Thursday August 1, 2002 The Guardian
The war against hackers is entering a new phase. In the UK and the US, behind the walls of usually bland-looking buildings and shielded from wireless hacking by lead-lined walls, the stuff of Hollywood films is being played out across giant plasma screens.
Programmers, often working on behalf of government agencies, track, monitor and frenziedly alter code in a bid to patch up vulnerable and sometimes besieged networks.
Details have emerged about a new technology, dubbed Magic Lantern, that allows the FBI to record keyboard strokes by secretly planting a software spy in a targeted computer. Rumours have also surfaced about a possible deal with a file-sharing network which would allow files to be viewed by the Feds.
The Bureau also has a shadowy position on European Union committees, tussling with the task of developing a single cross-border cyber crime unit.
This ramping up of activity signals a new phase in the long-running battle between hackers and law enforcement agencies. An industry source says BT Ignite is now tracking hackers across its UK and European networks for, among others, both the White House cyber security team and the FBI. Chris McNab, technical director at the London-based Matta Security, says the UK's National Hi-Tech Crime Unit is also embarking on a busy round of partnership building in a bid to tap the superior technical skills of private industry.
Given this flurry of activity, you might be forgiven for thinking that the cyber law enforcement outfits are on the verge of stamping out hacking, cyber crime and cyber terrorism. However, nothing could be further from the truth. In fact, a war is brewing and increasingly irate hackers are the ones being tipped as victors. Hackers are not only incensed at what they see as an outrageous infringement of civil liberties by some of the FBI moves, but are also disparaging about its efforts to counter them.
They are actively gearing up to launch their own attack against the agency, and security industry experts claim the FBI doesn't have a chance of winning.
The reasons for the FBI's offensive are straightforward: the agency is attempting to get a grip on hacking before it reaches overwhelming proportions. Gartner Group, computer industry analysts, estimates that by next year, 20 million people worldwide will be actively hacking. But by admitting to developing technology such as Magic Lantern, the FBI is also antagonising a global and powerful hacking community that does not classify itself as either cyber criminal or cyber terrorist, but views itself as a guardian of internet democracy.
The development of Magic Lantern has caused a storm in the hacking underground. It is deemed unethical, highly dangerous and goes against everything they claim to represent. More surprisingly, this attitude is reflected by some anti-virus vendors, who are also concerned at its implications.
Ironically, in developing Magic Lantern, the FBI sought inspiration from Back Orifice: a trojan that could wreak havoc in Microsoft operating systems. Back Orifice was itself developed by hackers to, as one said, "demonstrate what a total piece of crap Microsoft represents from the security perspective and to publicise the danger of trojans to home users."
"We are being sucked into an Orwellian nightmare," says one US-based hacker who calls himself Oxblood Ruffin. Oxblood, a member of the influential hacking group Hacktivismo, adds: "This [Magic Lantern] is a powerful tool and basically they have initiated a state-sponsored trojaning campaign with no judicial oversight. If you look at what's possible it's very scary. For instance, if there is no smoking gun, a rogue cop could plant a virtual one. It's possible to upload as well as download or browse the contents of a targeted user's machine. So if there are no kiddie porn pictures [on a computer] for instance, they can be uploaded and the doors kicked in five minutes later. No traces either."
Ruffin says the hacking community is coming together to battle the FBI and predicts that even technology vendors will be throwing their own weight in, too. "It's cut a dividing line right through the anti-virus community: it's a hugely divisive issue," he says. He also predicts that when the FBI unleashes its new tools, hackers are going to respond with a ferocity never previously seen. The last time hackers declared war against government, massive denial of service attacks were launched against the White House website, which had to close down for a day. The FBI website also had to shut down for several hours as defences were rebuilt. Several other websites, including the US Senate site, were defaced with diatribes against the FBI. The spark for the action was a series of raids against several hackers belonging to a group known as Global Hell. The coming action will be "10 times" more intense, it is claimed.
