Security industry gets embarrassing attention from ‘hacktivist’ groups
Published 5:00 am Friday, August 5, 2011
- Jeff Moss, the founder of two conferences on hacking and the security industry, says public humiliation will help “clean up” the industry.
LAS VEGAS — The website of ManTech International, a $2.6 billion computer security company that won a major FBI contract, hawks its services this way:
“Whether an intrusion is conducted by a skilled outsider with criminal intent, an adolescent hacker seeking a thrill or a disgruntled employee bent on revenge or espionage, the potential risks to the organization are enormous.”
Last Friday, ManTech was that organization.
A band of Internet vigilantes calling itself Anonymous said it sneaked into ManTech’s computers to demonstrate the company’s insecurity. The group released what it said were internal company documents and, in language that suggested the handiwork of an adolescent hacker seeking a thrill, taunted the company online: “It’s really good to know that you guys are taking care of protecting the United States from so-called cyber threats.”
ManTech is in good company. In recent months, several security firms and consultants have been hit by the very intruders they are hired to keep at bay.
Think of these companies as the new Pinkertons — instead of taking on 19th-century outlaws in the Wild West, they are hired today to protect corporate and government data, including the most delicate intelligence information, across a vast virtual frontier.
The string of embarrassing attacks on them demonstrates how vulnerable everyone is online, including those who are paid to be the protectors.
Many technology professionals who have long warned about such security risks, say so-called hacktivist groups like Anonymous, which publicize their attacks to make a point, are the least worrisome of the many potential intruders out there.
“With the rise of hacktivism, now the people who break into you tell you they break into you,” said Jeff Moss, founder of the Black Hat conference, which drew nearly 6,500 technologists, largely security professionals, to Las Vegas this week. “A little bit of public humiliation is going to go a long way in helping the security industry clean up.”
Other times, the attackers are mysterious and more worrying entities, as in the case of the still unknown organization that in March breached the systems of RSA, whose electronic security tokens are used across many industries.
RSA’s parent company, EMC, has said that replacing tokens and cleaning up the mess has cost it roughly $90 million so far this year.
Hackers used information obtained in the RSA attack to break into Lockheed Martin, the largest defense contractor in the country.
On Wednesday, the security company McAfee said it had uncovered a campaign of computer break-ins at 72 organizations and companies worldwide. McAfee called it the handiwork of a nation-state intent on acquiring, among other things, U.S. military designs. Defense contractors in the United States were a disproportionately large share of the companies targeted — 12 in all.
‘A wake-up call’
Anonymous, for its part, has made it plain that it goes after defense and intelligence contractors to expose their security vulnerabilities, not for financial or strategic gain. Booz Allen Hamilton, a $5.6 billion company based in McLean, Va., that does cyber security work for the Department of Defense, was hit by the group in early July; the hackers released the email addresses of 90,000 military personnel.
The most notorious breach of a security company came early this year after an executive at HBGary Federal, a relatively small consultant eyeing a government contract, boasted publicly of his ability to unmask the members of Anonymous. In response, hackers made off with a vast trove of the company’s email messages and dumped them online, exposing details of its business transactions.
Greg Hoglund, who is the chief executive of HBGary, the parent company that owns a minority stake in HBGary Federal, said that the breach was the result of “a human mistake” and that his firm, along with other security companies, had fortified their systems since then.
“It was a wake-up call for the entire security industry,” Hoglund said. “It probably needed to happen. I wish I didn’t have to be the sacrificial lamb.”