The Hindu Business Line : Hackers on the prowl

As I start writing this column comes news from the US of the indictment of two Indians (from Chennai) and a Malaysian national for breaking into some brokerage accounts, with a view to making illegal profits.

The modus operandus seems simple. The trio would buy a large volume of thinly traded shares using their personal online brokerage accounts. They would, thereafter, hack into the accounts of others using stolen usernames and passwords with a view to buying a large number of the same stocks. This naturally pushed up the prices of what were otherwise nearly junk bonds.

After achieving this artificial spurt in the value of lowly rated stocks, which others would normally not fancy, the trio would quickly sell their holdings, thereby making a huge profit.

First impressions are they operated from outside the US, especially from India and Thailand. There can be no better proof that cyber crime is genuinely international, as are traits of dishonesty and recklessness. The 23-count indictment covers offences of conspiracy, wire and security fraud as also aggravated identity theft. The accused, two of whom have already been arrested and will be extradited soon to the US, are in their early thirties and fit in admirably well with the internationally accepted profile of a hacker. We will have to wait for further details of their educational background, how they operated and how they were tracked down.

Obviously, the Indian and Malaysian authorities were taken into confidence as, without such cooperation, hardly anything can be achieved in a crime that is not only sophisticated but cuts across national boundaries. I would also be curious to know what kind of security was fused into the Web sites that were violated. I know it for certain that in an ambience like the stock market, which survives essentially on quick trade and large volumes, online security receives a low priority.

Growing vulnerability

Two other recent cases, though slightly different from the above, prove the growing vulnerability of cyber space. In the first one, the subject of hacker attack was the Nordea Bank of Sweden. The brain behind this only occasionally used form of hacking is a brilliant Russian programmer who goes by the nick name `The Corpse'. His identity is not known. He writes custom-made programs that help dishonest individuals to steal passwords even while they are typed by a customer through the process of keylogging.

"The Corpse'' is believed to be the author of a virus called Haxdoor Trojan, and the latest attack on the Swedish bank was through a Haxdoor worm variant. A number of Swedish nationals have been arrested following withdrawal of money immediately after the fraud was detected. About 250 customers are known to have been the victims.

Most ironically, "The Corpse", who sells all his programmes through his Web site, exhorts his customer through his advertisements that his products should be used only for educational purposes! The hard fact is that seldom are they employed for such a laudable objective.

What is also striking is that only customers who did not have anti-virus software on their machines were vandalised during the recent adventure. Almost something similar to scooterists refusing to wear helmets and paying the penalty for it. Does not the Nordea Bank attack send a clear message to those who frown on, nay ridicule, some of us who preach security all the time?

The DVD instance

In what was a blow to those in the multi-billion DVD industry, a hacker had claimed last year that he had bypassed the encryption on some high-definition DVDs. The Advanced Access Content System (AACS) Licensing Authority recently admitted that this was true. However it took the stand that the damage was limited to only a few discs, which alone could now be copied. The dare-devil intruder interestingly styles himself `muslix64', and, according to a BBC story, he achieved what was considered impossible by managing to gain access to the encryption keys which pass between certain discs and the player.

Amusingly, muslix64 told the media recently that he was not a dishonest hacker, and that his action, which he labelled "fair use enforcement", was the outcome of frustration. He had bought an HD-DVD movie. After buying it, he found to his chagrin that he could not play it because the DVD did not have the compliant connector insisted upon by the movie industry as part of the copy protection system. In his interview to SLYCK news, he triumphantly explained: If you can play it, you can decrypt it!

There is nothing you can do about it. The only thing they can try is to slow people down. I thought this was some unassailable logic. There is no information as yet as to what legal action the DVD industry is going to take against muslix64.

Prudence possibly demands that they persuade him to brief them on how he managed to break into a system of protection that the former considered impregnable. But then muslix64 may set a price for this!

And finally, there is a lot of folklore about hackers. There are several wild theories, including the one that this school has ceased to be mere pack of adventurers and are looking for money.

If this is valid, how do you account for characters like muslix64? Incidentally, Technology Review recently profiled diverse hackers. The first one was Randall Schwartz, a former system administrator of Intel, who was convicted for trying to crack the password file of the company's Supercomputer Systems Division. In his defence, Randall said he was only trying to prove how poor Intel's security was. Given that he is the celebrated author of a best-selling book, Learning Perl, people are willing to believe he was indeed honest.

Another was Joanna Rutkowska, a researcher with a security firm, who is widely known in Europe for her hacking abilities. She proved at a Black Hat conference in Virginia that if you used an advanced rootkit you could hide almost anything, especially Trojans and hacker backdoors.

And finally, there was the unnamed hacker in France who recently broke into the system used by Presidential candidate Le Pen and exposed the names of all elected officials who had promised to support him. What was the motive? God only knows!

(The writer is a former CBI Director who is currently Adviser (Security) to TCS Ltd.)

More Stories on : Security | Security Musings | Viruses

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
Find your way

Site access problem

`Time to retire Telegraph Act'

Linking the shop floor to the top floor...

Hackers on the prowl

Can't beat `em? Join `em!

The `BSC' of identity

Quiz

A cardinal sin called overconfidence

Cartoon