Storie di un “cacciatore di hacker”: Mikko Hypponen

May 31, 2016 15:10, by Il Disinformatico

Questo articolo vi arriva gratuitamente e senza pubblicità grazie alle donazioni dei lettori. Se vi piace, potete incoraggiarmi a scrivere ancora (anche con un microabbonamento).

Mikko Hypponen, di F-Secure, ha raccontato di recente al Collision di New Orleans alcuni suoi casi di lavoro molto illuminanti: un informatico che si è dato al crimine perché nel suo paese non c’erano sbocchi legali per il suo talento; una vittima di ransomware, che conferma che pagare conviene, purtroppo; un tracciamento del giro di denaro enorme dei ransomware, reso possibile dai bitcoin; la visione del mondo che hanno i paesi dove prospera il crimine informatico semplicemente perché in quei paesi la polizia ha problemi ben più gravi; i pregiudizi sull'uso dei siti d'incontri, che causano danni a persone innocenti; e l'attacco informatico all'Ucraina, vero e proprio esempio di guerra informatica. Mi manca il tempo di tradurre, ma ho preparato una rapida trascrizione che può aiutarvi a seguire l'ottimo inglese di Mikko. Se trovate errori, segnalateli nei commenti. Dopo questi racconti non dormirete tranquilli, ma questa è la realtà informatica che ci circonda.

My name is Mikko and I hunt hackers. Well, actually, I hunt the evil kind of hackers, because there's a lot of different hackers. Some are actually good. We like some hackers, but some we don't. And in this line of work, when you hunt hackers, analyze malware and reverse engineer online attacks, you get to meet different kinds of people. We regularly infiltrate forums in the deep web to figure out what's happening right now in the world of cybercrime organized gangs, and try to figure out what's their next step. So let me tell you a couple of stories about the kind of people that I meet in this line of work.

I regularly meet the attackers themselves, because we work with law enforcement to do investigations, and there was this one guy that I met around two years ago. His name was Sorin [?]; he's from Romania, in Eastern Europe. He lives in a small village maybe a hundred kilometers east from Bucharest, the capital of Romania. And he was running botnets: he was making money online with cybercrime. And his botnets had these keylogger components to steal people's credit card numbers. That's what he was doing. He was stealing people's credit card numbers as they were typing their credit card details on their infected computers while they were doing online shopping. So he was caught, he was charged, sentenced – he's actually right now in jail. But when I met him and I spoke with him I asked him why: why did you choose this career? Why did you go into the life of crime?

Obviously he was smart, he was a programmer, he could have done other things. And he told me that, well, he didn't really see other options. In this tiny village where he was living, you know, there weren't any jobs, there weren't any startups. The easiest way for him to turn his skills into income was to go into the life of crime. And the lesson here is that many of these problems that we're fighting aren't really technical: they are social problems. When you have people with the skills but without the opportunities you end up with problems like cybercrime. And that is a hard problem to fix. It's easy to fix technical problems; it's hard to fix social problems.

Now, I also meet a lot of victims when I work with computer security. And I met this one guy, actually a CEO for a startup in San Francisco, a couple of months ago. And I spoke with him because his company was in a big problem, because one of the employees had become infected with a ransom trojan and that employee's computer, his laptop, had been encrypted by the ransom trojan. Not only that, it had also mounted all the shares that this user could see in their network and encrypted all those, including their Dropbox shares. And ransom trojans make money by locking you out of your data. You get hit by a ransom trojan like Reveton or Cryptowall or Petya[?] and it will encrypt your files and then it will demand a payment in bitcoin from you in order to get your own files back.

And if you actually pay – if you actually pay – the ransom, like this guy did, you will get your files back. These cybercrime gangs that work with ransom trojans practically always deliver. If you pay, you will get your files back. So at least they are honest criminals. And the reason why these gangs are honest, why they deliver, is that these guys need a good reputation. Pretty much any victim for any ransom trojan will first try googling for a solution. Like let's say you get hit with Teslacrypt or Hydracrypt; you will Google for "Teslacrypt help". And when you do that, you will find earlier victims, people who had been infected with the same ransom trojan maybe last week, and they will tell their story: “I got infected, the encryption that they used was too strong, we couldn't figure out any way to decrypt the files, I didn't have backups, so I ended up paying two bitcoins to get my files back, and as soon as I paid they did provide me with a program which did decrypt all my files, I got everything back, they supported me – nice guys, you know, would recommend, five out of five”. So these guys need a good reputation, so that future victims will pay as well.

