Mikko Hypponen: Three types of online attack

Prevoditelj: Davorin Jelačić Recezent: Mislav Ante Omazić - EFZG

In the 1980s, in communist Eastern Germany,

Tijekom 1980-tih

u komunističkoj Istočnoj Njemačkoj,

ako ste posjedovali pisaći stroj,

if you owned a typewriter,

you had to register it with the government.

vlada je tražila da ga registrirate.

Morali ste evidentirati

You had to register a sample sheet of text out of the typewriter.

običnu stranicu teksta

koja je izišla iz pisaćeg stroja.

And this was done so the government could track

To se činilo kako bi vlada

mogla pratiti odakle tekstovi potječu.

where the text was coming from.

Ako bi otkrili dokument

If they found a paper which had the wrong kind of thought,

koji je sadržavao pogrešne misli,

they could track down who created that thought.

mogli su ući u trag

onome tko je stvorio tu misao.

Mi na Zapadu

And we in the West

nismo mogli razumjeti kako je netko to mogao,

couldn't understand how anybody would do this,

how much this would restrict freedom of speech.

koliko je to ograničavalo slobodu govora.

Mi nikada ne bismo učinili takvo što

We would never do that in our own countries.

u našim vlastitim zemljama.

Ali danas, 2011.,

But today, in 2011, if you go and buy a color laser printer

ako idete kupiti laserski pisač u boji

from any major laser printer manufacturer

bilo kojeg vodećeg proizvođača

i ispišete stranicu,

and print a page,

taj će ispis imati

that page will end up

having slight yellow dots printed on every single page,

diskretne žute točkice

ispisane na baš svakoj stranici,

s obrascem koji tu stranicu čini jedinstvenom

in a pattern which makes the page unique to you and to your printer.

u odnosu na Vas i Vaš pisač.

To se događa

This is happening to us today.

nama danas.

I čini se da nitko ne pravi problem oko toga.

And nobody seems to be making a fuss about it.

To je primjer

And this is an example

načina

of the ways our own governments are using technology

na koje naše vlade

rabe tehnologiju

protiv nas, građana.

against us, the citizens.

I to je jedan od tri glavna izvora

And this is one of the main three sources of online problems today.

problema na mreži danas.

If we look at what's really happening in the online world,

Ako pogledamo što se doista događa na Internetu,

we can group the attacks based on the attackers.

možemo klasificirati napade prema napadačima.

Imamo tri glavne skupine.

We have three main groups.

We have online criminals.

Imamo mrežne kriminalce.

Like here, we have Mr. Dmitry Golubov,

Ovdje imamo g. Dimitrija Golubova

from the city of Kiev in Ukraine.

iz Kijeva u Ukrajini.

Motive mrežnih kriminalaca

And the motives of online criminals are very easy to understand.

lako je razumjeti.

These guys make money.

Ti tipovi zarađuju novac.

They use online attacks to make lots of money --

Koriste mrežne napade

da zarade puno novca,

and lots and lots of it.

puno, puno novca.

We actually have several cases of millionaires online, multimillionaires,

Imamo i nekoliko slučajeva

mrežnih milijunaša, multimilijunaša,

koji su zaradili svojim napadima.

who made money with their attacks.

Here's Vladimir Tsastsin, from Tartu in Estonia.

Ovo je Vladimir Čačin iz Tartua u Estoniji.

Ovo je Alfred Gonzalez.

This is [Albert] Gonzalez.

Ovo je Stephen Watt.

This is Stephen Watt.

Ovo je Bjorn Sundin.

This is Bjorn Sundin.

This is Matthew Anderson, Tariq Al-Daour

Ovo je Matthew Anderson, Tariq Al-Daour

and so on and so on.

i tako dalje, i tako dalje.

Ti tipovi

These guys make their fortunes online,

zarađuju bogatstvo na mreži,

ali ga zarađuju na nezakonit način

but they make it through the illegal means

of using things like banking Trojans

koristeći bankovne trojance

kako bi krali novac s naših bankovnih računa

to steal money from our bank accounts while we do online banking,

dok mi obavljamo internetsko bankarstvo,

ili pomoću programa za bilježenje pritisnutih tipki

or with keyloggers

kojima prikupljaju podatke o našim kreditnim karticama

to collect our credit card information

while we are doing online shopping from an infected computer.

dok obavljamo internetsku kupnju sa zaraženog računala.

