Strategy 2011 – the year of high profile hacker attacks

The year 2011 was the year of Anonymous and LulzSec, and of course WikiLeaks, in terms of how the established order of things were shook to the very core by the internet world. Let’s not forget the role of the internet and social media, in particular, in bringing about the dramatic series of revolts that led to the ouster of dictatorial regimes in Tunisia, Egypt and Libya, and the ongoing disputes in Syria, for example.

During 2011, the Western World learned to appreciate the increasing power of hackers, groups like LulzSec and Anonymous and others intent on putting forward their brand of social justice.

Large corporations, like Sony, weren’t immune to this and the biggest coup for hackers in 2011 was the devastating attack on Sony’s PlayStation Network and its Online Entertainment network, which saw the online services shut down for weeks and hackers compromise the accounts of millions of gamers.

It was no doubt a harsh lesson for Sony, and indeed the CIOs of other corporations and government bodies.

It was also the year that saw cyber warfare take an insidious new twist. The Stuxnet attack which focused on disabling SCADA systems usually found in utility companies began as a virus (believed to have originated in Israel) that set out to disable the Iranian nuclear programme. However, variants of the virus began to spring up around the world targeting utility firms but also water supply networks in the US.

Indeed, the very pervasiveness of the internet in our lives and its impact on the established order began to manifest in a variety of Big Brother ways. High-profile attacks on Wall Street earlier in the year and of course the unease felt by governments like the US at the spate of revelations brought about by Julian Assange’s WikiLeaks led to murmurings about the prospect of an internet kill switch.

Indeed, governments like the US and UK made it very clear that they regarded any cyber attack on their servers and networks to be an attack on their very sovereign soil and would meet such attacks with whatever force, including physical warfare, they deemed necessary.

Hackers leave Blueshirts red-faced

Fine Gael also had an unfortunate series of brushes with hackers this year. The year began during the run-up to the elections, with the defacement of the Fine Gael website. The logo of the Anonymous hacktivist collective was put in place of the political party’s messages on the homepage.

The amended text read: “Nothing is safe, you put your faith in this political party and they take no measures to protect you. They offer you free speech yet they censor your voice. WAKE UP!”

But it didn’t end there. Within days, it emerged an Evening Herald journalist claimed he was sent data of 2,000 users of the site after the hack occurred.

Kevin Doyle, an Evening Herald journalist, claimed the commissioner was informed the data of 2,000 users of the site was stolen by those who attacked it. He previously said it was almost 4,000, however, this was due to repeat posters on the database. Doyle also said the database he received of the site’s users contained phone numbers, IP addresses and email addresses.

Two teenagers were arrested in September in connection with the attacks. The Computer Crime Investigation Unit attached to the Garda Bureau of Fraud Investigation carried out searches at two houses in Birr, Co Offaly, and in Galway. Computers and portable storage media were seized and removed for forensic examination.

Don’t forget the threat from within

If you think you need to worry about hackers outside your company trying to steal information, think again. The threat can also come from within the company. A former IT manager who hacked into the presentation of his former company’s CEO and replaced it with pornography was sentenced to two years in prison.

Walter Powell (52) worked for the Baltimore Substance Abuse Systems in Baltimore, Maryland. The company fired him in 2009.

He began hacking into the company’s computer network, which includes an incident where he replaced a presentation to the board of directors with porn, a release from the city state’s attorney’s office says.

This case only serves to remind organisations of the importance of IT security, and having a proper process in place when staff leave a company, said Graham Cluley, senior technology consultant at Sophos, in the Naked Security blog.

There were red faces at Trinity College, too, this year, because of internal hacker hijinks. In what is believed to also have been an inside job, a prankster posted an academic profile of fictional character Conan the Barbarian on the college’s website. The profile featured a photo of actor Arnold Schwarzenegger as the barbarian, whom Schwarzenegger played in his first film role.

The site summed up ‘Prof Barbarian’ as “Long Room Hub Associate Professor in Hyborian Studies and Tryant Slaying”.

The profile also referenced the 1982 movie that starred Schwarzenegger, and stated Conan had been preparing for academic life since being “ripped from his mother’s womb.” His PhD thesis is titled ‘To Hear the Lamentation of Their Women: Constructions of Masculinity in Contemporary Zamoran Literature’. This title refers to a line from the film, when Conan is asked what is best in life. “To crush your enemies, see them driven before you, and to hear the lamentation of their women,” he replied.

The parody faculty listing claimed Conan landed his job with the School of English “after successfully decapitating his predecessor during a bloody battle which will long be remembered in legend and song.”

Conan’s upcoming courses included “Vengeance for Beginners” and students who cheated or showed weakness face crucifixion.
The fake profile was quickly taken down upon its discovery, but reportedly not before many people archived the profile.

Lightning never strikes twice

While Dublin’s data centre scene continues to grow and grow, there was mystery surrounding an alleged lightning strike that caused a service outage at one of Amazon’s data centres in the city in August.

In the hours following the incident, Amazon originally blamed a lightning strike and an explosion which knocked out a generator leading to loss of power, which disrupted service for Amazon customers for up to 48 hours in some cases.

Electricity provider ESB Networks has provided a different version of events. A spokesperson told Siliconrepublic.com that the problem was due to a fault in one of its substations at Citywest and that power would have been available from an alternate source within a millisecond.

ESB Networks said an outage occurred which lasted less than a second. “In relation to Amazon, it would have experienced less than a second (of downtime) when the centre would have been switched to an alternate supply,” the spokesperson said. The cause was a fault in a substation in Citywest and there was no report of an explosion or fire.

Moreover, the Met Office has no record of a lightning strike in the Dublin area at the time when Amazon claims its centre was taken offline. The wording of Amazon’s initial statement clearly implied cause and effect between the lightning strike and an explosion which prevented its backup generators from providing power which they ordinarily should have done.

Amazon did not return emails seeking comment.

Government database issues will emerge in 2012

The year ended with the dreaded Budget in Ireland and imposition of new charges, including a €100 household charge on property owners across the land.

Debates around the rights and wrongs of such a new charge, however, revealed that the Government intends to scour the databases of the ESB, the Revenue Commissioners, the Private Residential Tenancies Board and potentially others to ensure everyone paid the new tax.

This is likely to throw up new debates in 2012 around data protection and the right of the State to mine databases into which people provide information, believing it would be protected and used in a particular way. Interesting times.

John Kennedy | |