Now the megatrend that has made ransom trojans one of the biggest headaches, one of biggest problems we have right now, is bitcoin: the fact that now, for the first time, online criminals have a way of getting the payday without us being able to follow the money and catch them. This is the problem. Now that doesn't mean that bitcoin is bad, because bitcoin isn't bad, or any blockchain-based currency, they aren't bad. They're just tools: just like cash is neutral. I mean, we all carry cash in our pockets, but especially criminals love cash, because for example real-world drug trade is done with cash. It's kind of hard to buy cocaine with a credit card – or so I've been told. And exactly for the same purpose online criminals use the online equivalent of cash: bitcoin.

But the most important difference between real-world cash and online cash is that bitcoin can be tracked to an extent. Bitcoin is based on blockchain. Blockchain is a public ledger. And when I say public, I really mean public. So public that anybody – I mean, any of you – can go online today and download the whole bitcoin blockchain, which will include every single transaction that has ever been done with bitcoin. Now you don't see who sent money to who, but you do see the transactions – like how much money, when, and from which wallet to which wallet. And this means that we can actually track the amount of money online criminals are moving: not who they are, but we can see how much they're moving. And it turns out that some of these ransom trojan gangs are making a lot of money.

For example, the Cryptowall gangs bitcoin wallets have had traffic worth more than $300 million over the last two years. Three hundred million dollars. Now if that would be a company instead of a cybercrime gang, that would probably be a unicorn. If you make 300 million in revenue and are very profitable, you probably would be a unicorn company. Cybercrime unicorns: we have cybercrime unicorns. Lesson here is that the money moving in these online cybercrime gangs is surprisingly large. Online organized crime is surprisingly large.

We also regularly work with the cops, and I remember this one meeting I had with law enforcement officers in Brazil, in São Paulo; this small unit of cops working for the central criminal police of São Paulo trying to solve cybercrime cases in Brazil. And São Paulo as a city is one of the hotspots in the world. São Paulo for years, for example, was the capital for banking trojans: they were creating more banking trojans in São Paulo than anywhere else in the world.

So when I met these guys I suppose I was sort of the ignorant European who comes over to tell these people what problems they have, and they really taught me a lesson, because after we chatted for a while and I told them what we see about the kind of crime coming out of their country, one of these cops told me that well, yeah, they get that. They understand that they have a problem. They know that there's lots of cybercrime in there: they understand it. But what I should understand is that São Paulo is also one of the murder capitals of the world. So where exactly should the law enforcement there be putting their limited resources? To fight online crime, which is certainly a problem, or to fight crimes where people actually die? And when you look at it from that point of view it's quite clear where you put your limited resources. And the lesson here is that problems seem different, they seem much smaller when you look at them from far away. But when you get closer the problems look different.

Then last year I met this lady in Australia. She wasn't really a victim of a hack. Not directly. She wasn't hacked herself: she was a victim of a data leak. It turns out that she had an account at Ashley Madison. She had an account at AshleyMadison.com, the cheating website. And as the Ashley Madison database was leaked, publicly published, late last year, her identity, the fact that she was there, became public as well. And of course the word got around: people at the office heard about it, the neighbors heard about it. Very embarrassing, of course. However, the reason why she was on Ashley Madison was not that she was trying to cheat on her husband. Quite the contrary.

A couple of years earlier she had suspected her husband of infidelity. She suspected that he was cheating on her. And she was convinced that he had an account at Ashley Madison, so she actually went to Ashley Madison trying to find him. She registered an account trying to find him, but she never did. Then she forgot all about it, until the neighbors started chatting about how she's a user of Ashley Madison. Now the lesson here is that we really shouldn't be jumping to conclusions.

Now everything around us is more and more running on computers and software. It's not just the computers that we are protecting anymore: it's pretty much the whole infrastructure. And this was very clear when I met this guy who works for a company called Prykarpattya Oblenergo; that's a company in Ukraine, headquartered in Kiev. It's a company which handles the electrical grid for most of Ukraine. And this company was hit with a cyberattack last Christmas Eve's eve, on December 23.

