PayPal’s chief security officer has called on the industry to reveal the identities of hackers involved in the online Anti Security (AntiSec) movement in order to stop a string of attacks against organisations.
The movement was run by activists, some within the online Anonymous collective, who had banded together with others to attack organisations it accused of corruption and censorship.
Individuals and groups hacked and launched denial of service attacks against US police, defence and intelligence departments, large technology companies and security firms, and dumped troves of sensitive data on public forums.
This had to stop, according to PayPal security chief Michael Barrett.
“I believe it’s crucial for all companies to do what they can to try to identify these individuals,” Barrett said.
“They delude themselves that they are anonymous on the internet. They are not.
„They can be found, and for the continued safety of the internet, we must identify them and have legitimate law enforcement processes appropriately punish them.”
PayPal’s own Electronic Crime and Threat Intelligence Unit, home to a veteran cybercrime investigator and former consultant to the FBI, Scotland Yard and the US Secret Service, had been on the tails of hacktivist groups for years.
The payments giant also has a personal interest in tracking down hacktivist groups. AntiSec hackers had encouraged others to attempt to access PayPal customer accounts using leaked usernames and passwords. Last year, PayPal’s blog website was taken offline following a distributed denial of service attack launched by activists angry that the company had frozen a donations account used by whistle blowing website WikiLeaks.
The AntiSec movement had existed for around a decade and was loosely guided by a mission statement to reveal poor security practice and put an end to security exploit disclosure which it said gave ammunition to criminal ‘black hat’ hackers and put consumers in danger.
But that was a false philosophy, according to Barrett.
“While many of them claim to be defending the internet they love, in practice it would seem that they are only hastening its demise. A cynical interpretation would suggest that what most of them desire is actually their ‘fifteen minutes of fame’.”
He disagreed with some commentators who argued the AntiSec movement may be effective in its mission to force organisations to improve poor information security practice.
“Thoughtfully designed industry regulation” like the Payments Card Industry Data Security Standard (PCIDSS) would do a better job, according to Barrett.
“No one would suggest encouraging improved physical security in the real world by decriminalising breaking and entering and classifying it as a sport; why should the online world be any different?” he said.
The AntiSec movement was brazen. Data stolen during the attacks was typically uploaded to pastebin.org and popular filesharing and BitTorrent websites, and promoted in the relentless stream of Twitter conversations under the AntiSec hashtag.
The most recent high-profile victim of the AntiSec assaults was agricultural giant Monsanto in which 2550 names, addresses phone numbers and email addresses reportedly linked to the company were exposed.
Previous targets included the CIA, Arizona Police department and the beleaguered tech monolith Sony.
Yet for all the bravado of the attacks, Barrett said the participants, typically teenage or young men, were terrified of being arrested.
“They are terrified of being ‘vanned’ (arrested), and if enough of them are, then I believe we’ll start to see a significant reduction in the activities of these groups,“ he said.
If law enforcement failed to catch the perpetrators, Barrett believed the AntiSec movement would continue unchecked.
In the meantime, the security industry should keep on its toes.
“Security companies and security experts are targets too,” Ron Gula, chief executive of Tenable Network Security said.
“We should not feel that we are ‘above’ being attacked or get some sort of pass for not being a victim just because we’re part of the good guy team.
“We all need to collectively watch our backs and realise that if and when we are targeted, it is a serious matter and should not be something that is taken lightly.” SCMAGAZINE
FEAR OF WHAT DOING THE CITIZENS
wrong if we are arrested more will show up ! Its time for big corrupt organizations to face it! We are here to stay and we are not going any where! Either you are on the ship or you walk the plank! Arrest enough of us and Anti-Violence will not be something in our vocabulary anymore! Face it the Revolution has started and people are awaking! The only way to stop us is to kill the world which I know you would have no problem doing. But like I said we are not going anywhere we are HERE to STAY! Have a nice day! 🙂 -by 0rаиg3_Jasmiи3
This guy is goating them on for a free security audit. Half of what he said in the article was complete BS. Go F&%K yourself Barrett. -by M Rousseau
What an oldschool method of looking at Anonymous. They are a decentralized group and as such, cannot be stopped by such crude methods. For every person you „van“, 5 more will spring up to take their place. Such bold statements by PayPal simply puts them in the sights of Anonymous. Enjoy the DDOS, fools. You should have just kept your heads down and hope to be bypassed by the shitstorm that’s come to the ’net. Idiot. -by Catzman
Some specified Information be supposed to initiate panic!