Mikko Hypponen: Three types of online attack

譯者: Chen-Han Hsiao 審譯者: Vivian Mig

In the 1980s, in communist Eastern Germany,

1980年代

在共產主義的東德

如果你擁有一部打字機

if you owned a typewriter,

you had to register it with the government.

你得去跟政府登記

你必須登記

You had to register a sample sheet of text out of the typewriter.

出自這台打字機的

範例文件

And this was done so the government could track

這麼做以後

政府就能追蹤文件的來源

where the text was coming from.

如果他們發現了

If they found a paper which had the wrong kind of thought,

寫著錯誤觀點的文件

they could track down who created that thought.

他們就可以追蹤到

是誰創造了這觀點

在西方世界中

And we in the West

我們不能理解怎麼有人能這麼做

couldn't understand how anybody would do this,

how much this would restrict freedom of speech.

這將會多麼限制言論自由啊

在我們國家

We would never do that in our own countries.

我們絕不這麼做

但來到現今2011年

But today, in 2011, if you go and buy a color laser printer

如果你從任何一家大型雷射印表機製造商

from any major laser printer manufacturer

買一部彩色雷射印表機

然後印出一張紙

and print a page,

這張紙最後

that page will end up

having slight yellow dots printed on every single page,

會有一些小黃點

印在每一頁上

圖案使這張紙是獨特的

in a pattern which makes the page unique to you and to your printer.

對你和你的印表機都是

這就是現在

This is happening to us today.

發生在我們身上的

似乎沒有人為此大驚小怪

And nobody seems to be making a fuss about it.

這裡

And this is an example

展示了

of the ways our own governments are using technology

我們的政府

使用科技

來對付我們這些公民們的例子

against us, the citizens.

這是今天網路問題的

And this is one of the main three sources of online problems today.

三大來源之一

If we look at what's really happening in the online world,

如果我們看一下網路世界到底發生了什麼

we can group the attacks based on the attackers.

我們根據攻擊者來分組

我們有三個主要的組

We have three main groups.

We have online criminals.

我們有網路罪犯

Like here, we have Mr. Dmitry Golubov,

就像這位，Dimitry Golubov先生

from the city of Kiev in Ukraine.

來自烏克蘭的基輔市

網路罪犯的犯罪動機

And the motives of online criminals are very easy to understand.

很容易了解

These guys make money.

這些傢伙為了賺錢

They use online attacks to make lots of money --

他們利用線上攻擊

來拿取很多的錢

and lots and lots of it.

很多很多錢

We actually have several cases of millionaires online, multimillionaires,

實際上我們有好幾個案子

都是線上百萬富翁 千萬富翁

都是利用線上攻擊來賺錢的

who made money with their attacks.

Here's Vladimir Tsastsin, from Tartu in Estonia.

這是來自愛沙尼亞 塔爾圖市的Vladimir Tsastsin

還有這是Alfred Gonzalez

This is [Albert] Gonzalez.

Stephen Watt

This is Stephen Watt.

Bjorn Sundin.

This is Bjorn Sundin.

This is Matthew Anderson, Tariq Al-Daour

Matthew Anderson 及 Tariq Al-Daour

and so on and so on.

等等等等

這些人

These guys make their fortunes online,

在線上賺取他們的財富

卻是透過違法的手段

but they make it through the illegal means

of using things like banking Trojans

像是使用銀行木馬

在我們使用線上銀行服務時

to steal money from our bank accounts while we do online banking,

竊取我們銀行中的錢

或者 我們使用一台中毒的電腦在線上購物時

or with keyloggers

他們使用鍵盤記錄器

to collect our credit card information

while we are doing online shopping from an infected computer.

來收集我們信用卡的資訊

美國特勤局

The US Secret Service,

在2個月前

two months ago, froze the Swiss bank account

凍結了Sam Jain先生

of Mr. Sam Jain right here,

在瑞士銀行的帳戶

這個帳戶裡有著 一千四百九十萬 美元

and that bank account had 14.9 million US dollars in it

當它被凍結後

when it was frozen.

Sam Jain也消失無蹤

Mr. Jain himself is on the loose; nobody knows where he is.

沒人知道他在哪裡

And I claim it's already today

今日我斷言

任何一個在場的人

that it's more likely for any of us to become the victim of a crime online

都很可能成為線上犯罪的受害者

甚至超越了現實生活

than here in the real world.

而且很明顯的

And it's very obvious that this is only going to get worse.

這將會變的更糟

In the future, the majority of crime will be happening online.

在未來 主要的犯罪行為

都會發生在網路上

第二組我們關切的

The second major group of attackers that we are watching today

主要犯罪集團

are not motivated by money.

它們的動機不在於錢

他們的動機源自別處

They're motivated by something else --

出於抗議

motivated by protests,

出於表達意見

motivated by an opinion,

出於被嘲笑

motivated by the laughs.

Groups like Anonymous have risen up over the last 12 months

過去12個月中 這類集團活躍了起來

像是匿名客組識(Anonymous)

並且變成線上攻擊領域的

and have become a major player in the field of online attacks.

主要參與者

這些就是三組主要的攻擊者

So those are the three main attackers:

為了錢的罪犯

criminals who do it for the money,

還有為了抗議

hacktivists like Anonymous doing it for the protest,

像是匿名客組織(Anonymous)的駭客們

but then the last group are nation states --

但第三組來源是民族國家們

governments doing the attacks.

政府正進行這樣的攻擊

我們看一下例子

And then we look at cases like what happened in DigiNotar.

像是 DigiNotar 公司所發生的

這是一個典型例子

This is a prime example of what happens when governments attack

當政府攻擊他們的公民

against their own citizens.

