Therefore, it is paramount to investigate some common defense mechanisms that can help pinpoint and capture these threats before they affect massive numbers of people and impair activities in a much more pervasive way.

 

 
References
Brecht, D. (2014, December). Are Cyber Threats the New Terrorism Frontier? Cyber Warnings E-Magazine, 28-32. Retrieved from http://www.cyberdefensemagazine.com/newsletters/december-2014/index.html#p=28
Clapper, J. R. (2013, March 12). US Intelligence Community Worldwide Threat Assessment Statement for the Record. Retrieved from http://www.odni.gov/files/documents/Intelligence%20Reports/2013%20ATA%20SFR%20for%20SSCI%2012%20Mar%202013.pdf
Donohue, B. (2014, December 19). FBI Officially Blames North Korea in Sony Hacks. Retrieved from http://threatpost.com/fbi-officially-blames-north-korea-in-sony-hacks/109999
Kostadinov, D. (2012, December 21). Cyberterrorism Defined (as distinct from “Cybercrime”). Retrieved from http://resources.infosecinstitute.com/cyberterrorism-distinct-from-cybercrime/
Morello, C. (2014, November 16). State Department shuts down its e-mail system amid concerns about hacking. Retrieved from http://www.washingtonpost.com/world/national-security/state-department-shuts-down-its-e-mail-system-amid-concerns-about-hacking/2014/11/16/92cf0722-4815-41ca-b602-9bfe8ecdb256_story.html
NATO REVIEW. (n.d.). The history of cyber attacks – a timeline. Retrieved from http://www.nato.int/docu/review/2013/cyber/timeline/EN/index.htm
Paganini, P. (2013, December 6). Cyber warfare – Why we need to define a model of conflict? Retrieved from http://securityaffairs.co/wordpress/20204/intelligence/cyber-warfare-model-of-conflict.html
Storm, D. (2014, December 22). Cyberwarfare: Digital weapons causing physical damage. Retrieved from http://www.computerworld.com/article/2861531/cyberwarfare-digital-weapons-causing-physical-damage.html
Suciu, P. (2014, December 21). Why cyber warfare is so attractive to small nations. Retrieved from http://fortune.com/2014/12/21/why-cyber-warfare-is-so-attractive-to-small-nations/
InfoSec Institute

Cyber Warfare Weapons – Part 1

Numerous malicious attacks on computers and mobile devices as well as networks of important entities have recently made the news and have brought back to the surface the debate on cyber warfare and the dangerousness of cyber weapons.
The increasing dependence on the Internet and the recent spur of attacks are beginning to create greater concern.
The fear is not just based on the possibility that a cyber attack could simply cause the non-availability of information and services we are now accustomed to. The Internet has not just reshaped the way we obtain news, communicate with others, take care of our finances, watch TV and listen to music, but it is also permeating other essential fields of our lives.
From power smart grids to the “Internet of Things,” the potential targets of cyber warriors are now multiple and the possible consequences catastrophic. Premeditated, politically or socially motivated attacks against a computer-dependent society could be orchestrated by foreign powers and affect nations at any level: from the availability of utilities, to denied access to important financial and medical information, to causing a significant impact on national GDPs.
This blog will explore the concept of cyber warfare and cyber weapons, plus recount latest happenings and discuss whether the danger is real.

 

