Mikko Hypponen: Three types of online attack

Prevodilac: Mile Živković Lektor: Tatjana Jevdjic

In the 1980s, in communist Eastern Germany,

1980-ih

u komunističkoj Istočnoj Nemačkoj,

ako ste imali pisaću mašinu,

if you owned a typewriter,

you had to register it with the government.

to ste morali da prijavite kod vlade.

Morali ste da predate

You had to register a sample sheet of text out of the typewriter.

list teksta kao uzorak

sa vaše pisaće mašine.

And this was done so the government could track

Ovo se radilo

kako bi vlada mogla da prati odakle dolazi tekst.

where the text was coming from.

Ako bi našli papir

If they found a paper which had the wrong kind of thought,

sa pogrešnom vrstom misli,

they could track down who created that thought.

mogli su da uđu u trag

onom ko je bio njen tvorac.

Mi na Zapadu

And we in the West

nismo mogli da razumemo kako bi neko mogao da radi ovo,

couldn't understand how anybody would do this,

how much this would restrict freedom of speech.

koliko bi ovo ograničilo slobodu govora.

Mi nikada ne bismo to uradili

We would never do that in our own countries.

u svojim zemljama.

Ali danas u 2011.

But today, in 2011, if you go and buy a color laser printer

ako kupite laserski štampač u boji

from any major laser printer manufacturer

bilo kog većeg proizvođača laserskih štampača

i odštampate stranicu,

and print a page,

ona će imati

that page will end up

having slight yellow dots printed on every single page,

blage žute tačke

na svakoj pojedinačnoj stranici

u šablonu koji stranicu čini jedinstvenom

in a pattern which makes the page unique to you and to your printer.

za vas i vaš štampač.

Ovo se dešava

This is happening to us today.

nama danas.

I niko ne diže prašinu zbog ovoga.

And nobody seems to be making a fuss about it.

Ovo je primer

And this is an example

načina na koji

of the ways our own governments are using technology

naše vlade

koriste tehnologiju

protiv nas, građana.

against us, the citizens.

Ovo je jedan od tri glavna izvora

And this is one of the main three sources of online problems today.

problema na internetu danas.

If we look at what's really happening in the online world,

Ako pogledamo na to šta se zaista dešava u svetu interneta,

we can group the attacks based on the attackers.

napade možemo grupisati na osnovu napadača.

Imamo tri glavne grupe.

We have three main groups.

We have online criminals.

Imamo internet kriminalce.

Like here, we have Mr. Dmitry Golubov,

Kao što je gospodin Dimitri Golubov ovde

from the city of Kiev in Ukraine.

iz grada Kijeva iz Ukrajine.

Motivi internet kriminalaca

And the motives of online criminals are very easy to understand.

su veoma laki za razumeti.

These guys make money.

Ovi ljudi zarađuju novac.

They use online attacks to make lots of money --

Koriste internet napade

da zarade hrpe novca,

and lots and lots of it.

veoma mnogo novca.

We actually have several cases of millionaires online, multimillionaires,

Zapravo imamo nekoliko slučajeva

internet milionera, multimilionera,

koji su novac zaradili svojim napadima.

who made money with their attacks.

Here's Vladimir Tsastsin, from Tartu in Estonia.

Ovde je Vladimir Cacin iz Tartua u Estoniji.

Ovo je Alfred Gonzales.

This is [Albert] Gonzalez.

Ovo je Stiven Vot.

This is Stephen Watt.

Ovo je Bjorn Sundin.

This is Bjorn Sundin.

This is Matthew Anderson, Tariq Al-Daour

Ovo su Metju Anderson, Tarik Al-Daur

and so on and so on.

i tako dalje.

Ovi ljudi

These guys make their fortunes online,

zarađuju bogatstva na internetu,

ali ih zarađuju kroz ilegalne tokove

but they make it through the illegal means

of using things like banking Trojans

korišćenjem stvari poput bankarskih trojanaca

kako bi krali novac sa bankovnih računa

to steal money from our bank accounts while we do online banking,

dok se mi bavimo internet bankarstvom,

ili praćenjem unosa na tastaturi

or with keyloggers

kako bi skupljali podatke o našim kreditnim karticama

to collect our credit card information

while we are doing online shopping from an infected computer.

dok kupujemo preko interneta sa zaraženog kompjutera.

