又現黑客入侵，又見事故遲報
圖片來自維基百科
|
????鑒于近期頻頻發生網絡黑客入侵事件，引發廣泛關注，2011年或許可以稱為“黑客之年”。但問題在于，2012年的網絡完全形勢很可能將更加嚴峻。 ????T惡意軟件專家蒂姆?阿姆斯特朗接受《網絡安全日報》（Security News Daily）采訪時稱，深層次原因在于“許多大型跨國公司的安全意識松懈”，“對于目的明確的團體或個人，一些公司的（安全屏障）已變得微不足道?！?/p> ????最新曝光的這起黑客入侵事件發生在1個多月前，但直至上周四才公諸于眾?；ㄆ旒瘓F(Citigroup)表示，約21萬名客戶(占其北美信用卡持有者的1%)的信息被竊取，這些信息包括信用卡號和電子郵箱等聯系信息。該行表示，其他數據，如社會保障號碼、出生日期、信用卡失效日期以及信用卡驗證碼都安然無恙。 ????花旗沿襲了目前此類事件常見的處理模式，沒有在事件發生的第一時間或是隨后的幾周發布任何警告。這一模式令人憂慮。事實上，如果不是《金融時報》(Financial Times) 上周三晚間曝出這則消息，迫使其不得不表態，花旗可能會繼續保持沉默?；ㄆ煜蛎襟w發布了一份聲明，但截至上周四下午，花旗集團網站，包括其新聞稿一欄，都沒有明確提及黑客入侵事件。 ????無獨有偶，今年4月份PlayStation網絡遭到入侵后，索尼(Sony)也決定延遲一周后再通知客戶；據報道此次入侵是“黑客行動主義者”組織Anonymous所為。3月份，黑客入侵威脅到客戶洛克希德-馬丁航空航天公司(Lockheed Martin)的信息安全。事件曝光后，EMC信息安全部RSA Security上周早些時候提出為數百萬用戶更換新的ID安全令牌。 ????立法委員們對此深感憂慮。美國參議員帕特里克?利奇(民主黨人-佛蒙特州)本周提出了《個人數據隱私和安全法案》(Personal Data Privacy and Security Act)。根據該法案，企業掩蓋數據被盜事件將構成犯罪。該法案同時將建立一個全國統一的黑客事件報告標準，取代目前各州各行其道的做法。 ????很難說近期黑客入侵事件頻現背后有什么特別的原因。部分原因可能是在黑客和信息安保部門間無休止的貓捉老鼠游戲中，黑客目前暫時占據了上風。 ????但毫無疑問，這一系列黑客入侵事件在某種程度上也是一種跟風行為。此次入侵花旗系統的黑客顯然是純罪犯，看中的是經濟利益。而近期其他許多黑客入侵則是所謂的“灰帽”攻擊行為，目的是為了出名、找刺激、炫技，或者僅僅只是為了揭示某一機構的電腦系統是多么不堪一擊。此類攻擊往往公開聲明支持某一事業，比如LulzSec在攻擊PBS網絡服務器時宣稱是為了抗議Frontline對布蘭德利?曼寧/維基解密(Wikileaks)案的報道。顯然，近期其他幾宗黑客入侵案，包括Fox News和索尼的案子，該組織同樣難辭其咎。 ????PlayStation入侵案曝光之后，LulzSec宣稱對數宗針對索尼系統的黑客入侵事件負責。其中最近的一起發生在上周四早間，據報道LulzSec宣稱從Sony Developer Network竊取了54兆的源代碼以及Sony BMG的內部網絡圖。這些數據發布在BT跟蹤服務器網站Pirate Bay上。 ????PlayStation黑客入侵案很可能是這一系列事件的導火索——顯然該公司的系統非常不安全，容易使其成為攻擊目標。 ????但不管如何，可以明確的是，包括私營企業和政府部門在內的各個組織都將加大安全投入，同時在系統遭到入侵時采取更加開誠布公的態度。 |
????Given the number of recent, high-profile network security breaches, it might be tempting to call 2011 the Year of the Hack. The danger is that there's a good chance 2012 might be even worse. ????The underlying reason for this is the "lax security posture of many large-scale global companies," the malware expert Tim Armstrong told Security News Daily. It has, he added, "now become almost trivial for a motivated group or individual to find a way in." ????The latest known hack, which occurred more than a month ago, was announced this morning: Citigroup (C) said information for about 210,000 customers, or 1% of its credit-card holders in North America, was stolen. The information included card numbers and contact information including email addresses. The bank said other data, such as Social Security numbers, birth date, expiration dates and card verification numbers were not compromised. ????In what is becoming a disturbingly familiar pattern, Citi decided not to issue any warnings about the breach when it occurred, or for several weeks following. In fact, it might still be mum if the Financial Times had not broken the story late last night, prompting Citi to confirm it. The company issued a statement to the media, but as of Thursday afternoon, there is no obvious mention on Citigroup's website of the attack, including on its press-release page. ????Likewise, Sony (SNY) decided to wait a week to inform its customers in April when its PlayStation Network was breached, reportedly by the "hacktivist" group Anonymous. Earlier this week, RSA Security, a division of EMC (EMC), offered to replace millions of customer secure ID tokens after it became known that a hack into its system back in March exposed its customer, Lockheed Martin (LMT), to a security breach. ????Lawmakers are becoming frustrated. U.S. Sen. Patrick Leahy (D-Vt.) this week introduced the Personal Data Privacy and Security Act, which would make it a crime for companies to conceal data breaches, and would create a national standard for reporting hacks, replacing the many disparate state laws now in place. ????It's hard to cite any particular reason why there have been so many high-profile hacks recently. Partly, it could be that in the endless cat-and-mouse game between hackers and security teams, the hackers have jumped ahead. ????But it's also no doubt partly trendmongering. The Citi hackers are apparently pure criminals, motivated by financial gain. Many of the other recent hacks are so-called "grey-hat" attacks. That is, they're done for publicity, for thrills, just to show off, or to reveal how bad an organization's computer security is. Often they're ostensibly done in support of a cause, as when LulzSec claimed it hacked PBS's Web servers to protest Frontline's coverage of the Bradley Manning/Wikileaks case. That group is apparently responsible for several other recent hacks as well, including on Fox News and Sony. ????LulzSec has claimed credit for several hacks on Sony's systems in the wake of the PlayStation breach. The latest came just this morning, when the group reportedly claimed to have lifted 54 megabytes of source code from the Sony Developer Network, along with maps of Sony BMG's internal network. The data was posted to Pirate Bay, the Bittorrent tracker site. ????The PlayStation hack likely motivated the subsequent attacks – the company's systems clearly are woefully insecure, making them a tempting target. ????Whatever the motivations though, it seems clear that organizations including private companies and governments going to have to invest more in security, and they're going to have to start being more forthcoming when their systems are breached. |