Cyber Warfare and Cyber Weapons
The definition of cyber warfare and cyber weapons is not as clear-cut as it might seem. Distinguishing these attacks from simple cyber crimes is essential to define rules of engagements by countries and to establish what should be considered a direct act of war against the sovereignty and wellbeing of a state.
According to the Tallin Manual on the International Law Applicable to Cyber Warfare – a study commissioned by the NATO Cooperative Cyber Defence Centre of Excellence that is not considered a legally binging document – cyber weapons are cyber means of warfare designed, used or intended to cause either injury or death of people or damage to or destruction of objects.
Without a globally recognized definition, however, it is hard to strictly define and recognize true acts of cyber warfare, prevent attacks, hold entities accountable and define legal responses. The inability to agree to basic notions is a considerable weakness in the international arena and leaves space to much uncertainty and endless possibilities for nations beginning to employ these warfare techniques.
Several definitions have been given by scholars, but, in general, a cyber weapon is intuitively considered any software, virus, and intrusion device that can disrupt critical infrastructures of other countries, from military defense systems to communications to electric power smart grids to financial systems and air traffic control.
Debates have been rising on the possibility to consider cyber weapons tools used not only to directly impair systems but also to spy on nations through cyber espionage. Again, the lack of a globally-recognized legal definition doesn’t help.
Have cyber weapons ever been deployed? You may recognize an incident that happened in 2009, the first known use of a cyber weapon: Stuxnet. It was a complex piece of malware believed to be an example of government cyber weapon aimed at severely disrupting the Iranian nuclear program. The paternity of the attack has been a source of debate, but in the end, it was believed to be a joint US/Israel operation. Stuxnet targeted a plant in Natanz, Iran. By turning off valves and impairing centrifuges, equipment was damaged and the Iranian uranium enrichment program effectively slowed down.
However, Stuxnet might have not even been the first cyber war tool directed toward Iran. Flame, another powerful malware that masqueraded itself as a routine Microsoft software update, had already been used to map and monitor Iranian networks and collect critical information.

 

Is a Cyber World War a Concern?
A 2013 report by Director of National Intelligence James R. Clapper explained that the possibility of a major cyber attack to US critical infrastructures causing a long-term and widespread disruption of services by major players like Russia and China is remote. However, smaller scale attacks by smaller states or non-state entities seem to be a concern. According to the report, “less advanced but highly motivated actors could access some poorly protected US networks that control core functions, such as power generation, during the next two years, although their ability to leverage that access to cause high-impact, systemic disruptions will probably be limited. At the same time, there is a risk that unsophisticated attacks would have significant outcomes due to unexpected system configurations and mistakes, or that vulnerability at one node might spill over and contaminate other parts of a networked system.”
This may not come as a surprise to anyone, but any telecommunications infrastructure attack could cause enough harm to generate fear. Every government or corporations entire infrastructure, let alone the public at large, may be at stake.
Can digital attacks really have tangible effects? Absolutely. An oil pipeline in Turkey was cyber attacked and exploded in 2008. The pipeline was super-pressurized and alarms were shut off. By hacking security cameras, attackers (allegedly Russian) were able to hide the blast from the control room that, unaware, was unable to respond promptly. Another attack to a German steel company demonstrated how, by simply infiltrating the information systems running the plant, hackers could cause major damage.
Although not a single Internet successful attack has been recognized as directed by a foreign terror organization against the United States homeland, there have been instances of intrusions intended to inflict significant harm on the American government or state agency, as well as US businesses. Last November, there was an intrusion into the networks of the Department of the State that led to the unclassified email system shutdown. Carol Morello, the diplomatic correspondent for The Washington Post who covered the affair, noted the activity was related to hacking of White House computers reported a month prior, and to security breaches that occurred at both the U.S. Postal Service and the National Weather Service. Those incidents pointed to Russian hackers as prime suspects; the perpetrators were believed to be working directly for the Russian government. Sony Pictures Entertainment (SPE) is another recent case; its networks were infected in a November 2014 incident. According to the FBI, the occurrence resembled past cyber efforts by North Korea.
What makes a cyber warfare attack appealing? Mainly the fact that it can come at little or no cost for the perpetrator. An attacker with great technical capabilities can create disruption by using a single computer wherever he or she is located. While the use of conventional weapons requires expensive manufacturing and physical travel to target locations, cyber attacks can be conducted from anywhere. Traditional weapons have a cost that might be prohibitive for many and are hard to transport (or deliver) in secrecy. In other cases, attacks might require the sacrifice of the offenders. Cyber attacks are quick, can be equally destructive and can definitely be inexpensive to execute.
According to Amy Chang, research associate at the Center for a New American Security, “Cyber warfare is a great alternative to conventional weapons. […] It is cheaper for and far more accessible to these small nation-states. It allows these countries to pull off attacks without as much risk of getting caught and without the repercussions when they are.”
Accountability is hard to prove when cyber weapons are used. By using several proxies or infecting computers indirectly, it is difficult to trace back to a particular malicious hacker or organization on any form of attacks. And even if a culprit is found, it is hard to accuse a nation of a deliberate act of war, especially due to lack of a legal framework.
The problem today is that we live in a high-tech world of uncertainty where people are not well trained and equipped for these new threats that can disrupt communications, and network traffic to and from websites and can potentially paralyze Internet service providers (ISPs) at the international level across national borders. So, in the face of constant security threats, there is a need for all to fully understand how to handle cyber security issues and cyber war and how to mitigate risks and minimize the damage, as best as possible if the circumstances arise.

