I'm going to be showing some of the cybercriminals' latest and nastiest creations. So basically, please don't go and download any of the viruses that I show you.
我今天要給大家看看,網路犯罪者 最新、最惡名昭彰的犯罪手法 基本上,請大家不要去下載 我接下來要給大家看的任何病毒
Some of you might be wondering what a cybersecurity specialist looks like, and I thought I'd give you a quick insight into my career so far. It's a pretty accurate description. This is what someone that specializes in malware and hacking looks like.
在座有些人可能會猜想 網路安全專家的工作是什麼樣子 很快地給大家看一下 我目前的工作經歷 這是還滿真實的描述 精通於惡意軟體的人 或是駭客就是長這樣
So today, computer viruses and trojans, designed to do everything from stealing data to watching you in your webcam to the theft of billions of dollars. Some malicious code today goes as far as targeting power, utilities and infrastructure.
現在,電腦病毒和木馬程式 設計來不只竊取電腦資料 還透過你的網路攝影機監視你 甚至盜領數十億美元 現在有些惡意代碼已經能夠 攻擊能源、公共事業及基礎建設
Let me give you a quick snapshot of what malicious code is capable of today. Right now, every second, eight new users are joining the Internet. Today, we will see 250,000 individual new computer viruses. We will see 30,000 new infected websites. And, just to kind of tear down a myth here, lots of people think that when you get infected with a computer virus, it's because you went to a porn site. Right? Well, actually, statistically speaking, if you only visit porn sites, you're safer. People normally write that down, by the way. (Laughter) Actually, about 80 percent of these are small business websites getting infected.
很快地給大家看一下 現在惡意代碼能辦到的事 此時此刻,每秒就有八位 新的網路使用者加入 現在,我們就有 25 萬種新的電腦病毒 還有三萬個剛中毒的網站 然後在這裡稍微打破大家的迷思 很多人以為電腦中毒 是因為上了色情網站 對吧?事實上,根據數據顯示 如果你只上色情網站,你還比較安全 順便一提,大家通常會把這記下來 (笑聲) 其實,大約有 80% 的病毒來源 是被感染的小企業網站
Today's cybercriminal, what do they look like? Well, many of you have the image, don't you, of the spotty teenager sitting in a basement, hacking away for notoriety. But actually today, cybercriminals are wonderfully professional and organized. In fact, they have product adverts. You can go online and buy a hacking service to knock your business competitor offline. Check out this one I found.
現在的網路犯罪者是什麼樣子呢? 很多人都會想到類似的畫面,對吧? 滿臉雀斑的青少年窩在地下室裡 為了成為惡名昭彰的駭客,入侵他人電腦 但事實上,現在的網路犯罪者 有驚人的專業力和組織性 其實,他們甚至還有產品廣告 你可以上網購買入侵電腦的服務 以離線狀態打擊你的商業對手 一起看看我發現的這則廣告
(Video) Man: So you're here for one reason, and that reason is because you need your business competitors, rivals, haters, or whatever the reason is, or who, they are to go down. Well you, my friend, you've came to the right place. If you want your business competitors to go down, well, they can. If you want your rivals to go offline, well, they will. Not only that, we are providing a short-term-to-long-term DDOS service or scheduled attack, starting five dollars per hour for small personal websites to 10 to 50 dollars per hour.
(影片)「你會在這裡只有一個理由 那個理由就是 因為你要讓你商業上的競爭者 敵人、憎恨的人 不管出於什麼理由,要針對什麼人 你要打敗他們 各位兄弟們,你們來對地方了 如果你要打敗你的競爭對手 你可以辦的到 你要對手無法連線,他們就會被迫離線 不只如此,我們還提供短期到長期的 分散式阻斷服務攻擊或是預定攻擊 個人的小型網站每小時五塊美金 到每小時十塊、五十塊美金。」
James Lyne: Now, I did actually pay one of these cybercriminals to attack my own website. Things got a bit tricky when I tried to expense it at the company. Turns out that's not cool. But regardless, it's amazing how many products and services are available now to cybercriminals. For example, this testing platform, which enables the cybercriminals to test the quality of their viruses before they release them on the world. For a small fee, they can upload it and make sure everything is good.
