Mikko Hypponen: Three types of online attack

翻译人员: Emma Zhao 校对人员: Felix Chen

In the 1980s, in communist Eastern Germany,

20世纪80年代

在共产主义的东德，

如果你有一台打字机，

if you owned a typewriter,

you had to register it with the government.

你就得去跟政府登记。

你必须登记

You had to register a sample sheet of text out of the typewriter.

出自那台打字机的

一份文本的样本。

And this was done so the government could track

这样做后，

政府就能跟踪文本出自何方。

where the text was coming from.

如果他们发现一张纸上

If they found a paper which had the wrong kind of thought,

写着错误的观点，

they could track down who created that thought.

他们就能跟踪

是谁产生这样的观点。

而在西方

And we in the West

我们不能理解有人怎么能做这种事，

couldn't understand how anybody would do this,

how much this would restrict freedom of speech.

这将会多么限制言论自由啊。

我们永远不会在我们自己的国家

We would never do that in our own countries.

里这样做。

可是，2011年的今天，

But today, in 2011, if you go and buy a color laser printer

如果你从任何一家大型的激光打印机厂商

from any major laser printer manufacturer

买一台彩色激光打印机

打印出一页，

and print a page,

这页纸最后

that page will end up

having slight yellow dots printed on every single page,

会有一些小黄点

印在每一页上

图案让这页纸是独特

in a pattern which makes the page unique to you and to your printer.

对你和你的打印机都是。

这就是今天

This is happening to us today.

发生在我们身上的。

似乎没有人为此大惊小怪。

And nobody seems to be making a fuss about it.

这是个

And this is an example

展示

of the ways our own governments are using technology

我们的政府

使用科技

来对付我们这些公民们的例子。

against us, the citizens.

这是今天网络问题的

And this is one of the main three sources of online problems today.

三大来源之一。

If we look at what's really happening in the online world,

如果我们看一下在线世界到底发生了什么，

we can group the attacks based on the attackers.

我们根据攻击者来分组。

我们有三个主要的组。

We have three main groups.

We have online criminals.

我们有在线罪犯。

Like here, we have Mr. Dmitry Golubov,

这里，我们有位德米特里 戈卢博夫（Dimitry Golubov）先生

from the city of Kiev in Ukraine.

来自乌克兰的基辅市。

在线罪犯的动机

And the motives of online criminals are very easy to understand.

非常容易理解。

These guys make money.

这些家伙为了赚钱。

They use online attacks to make lots of money --

他们通过在线攻击

赚很多钱，

and lots and lots of it.

很多很多钱。

We actually have several cases of millionaires online, multimillionaires,

我们实际上有好几个案子

都是在线百万富翁，千万富翁，

都是通过在线攻击赚的。

who made money with their attacks.

Here's Vladimir Tsastsin, from Tartu in Estonia.

这里还有来自爱沙尼亚的塔尔图的弗拉基米尔·莎斯森。

这位是阿尔弗雷德·冈萨雷斯（Alfred Gonzalez）。

This is [Albert] Gonzalez.

这是斯蒂芬·瓦特 （Stephen Watt）

This is Stephen Watt.

这是比昂·松丁（Bjorn Sundin）

This is Bjorn Sundin.

This is Matthew Anderson, Tariq Al-Daour

这是马修·安德森（ Matthew Anderson），塔利克·阿尔杜（Tariq Al-Daour）

and so on and so on.

等等等等。

这些人

These guys make their fortunes online,

在线挣了很多钱，

但他们挣的钱是非法的

but they make it through the illegal means

of using things like banking Trojans

通过使用类似银行木马

从我们账户偷钱

to steal money from our bank accounts while we do online banking,

当我们在网上进行银行业务，

或者使用键盘记录

or with keyloggers

来收集我们的信用卡信息

to collect our credit card information

while we are doing online shopping from an infected computer.

当我们通过被感染的电脑来在线购物的时候。

美国情报局，

The US Secret Service,

两个月前，

two months ago, froze the Swiss bank account

冻结了萨姆 杰恩先生

of Mr. Sam Jain right here,

在瑞士的银行账户，

那个账户冻结的时候

and that bank account had 14.9 million US dollars in it

帐上有一千四百九十万美金。

when it was frozen.

杰恩先生本人仍逍遥法外；

Mr. Jain himself is on the loose; nobody knows where he is.

没人知道他在哪。

And I claim it's already today

今天我断言

我们当中的任何一位都有可能

that it's more likely for any of us to become the victim of a crime online

成为在线犯罪的受害者

甚至超越现实世界。

than here in the real world.

而且很显然

And it's very obvious that this is only going to get worse.

这种情况越来越糟。

In the future, the majority of crime will be happening online.

将来，大多数的犯罪

会发生在线上。

第二类主要的攻击集团

The second major group of attackers that we are watching today

我们今天观察的

are not motivated by money.

不是出于金钱。

他们的动机源于别处 --

They're motivated by something else --

出于抗议，

motivated by protests,

出于发表意见，

motivated by an opinion,

出于被嘲笑过。

motivated by the laughs.

Groups like Anonymous have risen up over the last 12 months

这些匿名集团

在过去的12个月中很活跃

并且变成了在线攻击领域的

and have become a major player in the field of online attacks.

主要的参与者

这些就是三组主要的攻击者：

So those are the three main attackers:

为了钱的罪犯，

criminals who do it for the money,

匿名的攻击活跃者

hacktivists like Anonymous doing it for the protest,

为了抗议而作的，

but then the last group are nation states --

而最后一组是民族国家，

governments doing the attacks.

政府在攻击。

我们看一下例子

And then we look at cases like what happened in DigiNotar.

