Friday 27 September 2013

Apple cofounder Steve Wozniak expounds on his hacking shenanigans and online mischief

Chicago -- In his keynote address at a security conference today, Apple co-founder Steve Wozniak admitted he has enjoyed many adventures in hacking often for the sake of pranks on friends and family, especially back in his college days and the early years of working on computers and the Internet.
Steve Wozniak
Credit: REUTERS/Cathal McNaughton
Steve Wozniak
“I like to play jokes,” said the Wozniak jovially as he addressed his audience of thousands of security professionals attending the ASIS Conference in Chicago. The famed inventor at Apple admitted he also had some fun with light-hearted forays into hacking computer and telecommunications networks several decades ago back in his college years and while learning about electronics and computers.
People with imagination in engineering are naturally drawn to the idea of finding ways to bypass security controls as part of the process of discovering how things work, and Wozniak said this was especially true of himself.
“But I never once hacked a computer for real,” he told his audience, meaning his break-ins and intrusions were done in the spirit of exploration, never for profit or malice. One youthful prank involved some experimentation into a shared computer system several where he left nine pages of Polish jokes that were dumped on users.
[NEWS: Ten tech titans and their temper tantrums
MORE WOZ: Wozniak questions long-accepted date of 'Day One' at Apple
OTHER WOZNIAK THOUGHTS: A 5-minute Woz brain dump (AKA, 2013 UC Berkeley commencement address)]
As a young man in college when he read an article about how tone signaling techniques could be used to manipulate telephone networks to set up calls, he said he became intrigued and had to find out more and even try it himself.  He went out and learned more about the exact frequencies and tried them out on the telephone system. “I wanted to explore the network,” he said. It was all a form of “White Hat hacking” he says he did but never for purposes of stealing or avoiding paying bills.
As to his famous partnership with Steve Jobs, Wozniak said the two “became best friends instantly” and they shared a fascination with finding out how networks worked in sometimes unorthodox ways.  
Circumventing the controls placed by authority was sometimes part and parcel of satisfying the enormous drive he had as a budding computer engineer to experiment and grow in knowledge, he points out. Wozniak said he had a friend with the key to the college computing room and he snuck in in the middle of the night to run his computing programs on punch cards. He admitted he also used to sneak into at least one eminent Stanford institution’s lab every Sunday when it was supposed to be closed to find electronics and science manuals so he could learn more. It all just shows you “the brightest people in the world tend of leave their doors unlocked,” Wozniak said.
Wozniak said many of his break-in stunts were often combined with a prank, such as when he guessed his stepson’s password for the Macintosh and made the files he found hard to access, while also scheming with his wife to leave a folder marked “from Mom.” “He was livid,” said Wozniak about the prank.
Wozniak said one of his favorite pranks was coming up with a TV jammer that he secretly used to convince friends their TV sets were malfunctioning, while at the same time instructing them in outlandish ways to “fix” the problems — until he secretly stopped jamming their sets.
All of this youthful exuberance at the time may have occurred “because I was a geek, and had little hope of finding a girlfriend or a wife,” Wozniak says.

Is hacking in self-defence legal?

