Feeds

McKinnon a 'scapegoat for Pentagon insecurity'

US mil still wide open to attack, says reformed hacker

Beginner's guide to SSL certificates

As accused Pentagon hacker Gary McKinnon hopes against hope to avoid being extradited to the US, another reformed military systems meddler considers his own case - and how different the outcome was.

McKinnon is probably days away from extradition. Only a last minute plea to the Home Secretary "Wacky" Jacqui Smith - based on McKinnon's recent diagnosis with Asperger Syndrome - now stands between the Scot and a US trial for hacking into US government and military systems. Friends and family staged a demonstration outside the Home Office on Tuesday in a bid to draw attention to McKinnon's plight.

The handling of McKinnon's case is in marked contrast to how US authorities handled a similar one ten years ago. Like McKinnon, reformed computer hacker Mathew Bevan was charged with breaking into US military computer systems. Bevan was also curious about searching for evidence that the US military had harvested technology from crashed UFOs. Bevan's alleged crimes were cited as examples of cyberterrorism at Senate hearings in 1996.

But no attempt was ever made to extradite Bevan to the US. Instead he was prosecuted in the UK. The case eventually fell apart after 18 months, when prosecutors decided not to proceed.

Bevan put the legal fight behind him and has since gone on to become an ethical hacker and security consultant. Speaking exclusively to El Reg, Bevan said McKinnon is being used in a political game that has more to do with securing funds than deterring or preventing attacks.

"Clearly, lessons have not been learned since I breached similar systems and as I have always suggested - perhaps stopping the intrusions is not the goal of the administration," Bevan said. "Tacitly allowing access to machines by ensuring that default passwords or in fact access methods without passwords is suggestive of a system that really does not care too much about many of the machines connected to it."

Bevan questions why Windows PCs on US military networks are connected to the internet via direct IPs. Thousands of attackers regularly use the same remote access port accessed during McKinnon's hack, but little or no action has been taken in their cases, Bevan adds.

McKinnon has said that many other hackers had gained access to the same systems he was accessing, questioning why US authorities singled him out for prosecution. The fact that McKinnon did nothing to disguise his tracks and lived in a country with a friendly extradition regime probably has a fair bit to do with this.

Bevan supports McKinnon's contention that he was far from alone in rooting around US military systems. "You ask any military hacker about the machines they broke in to and they will tell you they were not the only people on those systems. Of course, they weren't the only people, as there were great numbers of people whiling away their time hacking computers."

Pork barrel ploy

McKinnon, according to Bevan, was far more than simply unlucky.

"Why is it that only a tiny number of those people ever face prosecution? It is clearly not because the others cannot be found. You cannot believe that out of so many people, Gary just happened to be caught."

McKinnon is being used as a scapegoat in a bid to secure extra funding to protect US military networks, according to Bevan, who reckons a commercial organisation would never get away with such trickery.

"I think it's all about timing and whether or not the hacker will make a good scapegoat whilst allowing the administration to request further money. The fear machine can keep churning out propaganda as per normal, but don't expect those machines to actually get better security. They are not businesses, have no shareholders and therefore do not have to answer to the same stringent rules and tests that the computer systems of corporations would."

Bevan compared hacking attacks to an infestation by pests. Both stem from a failure to follow basic housekeeping rules, he argued.

"My cynical side believes that those 'pesky hackers' are treated just like any bug infestation, the odd one or two or even a handful is not much of an issue until the place becomes overrun. It is then that you can call in the exterminators and make a big fuss about the problem, of course it never addresses that the usual problem with an infestation is someone has not been keeping their place tidy. You leave scraps around for rats to find and in a short time you will have many, many more rats sniffing around for the goodies."

With such lax security, the US authorities are lucky that McKinnon only had peaceful intentions in mind, Bevan noted.

"Gary is a self-confessed stoner and perpetrated the 'biggest military hack of all time' whilst completely wasted. This is clearly a sign of how lax the security of these systems was. If Gary had been clear minded and deliberate about what he wanted to achieve and was a malicious person rather than the pacifist he is - where exactly would we be now?"

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.