Tag Archives: chines hackers to be punished

Ghosts in the machine: the real hackers hiding behind the cliches of TalkTalk and Mr Robot

This week’s tabloid headlines about the teenager who allegedly broke into TalkTalk’s website invoked the usual formula: reclusive, antisocial, young, male. But hackers are more complicated than that – and the people pursuing them say the stereotype is a problem

Hackers are usually portrayed either as shadowy criminal masterminds, or little more than digital vandals. image www.intelagencies

The portrait of the hacker as an antisocial, lonesome deviant is pervasive and seemingly indelible. This week, for example, the British tabloids rounded on a child who has been arrested in connection with the hacking of telecommunications provider TalkTalk’s porous servers in order to access customers’ personal data. The Daily Mail’s front page referred to him as “a baby-faced loner who rarely leaves his bedroom”. The Sun described the boy, who lives on a council estate with his single mother in Ballymena, Northern Ireland, and who suffers from learning disabilities and attention deficit hyperactivity disorder, as “reclusive”. He is, they continued, an avid player of video games, as if such a detail distinguishes this particular teenager from any other. The Mirror quoted a neighbour who described the boy as “quiet and shy”. He was often seen, she added, with a skateboard, although there was no mention whether or not his baseball cap was worn in the style of Bart Simpson: anarchically askew.

There are two common stereotypes of the young, usually male, hacker. They are seen either as a shadowy criminal mastermind, able to sift hidden information for gold or, in the case of the teenagers who manage to take the websites of multinational corporations offline for a few hours, little more than digital vandals. As portrayed in the media, the alleged hacker from Ballymena straddles both stereotypes, with added ghost notes to do with class and poverty. He is an undesirable but, unlike the hooligans who throw stones at windows, also possesses arcane skill (at least in the eyes of those without a basic computer science education). The detail of his alleged crime is illegible to all but the cognoscenti. As such, he is presented as a deviant wunderkind, simultaneously astute and base, accomplished yet also somehow pitiful. A second teenager has now been arrested in west London; it will be interesting to see how his character is represented in the days to come.

These cliches have been strengthened and propagated by fictional representations of hackers. Jurassic Park’s Dennis T Nedry is the overweight, sweat-prone, moral-free computer scientist who disables security systems in order to smuggle dinosaur embryos out of the titular park in a hollowed can of shaving foam. His surname is a barely scrambled anagram of “nerdy”. Boris Grishenko, the bespectacled Russian hacker from GoldenEye, is a misogynistic narcissist who is both cowardly and conceited (he dies, pleasingly, in a shower of liquid nitrogen, which hits moments after he declares: “I am invincible!”). Lisbeth Salander, protagonist of Stieg Larsson’s The Girl with the Dragon Tattoo, may be a more contemporary class of elite hacker – lithe, attractive, leather-clad – but the get-up merely disguises a more familiar stereotype: she is highly introverted and struggles to make friends. Another character in the book describes Salander, variously, as “paranoid”, “obsessive” and “psychotic”. She subsists on pizza and fizzy pop. Now Mr Robot, a wildly successful new US drama, follows Elliot Alderson, a brilliant young hacker drawn into an anarchist movement. Elliot is lovable, but he’s also delusional, depressed, addicted to drugs, and beset with social anxiety disorder.

According to Ian Reynolds, a hacker turned security consultant who now works fortifying corporations and governments against the threat of cyber attack, these stereotypes are antiquated and unhelpful. “The common misconception that computer hackers are just spotty-faced teenagers working out of their bedrooms over their parents’ broadband connection is largely inaccurate,” he says. “In reality there is a far wider variety of people and personality types that are attracted to computer hacking. There is no blueprint. With ‘social engineering’ hacks, for example, the ideal personality is an outgoing, impressionable individual who is able to trick people into performing a task or divulging usernames or passwords. Introverts are much less likely to succeed in these styles of attack as they lack the confidence or social skills required.” Corey Nachreiner, chief technology officer at WatchGuard Technologies, which helps combat malicious online attacks, agrees. “Regardless of whether you’re talking about hackers in the positive sense – many non-criminal security researchers may identify with the term – or you’re talking about criminals, the stereotype is totally outdated and misleading,” he says.
Mr Robot: ‘Edward Snowden is a huge fan of our show’
Read more

The data supports the claim. According to research carried out by the online payments company Jumio in 2013, 43% of criminal hackers are aged between 35 and 50 years old. Only 8% of criminal hackers are under 18. Almost a quarter of criminal hackers are women, and almost half of all criminal hacking traffic originates from Asian-Pacific countries, the majority from Indonesia (14% of all cybercrime, compared to 19% from the US, a country many times its size). Criminal hackers usually do not work alone but are, in Jumio’s term, “fully fledged businesses”, with executives, middle managers and workers. “Even though there are some criminals who fit the stereotypical profile of a hacker, it underestimates the extent and organisation of the wider fraud and cybercriminal syndicates,” says Jumio’s Marc Barach. “Cybercrime is big business, populated by highly intelligent and hardworking people who often times excel at their jobs. If they applied their skills to legal pursuits, they’d probably be amazingly successful.”
Advertisement

