Dan Sneddon's Portfolio

Recent developments in the world of malicious hacking show that combining multiple technologies can lead to big things. The latest craze in combining crowdsourcing with organized cracking has brought the general public in on the effort, rather than making them passive observers.

The attacks from the malicious hacking group Anonymous have grown in both the profile of their targets and the media attention they have garnered. Anonymous even set up web pages where users with zero knowledge or experience in the realm of cracking websites could join in and help with the distributed attacks from their personal computers.

The cracking group LulzSec have been advertising phone numbers for a suggestions line that allows anyone to anonymously suggest their next target. Combined with the recent high-profile cracks that LulzSec have taken credit for, this helps to create a guerilla people vs. establishment air about these activities. This explains part of the hero-worship for LulzSec and Anonymous.

I think we can expect to see more of this as social networking and ubiquitous smart phones make it possible for individuals or groups to harness the computing power in peoples pockets and social networks to overpower security defense systems of companies and governments.

What’s the answer to this emerging threat? Adding bigger firewalls and more draconian security policy does nothing to prevent a large-scale distributed attack on all potentially vulnerable points within an organization’s network. It only takes one weak point for the attack to get further inside, and increasingly attacks are becoming indistinguishable from legitimate business. The real answer is for information security personnel and departments to use the same kind of crowdsourcing approach that the bad guys are using. Employers can help by encouraging their information security departments to share information, engage with professional groups, and develop communities to strengthen the whole field. Governments have learned this lesson in response to traditional terrorism and insurgencies, and it’s time for the same approach to be applied to cyber warfare.