的一個犯罪案例

DigiNotar 是一個荷蘭的

DigiNotar is a certificate authority from the Netherlands --

憑證發行機構

或者說 它曾經是

or actually, it was.

它在去年秋天時

It was running into bankruptcy last fall,

破產了

因為它們遭到入侵

because they were hacked into.

有人闖進去

Somebody broke in and they hacked it thoroughly.

徹底的毀了它

And I asked last week,

我上周

在與荷蘭政府代表開會時問過

in a meeting with Dutch government representatives,

我問一位領導

I asked one of the leaders of the team

他有否發現有可能

whether he found plausible that people died

有人會

because of the DigiNotar hack.

因為DigiNotar 攻擊而死亡

他的回答是肯定的

And his answer was: yes.

那麼 究竟為什麼人們的死亡

So how do people die

會源自於這樣的一個攻擊呢

as the result of a hack like this?

DigiNotar是個憑證發行機構

Well, DigiNotar is a CA.

They sell certificates.

他們販售憑證

What do you do with certificates?

你會用憑證來做什麼

Well, you need a certificate if you have a website

嗯 當你經營一個有https的網站

你會需要一個憑證

that has https, SSL encrypted services,

會以SSL加密的服務

services like Gmail.

像是Gmail

現在 我們所有人 或是大部份

Now we all, or a big part of us, use Gmail or one of their competitors,

使用Gmail 或是他對手們的其中一家

但這樣的服務

but these services are especially popular in totalitarian states like Iran,

在極權主義國家更為盛行

像是伊朗

where dissidents use foreign services like Gmail

異議人士

會使用像Gmail 這樣的國外服務

because they know they are more trustworthy than the local services

因為他們知道 這些服務比起國內服務更可以信任

而且這些服務是由SSL加密連線

and they are encrypted over SSL connections,

so the local government can't snoop on their discussions.

所以當地政府沒辦法竊聽

他們的討論

除非政府可以駭入國外的憑證發行機構

Except they can,

if they hack into a foreign CA and issue rogue certificates.

然後發行出假憑證

而這就是在 DigiNotar 案子中

And this is exactly what happened with the case of DigiNotar.

所發生的

來談談阿拉伯之春

What about Arab Spring

例如埃及所發生的事

and things that have been happening, for example, in Egypt?

在埃及

Well, in Egypt,

the rioters looted the headquarters of the Egyptian secret police

暴民洗劫了

埃及秘密警察的總部

in April 2011,

在2011年4月

當他們洗劫時發現很多文件

and when they were looting the building, they found lots of papers.

在這些文件中

Among those papers was this binder entitled, "FinFisher."

有一個名叫FINFISHER的夾子

這個夾子裡有些記錄

And within that binder were notes from a company based in Germany,

一間德國的公司

賣給了埃及政府

which had sold to the Egyptian government

一套可以用來竊聽

a set of tools for intercepting, at a very large scale,

的工具

有很大的比例

all the communication of the citizens of the country.

國家公眾的所有通信

他們把這套工具

They had sold this tool for 280,000 euros to the Egyptian government.

以28萬歐元賣給了埃及政府

這間公司的總部就在這

The company headquarters are right here.

所以 西方政府

So Western governments are providing totalitarian governments with tools

提供工具給極權政府

to do this against their own citizens.

來竊聽他們的人民

但西方政府對他們自己的人民也這麼做

But Western governments are doing it to themselves as well.

例如說 在德國

For example, in Germany,

幾個星期前

just a couple of weeks ago, the so-called "State Trojan" was found,

有個叫 State Trojan 的木馬被找到

這是個被德國政府官方

which was a Trojan used by German government officials

用來調查他們公民

to investigate their own citizens.

的一支木馬

如果你是個犯罪案件的嫌疑犯

If you are a suspect in a criminal case,

well, it's pretty obvious, your phone will be tapped.

很明顯的 你的電話會被監聽

但在今日 不只是如此

But today, it goes beyond that.

他們還會監聽你的網路連線

They will tap your Internet connection.

他們甚至使用使用像是 State Trojan 的工具

They will even use tools like State Trojan

使你的電腦感染木馬

to infect your computer with a Trojan,

which enables them to watch all your communication,

這使他們能夠

監看你所有的通訊

查看你線上的發言

to listen to your online discussions,

並收集你的密碼

to collect your passwords.

Now, when we think deeper about things like these,

當我們對這樣的事情

做更深的思考

人們的反應顯然會是

the obvious response from people should be,

"嗯，這聽起來不好"

"OK, well, that sounds bad, but that doesn't really affect me,

"但我是個合法的公民，這並不影響我"

because I'm a legal citizen.

"我何必擔心呢"

Why should I worry? Because I have nothing to hide."

"因為我沒什麼可隱藏的"

但這是個不合理

And this is an argument which doesn't make sense.

的論點

隱私是不言而喻

Privacy is implied.

隱私用不著討論

Privacy is not up for discussion.

This is not a question

這不是個

between privacy

隱私對抗安全

的問題

against security.

It's a question of freedom

這是個 自由對抗控制

的問題

against control.

我們在2011年的當下

And while we might trust our governments right now, right here in 2011,

我們信任我們的政府

any rights we give away will be given away for good.

任何我們放棄的權利 會永久的失去

而我們能不能信任 盲目的信任

And do we trust, do we blindly trust, any future government,

未來的政府

譬如說50年後

a government we might have 50 years from now?

的政府呢?

這就是接下來的五十年中，

And these are the questions

我們要擔憂的問題

that we have to worry about for the next 50 years.