Next week, Part 2 which looks at cyberspace and a unique set of security issues.

If you like this article feel free to share, or give your feedback and comments.

The Last Mile of IoT: Artificial Intelligence (AI)

IoT expert Ahmed Banafa analyzes the last mile of the Internet of Things

Source: The Last Mile of IoT: Artificial Intelligence (AI)

The Effects of Cyber Crime

Criminals take advantage of technology in many different ways. The Internet, in particular, is a great tool for scammers and other miscreants, since it allows them to ply their trade while hiding behind a shield of digital anonymity. Cyber crime affects society in a number of different ways, both online and in the offline world.

Identity Theft
Becoming the victim of cyber crime can have long-lasting effects on your life. One common technique scammers employ is phishing, sending false emails purporting to come from a bank or other financial institution requesting personal information. If you hand over this information, it can allow the criminal to access your bank and credit accounts, as well as open new accounts and destroy your credit rating. This type of damage can take months or even years to fix, so protecting your personal information online is an important skill to learn.

Security Costs
Cyber criminals also focus their attacks on businesses, both large and small. Hackers may attempt to take over company servers to steal information or use the machines for their own purposes, requiring companies to hire staff and update software to keep intruders out. According to Milton Kazmeyer of EWeek, a survey of large companies found an average expenditure of $8.9 million per year on cyber security, with 100 percent of firms surveyed reporting at least one malware incident in the preceding 12 months and 71 percent reporting the hijacking of company computers by outsiders.

Monetary Losses
The overall monetary losses from cyber crime can be immense. According to a 2012 report by Symantec, more than 1.5 million people fall victim to some sort of cyber crime every day, ranging from simple password theft to extensive monetary swindles. With an average loss of $197 per victim, this adds up to more than $110 billion dollars lost to cyber crime worldwide every year. As consumers get wise to traditional avenues of attack, cyber criminals have developed new techniques involving mobile devices and social networks to keep their illicit gains flowing.

Piracy
The cyber crime of piracy has had major effects on the entertainment, music and software industries. Claims of damages are hard to estimate and even harder to verify, with estimates ranging widely from hundreds of millions to hundreds of billions of dollars per year. In response, copyright holders have lobbied for stricter laws against intellectual property theft, resulting in laws like the Digital Millennium Copyright Act. These laws allow copyright holders to target file sharers and sue them for large sums of money to counteract the financial damage of their activities online.

 
References
• eWeek: Cybercrime Costs Jumped 6 Percent in 2012
• Norton: 2012 Norton Cybercrime Report
• Bloomberg Businessweek: The Cost of Cybercrime
• Freakonomics: How Much Do Music and Movie Piracy Really Hurt the U.S. Economy?
• The Washington Post: SOPA – How Much Does Online Piracy Really Cost the Economy?

Feel free to share our post, or give us your feedback and comments. Have a nice cybersafe weekend:)

WiFi system defences

As a follow-on to the previous blog post on securing your home network from August 27, we explore in greater detail some of the issues regarding WiFi system defences.

1.    Data Interception
Today, it’s widely understood that data sent over Wi-Fi can be captured by eavesdroppers – easily, within a few hundred feet; even farther with directional antennas. Fortunately, all Wi-Fi CERTIFIED products now support AES-CCMP data encryption and integrity. Unfortunately, there are still legacy products that only speak TKIP, and many WLANs are configured to accept both AES and TKIP. But TKIP is vulnerable to message integrity check (MIC) attacks that allow a limited set of spoofed frames to be injected – for example, ARP. Although resulting risks are modest, the writing is on the wall: The time has come to retire TKIP and require AES-CCMP.