Both Reynolds and Nachreiner are eager to distinguish between so-called “script kiddies” – mischief-making teenagers who download distributed denial of service (DDoS) tools and use them to send a vast amount of fake traffic to a particular website in order to cause its servers to fail and go offline – and skilled computer hackers. “Fifteen years ago, it may have been true that many of the internet hacking ‘pranks’ or nuisance malware was created by egotistical script kiddies,” says Nachreiner. “Many of them may have fit the profile of awkward, socially inept loners with strong technical skills. Today, however, the hacker profiles are much more diverse.” Nacheiner says that you need only spend a few minutes roaming the halls of Def Con, the world’s largest hacker convention, which is held annually in Las Vegas, to witness the diversity of people who adopt the label. “You’ll find everyone from guys in trench coats with blue hair, to old greybeards in their 60s, to polished, dynamic professionals.”

The term “hacker” was not coined to describe one particular type of person. Its first documented use in relation to computers was in 1955, when it was recorded in the minutes of a meeting of the Massachusetts Institute of Technology (MIT)’s seminal computing group, the Tech Model Railroad Club. They used it to mean “messing about with machines”. Its definition was formalised four years later by club member Peter R Samson, who, in his TMRC dictionary, defined the word as “something done without constructive end” or, deliciously, “an entropy booster”.

Writing in 2005, Samson claimed that, in those early years, the word “hacking” was neutral, with no suggestion of malice or benevolence. He cites, as one of the earliest examples of a hack, a group project to find a way to play music on one of the university’s room-sized computers. By 1975 the word “hacker”, which was now in widespread usage, was defined in the Jargon File, a glossary for computer programmers, as “a person who enjoys exploring the details of programmable systems and how to stretch their capabilities”. This was, the definition stated, distinguishable from most computer users, who “prefer to learn only the minimum necessary”.
OPM hack: China blamed for massive breach of US government data

Jargon File’s definition is, according to Timo Gnambs, a researcher for the Leibniz Institute for Educational Trajectories, a more accurate description of the hacker mentality than the contemporary stereotype. Gnambs recently published a study in the Journal of Research in Personality, in which he trawled data from 19 previous studies, involving nearly 1,700 people, in order to examine correlations between programming talent and personality type. While he found a strong association between introversion and programming skill, he also saw firm links between intelligence, conscientiousness and, in stark contrast to the cliches, “openness” – a person’s degree of creativity and intellectual curiosity. There was, he found, no link between a person’s agreeableness or neuroticism and their skill as a hacker.

“According to prevalent stereotypes, computer programmers are supposed to lack interpersonal skills, and are frequently characterised as socially inhibited individuals that are single-mindedly focused on computers,” Gnambs says. “My study showed that personality traits that, according to the stereotypes, are typical for programmers, do not differentiate able from less-able programmers. In other words, particularly disagreeable programmers do not create better code.”

Delusional, paranoid, narcissistic, moral-free … screen hackers (from left) Elliot Anderson , Lisbeth Salander, Boris Grishenko & Dennis Nedry in Jurassic Park images www.intelagencies

While there may not be a blueprint for a typical hacker, according to Reynolds, the common denominator is that computer hacking in its purest form attracts highly technical, creative people. “They must get a kick out of taking a non-standard approach to gaining access to a website or environment – circumventing the layer of security that is designed to keep people out,” he says. It’s this puzzle element to hacking – the need for lateral thinking, problem solving, even outsmarting an adversary – that inspired Pete Herzog to co-found Hacker Highschool in 2002, an educational programme that seeks to “capture the fun and magic of hacking”.

Herzog worked with La Salle University in Barcelona to design 12 lessons for teenagers, designed to teach security skills, and ran the course as summer classes, teaching children a foundation in network security, alongside values of respect and empathy. In 2010 Herzog and his team rewrote the lessons, removing the teacher from the equation so, as he puts it, the students “could teach themselves, like real hackers”. The course has proved hugely popular. On average, lessons are downloaded a quarter of a million times every month, in 10 languages.
Inside the secret world of hackers
Read more

There is a big difference between teenagers who experiment with, say, breaking into a telecommunication company network, and organised criminal hackers, says Herzog. “Long-term criminal hackers do it for a living,” he adds. “But most teens who commit illegal criminal acts do it as part of a power struggle, something we all go through. They’re lashing out. Some teens punch, some scream, some have sex and some shoplift. In most cases we assign the behaviour as teenage angst and get them help. With hacking, however, they’re tried as criminals and often go to jail.” Herzog likens his course to boxing clubs, which aim to turn teenage frustration and anger into discipline and passion through sport. “We need to stop punishing teens for carrying out cyber attacks because they got angry at someone. Right now, if a teen hacks into a web server and deletes data, they will likely serve a longer, tougher sentence then if they broke into the server room, knocked out a few employees and set the web server on fire. What does that tell you? That doesn’t create fewer hackers. It just turns more hackers into criminals.”
Advertisement

Many criminal hackers, especially the kind who, in their younger years, staged attacks against corporations out of frustration, have been able to turn their expertise into gainful employment in the way that Herzog hopes his course will encourage. Kevin Mitnick, who calls himself “the world’s most famous hacker”, was certainly one of the most notorious. Prior to his arrest in North Carolina in 1995, he was the FBI’s most-wanted outlaw, after hacking into computers belonging to companies such as Motorola, Nokia and Sun Microsystems. He spent five years in prison, including eight months in solitary confinement, because a federal judge believed, preposterously, that he could “whistle tones into a phone and launch a nuclear missile”.

