23/10/2012

1

P R O F E S S O R M A T T W A R R E N ,

S C H O O L O F I N F O R M A T I O N S Y S T E M S , D E A K I N U N I V E R S I T Y

W W W . M J W A R R E N . C O M

The Impact of Hacktivismon Australian Organisations

Hackers

Motivation is an important aspect of hacking,whether it is:

Traditional - Gaining knowledge (hacker manifesto); For financial gain (current situation – organised

crime).

Motivation has changed over time from singlehackers to groups of hackers.

LulzSec Profile

Small Group of Hackers (6/7);

“For the past 50 days we've been disrupting and exposing corporations, governments, often the general population itself, and quite possibly everything in between, just because we could”.

(Last Message?);

Aim to Cause Disruption.

23/10/2012

2

Attacks

X-Factor contestant Database Released; CIA Web-site Defaced; InfraGard – FBI Think Tank – defaced site and

related database of user details; Released 62,000 email address and passwords

including Australian organisation details, e.g. Universities, local government, NPO.

Desire to highlight security weaknesses.

Of Interest

Traditional model of a hacking group.

Extensive use of Social Media Twitter Followers –356,000 and use of sites such as Pastebin.

Hacktivsm

In the broadest term it is the use of technology as a means of protest to promote political ends. The aims of the protest would depend upon the group;

Term developed from the mid 90’s by the hacking group “Cult of the Dead Cow”;

Techniques can include hacking, malware, denial of service and information disclosure.

Anonymous

23/10/2012

3

Anonymous

Anonymous is NOT an organization, a club, a party or even a movement.

There is no charter, no manifest, no membership fees.

Anonymous has no leaders, no gurus, no ideologists. In fact, it does not even have a fixed ideology.

Anonymous has no centralized infrastructure but use existing facilities of the Internet, especially social networks.

“We are ready to hop on to the next one if this one seems compromised, is under attack, or starts to bore

us”.

http://www.cyberguerrilla.org

Key Campaigns

The Church of Scientology, Vatican;

Software Piracy;

Political Campaigns against governments– Australia, Burma, Iran, UK, USA, Russia, Syria, and India;

Supporting the Arab Spring;

Sony;

Wikileaks;

Cyber Bullying.

Australian examples are linked to government decisions

relating to Internet Filtering and Data Retention.

Sony Hacking Example (2011)

Anonymous had vowed retribution against Sony for taking legal action against hackers who cracked PS3 defences to change console operating software;

A message signed by Anonymous at the website anonnews.org announced an "Operation Payback" campaign aimed at Sony because of its cases against the two hackers.

Sony Hacking Example (2011)

23/10/2012

4

77 million customers details were stolen;

The data that was disclosed included; passwords, logins to the Sony PlayStation network as well as user

email addresses;

It has been assessed that 700,000 Australian customers were impacted;

The breach occurred on April 17-19…Sony notified its customers on the 27 April.

Sony Hacking Example (2011) Australian – Data Retention Strategy

The Australian Government proposing: Data Retention Strategy where Internet Service Providers

holds customers data for a period of two years.

Law enforcement agencies would have access to this data as required.

Anonymous don’t agree with the proposal.

Anonymous Steal Data from AAPT

Anonymous steal 40GB worth of user data from ISP -AAPT and released the information to the public;

The aim was to show that ISP’s cannot securely protect data;

Some of data was sanitised and released via Pastebin;

The initial release was 180,000 records posted via Pastebin.

Australian Organisations Listed

Australian Federal Police; Australian Securities and Investments Commission; Reserve Bank of Australia; ABC Ultimo; NSW Attorney General's Department; Brisbane City Council, Road and Traffic Authority; Labour Council of NSW; Bureau of Meteorology; Department of Premier and Cabinet Queensland; Australian Post; Australian Crime Commission; Productivity Commission; Refugee Review Tribunal; Energy Australia and; Department of Defence Southern Region.

23/10/2012

5

Anonymous Profile

Strong Global Presence;

Strong use of Social media networks;

Twitter Anonymous – 648,085 Followers

Australian Anonymous 3,483 followers

YouTube – Anonymous Channel Message to the American People – 7.6 million views (National

Defense Authorization Act).

New Developments

Development of new sub-group. Warren and Leitch (2010). Hacker Taggers: A new type of hackers, Information

Systems Frontiers, Vol, 12, No 4.

Hacker taggers – the same as traditional hackers but also politically motivated.

Hacker Taggers

A new Hacking Sub Group: are very competitive; have a strong desire to succeed; exchange information amongst themselves, e.g.

successful defacements; respect each other based upon their success; cause minimal damage to websites or no damage to

websites; only deface websites, do not steal information or

damage websites long term; rely upon media reports to cause political damage or

embarrassment; can be individuals or groups of people.

Hacker Taggers

23/10/2012

6

Hacker Tagger – Australian Case Study

In late 2005, the Chief Minister of the Australian Capital Territory (ACT) caused controversy by posting the Australian Federal draft counter-terrorism legislation on his website without the approval of the Federal Government.

"Fatal Error was here ohh yeahh let's go! irc.gigachat.net #Ferror".