2.    Denial of Service
WLANs are inherently vulnerable to DoS. Everyone shares the same unlicensed frequencies, making competition inevitable in populated areas. The good news: As enterprise WLANs migrate to 802.11n, they can use channels in the larger, less-crowded 5 GHz band, reducing “accidental DoS.” Moreover, contemporary access points (APs) can auto-adjust channels to circumvent interference. But that still leaves DoS attacks: Fake messages sent to disconnect users, consume AP resources, and keep channels busy. To neutralise common DoS attack methods like Deauth Floods, look for newer products that support 802.11w management frame protection.

3.    Rogue AP’s (Access Points)
Business network penetration by unknown, unauthorised AP’s has long been a top worry. Fortunately, most enterprise WLANs now use legitimate AP’s to scan channels for possible rogues in their spare time. Unfortunately, verifying “true rogues” by tracing their wired network connectivity is a skill that ordinary WLAN gear has yet to perfect. Without accurate classification, automated rogue blocking is a risky proposition. To not just detect, but effectively mitigate rogue AP’s, deploy a Wireless IPS that can reliably differentiate between harmless neighbours, personal hotspots, and network-connected rogues that pose real danger, taking policy-based action to trace, block, and locate the latter.

4.    Wireless Intruders
Wireless IPS products like Motorola AirDefense, AirMagnet, and AirTight can also detect malicious Wi-Fi clients operating in or near a business’ airspace. However, truly effective defence requires up-to-date, properly deployed WIPS sensors. In particular, 802.11a/b/g sensors must be updated to monitor new 5 GHz channels (including 40 MHz channels), parse 802.11n protocols, and look for new 802.11n attacks. Furthermore, because 802.11n clients can connect from farther away, WIPS sensor placement must be reviewed to satisfy both detection and prevention needs.

5.    Misconfigured AP’s (Access Points)
Back when standalone AP’s were individually-managed, configuration errors posed a significant security threat. Today, most enterprise WLANs are centrally-managed, using coordinated updates and periodic audits to decrease TCO, improve reliability, and reduce risk. But 802.11n adds a slew of relatively complex config options, the consequences of which depend on (highly variable) Wi-Fi client capabilities.  Prioritisation and segmentation for multi-media further complicates configuration. The answer here: Combine sound, centralised management practices with 802.11n/WMM education and planning to reduce operator error.

6.    Ad Hocs and Soft AP’s
Wi-Fi laptops have long been able to establish peer-to-peer ad hoc connections that pose risk because they circumvent network security policies. Fortunately, ad hocs were so hard to configure that few bothered to use them. Unfortunately, that barrier is being lifted by “soft AP’s” in Windows 7 and new laptops with Intel and Atheros Wi-Fi cards. Those virtual AP’s can provide easy, automated direct connections to other users, bypassing network security and routing traffic onto the enterprise network. Measures used to deter Ad Hocs may also prove useful against unauthorised Soft AP’s, such as IT-managed client settings and WIPS.

7.    Misbehaving Clients
Clients that form unauthorised Wi-Fi connections of any type, whether accidentally or intentionally, put themselves and corporate data at risk. Some enterprises use Group Policy Objects to configure authorised Wi-Fi connections and prevent end-user changes. Others use host-resident agents and/or WIPS to monitor Wi-Fi client activity and disconnect high-risk connections. However, many businesses (especially SMBs) still depend on end-users to connect only to known, authorised wireless APs.  Given ubiquitous deployment, longer reach, and broader consumer electronics integration, accidental or inappropriate Wi-Fi connections have never been easier.  If you haven’t already taken steps to stop Wi-Fi client misbehaviour, start now.

