Oh Noes! The NBN ha5 been hax0red! The police have saved us from “…what could have been Australia’s biggest hacking attack.” Where’s Kent Brockman when you need him? I’ll happily go on TV and say that yes, it is indeed TIME TO PANIC.
Oh wait. No I won’t. Because it isn’t. Or, at least, not about the likes of the alleged attacker.
The specifics of how David Cecil allegedly gained control over some of the systems of Platform Networks have not been made public. But if I had to guess, it was more likely than not an exercise in extreme patience, looking for already-known and publicised weaknesses in the software Platform Networks used, and taking advantage of what I’d call the “moat weakness” of most network security – while the moat may be very well defended, once you’ve crossed the moat, it’s relatively easy to make your way around the castle. But I may be doing a disservice to the perpetrator of the attacks.
In any case, that a sufficiently determined and patient attacker could gain access to parts of NBN infrastructure is not terribly surprising. Furthermore, the NBN project is almost irrelevant to the attack itself; the equivalent infrastructure exists, in a marginally more fragmented form, for our current hodgepodge of data networks.
But self-aggrandizing hackers of this kind represent about as much of a genuine threat as the taggers who compete to place their tags in the most prominent and inaccessible places.
Like taggers, their raison d’etre is simple – to gain the attention of other hackers because of the difficulty of their feat. Along the way, like irresponsible teenagers, they may do damage. But it is not their primary motivation. This does not in any way excuse their actions, any more than it would excuse a tagger who risked his life, and the lives of train passengers, to apply a tag in a particularly appealing spot. But it places the magnitude of the risk in some perspective.
By contrast, the activities of organized, profit-motivated criminals, and spies, seem to attract SFA attention, but it is they who represent by far the greater threat. Not to mention the currently perfectly legal, but increasingly concerning, aggregation (the aggregated data itself representing a hugely attractive target for criminals and spies) and sophisticated analysis of legitimately collected personal data by various large organizations.
But rather than designing our IT systems and focusing law enforcement efforts on these real threats, let’s throw the book at some ego-driven overgrown teenage boys and convince ourselves we’re keeping ourselves safe. It’s the electronic equivalent of the Bear Patrol from that very same Simpsons episode.
Update: Several helpful links in comments. It turns out that while Platform Networks was not yet providing services for the NBN (making the link even more spurious), there are claims that the same individual was responsible for the mass deletion of websites and customer data at a web hosting provider earlier in the year. That’s more in the realm of large-scale vandalism. But I think the wider point still stands – the threat this type of activity poses is relatively small compared to other types of computer crime that get far less attention.
Yep, totally over the top reporting for this kind of thing. Evil I tell you, eeeeeeevil!!!11!! Speaks more about the investigating police than the hacker. “Could have”, “might have”, and “possibly” seems to sum up the crime here rather than any actual harm. Pity that the police hype these things up to make themselves feel important and justify their existence.
In the same vein, some Castlemaine guy in trouble for having stuff that “might” be dangerous. I’d better not cough on anyone or I “might” wipe out mankind!!!!
The authorities are rather more justified in apprehending the chap in Castlemaine. Have you taken a look at the full list of what he was collecting?
There’s been some speculation on Twitter that this is mostly just an AFP publicity exercise. I’d imagine that this sort of thing is not uncommon on existing non NBN wholesaler networks.
tigtog – can you really buy anti personnel mines on ebay? You’d think customs would have something to say about that. I don’t know what chemical shops are like post 9/11, but as a kid I used to have a lot of those sorts of chemicals that are listed for various sciencey types of experiments (home made fireworks/rockets). And pre WWW one of the best sources of information was the university library – its amazing what they published for general public consumption in WWII and the books are still around.
http://www.zdnet.com.au/distributeit-confirms-evil-behind-hack-339319324.htm
“NBN Co has evaluated its systems and controls and can confirm the National Broadband Network was not affected by this incident,” the NBN Co said. “The company said to have been involved is not yet offering services over the NBN.”
Very crude, “brute force”, attack. He was easily tracked down.
Murdoch and ABC are beating this up into a frenzy, something along the lines of “To add to the insulation roof fires catastrophe and the school hall fiasco, the NBN is a complete hackers paradise”.
The Register
http://www.theregister.co.uk/2011/07/27/more_on_the_nbn_hack/
CMMC’s link @4 is what makes the AFP investigation and arrest far more than just a PR exercise. If the allegation that Cecil was responsible for the Distribute.IT attack in June is holds true, then this goes far beyond mere “bragging rights” hacking. The Distribute.IT hack was extremely malicious.
tigtog – Potassium nitrate (Saltpetre), sulphur and charcoal powder. Are these illegal substances? Detonator cord certainly sounds importantly dangerous but could it be the black powder string used in consumer fireworks?
And guess what these evil substances make: black powder as found in crackers, fireworks, old fashioned bullets (not newer ones which have smokeless powder). If ignited in the open, even in large amounts, it produces an exiting fizz and a lot of smoke.
Five kilograms in total is not stockpiling. They used that word to make him sound like a criminal.
As for “antipersonnel mine”. Well, I’m assuming that’s bs till I hear more. (I’m waiting for the big announcement that he had Rambo dvds.) The police just have to destroy his reputation, it’s in their nature.
The real story here is ebay and it invasion of this man’s privacy.
Sorry to sidetrack your thread.
For a technophobe, this is like drinking castor oil, but probably necessary.