Američka Tajna služba,

The US Secret Service,

pre dva meseca,

two months ago, froze the Swiss bank account

zamrzla je švajcarski bankovni račun

of Mr. Sam Jain right here,

gospodina Sema Džejna ovde

i taj račun je imao 14,9 miliona dolara

and that bank account had 14.9 million US dollars in it

kada je zamrznut.

when it was frozen.

Sam gospodin Džejn je u bekstvu;

Mr. Jain himself is on the loose; nobody knows where he is.

niko ne zna gde je on.

And I claim it's already today

I tvrdim da je već danas

verovatnije da će bilo ko od nas

that it's more likely for any of us to become the victim of a crime online

biti žrtva kriminala na internetu

nego u stvarnom svetu.

than here in the real world.

Veoma je očigledno

And it's very obvious that this is only going to get worse.

da će se stvari samo pogoršavati.

In the future, the majority of crime will be happening online.

Većina zločina će u budućnosti

biti na internetu.

Druga velika grupa napadača

The second major group of attackers that we are watching today

koje posmatramo danas

are not motivated by money.

nije motivisana novcem.

Motiviše ih nešto drugo -

They're motivated by something else --

protesti,

motivated by protests,

mišljenja,

motivated by an opinion,

ismevanje.

motivated by the laughs.

Groups like Anonymous have risen up over the last 12 months

Grupe poput Anonimusa

su porasle u poslednjih 12 meseci

i postale veliki igrač

and have become a major player in the field of online attacks.

na polju internet napada.

To su tri glavna napadača:

So those are the three main attackers:

kriminalci koji to rade zbog novca,

criminals who do it for the money,

haktivisti poput Anonimusa

hacktivists like Anonymous doing it for the protest,

koji to rade iz protesta

but then the last group are nation states --

i poslednja grupa su države,

governments doing the attacks.

vlade koje vrše napade.

A onda vidimo slučajeve

And then we look at cases like what happened in DigiNotar.

poput onog u DigiNotaru.

Ovo je vrhunski primer toga šta se desi

This is a prime example of what happens when governments attack

kada vlade napadnu

against their own citizens.

svoje sopstvene građane.

DigiNotar je autoritet za sertifikate

DigiNotar is a certificate authority from the Netherlands --

iz Holandije -

zapravo bio je.

or actually, it was.

Prošlog leta su

It was running into bankruptcy last fall,

išli ka bankrotu

jer ih je neko hakovao.

because they were hacked into.

Neko je upao

Somebody broke in and they hacked it thoroughly.

i detaljno ih hakovao.

And I asked last week,

Prošle nedelje sam pitao,

na sastanku sa predstavnicima holandske vlade,

in a meeting with Dutch government representatives,

pitao sam jednog od vođa tima

I asked one of the leaders of the team

da li misli da je verovatno

whether he found plausible that people died

da su ljudi umrli

because of the DigiNotar hack.

zbog hakovanja DigiNotara.

Njegov odgovor je bio potvrdan.

And his answer was: yes.

Kako ljudi umiru

So how do people die

kao posledica ovakvog hakovanja?

as the result of a hack like this?

DigiNotar je autoritet za sertifikate.

Well, DigiNotar is a CA.

They sell certificates.

Oni prodaju sertifikate.

What do you do with certificates?

Šta se radi sa sertifikatima?

Well, you need a certificate if you have a website

Sertifikat vam je potreban

ako imate sajt koji ima https,

that has https, SSL encrypted services,

SSL šifrovane servise,

services like Gmail.

servise poput Gmail-a.

Svi mi ili velik deo nas,

Now we all, or a big part of us, use Gmail or one of their competitors,

koristi Gmail ili neki od njegovih suparnika,

ali ovi servisi su naročito popularni

but these services are especially popular in totalitarian states like Iran,

u totalitarnim državama

poput Irana,

where dissidents use foreign services like Gmail

gde disidenti

koriste strane servise poput Gmail-a

because they know they are more trustworthy than the local services

jer znaju da su pouzdaniji od lokalnih

i da su šifrovani preko SSL mreža,

and they are encrypted over SSL connections,

so the local government can't snoop on their discussions.

tako da lokalna vlada ne može da prisluškuje

njihove razgovore.