我真的有付過錢 請其中一位網路犯罪者 來攻擊我自己的網站 我試著要跟公司申請攻擊費時 事情變得有點棘手 結果並不如意 但不管怎樣,現在那麼多產品和服務 都受到網路犯罪者的威脅 涵蓋範圍非常可觀 舉例來說,這個測試平台 可以讓網路犯罪者 在散播病毒到世界各地之前 測試他們病毒的品質 只要花一筆小錢,他們就能上傳病毒 並確保一切順利
But it goes further. Cybercriminals now have crime packs with business intelligence reporting dashboards to manage the distribution of their malicious code. This is the market leader in malware distribution, the Black Hole Exploit Pack, responsible for nearly one third of malware distribution in the last couple of quarters. It comes with technical installation guides, video setup routines, and get this, technical support. You can email the cybercriminals and they'll tell you how to set up your illegal hacking server.
但現在不只如此 網路犯罪者現在還有犯罪套件 能利用圖表上顯示的商業智慧數據 來管理惡意代碼的散佈 這是散佈惡意軟體的市場領導者 「黑洞漏洞攻擊套件」 在前幾季,有將近三分之一的惡意軟體散佈 是由其造成 套件裡包含技術上的安裝說明 視頻安裝的例行程序 還有,技術上的支持 你可以寄電子郵件給網路犯罪者 他們會告訴你 如何架設你的非法駭客伺服器
So let me show you what malicious code looks like today. What I've got here is two systems, an attacker, which I've made look all Matrix-y and scary, and a victim, which you might recognize from home or work. Now normally, these would be on different sides of the planet or of the Internet, but I've put them side by side because it makes things much more interesting.
給大家看一下現在的惡意代碼是什麼樣子 這裡有兩套系統 一個是攻擊者 我已經把它設計成嚇人的矩陣模型 一個是被害者 就是平常我們在家裡或職場上看到的 正常來說,這兩者會在地球的兩邊 或是網路的兩端 但我把它們放在一起作比較 能夠呈現更有趣的對比
Now, there are many ways you can get infected. You will have come in contact with some of them. Maybe some of you have received an email that says something like, "Hi, I'm a Nigerian banker, and I'd like to give you 53 billion dollars because I like your face." Or funnycats.exe, which rumor has it was quite successful in China's recent campaign against America.
你的電腦會中毒,有很多種可能 你可能接觸過其中某些病毒 也許你們當中,有人已經收過電子郵件 內容是:「嗨,我是奈及利亞的銀行家 我想要給你 530 億美元 因為我喜歡你的長相。」 或是收到 funnycats.exe,聽說它 在中國最近反抗美國的活動中 執行相當成功
Now there are many ways you can get infected. I want to show you a couple of my favorites. This is a little USB key. Now how do you get a USB key to run in a business? Well, you could try looking really cute. Awww. Or, in my case, awkward and pathetic. So imagine this scenario: I walk into one of your businesses, looking very awkward and pathetic, with a copy of my C.V. which I've covered in coffee, and I ask the receptionist to plug in this USB key and print me a new one. So let's have a look here on my victim computer. What I'm going to do is plug in the USB key. After a couple of seconds, things start to happen on the computer on their own, usually a bad sign. This would, of course, normally happen in a couple of seconds, really, really quickly, but I've kind of slowed it down so you can actually see the attack occurring. Malware is very boring otherwise. So this is writing out the malicious code, and a few seconds later, on the left-hand side, you'll see the attacker's screen get some interesting new text. Now if I place the mouse cursor over it, this is what we call a command prompt, and using this we can navigate around the computer. We can access your documents, your data. You can turn on the webcam. That can be very embarrassing. Or just to really prove a point, we can launch programs like my personal favorite, the Windows Calculator.