Tajna služba SAD-a

The US Secret Service,

blokirala je prije dva mjeseca

two months ago, froze the Swiss bank account

bankovni račun u Švicarskoj

of Mr. Sam Jain right here,

ovog gospodina, Sama Jaina,

a na tom je računu bilo 14,9 milijuna dolara,

and that bank account had 14.9 million US dollars in it

u trenutku blokade.

when it was frozen.

G. Jain je u bijegu;

Mr. Jain himself is on the loose; nobody knows where he is.

nitko ne zna gdje je.

And I claim it's already today

Tvrdim da je danas već vjerojatnije

da će bilo tko od nas

that it's more likely for any of us to become the victim of a crime online

postati žrtvom mrežnog kriminala

nego žrtvom kriminala u stvarnom svijetu.

than here in the real world.

I sasvim je očito

And it's very obvious that this is only going to get worse.

da će se stvari samo pogoršati.

In the future, the majority of crime will be happening online.

U budućnosti, većina zločina

odvijat će se na Internetu.

Drugu glavnu skupinu napadača

The second major group of attackers that we are watching today

koju danas promatramo

are not motivated by money.

ne motivira novac.

Motivira ih nešto drugo --

They're motivated by something else --

motiviraju ih prosvjedi,

motivated by protests,

mišljenja,

motivated by an opinion,

motivira ih humor.

motivated by the laughs.

Groups like Anonymous have risen up over the last 12 months

Skupine poput Anonymous

ojačale su tijekom posljednjih 12 mjeseci

i postale glavni igrač

and have become a major player in the field of online attacks.

na području mrežnih napada.

To su, dakle, tri glavna napadača:

So those are the three main attackers:

kriminalci koji to čine radi novca,

criminals who do it for the money,

hakerski aktivisti kao Anonymous

hacktivists like Anonymous doing it for the protest,

koji to čine iz bunta,

but then the last group are nation states --

ali posljednja skupina su nacionalne države,

governments doing the attacks.

vlade koje provode napade.

I tada promatramo slučajeve

And then we look at cases like what happened in DigiNotar.

poput slučaja DigiNotar.

Ovo je najbolji primjer onoga što se događa

This is a prime example of what happens when governments attack

kad vlade napadaju

against their own citizens.

svoje vlastite građane.

DigiNotar je tvrtka koja izdaje certifikate,

DigiNotar is a certificate authority from the Netherlands --

iz Nizozemske --

zapravo, bila je.

or actually, it was.

Otišla je u stečaj

It was running into bankruptcy last fall,

prošle jeseni

jer je bila žrtvom hakiranja.

because they were hacked into.

Netko je provalio

Somebody broke in and they hacked it thoroughly.

i temeljito ih hakirao.

And I asked last week,

Upitao sam prošli tjedan,

na sastanku s predstavnicima nizozemske vlade,

in a meeting with Dutch government representatives,

pitao sam jednog od vođa tima

I asked one of the leaders of the team

misli li on da je vjerojatno

whether he found plausible that people died

da je netko poginuo

because of the DigiNotar hack.

kao posljedica hakiranja DigiNotara.

Odgovorio mi je pozitivno.

And his answer was: yes.

Pa kako to ljudi pogibaju

So how do people die

kao posljedica ovakvog hakiranja?

as the result of a hack like this?

DigiNotar je ovlašteni certifikator.

Well, DigiNotar is a CA.

They sell certificates.

Prodaju certifikate.

What do you do with certificates?

Što činimo s certifikatima?

Well, you need a certificate if you have a website

Trebate certifikat

ako imate Internetske stranice koje koriste https,

that has https, SSL encrypted services,

SSL enkripcijski servis,

services like Gmail.

servise poput Gmail-a.

Svi mi, ili velik broj nas,

Now we all, or a big part of us, use Gmail or one of their competitors,

koristimo Gmail ili nekog od konkurenata,

ali su te usluge naročito popularne

but these services are especially popular in totalitarian states like Iran,

u totalitarnim državama

poput Irana,

where dissidents use foreign services like Gmail

gdje disidenti

koriste strane usluge poput Gmail-a

because they know they are more trustworthy than the local services

jer znaju da im više mogu vjerovati nego lokalnim uslugama,

a i šifrirani su pri SSL povezivanju,

and they are encrypted over SSL connections,

so the local government can't snoop on their discussions.

pa lokalne vlade ne mogu njuškati

po njihovim diskusijama.