The response by the Media

Stanhope's website defaced – The Age

ACT Chief Minister targeted by hackers – Computer World

Hackers shut down Stanhope website – Sydney Morning Herald.

Australian Impact

Between 22/10/12 – 12/10/12 (10 days); 379 Australian Websites were hacked and tagged.;

Approximately 38 hacks per day.

Attacks were simple exploits and hacked sites were SMEs, schools and local government.

23/10/2012

7

http://organicmountaingarlic.com.au/

A Pro Turkey Message and includes an audio of the Turkish national anthem.

Queensland Fungi Society

Cyber Militias

Hackers who carry out activities because of a national political cause, acting out of patriotism.

Brought together for a certain period of time.

Cyber militias need to be co-ordinated and information distributed, e.g. tool-kits.

The role of governments?

Estonia

1.4 million people Substantial ethnic Russian minority Member of EU and NATO. Extensive Internet use – Banking, voting, petrol purchase, etc. – 60% use Internet daily

A Developed Information Society.

23/10/2012

8

The Physical Cause

On April 27, 2007, officials in Estonia relocated the "Bronze Soldier," a Soviet-era war memorial commemorating an unknown Russian who died fighting the Nazis. The move incited rioting by ethnic Russians and the blockading of the Estonian Embassy in Moscow.

Protests & Cyber Attacks

Relocation of Russian statue triggered protests outside Estonia as well as inside.

Defacement and DDoS

Attacks were dominated by BOTS.

Almost all traffic came from outside Estonia.

Attacks against Estonia government, media and banking organisations.

23/10/2012

9

The Attack

In Estonia the attack took the form of coordinated mass requests for information and spam e-mail which slowed down key Web sites so they did not function or crashed due to the attacks.

The attacks, which started around April 27th 2007 and lasted about three weeks. Peaking May 9th 2007 –Victory Day – Russia.

The important role of BOTs.

23/10/2012

10

Bot Net

(roBOT NETwork) Also called a "zombie army," a botnet is a large number of compromised computers that are used to create and send spam or viruses or flood a network with messages as a denial of service attack.

The computer is compromised via a Trojan that often works by opening an Internet Relay Chat (IRC) channel that waits for commands from the person in control of the botnet.

Attack Profile

Security Analysts observed 128 unique DDoS attacks on Estonian websites in May 2007.

Of these, 115 were ICMP floods, 4 were TCP SYN floods, and 9 were generic traffic floods.

http://asert.arbornetworks.com

ICMP Flood

ICMP (Internet Control Message Protocol) flood, also known as Ping flood or Smurf attak, is type of Denial of Service attack.

It sends large amounts of (or just over-sized) ICMP packets to a machine in order to attempt to crash the TCP/IP stack on the machine and cause it to stop responding to TCP/IP requests.

23/10/2012

11

TCP SYN

An assault on a network that prevents a TCP/IP server from servicing other users.

It is accomplished by not sending the final acknowledgment to the server's SYN-ACK response (SYNchronize-ACKnowledge) in the handshaking sequence, which causes the server to keep signalling until it eventually times out.

The source address from the client is, of course, counterfeit.

SYN flood attacks can either overload the server or cause it to crash.

Foreign Affairs

Government ofEstonia

Dates of Attacks

Dates of Attacks 21 attacks on 3rd May 2007

17 attacks on 4th May 2007

31 attacks on 8th May 2007

58 attacks on 9th May 2007

1 attack on 11th May 2007

May 9th – Victory Day – Russia

Duration of Attacks

Attacks Duration 17 less than 1 minute

78 1 min - 1 hour

16 1 hour - 5 hours

8 5 hours to 9 hours

7 10 hours or more

23/10/2012

12

Duration of Attacks

Attacks Bandwidth measured 42 Less than 10 Mbps 52 10 Mbps - 30 Mbps 22 30 Mbps - 70 Mbps 12 70 Mbps - 95 Mbps

The largest attacks measured: 10 attacks measured at 90 Mbps, lasting upwards of 10 hours.

Aftermath

Dmitri Galushkevich was fined 17,500 kroons (£830) for an attack which blocked the website of the Reform Party of Prime Minister Andrus Ansip.

NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) was set up on Estonia with the support of NATO.

The role of Russian Youth Groups – Nashi was considered key in sharing and co-ordinating activities.

Hacktivism Australian Context

Australian Organisations are at a low risk of Hacktivism unless in particular industries or a particular sector;

Mass disclosure of data could impact all organisations;

Hacker Taggers is a greater risk for smaller organisations with lower levels of security

Unknown political issues could trigger attacks.

Grey Areas

The boundaries are blurred between: Hackers;

Hacker Taggers;

Hacktivsm;

Cyber Militias;

Cyber Terrorists and;

Cyber Warfare.

23/10/2012

13

Conclusion

Is Hacktivsim a modern form of civil disobedience and just a form of expression?

Or is Hacktivism a threat to Australian organisations and their customers?

The impact of unforeseen events.

Thank You

For Your Time

Next Talk

26th November

Title: Security Learning from Incident Response

Speaker: Dr Atif Ahmad, University of Melbourne