電腦中毒有很多種管道 我想給大家看一些我最喜歡的案例 這是一個小小的隨身碟 你要如何讓公司插入隨身碟呢? 你可以用很可愛的方式 喔~ 或者,我自己是用楚楚可憐的方式 想像一下這個場景,我走進你們公司 看起來很膽小無助地拿著一份 被咖啡濺濕的履歷表 我請櫃台人員插入這個隨身碟 幫我印一份新的 我們來看看被害者電腦的情形 我現在要插入隨身碟 幾秒鐘後 電腦開始自己跑出一些東西 通常是不好的兆頭 當然這種現象,通常只發生 在幾秒鐘之內,速度非常非常快 但我把速度稍微放慢 讓大家看清楚,電腦是怎麼遭受攻擊 不然惡意軟體其實滿無聊的 現在電腦正在寫惡意代碼 幾秒鐘後,左手邊 你可以看到攻擊者的電腦出現有趣的符號 假如現在我把游標移到上面 這個叫做命令提示字元視窗 利用它,就能隨意控制電腦了 我們可以獲取你的文件、資料 你可以打開網路攝影機 就會變得很尷尬 為了證明我的觀點 我們可以打開一個程式,像是我最愛的 Windows 計算機
So isn't it amazing how much control the attackers can get with such a simple operation? Let me show you how most malware is now distributed today. What I'm going to do is open up a website that I wrote. It's a terrible website. It's got really awful graphics. And it's got a comments section here where we can submit comments to the website. Many of you will have used something a bit like this before. Unfortunately, when this was implemented, the developer was slightly inebriated and managed to forget all of the secure coding practices he had learned. So let's imagine that our attacker, called Evil Hacker just for comedy value, inserts something a little nasty. This is a script. It's code which will be interpreted on the webpage. So I'm going to submit this post, and then, on my victim computer, I'm going to open up the web browser and browse to my website, www.incrediblyhacked.com. Notice that after a couple of seconds, I get redirected. That website address at the top there, which you can just about see, microshaft.com, the browser crashes as it hits one of these exploit packs, and up pops fake antivirus. This is a virus pretending to look like antivirus software, and it will go through and it will scan the system, have a look at what its popping up here. It creates some very serious alerts. Oh look, a child porn proxy server. We really should clean that up. What's really insulting about this is not only does it provide the attackers with access to your data, but when the scan finishes, they tell you in order to clean up the fake viruses, you have to register the product. Now I liked it better when viruses were free. (Laughter) People now pay cybercriminals money to run viruses, which I find utterly bizarre.
所以攻擊者能輕易控制電腦 不是很驚人嗎? 我讓大家看看現在的惡意軟體 是如何散佈出去的 我現在要打開我架的 網站 這網站很爛,製圖滿差的 這裡有個留言板 可以在網站上留下評論 很多人都用過這種留言板 不幸地,執行這個動作後 版主有點得意忘形 試圖遺忘 所有他學過的安全編碼 想像一下我們的攻擊者 為了笑果,我們將其稱為「邪惡駭客」 他在網頁中置入了棘手的東西 這是一串程式語言 是一種網頁可讀取的編碼 我現在要送出這則留言 接著,我要打開 受害者電腦的網頁瀏覽器 上我的網站 www.incrediblyhacked.com 注意看,幾秒鐘後 網站被轉出 從網站上方的網址 可以看到 microshaft.com 網站在碰到這些攻擊套件後就當機了 然後出現冒牌的防毒軟體 這種病毒假裝自己是防毒軟體 它會仔細瀏覽並掃描整個系統 看一下這裡出現什麼 出現了嚴重的警告 看,兒童色情網代理伺服器 我們真的應該把它清乾淨 真的很羞辱人的部分 不只是它賦予了攻擊者竊取資料的能力 更是因為當掃描結束後,它會顯示 為了清理假的病毒 你必須要申請產品註冊 現在我更喜歡免費的病毒了 (笑聲) 現在大家付錢請網路犯罪者 來跑病毒 我覺得很奇怪
So anyway, let me change pace a little bit. Chasing 250,000 pieces of malware a day is a massive challenge, and those numbers are only growing directly in proportion to the length of my stress line, you'll note here. So I want to talk to you briefly about a group of hackers we tracked for a year and actually found -- and this is a rare treat in our job. Now this was a cross-industry collaboration, people from Facebook, independent researchers, guys from Sophos. So here we have a couple of documents which our cybercriminals had uploaded to a cloud service, kind of like Dropbox or SkyDrive, like many of you might use. At the top, you'll notice a section of source code. What this would do is send the cybercriminals a text message every day telling them how much money they'd made that day, so a kind of cybercriminal billings report, if you will. If you look closely, you'll notice a series of what are Russian telephone numbers. Now that's obviously interesting, because that gives us a way of finding our cybercriminals. Down below, highlighted in red, in the other section of source code, is this bit "leded:leded." That's a username, kind of like you might have on Twitter.
