Web vandalism is on the rise around the world, underscoring the shoddy
state of affairs in IT security, according to the owner of a Web site that
tracks such information.
In the past two weeks, Zone-H.org
proprietor Roberto Preatoni said defacements have increased to more than
500 separate attacks a day and more than 1,500 over weekends. A year ago,
he said, his site got around 30 to 50 defacement notices a day from hackers.
This increasing trend, he said, should put IT managers on notice, because
if crackers (malicious hackers) have access to the Web server controlling
public pages, they likely have access to the entire network.
“There are some defacements not getting to the root level, but most of the
time there is a root privilege access behind the defacement, therefore
everything which is contained in the Web server is at danger,” he said.
A new wave of hackers, drawn both for the appeal of the underground
movement and for political reasons, has cropped up in recent times, giving
every indication more defacements and Web server compromises are
forthcoming. Preatoni predicts the number will rise to 700 defacements a
day before December.
Some of the new hackers are clearly neophytes (called n00bs or script
kiddies), with some computer knowledge and virtually no programming
experience. Consider one of the “tons” of e-mails Preatoni gets on a daily
basis, he said, even though the site only tracks defacements and network
breaches:
“Hay, ma name is Artur and i from poland. I have 15 yers and i want ot
bo a haker, because i vey like it and not only. I need some good programs
or someone who will teach me.
More dangerous are the politically motivated hackers, who break into a
site, take information if they can, and leave a “calling card” in their
wake, in the form of a diatribe against governments.
Last year, a crew calling themselves PHC claimed they had hacked into the
Indian government’s nuclear power plant network and stole the plans for
India’s atomic energy consumption rates for the next 10 years. They further
claimed they passed it on to an organization called the Al Qaida Alliance,
which has since “officially” disbanded (the group was made up of many
pro-Palestinian and pro-Al Qaida hacking groups).
Most of the time, however, defacements are seen as little more than
vandalism, with the hackers leaving their mark on the defaced site, like
“You’ve been owned,” or their political agenda. In August, the Recording
Industry Association of America (RIAA) was subject to a high-profile
defacement, which drew a lot of public attention.
Whether these hackers are politically motivated or just looking for a
diversion, most of them frequently use known exploits (a.k.a., 0day in
hacker parlance), which target an operating system’s weaknesses. In many
cases, Preatoni said, these exploits can be rendered obsolete with a
security patch and pro-active network administration.
But the factor, he said, keeping most administrators from closing down
their networks from external attack is, for the most part, budget cuts for IT spending.
He also added that it is strange to see SecurityFocus doesn’t see the
threat. Owned by security software developer Symantec, the site also
maintains Bugtraq, a popular e-mail discussion list for security technicians.
Incidentally, the security site was defaced last November indirectly by
hacker “fluffi bunny,” who hacked into the ad agency serving SecurityFocus’ banner ads and inserted his
own with a banner sporting a pink bunny rabbit and the slogan, “You think
you know? You have no idea – security fluffi.”
SecurityFocus also maintains a ThreatCon indicator, which measures the
network “danger” level throughout the world. Currently, that indicator is
at Level 1, which indicates “no discernible (widespread) network incident
activity,” according to the Web site.
Preatoni said he doesn’t know why the ThreatCon indicator says there is no
widespread activity, since his site sees 500 or more defacements a day.
“SecurityFocus needs to wake up,” he said. “They chat about security
status, but we’re hands-on, we see how much of a problem this really is.”
In the past 24 hours, he said, he’s gotten almost 1,500 defacement
notifications and is thinking of expanding his staff of 40 volunteers to 80
in the coming weeks to process all the attacks.