But while hackers are incensed with the FBI's moves, they are also dismissive of them. A hacker who uses the handle Pink Reed says: "We have more targeted experience than anyone in this area and the FBI has stolen our idea. They couldn't come in with their own - they don't have the know-how. If a hacker is any good, he will have a wealth of home-grown tools and techniques with which he can do pretty much what he wants. The FBI doesn't have an idea - or a chance."
This attitude reflects the widely held belief among hackers that the people charged with maintaining security are often little more than amateurs. And this is a view also held by experts on the other side of the divide. Chris McNab, a former ethical hacker, says: "Hackers have time, resources and experience. They are experts at finding vulnerabilities and most of the time, the security industry is playing catch up."
Even the FBI's attempts, if true, to break into music, text, image and video files as they are transmitted across networks, look set to land little more than a public relations victory.
McNab adds: "If hackers are going be transmitting anything that might be of use, it's certainly not going to be sent unencrypted.
"They have been using encryption for years and it can take years to unscramble the codes. It's just not feasible." For the FBI to catch the hackers, it must be sure of their identity and intent before they embark on an attack.
Both McNab and Ruffin agree that the FBI does not have the experience or resources to combat hackers, despite working hard to assemble partnerships with private industry over the past two years. For example, it holds daily briefings with Internet Security Services' X-Force. This is a team dedicated to defending its corporate clients from attack, a team that uncovers 150 new attack methods every month. X-Force provides this and other information to the FBI, but the discoveries are inevitably made after the attack.
Ruffin speaks disparagingly about the private industry partnerships the FBI has formed. "A lot of them are highly paid with poor knowl edge: the FBI does not have the best help in the world." McNab says of the UK's National Hi-Tech Crime Unit: "It's a government organisation with government salaries, how is it going to attract the best talent?"
Hackers won't be drawn on when a concerted effort will be made to counter the FBI's strategy, but it is likely to be sparked with the first arrest of a member of the hacking community through the use of Magic Lantern, and attacks are likely to be launched from Cardiff to California.
What must be worrying for the FBI are the hacking tools that they are not aware of. Even inexperienced hackers have access to techniques that are devastatingly destructive. For example, techniques exist that allow programs to be planted on a hacked website. Every user that enters that site will unwittingly run the program, which will lie dormant until 3am. It then automatically uninstalls any firewall around that computer or network, replacing it with malicious code that completely wipes the hard disk.
And the hard facts are that a hacker can break into any computer and - unless they are incompetent - they will remain undetected. Most hackers, when launching an attack, will route the attack through five or six computers that could be scattered around the globe. A favoured option for attacks launched from the UK and the US is to ensure the launch computer is often located some distance away, such as in Korea. Cyber crime units could determine its location as a result of its Internet Protocol (IP) address, but then they would need to speak to the ISP in Korea, send people out to Korea, get a warrant to retrieve the logs and audit recent movements to see if more attacks originated from that computer - and only then move in to make the arrests. And there is a very high chance that the owner of the computer is completely unaware his machine is being used to launch the attack.
The process would need to be repeated for each computer and, if the hacker is experienced, the same computer would never be used again to launch an attack. If the attack was traced to a UK ISP, the whole process and appeals to judiciary would need to be repeated with the very good chance that the targeted computer was a hijacked machine. Given that hackers have millions of computers from which to choose, the efforts of law enforcement are effectively reduced to little more than a hope and a prayer.
Oxblood Ruffin, although keen to stress his law-abiding credentials, says: "There is a lot of arm waving when some one gets caught as though they were the greatest criminal since Professor Moriarty. People who get caught just aren't that good at what they do."
Even the technology used to track hackers in real time has its limitations. While it provides the ability to defend against attacks as they take place, it can only track hackers as they move forward through networks to the point of attack. To snare the hacker, trackers must be absolutely sure about where the attack originates from. And seasoned hackers are notoriously adept at covering their tracks.
Despite the sense of indignation in the hacking community, there is also a feeling of confidence that its best efforts can easily be countered. McNab believes this too and says: "They will get around it." He points out that law enforcement "really does have some problems at the moment in combating hackers, and the bottom line is that nothing can stop a determined hacker."
The danger for the FBI and other cyber crime outfits is that when hackers decide to act, they can hit out - and they can hit out hard.