不管怎樣,現在我要稍微換個步調 一天要追趕 25 萬個惡意軟體 是很大的挑戰 而這樣的數據只會不斷上升 你可以看到,它和我皺紋的長度成正比 所以我要簡短的跟大家談談 我們追蹤了一年的駭客團隊 而且我們確實找到他們 對我們的工作來說,這是很難得的事 這是一個跨企業的合作研究 成員有臉書的網友、獨立研究員 以及 Sophos (防毒軟體公司)的人員 這裡有一些文件 是網路犯罪者 上傳到類似 Dropbox 或 SkyDrive 的雲端 就像你們可能使用過的雲端服務 上方,你們可以看到原始碼的部分 它的功能是每天傳送訊息 給網路犯罪者,告知他們 他們當天賺了多少錢 所以你可以說它 有點像網路犯罪者的營業額報告 如果你仔細看,你會注意到有一串 俄羅斯的電話號碼 顯然現在事情越來越有趣了 因為它提供我們找出網路犯罪者的管道 下方,紅色部分 另一部分的原始碼 是位元 "leded:leded" 那是使用者名稱 有點像你在推特上的名字
So let's take this a little further. There are a few other interesting pieces the cybercriminals had uploaded. Lots of you here will use smartphones to take photos and post them from the conference. An interesting feature of lots of modern smartphones is that when you take a photo, it embeds GPS data about where that photo was taken. In fact, I've been spending a lot of time on Internet dating sites recently, obviously for research purposes, and I've noticed that about 60 percent of the profile pictures on Internet dating sites contain the GPS coordinates of where the photo was taken, which is kind of scary because you wouldn't give out your home address to lots of strangers, but we're happy to give away our GPS coordinates to plus or minus 15 meters. And our cybercriminals had done the same thing. So here's a photo which resolves to St. Petersburg. We then deploy the incredibly advanced hacking tool. We used Google. Using the email address, the telephone number and the GPS data, on the left you see an advert for a BMW that one of our cybercriminals is selling, on the other side an advert for the sale of sphynx kittens. One of these was more stereotypical for me. A little more searching, and here's our cybercriminal. Imagine, these are hardened cybercriminals sharing information scarcely. Imagine what you could find about each of the people in this room. A bit more searching through the profile and there's a photo of their office. They were working on the third floor. And you can also see some photos from his business companion where he has a taste in a certain kind of image. It turns out he's a member of the Russian Adult Webmasters Federation.
現在我們更進一步來看 還有一些網路犯罪者所上傳的 有趣的東西 在場的各位,大部分都會在會議時 用智慧型手機拍照上傳 而大部分的智慧型手機都有一項特色 當你拍照時 手機會匯入有關拍攝地點的 GPS 資料 事實上,最近我大部分的時間 都花在交友網站上 當然是為了研究目的 而我注意到交友網站上 大約 60% 的個人照 提供了拍攝地點的 GPS 服務 這其實有點可怕 因為你不會給陌生人 你家的住址 但我們卻樂意分享我們的位置 讓 15 公里外的人知道 網路犯罪者也是做同樣的事情 這是在聖彼得堡的照片 我們部屬了非常先進的駭客工具 也就是 Google 利用電子郵件、電話號碼 以及 GPS 數據,左手邊可以看到 網路犯罪者在宣傳的 BMW 廣告 另一邊可以看到賣斯芬克斯貓的廣告 其中一個對我來說比較常見 進一步研究之後,找到這位網路犯罪者 想像一下,這些頑固的網路犯罪者 幾乎不分享資訊 想像一下,你可以在現場 每個人身上找出什麼資訊 透過個人資料進一步搜尋 這是他們辦公室的照片 他們在三樓工作 你可以從他們的企業夥伴那裡 看到更多照片 在那,他帶有某種形象的特徵 結果發現他是 俄羅斯成人網路管理聯盟的一員
But this is where our investigation starts to slow down. The cybercriminals have locked down their profiles quite well. And herein is the greatest lesson of social media and mobile devices for all of us right now. Our friends, our families and our colleagues can break our security even when we do the right things. This is MobSoft, one of the companies that this cybercriminal gang owned, and an interesting thing about MobSoft is the 50-percent owner of this posted a job advert, and this job advert matched one of the telephone numbers from the code earlier. This woman was Maria, and Maria is the wife of one of our cybercriminals. And it's kind of like she went into her social media settings and clicked on every option imaginable to make herself really, really insecure. By the end of the investigation, where you can read the full 27-page report at that link, we had photos of the cybercriminals, even the office Christmas party when they were out on an outing. That's right, cybercriminals do have Christmas parties, as it turns out. Now you're probably wondering what happened to these guys. Let me come back to that in just a minute.