8.    Endpoint Attacks
Now that over-the-air encryption and network-edge security have improved, attackers have refocused their attention on Wi-Fi endpoints. Numerous exploits have been published to take advantage of buggy Wi-Fi drivers, using buffer overflows to execute arbitrary commands – sometimes at ring 0 (high-privilege kernel mode).  Automated attack tools like Metasploit can now be used to launch Wi-Fi endpoint exploits with minimal effort.  Although vendors do (usually) patch these bugs once discovered, Wi-Fi driver updates are not distributed automatically with OS updates. To protect your workforce, track Wi-Fi endpoint vulnerabilities (for example, using WiFiDEnum) and keep your Wi-Fi drivers up-to-date.

9.    Evil Twin AP’s
Fraudulent AP’s can easily advertise the same network name (SSID) as a legitimate hotspot or business WLAN, causing nearby Wi-Fi clients to connect to them. Evil Twins are not new, but easier-to-use hacker tools have increased your risk of running into one. Tools like Karmetasploit can now listen to nearby clients, discover SSIDs they’re willing to connect to, and automatically start advertising those SSIDs. Once clients connect, DHCP and DNS are used to route client traffic through the Evil Twin, where local (fake) Web, mail, and file servers execute man-in-the-middle attacks. The only effective defence against Evil Twins is server authentication, from 802.1X server validation to application server certificate verification.

10.  Wireless Phishing
In addition to the above man-in-the-middle application attacks, hackers continue to develop new methods to phish Wi-Fi users.  For example, it’s possible to poison Wi-Fi client Web browser caches, so long as the attacker can get into the middle of a past Web session – such as by using an Evil Twin at an open hotspot. Once poisoned, clients can be redirected to phishing sites long after leaving the hotspot, even when connected to a wired enterprise network. One technique for mitigating this threat is to clear your browser’s cache upon exit.  Another possibility is to route all hotspot traffic (even public) through a trusted (authenticated) VPN gateway.

In summary, the state of Wi-Fi security has significantly improved over the years. Today’s enterprise WLANs can be effectively hardened against intrusion and misuse. However, end-to-end security still cannot be assumed; just enabling Wi-Fi encryption will not make applications running over wireless networks “safe.” Wi-Fi technologies, products, and attacks will continue to emerge. Security admins still need to keep abreast of new threats, assess their business risk, and take appropriate action.

Thanks to arcadeusops.com friends Aurelian Neague and Lisa Pfifer for these ideas.

Top 10 Ways to Secure your Home Network

Today, we will look at the top ten things you can do to improve the security of your home network. At Arcadeusops.com we see many home networks that are misconfigured, or have default settings. If you do not have custom settings then you are wide open to malicious attacks – even a small amount of customisation will reduce your risk to system breaches. This Part 1, with Part 2 next week, which will focus in more detail on WiFi issues.

1. Change the name of your home wireless network
As soon as your home wireless network has been set in place, you need to change the SSID (Service Set Identifier). This is the name of your home network, the name other mobile devices will see when trying to connect to the Internet by using the wireless network from your home. The reason you need to change its name is quite easy to guess. Modifying the name increases the difficulty for a hacker to gain access to your network. Usually, router manufacturers assign the name of the company that produced the router and it could be something like “Linksys“, “Cisco” or “Belkin“. In case the SSID is not modified, a hacker has a better chance of breaking into a network, simply by knowing the manufacturer of the router. And one more thing related to this step: Do not use your name or your family name in order to avoid being identified as the owner of the network. This is another detail that could give an advantage to a potential hacker or for an online criminal that might attempt an identify theft.

2. Choose a strong and unique password for your wireless network
Your wireless router comes pre-set with a default password. The problem is that this default password is easy to guess by hackers, especially is they know the manufacturer’s name for the router. See step 1 above. When setting a good password for your wireless network, make sure it is at least 15 characters long and includes numbers, letters and various symbols. This setting will prevent other people from accessing your network. Though usually, it is nothing more serious than some neighbour “stealing” from your network bandwidth speed, you may have to deal with other more challenging situations, like online criminals that can access your network to “listen” to your traffic data and retrieve sensitive information.

3. Increase your security by enabling network encryption
There are a few popular encryption options for wireless networks, like WEP, WPA and WPA2. The latter form of encryption – WPA2 – is preferred for its improved security and especially if you have a home network. The option to encrypt traffic is useful if you need to make your communication signals unusable for any unauthorised third party software. At this moment all wireless devices out there support this technology and it is common knowledge to use WPA2, which has a greater degree of security.

