Business | Cyber-security

White hats to the rescue

Law-abiding hackers are helping businesses to fight off the bad guys

|SAN FRANCISCO

ANDREW WHITAKER has made a career out of breaking into things. A “white hat” hacker in techie jargon, Mr Whitaker leads a team of security specialists at Knowledge Consulting Group who spend their days trying to worm their way into clients’ computer systems to see how vulnerable they are to cyber-criminals, spies and other nefarious “black hats”. The team’s record is both impressive and alarming. Some of the firm’s clients are utilities, and Mr Whitaker and his colleagues often target software that controls critical infrastructure, such as water and power supplies. “We’re getting in pretty much every single time,” he says.

Crooks and spooks are still finding plenty of chinks in digital armour too. On February 15th Kickstarter, a crowdfunding site that lets users send cash to entrepreneurs promoting novel projects, said hackers had stolen usernames, encrypted passwords and e-mail addresses from it. A few days later a security researcher claimed to have found evidence that Snecma, a French aerospace firm, had been attacked by hackers, though it is not clear if they got into its systems. Kaspersky Lab, a security firm, recently said it had discovered a global spying operation, dubbed “The Mask”, which had been running since 2007 and which targeted everything from governments to activists and energy companies.

The effects of a hacking attack can be devastating for a company’s reputation and its bottom line, as Target is discovering to its cost. At the end of last year the giant American retailer was hit by hackers who swiped the details of credit and debit cards held by 40m of its customers by placing malicious software on thousands of the registers in its stores. In total, intruders gained access to 70m records that contained partial names and e-mail and postal addresses of customers.

Target’s catastrophic breach may come to be seen as the digital equivalent of BP’s disastrous Deepwater Horizon oil spill. The retailer faces a whopping bill for cleaning up the mess the massive data leak has caused. Jefferies, an investment bank, estimates that it may have to pay up to $1.1 billion to the payment-card industry because of the breach. Target is also spending a fortune on such things as free identity-theft insurance for customers.

As more business shifts online, hackers have plenty of targets to aim at. Last year a report published by an arm of Symantec, a security firm, estimated that cybercrime costs the world $113 billion a year; it put the number of victims at 378m. The Ponemon Institute, another research outfit, reckons that in 2012 malicious attacks cost American companies $277 for each customer’s or user’s account put at risk, a lot more than the cost of leaks caused by technical glitches or mistakes by employees. Other countries are not far behind (see chart).

Since Edward Snowden’s leaks about the NSA’s activities, much ink has been spilled about the threat to cyber-security from rogue employees. Yet most breaches are still caused by outsiders. And businesses are struggling to match the wiles of the unknown intruders trying to pinch their data. Hikmet Ersek, the boss of Western Union, said financial-services firms like his are in a “street fight” with hackers.

The threat posed by determined cyber-invaders explains why companies that offer to mimic them and test the vulnerabilities of clients’ systems—a practice known as “penetration testing”—are in demand. Some businesses, such as banks and outfits handling electronic payments, are required by regulators or industry bodies to conduct regular “pentests”. Others hire pentesters because they think outsiders may spot things that internal security teams miss. “You tend to get tunnel vision in-house,” says Charles Henderson of Trustwave, an internet-security firm whose SpiderLabs arm conducts pentests.

Like Mr Whitaker, other white-hat hackers find it a doddle to bust into clients’ systems. Jim O’Gorman of Offensive Security says that his team was asked by an executive at a large electronics manufacturer to test its security. They were stunned by how quickly they broke into its networking and manufacturing systems. “I told him you’ve spent 20 years building up your firm’s reputation and in 20 hours we’ve got control of your company,” boasts Mr O’Gorman. Technology firms, which might be expected to know better, suffer more data breaches than those in other industries, or even the government.

A popular trick used by black-hat and white-hat hackers alike is to send fake “phishing” e-mails, which seem to come from legitimate sources and ask a firm’s employees to enter their usernames and passwords. Mr Whitaker says about a fifth of employees who receive these e-mails are fooled by them. Once inside a network, his team takes an average of four hours to take control of it.

Critics of pentesting say cheap software that automatically scans for vulnerabilities in a firm’s systems can automate much of the work pentesters do. They also claim that tests can create a false sense of security inside companies. Michael Borohovski of Tinfoil Security, which makes software that hunts for security flaws, says firms often make big changes to their systems between pentests, which can accidentally create new vulnerabilities. Moreover, some pentesters may simply lack the skills and ruthlessness to spot weaknesses that cyber-crooks will find.

Executives who have used pentesters acknowledge that clients should choose them carefully, and call them back whenever big changes are made to computer systems. But they reject the notion that they can be replaced with software. “They’re not just testing security tools, but also exploiting vulnerabilities to probe deeper inside companies’ systems,” says Richard Moore of New York Life, an insurer.

To convince sceptical clients that their systems are vulnerable, Trustwave records videos of its hackers breaking into them, to prove that they really did get in. Some white hats go even further, pinching a confidential document from their clients’ servers and then presenting it to them with a flourish. “This makes the threat much more real,” says Deke George of NetSPI, another pentesting firm. When shocked bosses are presented with this sort of evidence, they usually reach for their chequebooks fast to fix the problem.

Still, even a robust pentesting strategy combined with other security measures may not be able to foil dogged intruders. In Target’s case, it appears that the initial breach through which black hats secured access to its systems took place at a heating and ventilation company that was one of Target’s suppliers. More details about how the theft worked will no doubt emerge as investigations proceed.

New risks are constantly emerging, notably in the field of mobile apps. Companies are rolling out lots of these, so that their employees can work on tablets and smartphones as they travel. But pentesters who have begun probing them say that the quality of the security associated with them is years behind that of other corporate apps. So is anyone safe? Knowledge Group’s Mr Whitaker says that only one utility was able to frustrate his hackers’ attempts to break in. Its secret? The engineer whose data they wanted still kept it on old-fashioned floppy disks that he simply took out of his computer every night.

This article appeared in the Business section of the print edition under the headline "White hats to the rescue"

Putin’s inferno: The battle for Ukraine

From the February 22nd 2014 edition

Discover stories from this section and more in the list of contents

Explore the edition

Discover more

Making accounting sexy again

The profession needs a makeover to attract newcomers

A marketing victory for Nike is a business win for Adidas

The contest of the sportswear giants heats up


The pros and cons of corporate uniforms

A quarter of the American workforce wears one. Why?