PayPal CSO calls for AntiSec hunt

PayPal’s chief security officer has called on the industry to reveal the identities of hackers involved in the online Anti Security (AntiSec) movement in order to stop a string of attacks against organisations.

The movement was run by activists, some within the online Anonymous collective, who had banded together with others to attack organisations it accused of corruption and censorship.

Individuals and groups hacked and launched denial of service attacks against US police, defence and intelligence departments, large technology companies and security firms, and dumped troves of sensitive data on public forums.

This had to stop, according to PayPal security chief Michael Barrett.

“I believe it’s crucial for all companies to do what they can to try to identify these individuals,” Barrett said. 

“They delude themselves that they are anonymous on the internet. They are not.

"They can be found, and for the continued safety of the internet, we must identify them and have legitimate law enforcement processes appropriately punish them.”

PayPal’s own Electronic Crime and Threat Intelligence Unit, home to a veteran cybercrime investigator and former consultant to the FBI, Scotland Yard and the US Secret Service, had been on the tails of hacktivist groups for years.

The payments giant also has a personal interest in tracking down hacktivist groups. AntiSec hackers had encouraged others to attempt to access PayPal customer accounts using leaked usernames and passwords. Last year, PayPal's blog website was taken offline following a distributed denial of service attack launched by activists angry that the company had frozen a donations account used by whistle blowing website WikiLeaks.

The AntiSec movement had existed for around a decade and was loosely guided by a mission statement to reveal poor security practice and put an end to security exploit disclosure which it said gave ammunition to criminal ‘black hat’ hackers and put consumers in danger.

But that was a false philosophy, according to Barrett.

“While many of them claim to be defending the internet they love, in practice it would seem that they are only hastening its demise. A cynical interpretation would suggest that what most of them desire is actually their ‘fifteen minutes of fame’.”

He disagreed with some commentators who argued the AntiSec movement may be effective in its mission to force organisations to improve poor information security practice.

“Thoughtfully designed industry regulation” like the Payments Card Industry Data Security Standard (PCIDSS) would do a better job, according to Barrett. 

“No one would suggest encouraging improved physical security in the real world by decriminalising breaking and entering and classifying it as a sport; why should the online world be any different?” he said.

The AntiSec movement was brazen. Data stolen during the attacks was typically uploaded to pastebin.org and popular filesharing and BitTorrent websites, and promoted in the relentless stream of Twitter conversations under the AntiSec hashtag.

The most recent high-profile victim of the AntiSec assaults was agricultural giant Monsanto in which 2550 names, addresses phone numbers and email addresses reportedly linked to the company were exposed.

Previous targets included the CIA, Arizona Police department and the beleaguered tech monolith Sony.

Yet for all the bravado of the attacks, Barrett said the participants, typically teenage or young men, were terrified of being arrested.

“They are terrified of being ‘vanned’ (arrested), and if enough of them are, then I believe we’ll start to see a significant reduction in the activities of these groups," he said.

If law enforcement failed to catch the perpetrators, Barrett believed the AntiSec movement would continue unchecked.

In the meantime, the security industry should keep on its toes.

“Security companies and security experts are targets too,” Ron Gula, chief executive of Tenable Network Security said.

“We should not feel that we are ‘above’ being attacked or get some sort of pass for not being a victim just because we're part of the good guy team.

“We all need to collectively watch our backs and realise that if and when we are targeted, it is a serious matter and should not be something that is taken lightly.”

Copyright © SC Magazine, Australia