What actually happened on December 23 was that one of the operators realized that his mouse doesn't work. His mouse doesn't work: that's how it started. Maybe it's broken, maybe it's a bad battery, but then the operator realizes that although his mouse didn't work, the cursor was moving on the screen anyway. And this is a bad sign. You can take this to heart: if your mouse doesn't work but it's still moving, you have a problem. And they did have a problem. It turns out that he was locked out from his own workstation: a Windows workstation which was used to operate the actual electrical grid – to actually operate the relays that control the flow of electricity in Ukraine. And he wasn't alone: all the operators in the same room were locked out of their own systems. So they were just bystanding and watching as someone else was using their computers to turn off backup power and then switch off relays, which directly translated into power being cut off in different parts of Ukraine.

It only took the shadow operator half a minute to switch off power for 200,000 people, eventually clicking the relay which controlled the power for the building where the operators were in themselves, so they were left in the darkness.

Now this power outage didn't last forever. Power was recovered within a couple of hours. Not through computers, because the unknown attacker had actually overwritten the firmware on the control equipment. So there was no way to recover: they actually had to physically go and switch the relays on by hand. But that's what they did, and they recovered the power to most of the country within the day. Which was very good, because this was in December, and temperatures can get really freezing in December: you can easily see how this could have turned into something more serious if the power had been out for maybe a week, well, people start dying as temperature start dropping. And at the very same time when this attack was underway, the company was hit with a denial of service attack which overflowed their phone central. Phones were ringing off the hook. Whoever was behind the attack launched a phone denial of service attack at the same time, maybe to disrupt the operations or maybe just to prevent real victims of the power outage from being able to call the power company and report the outage. And all those phone calls which were coming into this company in Ukraine were coming from Russia; they were coming from the area code of Moscow.

Now this is important, because Ukraine and Russia are at war. Russians don't call it a war, but Russia has annexed part of Ukraine and joined it to its own country. With force. I call that a war. So when you have something like this happening between two countries who are at war, well, I think we really should be calling that cyberwar.

Cyberwar is a term that I've never liked, because almost always when it's being used it's being used incorrectly. You know, there's some random denial of service attack somewhere or there's some spying attack somewhere else, maybe done by a nation-state, maybe not; but the headlines will always speak about cyberwar. But most of those cases are not about war: most of those cases are about espionage and spying. And espionage isn't war, and spying isn't war. But what happened on Christmas Eve's eve in Ukraine was something different.

So we are entering a new era. We just got rid of the last arms race, the nuclear arms race, and now it seems we're entering the next arms race, the cyber arms race; and I believe that we've seen only the very beginning of this arms race. It will most likely go on for decades. And that attack was possible because everything around us is being controlled by computers. Every single factory is being run by computers. Every single power plant, every single food processing plant. And we all know that this is extending into our homes with the IOT revolution. You can't imagine a device so small or insignificant that it wouldn't be online. Eventually, everything will be online – your toasters will be online, whether you like it or not, whether it makes any sense or not: your goddamn toasters will be online. Which means they will be a vector for attackers.

Attackers aren't really interested in hacking toasters, but if the toaster will leak your Wi-Fi password they will certainly use that as a way of getting into your home network or into your enterprise network. They are becoming vectors for attackers, and that's why we have to secure them, and that is hard.

The lesson here is that whenever you hear the word "smart" what you should be thinking about is "exploitable". You know: a smart factory, exploitable factory; smart grid, exploitable grid; smart car, smartwatch, smartphone. That's what it means: it's programmable, which means it's exploitable.

But don't get me wrong. I do believe that the Internet is the greatest thing that has happened to mankind during our generations. When there will be history books written about this time, a hundred years from now, the thing that they will highlight as the most important thing is that we were the people that first got online. The Internet was born, and yes - the Internet was born, and when it was born it created problems for us. We no longer have to worry about just criminals who are close to us; we have to worry about criminals who can be anywhere on the planet, but clearly it has brought us more good than bad. So much connectivity, so much business, so much entertainment: clearly more good than bad. And I wish – I hope – that eventually we can say the same thing about the Internet of things as well. I hope it will eventually bring us more good than bad, just like the Internet has brought us more good than bad. Thank you very much.

Nuovo spettacolare atterraggio di SpaceX

May 28, 2016 3:15, by Il Disinformatico

Questo articolo vi arriva gratuitamente e senza pubblicità grazie alle donazioni dei lettori. Se vi piace, potete incoraggiarmi a scrivere ancora (anche con un microabbonamento).

Video completo del lancio (diretta commentata, atterraggio a 29:50):

Altro video completo del lancio (diretta tecnica, rientro inizia a 26:40, atterraggio a 29:50):



Video accelerato del rientro visto dalla telecamera di bordo del primo stadio del Falcon 9: si vedono fasi del rientro mai viste prima.