Odnosno mogu, ako hakiraju stranog certifikatora

Except they can,

if they hack into a foreign CA and issue rogue certificates.

i izdaju lažne certifikate.

I upravo se to dogodilo

And this is exactly what happened with the case of DigiNotar.

u slučaju DigiNotar-a.

A što je s arapskim proljećem

What about Arab Spring

i onime što se događalo, na primjer, u Egiptu?

and things that have been happening, for example, in Egypt?

U Egiptu su

Well, in Egypt,

the rioters looted the headquarters of the Egyptian secret police

pobunjenici opljačkali stožer

egipatske tajne policije

in April 2011,

u travnju 2011.,

i pri pljački su pronašli gomilu dokumenata.

and when they were looting the building, they found lots of papers.

Među tim dokumentima je bio

Among those papers was this binder entitled, "FinFisher."

i fascikl "FINFISHER."

U tom su fasciklu bile bilješke

And within that binder were notes from a company based in Germany,

kompanije sa sjedištem u Njemačkoj

koja je egipatskoj vladi prodala

which had sold to the Egyptian government

kolekciju alata

a set of tools for intercepting, at a very large scale,

za presretanje komunikacija --

na masovnoj osnovi --

all the communication of the citizens of the country.

građana te zemlje.

Prodali su te alate

They had sold this tool for 280,000 euros to the Egyptian government.

egipatskoj vladi za 280.000 eura.

Upravna zgrada te kompanije je baš ovdje.

The company headquarters are right here.

Znači, zapadne vlade

So Western governments are providing totalitarian governments with tools

totalitarnim vladama daju alate

to do this against their own citizens.

koje koriste protiv vlastitih građana.

Ali zapadne vlade isto čine i sebi.

But Western governments are doing it to themselves as well.

Na primjer, u Njemačkoj,

For example, in Germany,

prije samo nekoliko tjedana

just a couple of weeks ago, the so-called "State Trojan" was found,

otkriven je takozvani Scuinst Trojan,

trojanac

which was a Trojan used by German government officials

koji dužnosnici njemačke vlade

to investigate their own citizens.

koriste za istraživanje vlastitih građana.

Ako ste osumnjičeni u kaznenom postupku,

If you are a suspect in a criminal case,

well, it's pretty obvious, your phone will be tapped.

očigledno je da će vam prisluškivati telefon.

Ali danas idu i dalje od toga.

But today, it goes beyond that.

Prisluškivat će vašu Internet vezu.

They will tap your Internet connection.

Koristit će alate poput Scuinst Trojana

They will even use tools like State Trojan

kako bi zarazili vaše računalo trojancem,

to infect your computer with a Trojan,

which enables them to watch all your communication,

što im omogućuje

praćenje svih vaših komunikacija,

slušanje vaših mrežnih diskusija,

to listen to your online discussions,

prikupljanje vaših lozinki.

to collect your passwords.

Now, when we think deeper about things like these,

Kada dublje razmislimo

o ovakvim stvarima,

očit odgovor ljudi bi mogao biti da,

the obvious response from people should be,

"Dobro, to je loše,

"OK, well, that sounds bad, but that doesn't really affect me,

ali to me se ne tiče jer ne kršim zakon.

because I'm a legal citizen.

Zašto da to mene brine?

Why should I worry? Because I have nothing to hide."

Ništa ne skrivam."

A to je argument,

And this is an argument which doesn't make sense.

koji nema smisla.

Privatnost se podrazumijeva.

Privacy is implied.

Privatnost nije predmet diskusije.

Privacy is not up for discussion.

This is not a question

Nije riječ o dilemi

between privacy

između privatnosti

i sigurnosti.

against security.

It's a question of freedom

Riječ je o pitanju slobode

i pitanju kontrole.

against control.

I dok možda vjerujemo našim vladama

And while we might trust our governments right now, right here in 2011,

sada, baš ovdje, 2011.,

any rights we give away will be given away for good.

svako pravo kojega se odreknemo, izgubit ćemo zauvijek.

I zar vjerujemo, zar slijepo vjerujemo,

And do we trust, do we blindly trust, any future government,

svakoj budućoj vladi,

nekoj vladi koja će vladati

a government we might have 50 years from now?

i za 50 godina?

To su pitanja

And these are the questions

o kojima moramo brinuti u sljedećih 50 godina.

that we have to worry about for the next 50 years.