BreachBytes

Yesterday, my BreachBytes co-author Andy wrote about the rise of organized crime in cybersecurity. It is an interesting and alarming trend that we have been discussing for quite some time at Packet Analytics. I have been watching a few developing stories on another trend in the hacker community: hacktivism. The Register reported yesterday on the RIAA website’s recent defacement problems and on the Church of Scientology’s DOS problems. Just this morning Rueters has a blurb about purported cyberattacks aimed at Panama by US hackers angry with the election of Pedro Miguel Gonzalez as the president of the Panamanian legislature (Gonzalez is a murder suspect in the US).

Reading, research and personal experience has led me to believe that modern hackers (I am not including whitehat hackers here — that’s another post) are motivated in one of three ways:

1. Bragging rights (traditional hackers, script kiddie)
2. Money (organized crime, identity thieves, scammers)
3. Ideology (hacktivists, spies)

Bragging rights has historically been the motivation for most hackers. Hacking started out as a prank and a way to learn new technology through breaking it. It was mostly viewed as harmless fun by those doing it although those on the receiving end never seemed to agree.

A more recent trend in hacker motivation is money. Andy’s post from yesterday does a good job of covering the organized crime aspect of the topic so I will defer to him. I will add that there are plenty of identity thieves and phishers out there that are not affiliated with organized crime.

The most complex modern hacker motivation is ideology. This category is broad and deep including religion, politics and a variety of other causes. The issues and motivations are too many to comment on here but I will say from my personal experiences at Los Alamos National Laboratory that the threats are real.

These three motivations (bragging rights, money and ideology) form the base of modern hacker culture. When evaluating your organization’s security posture it is important to take these into account to identify what is motivating attacks against your network (or employees). Doing so will better prepare you to defend your organization from the threat of hackers.

This entry was posted on Tuesday, January 22nd, 2008 at 9:57 am and is filed under Computer Security, Cybercrime. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.