FBI hacker spared jail

Joseph Thomas Colon, the government consultant who accessed the FBI’s high-security classified computer network, has been spared jail. The judge in his case ruled that Mr Colon was not a malicious attacker and did not want to harm national security. This meant that a much lighter sentence was possible, even though the case involved unauthorised access to some of the most secret databases and networks in the US. Mr Colon used simple conventional methods in order to crack the FBI network from the inside and claimed he had the tacit approval of his FBI superiors.

“This is not a case of al-Qaeda people trying to sneak into the FBI system”, said Judge Richard J. Leon about the Mr Colon, who used his computer expertise to bypass bureaucratic barriers and obstacles. The IT consultant pleaded guilty to several counts of exceeding authorised access back in March. During the course of the trial it had been revealed that Mr Colon gained access to FBI networks and tens of thousands of employees passwords. He also managed to break into computers within the network, including that of the FBI director. The prosecution did not allege that Mr Colon acted out of malice or for reasons of financial gain, but the former government consultant could still have faced up to 18 months in prison as a result of his actions. Given the sensitive nature of his break-ins the FBI had to spend millions of dollars investigating whether any secret data was leaked.

Estonia arrests first hacker over cyberattacks

A teenage resident of Tallinn has been arrested by Estonian police in connection with a wave of Denial of Service attacks that disrupted the functioning of the country's Internet servers. The attacks were linked to a diplomatic stand-off between Estonia and Russia over the relocation of a Soviet-era war memorial in the Baltic state's capital. Protests from the local Russian minority spilled over from the streets of Tallinn, where one person died and more than 150 were arrested, onto the Internet: official web portals were hacked and access to them blocked.

Following days of disturbances a tense calm has now descended over Tallinn, and Estonian police have now reported their first arrest in connection with the Internet attacks. According to a spokesperson for the prosecutor's office, a 19-year-old of Russian origin has been arrested in Tallinn. The teenager was allegedly involved in posting calls for DoS attacks on Estonian sites and providing IP addresses for official sites that he wanted targeted.

Despite the fact that many attacks may have have come from abroad, Estonia intends to use all means at its disposal to bring those responsible for blocking the country's key Internet portals to justice. This means that this first arrest may certainly not be the last in the Estonian investigation - the authorities are still trying to find the perpetrators, and according to official sources many leads can be traced to Russia. Ivo Kolk, from the Central Criminal Police, said that the main attack routes were traced by his department in cooperation with other state services and private security professionals.

How to Detect a Hacker Attack

Most computer vulnerabilities can be exploited in a variety of ways. Hacker attacks may use a single specific exploit, several exploits at the same time, a misconfiguration in one of the system components or even a backdoor from an earlier attack.

Due to this, detecting hacker attacks is not an easy task, especially for an inexperienced user. This article gives a few basic guidelines to help you figure out either if your machine is under attack or if the security of your system has been compromised. Keep in mind just like with viruses, there is no 100% guarantee you will detect a hacker attack this way. However, there's a good chance that if your system has been hacked, it will display one or more of the following behaviours.

Windows machines:

• Suspiciously high outgoing network traffic. If you are on a dial-up account or using ADSL and notice an unusually high volume of outgoing network (traffic especially when you computer is idle or not necessarily uploading data), then it is possible that your computer has been compromised. Your computer may be being used either to send spam or by a network worm which is replicating and sending copies of itself. For cable connections, this is less relevant - it is quite common to have the same amount of outgoing traffic as incoming traffic even if you are doing nothing more than browsing sites or downloading data from the Internet.
• Increased disk activity or suspicious looking files in the root directories of any drives. After hacking into a system, many hackers run a massive scan for any interesting documents or files containing passwords or logins for bank or epayment accounts such as PayPal. Similarly, some worms search the disk for files containing email addresses to use for propagation. If you notice major disk activity even when the system is idle in conjunction with suspiciously named files in common folders, this may be an indication of a system hack or malware infection.
• Large number of packets which come from a single address being stopped by a personal firewall. After locating a target (eg. a company's IP range or a pool of home cable users) hackers usually run automated probing tools which try to use various exploits to break into the system. If you run a personal firewall (a fundamental element in protecting against hacker attacks) and notice an unusually high number of stopped packets coming from the same address then this is a good indication that your machine is under attack. The good news is that if your personal firewall is reporting these attacks, you are probably safe. However, depending on how many services you expose to the Internet, the personal firewall may fail to protect you against an attack directed at a specific FTP service running on your system which has been made accessible to all. In this case, the solution is to block the offending IP temporarily until the connection attempts stop. Many personal firewalls and IDSs have such a feature built in.
• Your resident antivirus suddenly starts reporting that backdoors or trojans have been detected, even if you have not done anything out of the ordinary. Although hacker attacks can be complex and innovative, many rely on known trojans or backdoors to gain full access to a compromised system. If the resident component of your antivirus is detecting and reporting such malware, this may be an indication that your system can be accessed from outside.

Unix machines:

• Suspiciously named files in the /tmp folder. Many exploits in the Unix world rely on creating temporary files in the /tmp standard folder which are not always deleted after the system hack. The same is true for some worms known to infect Unix systems; they recompile themselves in the /tmp folder and use it as 'home'.
• Modified system binaries such as 'login', 'telnet', 'ftp', 'finger' or more complex daemons, 'sshd', 'ftpd' and the like. After breaking into a system, a hacker usually attempts to secure access by planting a backdoor in one of the daemons with direct access from the Internet, or by modifying standard system utilities which are used to connect to other systems. The modified binaries are usually part of a rootkit and generally, are 'stealthed' against direct simple inspection. In all cases, it is a good idea to maintain a database of checksums for every system utility and periodically verify them with the system offline, in single user mode.
• Modified /etc/passwd, /etc/shadow, or other system files in the /etc folder. Sometimes hacker attacks may add a new user in /etc/passwd which can be remotely logged in a later date. Look for any suspicious usernames in the password file and monitor all additions, especially on a multi-user system.
• Suspicious services added to /etc/services. Opening a backdoor in a Unix system is sometimes a matter of adding two text lines. This is accomplished by modifying /etc/services as well as /etc/ined.conf. Closely monitor these two files for any additions which may indicate a backdoor bound to an unused or suspicious port.