就像DigiNotar公司发生的。

这是政府攻击的

This is a prime example of what happens when governments attack

典型例子

against their own citizens.

来反对自己的民众。

DigiNotar是荷兰的

DigiNotar is a certificate authority from the Netherlands --

一个权威证书

或者说它曾经是。

or actually, it was.

它去年秋天遭遇

It was running into bankruptcy last fall,

破产

因为他们遭到入侵。

because they were hacked into.

有人闯进去

Somebody broke in and they hacked it thoroughly.

彻底毁了它。

And I asked last week,

我上周

在与荷兰政府代表开会时问过，

in a meeting with Dutch government representatives,

我问一位领导

I asked one of the leaders of the team

是否他发现有可能

whether he found plausible that people died

有人会

because of the DigiNotar hack.

因为Diginotar攻击而死亡。

他的回答是肯定的。

And his answer was: yes.

那么，究竟如何人们的死亡

So how do people die

归咎于这样一个攻击呢？

as the result of a hack like this?

DigiNotar是一个权威证书。

Well, DigiNotar is a CA.

They sell certificates.

他们卖证书。

What do you do with certificates?

你用证书做什么？

Well, you need a certificate if you have a website

你需要证书的情况会是

你有一个有https的网站，

that has https, SSL encrypted services,

SSL加密服务，

services like Gmail.

类似Gmail的服务。

当今我们所有人或大部分人，

Now we all, or a big part of us, use Gmail or one of their competitors,

使用Gmail或它对手们中的任何一家，

这些服务在极权主义国家

but these services are especially popular in totalitarian states like Iran,

尤其流行

比如伊朗，

where dissidents use foreign services like Gmail

持异议者

使用诸如Gmail的国外服务

because they know they are more trustworthy than the local services

因为他们知道这些比当地的服务更可靠

他们通过SSL的连接加密，

and they are encrypted over SSL connections,

so the local government can't snoop on their discussions.

所以当地政府窥探不到

他们的讨论。

他们也能，如果他们攻击了一个国外权威证书，

Except they can,

if they hack into a foreign CA and issue rogue certificates.

出具伪劣证书。

这恰恰就是发生在

And this is exactly what happened with the case of DigiNotar.

DigiNotar的案子中。

阿拉伯跳是怎么回事？

What about Arab Spring

比如说在埃及发生的那些事？

and things that have been happening, for example, in Egypt?

在埃及，

Well, in Egypt,

the rioters looted the headquarters of the Egyptian secret police

暴徒们洗劫了

埃及秘密警察的总部

in April 2011,

那是2011年4月，

他们洗劫时找到很多文件。

and when they were looting the building, they found lots of papers.

在这些文件中，

Among those papers was this binder entitled, "FinFisher."

有一个名叫FINFISHER的夹子。

夹子中有些笔记

And within that binder were notes from a company based in Germany,

是来自一家德国公司

这家公司卖给埃及政府

which had sold to the Egyptian government

一套工具

a set of tools for intercepting, at a very large scale,

用来截取--

很大比例是

all the communication of the citizens of the country.

国家公众的所有通信。

他们把这套工具

They had sold this tool for 280,000 euros to the Egyptian government.

以28万欧元卖给埃及政府。

公司的总部就在那里。

The company headquarters are right here.

所以，西方政府

So Western governments are providing totalitarian governments with tools

给极权政府提供工具

to do this against their own citizens.

来反对他们自己的民众。

但西方政府也同样对他们自己这样做。

But Western governments are doing it to themselves as well.

比如，在德国，

For example, in Germany,

就是几周前

just a couple of weeks ago, the so-called "State Trojan" was found,

发现一个叫Scuinst Trojan 的

木马病毒

which was a Trojan used by German government officials

被德国政府官方用来

to investigate their own citizens.

调查他们自己的民众。

如果你是一宗刑事案件的嫌疑，

If you are a suspect in a criminal case,

well, it's pretty obvious, your phone will be tapped.

很显然，你的电话会被监听。

可是今天，事情已经超越了。

But today, it goes beyond that.

他们会监视你的网络连接。

They will tap your Internet connection.

他们会用类似Scuinst Trojan的工具

They will even use tools like State Trojan

用一个木马来感染你的电脑，

to infect your computer with a Trojan,

which enables them to watch all your communication,

这样就让他们

监视你所有的通信，

监听你的在线讨论，

to listen to your online discussions,

收集你的密码。

to collect your passwords.

Now, when we think deeper about things like these,

当我们更深的想一下

这些事情，

人们的反应显然应是

the obvious response from people should be,

“对啊，听起来很糟糕，

"OK, well, that sounds bad, but that doesn't really affect me,

但因为我是合法公民，也不会真正影响我啦。

because I'm a legal citizen.

为什么我要担忧呢？

Why should I worry? Because I have nothing to hide."

我没有什么可隐藏的。”

这就是争论所在，

And this is an argument which doesn't make sense.

没什么道理。

隐私是不言而喻。

Privacy is implied.

隐私用不着讨论。

Privacy is not up for discussion.

This is not a question

这不是个

between privacy

隐私

反对安全的问题。

against security.

It's a question of freedom

而是一个

自由反对管制的问题。

against control.

我们2011年的当下

And while we might trust our governments right now, right here in 2011,

会信任我们的政府，

any rights we give away will be given away for good.

我们放弃的任何权力会永远失去。

我们会不会信任未来的政府，

And do we trust, do we blindly trust, any future government,

盲目地信任，

一个50年后的

a government we might have 50 years from now?

政府呢？

这些就是我们要为下一个50年

And these are the questions

而担忧的问题。

that we have to worry about for the next 50 years.