Ali može, ako hakuje strani autoritet za sertifikate

Except they can,

if they hack into a foreign CA and issue rogue certificates.

i izda lažne sertifikate.

I upravo ovo se desilo

And this is exactly what happened with the case of DigiNotar.

sa slučajem DigiNotar.

A šta sa Arapskim prolećem

What about Arab Spring

i stvarima koje su se dešavale, recimo u Egiptu?

and things that have been happening, for example, in Egypt?

Pa u Egiptu,

Well, in Egypt,

the rioters looted the headquarters of the Egyptian secret police

protestanti su opljačkali štab

egipatske tajne policije

in April 2011,

u aprilu 2011.

i kada su pljačkali zgradu našli su puno papira.

and when they were looting the building, they found lots of papers.

Među ovim papirima

Among those papers was this binder entitled, "FinFisher."

bila je fascikla s imenom "FINFISHER."

Unutar te fascikle bile su beleške

And within that binder were notes from a company based in Germany,

kompanije stacionirane u Nemačkoj

koja je egipatskoj vladi prodala

which had sold to the Egyptian government

komplet alata

a set of tools for intercepting, at a very large scale,

za presretanje -

i to na veoma velikim razmerama -

all the communication of the citizens of the country.

svih komunikacija građana te zemlje.

Ovaj alat su prodali

They had sold this tool for 280,000 euros to the Egyptian government.

egipatskoj vladi za 280 hiljada evra.

Kompanijino sedište je upravo ovde.

The company headquarters are right here.

Tako da vlade Zapada

So Western governments are providing totalitarian governments with tools

daju totalitarnim vladama alate

to do this against their own citizens.

da ovo rade protiv svojih građana.

Ali Zapadne vlade rade isto to i same sebi.

But Western governments are doing it to themselves as well.

Na primer, u Nemačkoj,

For example, in Germany,

samo pre par nedelja,

just a couple of weeks ago, the so-called "State Trojan" was found,

otkriven je takozvani "Državni trojanac",

koji je bio trojanac

which was a Trojan used by German government officials

koji su koristili nemački zvaničnici

to investigate their own citizens.

da istražuju sopstvene građane.

Ako ste osumnjičeni u krivičnom slučaju,

If you are a suspect in a criminal case,

well, it's pretty obvious, your phone will be tapped.

poprilično je očigledno da će vam prisluškivati telefon.

But today, it goes beyond that.

Ali stvari danas idu dalje od toga.

Prisluškivaće vašu internet vezu.

They will tap your Internet connection.

Čak će koristiti alate poput "Državnog trojanca"

They will even use tools like State Trojan

da trojancem zaraze vaš kompjuter,

to infect your computer with a Trojan,

which enables them to watch all your communication,

što im omogućuje

da prate svu vašu komunikaciju,

da prate vašu diskusiju na internetu,

to listen to your online discussions,

da skupljaju vaše šifre.

to collect your passwords.

Now, when we think deeper about things like these,

Kada dublje razmislimo

o ovakvim stvarima,

očigledan odgovor ljudi trebalo bi da bude:

the obvious response from people should be,

"U redu, to zvuči loše,

"OK, well, that sounds bad, but that doesn't really affect me,

ali to me baš i ne pogađa jer sam legalan građanin.

because I'm a legal citizen.

Zašto bih brinuo?

Why should I worry? Because I have nothing to hide."

Nemam ništa da krijem."

Ovo je argument

And this is an argument which doesn't make sense.

koji nema smisla.

Privatnost se podrazumeva.

Privacy is implied.

O privatnosti se ne može diskutovati.

Privacy is not up for discussion.

This is not a question

Ovo nije pitanje

between privacy

privatnosti

naspram bezbednosti.

against security.

It's a question of freedom

To je pitanje slobode

naspram kontrole.

against control.

Iako možda verujemo svojim vladama

And while we might trust our governments right now, right here in 2011,

sada u 2011.,

any rights we give away will be given away for good.

svako pravo kojeg se odreknemo biće zauvek oduzeto.

Da li verujemo, da li slepo verujemo

And do we trust, do we blindly trust, any future government,

bilo kojoj budućoj vladi,

vladi koju ćemo možda imati

a government we might have 50 years from now?

za 50 godina?

Ovo su pitanja

And these are the questions

o kojima moramo da brinemo sledećih 50 godina.

that we have to worry about for the next 50 years.