Now 51, Mitnick, runs a successful and profitable company where he and his team attempt to break into corporations by any means necessary, in order to expose security flaws (work that’s known, alluringly, as “penetration testing” in the business) – much the same things he did as a criminal hacker. GCHQ reportedly hires many ex-criminal hackers, and the idea of the programming wunderkind who is caught by the authorities then cajoled into working for them has become a recurrent motif in drama. The more notorious the hacker, the more likely they are to be hired. In 2011, the 21-year-old hacker George Hotz, who “unlocked” Apple’s iPhone and Sony’s PlayStation 3 console to run pirated software, was hired by Facebook weeks after he settled a lawsuit with Sony. “Knowledge is power, and a reformed criminal knows the industry far better than someone who has never been there and done it,” says Barach. Herzog goes further. “You wouldn’t hire a policeman who’s never thrown a punch or a fireman who’s never set a fire either. So why would you want to hire a security professional who’s never hacked?”
Anonymous plans to reveal names of about 1,000 Ku Klux Klan members
Read more

Some blame for the way hackers are routinely viewed as a monolithic group can be ascribed to the hackers themselves, who often labour, not only under a mask of anonymity, but also one of uniformity. Members of Anonymous, one of the largest collectives of hackers in the world, are known for wearing identical Guy Fawkes masks, the design taken from the graphic novel V for Vendetta. But behind the masks, there’s diversity. “Many of the larger, more well-known hacking groups have people from all backgrounds and walks of life, says Reynolds. “Usually it’s a variety of people united over a common cause.” That cause can be politically motivated, vigilantism, crime or, in the case of state-sponsored hackers, even patriotism. “We should spend much more time profiling the motive of different threat actors rather than the psychologies,” says Nachreiner. “You’ll often find multiple members of the same threat-actor group to all have slightly different psychologies, but a shared motive.”

The stereotype will, however, endure as long as people need a bogeyman they can visualise trying to steal their data. The image of a rotund, washed-up journalist hacking celebrity’s phones for News International doesn’t have the same potency as the hooded, indoorsy miscreant, neither for headline- nor Hollywood writers. “Hacking is the closest thing the general public knows to be an unknown, unexplained power that some people possess, like modern magic,” says Herzog. “So, of course, there will be witch-hunts for those who wield that power. We can’t fight that. But we can teach young hackers humility and empathy.”

www.clublibido.com (8)

Henry Sapiecha

Cyberattack: US should retaliate for theft of personal data, congressmen say

Govt hacking could affect every federal agency

The entire US federal workforce may be at risk after yet another massive cyber breach involving what security experts believe were hackers based in China.

Washington: The Obama administration should retaliate for a cyberattack on federal employee records that US officials have linked to the Chinese government, members of the House Intelligence Committee said on Sunday.

“There has to be a price to pay for this,” Representative Peter King, who is on both the intelligence and Homeland Security committees, said on “Fox News Sunday.”

cyberwar hand press button image www.intelagencies.com

Congressmen are calling for payback for the massive hack of US government personnel data. Photo: Supplied

While the timing and method of retaliation should be determined by the administration and kept secret, “these countries or these terrorist groups should know there will be consequences when they act this way,” Mr King said.

Representative Adam Schiff of California, the top Democrat on the intelligence panel, said the administration must determine “when we’re going to go on offence.”

Neither lawmaker confirmed that the Chinese government was behind the breach at the Office of Personnel Management, which serves as the government’s human resources department. Hackers stole data on as many as 4 million current and former federal employees before the attack was discovered in April, the government said on Thursday.

“We’ve gotten very good at attribution,” or figuring out the source of cyber attacks, Mr Schiff said.

Mr King called China “certainly a likely suspect.”

A spokesman for the Chinese embassy in Washington, Zhu Haiquan, said in an email Friday: “Jumping to conclusions and making hypothetical accusations is not responsible and counterproductive.”

Mr Schiff and Mr King called for stepped-up actions to better protect US computer systems. “More has to be done,” Mr King said.

Senator Lindsey Graham of South Carolina, a Republican presidential candidate, said Congress should increase funding for cybersecurity.

“People in the intelligence committee are more worried about this than anything else,” Senator Graham said on CNN’s “State of the Union.” A cyberattack could disrupt US financial systems, he said.

The government should encourage companies to enhance their defences, Senator Graham said.

“Incentivise the private sector to harden their infrastructure against the cyber-attack,” he said. “Give them liability protections if they do.”

Bloomberg

ooo

Henry Sapiecha