4. Disable the wireless network when you’re not at home
This option is useful especially when leaving home for extended periods of time, for a vacation or for a few days. This security measure, besides helping you to reduce power consumption, it will surely stop any hackers that could “listen” to your network’s traffic or might try to access it for malicious purposes.

5. Where are you placing the router in the house?
It could be a good idea to place the wireless router as close as possible to the middle of your house. And it’s not just for every place or room in the house to have same access to the Internet, but because you don’t want to have your wireless signal range reach too much outside your house, where it can be easily received by hackers. For this reason, don’t place it too close to a window, from where the signal can be easily accessed from outside, even at some distance, and you may also follow our fourth rule to disable the router when leaving your home.

6. Choose a strong password for your network administrator
To set up your wireless router, usually you need to access an online platform or web page, where you can make modifications to your network settings.
As everybody knows, it is something normal to find a router with default credentials such as “admin” and “password”. And these default login credentials are not so difficult to break by a hacker. Most changes we do on an online platform are things like setting a strong password for the wireless network or changing the network’s name, both changes being made to ensure a greater level of protection from online criminals’ malicious actions; but if an IT criminal is able to access the administrator platform and gain access to your network’s setup and configuration settings, this will ruin your day for sure.

7. Disable Remote Access
Normally, you can access your router’s interface from a device connected to your network, but some routers allow access even from remote systems. To stop online hackers access to your router’s private settings, it is safe to disable this option in your router’s settings. To make this change, access the web interface and search for “Remote access” or “Remote Administration“.

8. Keep your router’s software up-to-date
Consider your router’s software like any other software you have on your operating system. It may be your antivirus program or any other application running on the system. The router’s firmware, like any other software, contains flaws which can become major vulnerabilities, unless they are quickly fixed by firmware releases from the manufacturer. The problem is that most routers don’t have the option to install the latest security updates and from time to time you need to check the official website for security fixes. We must not forget that some of the worst security breaches came from security holes in unpatched programs and operating systems. Also, make sure you update your OS with the latest security patches. Windows and Linux can be setup to automatically update security patches. Do it.

9. Make sure you have a good firewall
Form our pen testing experiences at arcadeusops.com, it is unbelievable how many systems (home and enterprise) have no firewall at all, on their router or on their OS’s. Make sure your have a basic firewall at least and do not accept default firewall configuration settings. Some routers have their own firewalls that can help block hackers from accessing your computer. In case your router doesn’t have such a firewall, make sure you install a good firewall solution on your system to watch for malicious access attempts to your wireless network. These days, most people use the firewall solution provided by their operating systems, which is a good option. In case you are using a security software that contains a firewall, it is a good option to turn it on.

10. Protect the devices that connect most frequently to your wireless network
Don’t leave any door open for online criminals! Though you may have secured your router and your wireless network, you need to make sure you are not leaving any security breach that can be exploited by IT criminals. Therefore, follow some general and common sense guidelines to stay away from online dangers, like having the latest software available installed on the system and the latest security patches downloaded to ensure no security hole or breach is left open to online predators. Even more, check what devices connect mostly to your home network and make sure they have security software installed against the viruses and spyware. Finally, use a specialised security software to protect your devices from financial and data stealing malware, cyber-criminals and malicious hacker servers.

Thanks to Arcadeusops.com friends Aurelian Neague and Lisa Pfifer for these ideas.

Welcome!

We welcome you to the blog of Arcadeus OPS Ethical Hackers and Pen Testers. This is our maiden post here. We will communicate about topics on cyber security and cyber resilience, big data, cloud computing, White Hat hacking and Pen Testing, cybercrime and hacking in general, the Internet of Things, and other technology related matters. Please feel free to comment, ask questions, and contact us for more information. We hope you will enjoy our content here. You can also visit our web site ArcadeusOPS.com or follow us on Twitter at Arcadeus [Pentest]. We are looking forward to hear from you!

Hop on and enjoy the ride.

The Arcadeus OPS team.