由此開始,我們的調查遇到瓶頸 網路犯罪者把他們的個人檔案鎖得很確實 而此正是我們 使用社群媒體和行動裝置時,最重要的一課 我們的朋友、家人和同事 在我們沒做錯事時,也可能危及我們的安全 MobSoft,是這位網路犯罪者擁有的 其中一家公司 有趣的是 擁有 MobSoft 的人 50% 分享過招聘廣告 而此招聘廣告,剛好符合其中一支 先前顯示的電話號碼 這位女性是瑪麗亞 她是其中一位網路犯罪者的妻子 她可能是進入她的社群媒體設定 點選了你想的到的任何選項 使自己陷入極不安全的狀態 在調查的最後 在連結中,你可以看到整整 27 頁的報告 我們有網路犯罪者的照片 甚至是全體職員 一起出遊辦的聖誕節派對 沒錯,結果網路犯罪者 也有聖誕派對 現在你可能會想,這些傢伙是怎麼回事 等等我再回來談這件事
I want to change pace to one last little demonstration, a technique that is wonderfully simple and basic, but is interesting in exposing how much information we're all giving away, and it's relevant because it applies to us as a TED audience. This is normally when people start kind of shuffling in their pockets trying to turn their phones onto airplane mode desperately.
我想要最後再做一次示範 一個非常簡單且基本的技巧 有趣的是我們總共洩漏了 多少資訊 這很重要,因為它適用於我們所有 TED 觀眾 通常我們在口袋裡移來移去 拼命地要把手機轉成飛航模式就是這樣子
Many of you all know about the concept of scanning for wireless networks. You do it every time you take out your iPhone or your Blackberry and connect to something like TEDAttendees. But what you might not know is that you're also beaming out a list of networks you've previously connected to, even when you're not using wireless actively. So I ran a little scan. I was relatively inhibited compared to the cybercriminals, who wouldn't be so concerned by law, and here you can see my mobile device. Okay? So you can see a list of wireless networks. TEDAttendees, HyattLB. Where do you think I'm staying? My home network, PrettyFlyForAWifi, which I think is a great name. Sophos_Visitors, SANSEMEA, companies I work with. Loganwifi, that's in Boston. HiltonLondon. CIASurveillanceVan. We called it that at one of our conferences because we thought that would freak people out, which is quite fun. This is how geeks party.
大家都知道 選擇無線網路的概念 每次你拿出你的 iPhone 或黑莓機都會做這件事 把它連到像 TEDAttendees 的網路 但你可能不知道 這時你也發射出了 一系列先前連過的網站訊號 即使你並沒有常常在使用無線網路 所以我稍微掃描了一下 比起網路犯罪者,我比較有顧忌一點 因為他們並不在乎法律的約束 這是我的行動裝置 你們可以看到一連串的無線網路 TEDAttendees, HyattLBTE 你們覺得我連的是哪一個網路? 我家的網路 PrettyFlyForAWifi 我覺得這名字很不錯 Sophos_Visitors, SANSEMEA 這是我公司的網路 Loganwifi ,它在波士頓 還有 HiltonLondon 以及 CIASurveillanceVan 我們在其中一場會議使用這個名稱 因為我們覺得這可以嚇到大家 還滿有趣的 這就是網路怪客娛樂的方式
So let's make this a little bit more interesting. Let's talk about you. Twenty-three percent of you have been to Starbucks recently and used the wireless network. Things get more interesting. Forty-six percent of you I could link to a business, XYZ Employee network. This isn't an exact science, but it gets pretty accurate. Seven hundred and sixty-one of you I could identify a hotel you'd been to recently, absolutely with pinpoint precision somewhere on the globe. Two hundred and thirty-four of you, well, I know where you live. Your wireless network name is so unique that I was able to pinpoint it using data available openly on the Internet with no hacking or clever, clever tricks. And I should mention as well that some of you do use your names, "James Lyne's iPhone," for example. And two percent of you have a tendency to extreme profanity.