I certainly would like to get my claws on the clown who smashed up my FB a while back. I’ve suspected for a long time that Robert’s dismissal of them as superannuated preppies imbibed of the Murdochist philosophy, is very likely. But I understand there is much money to made through the raiding of people’s info and the passing on of it to marketers, corporations and even political cranks.
I know Robert is patiently trying describe it in kindie language for folk like me; I’ll come back for a second look at the esoterica more closely, later.
I too think that customs would have something to say about that. However, if this guy *thought* he could buy anti-personnel mines on e-bay, and tried to, then surely that makes him a person of interest?
If that’s all it turns out to be, I’ll happily agree with you.
What jt said. I was reading the Whirlpool threads, and it was not happy. There were a lot of resellers complaining about the thousands or tens of thousands of dollars lost because their Distribute.IT data was scrubbed beyond repair. Some probably went into receivership. “Evil” is quite an appropriate tag for the hacker.
(Yes, they should have kept backups, and many of them. But that doesn’t make his actions less heinous.)
DA @ 7, 5 kg of gunpowder is quite a lot. To put that into perspective, a blackpowder revolver would typically hold a total of around 10 grammes (depending – I’m generalising a bit here) which, if it all went off at once, would be more than enough to blow your hand off.
Disclaimer: I own and shoot blackpowder revolvers.
David Irving – Do you need a licence for the black powder or only for the firearm?
Agree that you’d stand clear before lighting 5kg of blackpowder but in uncontained it’s not going to blow up your house. Also it’d be more entertaining to light in smaller wrapped amounts like what happens in crackers.
From the black powder shooter: if this guy shoots large calibre black powder fire arms he would get up to 140 shots from 1kg of powder. 13 shots per match and up to 8 matches in a day. So he could go close to a kg of powder in a day’s shooting. If he is a keen shooter he could easily use it up in 2 months. Also, many clubs have one person who buys blackpowder in bulk to save on the freight charges (specialised freight) and shares it out with other club members to recoup their investment.
He might even own a blackpowder cannon…
There are a number of reasons why someone could have that amount of black powder not all of them criminal.
Blackpowder is also a fairly inefficient explosive.
tigtog – Potassium nitrate (Saltpetre), sulphur and charcoal powder – ingredients for black powder. But he is a trainspotter, now that sounds suspicious! /sarcasm
To be clear TT that last comment was aimed at the media/AFP not your lovely self.
I’m starting to get it now.
Hacking is only bad when you sell the info to the Murdochs.
Otherwise it’s just harmless.
Glad thats cleared up.
jt – if he is responsible for the Distribute.IT attack then they should be throwing the book at him because that was very malicious. However they did report on the news that the AFP had been monitoring him for months. And if that attack happened while they were monitoring him that would be a big fail on the AFP’s part so I’m a bit skeptical about that accusation. I haven’t heard it reported that the AFP believe he is responsible for that attack
Presumably if he shoots large calibre blackpowder firearms then he is a registered gun owner under our firearm control laws, a legacy of the Port Arthur tragedy, and the police could and would have looked him up on their databases to check this before raiding him.
Shades of Eric Olthwaite and Gunpowder Plots. I still want to get at whover hacked my FB tho, not much of value yet so much of value.
And what sort of example do the government and FB set, with their own people crawling around looking for ways to censor, also.
If someone sends me a blue joke on FB, I do NOT expect some anonymous coward to demand that I approach FB to have the comment released, because some prig somewhere else might be vaguely offended.
@GregM I would say that they did, they usually do if only to ascertain whether there are likely to be firearms on the property before they go in.
Jumpy, my point is that high-profile vandals are the least of our concerns. It’s the low-profile types for whom hacking is a means to an end that represent a far greater threat.
Bit O/T back in the day we used a hollowed out truck axle, a liberal amount of powder and a drilled fuse access hole, hammered the “splitting gun” into the end of a log, rested a crowbar against it’s end lit a short fuse and watched the log blow apart.
DA upthread, you need a firearms licence (or possibly pyrotechnics licence) to buy gunpowder, in SA at least.
Mindy, some of the blokes I know shoot smoothbore matchlock pistols, and they go through powder very quickly.
I don’t know if I’d care to make the stuff myself (although I did when I was a kid and you could buy saltpetre by the pond – I’m probably lucky to still have all my fingers). Apparently to burn efficiently, it needs to be milled.
Just to get back to the original topic of the great NBN hack. I heard Mike Quigley taking a baseball bat to the claims on the ABC This World Today. Unfortunately I did not hear the whole thing but the poor ABC interviewer who was clearly not interested in providing any enlightenment for the public, kept coming back with “but xxxx says”, Quigley would then comprehensively demolish the claim. In the end she had to resort to that old chestnut for reporters who have run out of ideas “can you guarantee”. Why do they think they are being clever when they ask that? No one can ever really provide open guarantees. Anyone who does is usually lying.
I guess it is the last refuge when all your other allegations have been demolished. Still it would be nice if they took some responsibility to actually inform the public rather than providing theatre through controversy.
@DI(NR) yes in NSW too.
I just read the transcript, Point of Order, and I recall hearing bits of it when I was out at lunch time.
It’s a pity, Eleanor Hall is usually quite reasonable.
Here’s the link:
Irate NBN chief gives media a serve
The headlines saying that the NBN was hacked were wrong, Turnbull was wrong, the NBN wasn’t hacked.