Don't underestimate cyber terrorism threat, security experts say
by Lucian Constanti, m.infoworld.comMarch 2nd 2012
Terrorists currently use the Internet for communication, but some of them also have knowledge of hacking
Concern about cyber terrorism was evident this week among security experts at the RSA security conference in San Francisco, who find that some people with extremist views have the technical knowledge that could be used to hack into systems.
Cyber terrorism does not exist currently in a serious form, but some individuals with extremist views have displayed a significant level of knowledge of hacking, so the threat shouldn't be underestimated, said F-Secure's chief research officer Mikko Hypponen on Thursday at the RSA security conference in San Francisco .
[ Master your security with InfoWorld's interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
Other security experts agree. "I think it's something that we should be concerned about. I wouldn't be surprised if 2012 is the year when we start seeing more cyber terrorism," said Mike Geide, a senior security analyst at security vendor Zscaler.
Extremists commonly use the Internet to communicate, spread their message, recruit new members and even launder money in some cases, Hypponen said during a presentation about cyber terrorism at the conference.
Based on the data Hypponen analyzed, most groups of radical Islamists, Chechen terrorists or white supremacists seem at this stage more concerned about protecting their communications and hiding incriminating evidence on their computers.
They've even built their own file and email encryption tools to serve this goal and they use strong algorithms that cannot be cracked, Hypponen said. However, there are some extremists out there that possess advanced knowledge of hacking, and they are trying to share it with others, he added.
The researcher has seen members of extremist forums publish guides on how to use penetration testing and computer forensics tools like Metasploit, BackTrack Linux or Maltego. "I don't think they're using these for penetration testing though," Hypponen said.
Others have posted guides on website vulnerability scanning, SQL injection techniques, and on using Google search hacks to find leaked data and more, he said.
Although such extremists have mainly succeeded in unsophisticated Web defacements so far, Hypponen believes that cyber terrorists could become the fourth group of Internet attackers after financially-motivated hackers, hacktivists and nation states engaging in cyber espionage.
SCADA systems used in industrial facilities could represent a target for cyber terrorist attacks. "If you're talking about terrorism in the real world where you want to blow up a dam or do some destruction, you can potentially do that remotely through a cyber attack," Geide said. The technology required to do this already exists, he said.
The closest we've gotten to a real cyber terrorist attack was the DigiNotar breach which resulted in rogue digital certificates being issued for high-profile domain names, said Richard Moulds, vice president of strategy and product marketing at French defense contractor Thales.
The Iranian hacker who took credit for the breach claimed that he had no affiliation to the Iranian government, but he did express pro-government political views in his statements.
With Iran currently under the spotlight because of its controversial nuclear energy program, it will be interesting to see how the country's hackers react, Geide said.
Original Page: http://m.infoworld.com/d/security/dont-underestimate-cyber-terrorism-threat-security-experts-say-187811
Shared from Read It Later
No comments:
Post a Comment