我們現在談點有趣的 談談你們好了 在座有 23% 的人最近去過星巴克 並且使用無線網路 事情越來越有趣 有 46% 的人可以讓我連線到某家企業 XYZ 員工的網路 這並不是一門精確的科學,但它多少滿準確的 我可以指出在場 761 位聽眾 最近去過的旅館 而且是相當精確的位置 在場的 234 位聽眾,我知道你們住哪裡 你們的無線網路名稱很特別 讓我能夠非常精確的判斷位置 只需要使用網路上公開的資料 不需要當駭客或任何聰明的技巧 我也要順便提一下 有些人直接使用自己的姓名 比如說「詹姆斯·萊恩的iPhone」 還有 2% 的人使用不雅的名稱
So something for you to think about: As we adopt these new applications and mobile devices, as we play with these shiny new toys, how much are we trading off convenience for privacy and security? Next time you install something, look at the settings and ask yourself, "Is this information that I want to share? Would someone be able to abuse it?"
所以有些事應該要思考一下 當我們接受這些新的應用程式及行動裝置 當我們在把玩這些閃亮亮的機子時 我們為了方便 賠上了多少隱私和安全? 下次當你要安裝軟體時 看看設定,問問自己 「這是我想要分享的資訊嗎? 會不會有人濫用它呢?」
We also need to think very carefully about how we develop our future talent pool. You see, technology's changing at a staggering rate, and that 250,000 pieces of malware won't stay the same for long. There's a very concerning trend that whilst many people coming out of schools now are much more technology-savvy, they know how to use technology, fewer and fewer people are following the feeder subjects to know how that technology works under the covers. In the U.K., a 60 percent reduction since 2003, and there are similar statistics all over the world.
我們也必須仔細思考 未來的人才庫該如何發展 科技日新月異,速度驚人 而那 25 萬種惡意軟體 還會持續不斷增加 現在有一個需要關注的趨勢 許多離開校園的人 都越來越了解科技,他們知道如何使用科技 越來越少人去研究使用說明 來了解科技背後是如何運作 在英國,這一類的人 從 2003 年開始就減少了 60% 全世界的統計都差不多
We also need to think about the legal issues in this area. The cybercriminals I talked about, despite theft of millions of dollars, actually still haven't been arrested, and at this point possibly never will. Most laws are national in their implementation, despite cybercrime conventions, where the Internet is borderless and international by definition. Countries do not agree, which makes this area exceptionally challenging from a legal perspective.
我們必須好好想想科技帶來的非法問題 我談到的網路犯罪者 儘管盜領了幾百萬美元 現在仍然逍遙法外 而且看起來永遠抓不到了 大部分的法律都是以國家為單位來執行 儘管網路犯罪基本上按定義來說 是全球不分國界的 國家無法掌控,使得科技 在法律上特別棘手
But my biggest ask is this: You see, you're going to leave here and you're going to see some astonishing stories in the news. You're going to read about malware doing incredible and terrifying, scary things. However, 99 percent of it works because people fail to do the basics. So my ask is this: Go online, find these simple best practices, find out how to update and patch your computer. Get a secure password. Make sure you use a different password on each of your sites and services online. Find these resources. Apply them.
但我最大的請求是 你將要離開這裡了 你會在新聞上看到很多驚人的故事 你會看到惡意軟體做了很多 非常駭人的事情 然而,這些軟體 99% 可以成功 是因為大家都忽略了基本原則 所以我的請求是:上網 去找出這些簡單卻最好用的執行方法 去了解要如何更新和修正你的電腦 設一組安全的密碼 請確保你在登入每個網站時 都是使用不同的密碼 找出這些資源,並加以利用
The Internet is a fantastic resource for business, for political expression, for art and for learning. Help me and the security community make life much, much more difficult for cybercriminals.
網路是一個很棒的資源 不管是對企業、對政治 對藝術,還是對於學習 請大家幫我及安全社群 讓網路犯罪者的生存 更加艱難
Thank you.
謝謝
(Applause)
(掌聲)