Defending Against Hacktivism

‘Hacktivism’ is a term that describes hacking on behalf of ideals. Wikileaks is one example of hacktivism, made famous by their hacking of US government systems. Anonymous is often referred to as a hacktivist organization. This new hacktivism movement has serious implications for security.

A lot of what I’ve written about in the past has been an explanation of why certain security methods work and why some don’t. Most of that is based on attackers and their motivation – if a target costs more to attack than the payoff it won’t be attacked. In the case of typical hackers and malware developers the goal is simply to make your product too “expensive” to hack.

But defending against hacktivist groups is an entirely different game. These are people who aren’t doing this for profit, they’re doing it because they believe it’s the right thing to do, or because they enjoy it. Trying to apply a cost benefit analysis to hacktivism doesn’t work, because resources are spread out across large groups (millions will join DDoS attacks, or other simple scripted attacks) and the goals are often more important to the hacktivist group than money.

This new motivation is far more powerful than a financial one. In the case of an activist motivated attack financial gain isn’t a factor, therefor the cost is purely based on time. (In reality we’ve seen legal repercussions used as a deterrent as well).

The situation is similar to that of defending against so-called Nation State or Government Funded Malware; attacks like Stuxnet, Duqu, or Flame, all of which originated from the US government. Again, financial gain is not the prime motivator (well, I suppose for the US gov’t it is but I won’t go into politics).

Dealing with Hacktivist and Nation State malware is just about the same, as the motivations are less relevant and it’s all about defending from everything. It calls for a new level of security, one that software currently does not provide for us. Current policies enforced by operating systems are weak and don’t benefit the user much at all, and the only way to achieve true proactive security is to use PaX and Grsecurity for Linux, which is difficult for Desktop Users.  Now, desktop users are not always the target, but as we’ve seen with Flame, DuQu, and Stuxnet they’re often caught in the crosshairs or even used to spread the malware.

Providing truly proactive security to desktop users will take entirely new tools and techniques. Maybe in future blog posts I’ll talk about those techniques, though it would take quite a while to explain. For now we have to rely on PaX and Grsecurity, or if we’re stuck on Windows, locking down the system with unruly policies and various other techniques to secure the system.

Without an explanation of how to defend I suppose this post may seem a bit useless. The point I want to draw attention to is that between Nation State and Hacktivist attacks we are going to continue to see a rise in advanced malware designed for attacking otherwise secure systems, and our current security is too outdated to deal with it.