Matt Keil, senior research analyst with Palo Alto Networks, does not condone cyber retaliation.
In sport, sometimes the best defense is a good offense, but since hacking is considered illegal, organizations under a cyber attack only have defensive options. Or do they? A legal expert says retaliatory hacking might not be illegal in Australia.
The general rule for penetration testers, or hackers who make a crust breaking into others' computers, is don't hack unless you've got consent.
"We can hack when we have permission to do it," says Rob McAdam, chief executive of penetration-testing firm PureHacking.
McAdam says he's been asked twice over 11 years to "hack back". "They were international sources that asked us to help with domestic circumstances, but both times we refused."
Advertisement
"White hat" hacking services that McAdam and others provide help customers mitigate vulnerabilities, such as un-patched software, that "blackhat" or bad hackers could exploit.
"Hack back" on the other hand moves the battle beyond the victim's network to the attacker's turf. The thinking goes that a company could eliminate a competitive technology that was born out of its stolen IP.
Matt Keil, senior research analyst with Palo Alto Networks, previoulsy told IT Pro he did not recommend it.
"I don't think companies should venture down that path. At a government level, this type of probing and poking as been going on for many years. I wouldn't condone attacking other organisations at government or company level," Keil says.
Questions over the legality of cyber retaliation linger for lawmakers in Australia and the US. Supporters say it's a necessary evolution in the fight against malicious hackers who only need to find the weakest point to gain entry. One employee who opens a malware-laden phishing email could be enough.
Earlier this year, a US private commission on intellectual property argued that laws and law-enforcement couldn't keep pace with nimble hackers, and petitioned for legal reform that would permit acts of self-defence if law enforcement support was limited.
Alongside calls in the US for more freedom to hack back, a new breed of security company has emerged promising "active defence". FireEye is one example, but the best-known is CrowdStrike, which promises to identify hackers, reveal their intent and disrupt their intrusion.
"It's less about trying to keep them out and more about being able to hunt them down and limit the damage that they're able to do," CrowdStrike CEO George Kutz told IT Pro recently. "You want to make it really costly for them to get in and you want to be able to identify them very quickly and eradicate them from the network."
While the company has mocked "passive defence", it's also been careful to avoid claiming it actually offers hack back services due to the tough stance the US takes on hacking.
"There isn't much 'hack back' going on in the real world these days," says H.D. Moore, chief researcher at US penetration testing firm Rapid7 and founder of Metasploit, a popular attack toolkit both blackhat and whitehat hackers use for remote intrusion, either to improve or break defences.
"Hack back is illegal as hell in the US, and even if you're military or intelligence, it's illegal until you get approval directly from the executive branch," he adds.
In Europe things are a little looser. "Their perspective is that no one's going to go after them if they're hacking bad guys, so they just sit around and hack Syria all day or Iran" Moore says.
Unlike the US, Australian organisations may have an option to fight back, according to Dr Alana Maurushat, a senior lecturer at the UNSW's Law Faculty, who has contributed to cyber elements of Australia's Model Criminal Code (MCC).
"Depending how it is done, it may not be illegal," Dr. Maurushat tells IT Pro, pointing to a 2001 MCC Officers Committee report, which considered "computerised counter attack against cybernet intruders" could be construed as self-defence.
According to Dr Maurushat's research, hack back is fairly common in Australia. She cites an anonymous survey at the 2009 AusCERT security conference where 20 per cent of the audience said they had used hack back. And since it's already happening, she's advocating legislation that permits it if it meets several conditions such as "sufficient attribution of the source of an attack" and "reasonable, proportionate and necessary" measures that also avoid damage to unintended third-parties.
Those are tricky to meet though. A report last week claimed 32 per cent of targeted attacks in the second quarter of 2013 involved a command and control server located in Australia. Chances are that many of these were actually compromised servers, not willing attackers.
Marcus Carey, a former NSA cryptography expert at the NSA explained the issue to IT Pro.
"When I was at NSA I had a co-worker try to hack back and he was actually hacking an American Oil company that had been compromised."
His rule: don't hack targets outside your network. But he adds: "You should be tracking all enemy activity such as keystrokes and all other traffic. This is where honeypots come into play."
Honeypots are decoy simulated environments designed to lure attackers. Researchers can use to them to study attackers' means and methods, but they do have limits.
"Fully automated simulations of a real network costs a lot and can be rather quickly discovered and blacklisted by the attackers. That is why they are not widely used," Vitaly Kamluk, chief malware analyst at Kaspersky' Lab Russian Global Research & Analysis Team says.
Nonetheless, Carey and McAdam have released honeypot-inspired "active defence" tools that help alert customers to when their information is stolen. Carey's HoneyDocs rigs decoy documents with a 'call back' feature that tells owners when the document has been accessed. McAdam's crawls the web for stolen data.
Another Australian company, Threat Intelligence, has launched a new online product that tracks hackers around the world and sends mobile and email alerts to users of its Threat Analytics about attacks against their websites before they begin. It includes hacker profiles and the types of attacks they usually perform.
"We are experiencing a shift in the global threat environment. To prevent falling behind and falling victim to a security breach, organisations need to mature their thinking beyond traditional security controls and into the era of threat management," says Ty Miller, Threat Intelligence founder and CEO. 
McAdams says clients are better informed.
"Where we do find a piece of information, we hand to the client [who] hands it over to the police and they go do their job. That's a completely appropriate way to do 'hack back'," says McAdams.
But if you've collected attack data and don't get joy from the cops?
"Your best recourse is to dump it publicly," says Moore. "Just publish it all and say hey guys, we're seeing attacks from this company in China, or Malaysia, or wherever it's going to be, and document it and back it all up. The press is probably the best thing you can do at that point."

Anil Ambani hacking probe reveals more breaches; tax accounts of Dhoni, SRK, Sachin and Salman hacked

Mumbai Police, which is probing the alleged hacking by a CA student into Anil Ambani's e-filing of Income-Tax returns account, has stumbled upon another CA student who not only accessed the top industrialist's account, but also of popular cricketers and film stars including Sachin Tendulkar, M S Dhoni, Shah Rukh Khan and Salman Khan.

According to police, during the probe of the case of a Hyderabad-based young CA student hacking into the IT account of Ambani, it has emerged that the business tycoon's account was also fraudulently accessed from Noida, northern outskirts of Delhi.

"We questioned the girl if she had also accessed the account from Noida for which she replied in negative. She also denied she knew anybody from Noida," said Mukund Pawar, Senior Inspector at Cyber Cell of the crime branch, Thursday.

The 21-year-old woman, who has been doing her chartered accountancy articleship at Manoj Daga & Company in Hyderabad, was booked under relevant sections of Information Technology Act on September 7, police said.

The probe took them to Vishal Kaushal Company, an accountancy firm in Noida, where CA student Sanchit Katiyal (22) was found to have hacked into Ambani's account, he said.

Sanchit, who is doing his articleship, was accordingly booked by the Cyber Crime Cell on September 16 and his computer and hard disks were seized, Pawar added.

Like the Hyderabad based girl, Sanchit had also for curiosity had hacked into Ambani's account on June 26.

The accused first accessed the accounts of Shah Rukh and Salman on June 22, Dhoni's account on June 24 and then broke into Ambani's account.

He again accessed Dhoni's account on June 28, and Sachin's account on July 4.

The modus operandi in both the cases was similar. The two had sent e-mails to the IT department seeking change in the password of the person whose account they planned to hack into. The IT department then did the needful, a procedure that highlights the fragility of the department, says Crime branch.

Using the new password, the duo accessed the accounts of the prominent personalities.

Both the accused are not yet arrested, said another police officer adding that, "the offences were bailable. We have plans to file the charge-sheets at the earliest. And at the time of filing the chargesheets, we would place the duo under arrest."