Surveys suggest hacktivist groups like Anonymous and LulzSec have managed to grab the attention of businesses around the world, although it's still not clear what lies in their game plan beyond keeping IT administrators as anxious as possible. Some are advocating a "stand your cyber ground" approach that tweaks self-defence principles to encourage companies to fight hackers with hacks of their own, while The Pirate Bay took the opposite approach by coming out against a recent DDoS attack on British ISP Virgin Media. Recognising two sides to this story, some observers were debating the role that government should play in helping private companies bolster their cyber-attack defences; prominent Australian academic Bill Caelli said the whole discussion was proceeding far too slowly.
Proceeding less slowly was AusCERT, the security industry's major Australasian conference. Themed Security on the Move, the conference (see our Day 1 coverage, Day 2 coverage and pictures, as well as exhibition pictures) drew out a broad range of opinions, with some attendees wondering whether security was growing up at last. A delegate from Stratsec said intrusion detection systems are "needy and noisy" while a US Army Cyber Command attorney said the organisation had never even seen a real cyber-attack. Researchers touted their success in a planned test of quantum cryptography over a 500km link in the US, while others said organisations "can survive" a hacktivist attack but weren't so sure about Android security – particularly after one security player demonstrated an Android-based spying application. Other speakers warned that security attack vectors were going to continue multiplying faster than defences could keep up, with mobile devices proving to be the favourite of modern-minded hackers. Russian Android hackers are apparently building their Android attacking skills, while the iPhone and iPad are gaining favour with others. Cyber spies, never deterred, are also exploiting flaws in Java and Flash.
AusCERT speakers were also taking a broader view, noting that Facebook has become a favourite tool in human trafficking and considering the potential for state-sponsored cyber war to undermine existing trust models online. Cyber-attacks could "take us back to the pre-electric era", Kaspersky Labs founder Eugene Kaspersky warned.
Microsoft's Swedish operation was taking a novel approach, with a new educational campaign encouraging spammers to retrain as direct marketers. Telcos also need to do some educating as they work to regain customers' trust, some executives warned, while security firm Kaspersky was forced to do its own trust-building as it quashed rumours Apple had asked it to help bolster Mac OS X's security defences.
Things were busy on the malware scene, with a new form of malware accusing the user of copyright infringement, then locking their computer and demanding payment to unlock it. Tatanga, another financially-focused malware, tricked users by claiming to offer free credit card fraud insurance. Another piece of ransomware was targeting North American users, while a false alarm generated by Symantec security software had Excel users wrongly worried they had been hit with an exploit.
Meanwhile, a security analyst said more than 10,000 Australian computers had been hit by the Windows-based Ramnit botnet, while another warned that a new virus hitting Australian computers would disable "most" antivirus software. Wikipedia warned users that some were seeing advertisements because they had been infected by browser-based malware. Nascent US telco Voyager postponed its mobile service launch after claiming its website had been downed by a malicious attack.
Amnesty International's website was compromised and used to load malware onto visitors' computers, while a separate hack saw $90,000 in bitcoins stolen and yet another one – a variant of the Zeus Trojan – was tricking Facebook and Web mail users into giving up their card details. Others were warned of booby-trapped RTF files and a cyber-espionage attack based in China, which has apparently compromised the systems of 22 government and private-sector organisations in the US, Europe, and Asia.
The continuing emergence of new malware has proved difficult for security platforms over the past six months, CSO-Enex Test Labs' eThreatz testing revealed as particularly busy months for malware saw even top-ranked detection tools missing some beats. That's little solace for organisations like the University of North Carolina Charlotte in the US, which admitted that a decade-long data breach had exposed more than 350,000 personal identifiers. But it's not alone in facing down potential security risks: a survey found that 9 out of 10 executives and employees are using their personal smartphones and tablets for business – and about half are doing so without their employers' permission. With many hackers focusing on small businesses because enterprises require too much work to attack, this could be a double whammy for mobile device-using SMBs.
No wonder security is such a downer for many – and why so many are fighting to preserve rights in today's online world. Twitter joined the cause of privacy by resisting efforts to force it to turn over details on a user associated with the Occupy Wall Street protests, while others expressed concern over the US Federal Bureau of Investigation's efforts to secure the right to demand 'backdoor' access to Skype, instant messaging and email systems.
Yet, some governments are as keen to protect privacy as violate it: California legislators passed a bill preventing employers from demanding job applicants' Facebook and other social-networking passwords as part of their applications. One IT lawyer was arguing that concerns over the US Patriot Act were overblown, while Victoria's privacy commissioner said his office was dead serious about privacy and would not hesitate to prosecute Australian companies whose use of offshore cloud providers ends up compromising Australians' personal information.