Feeds

McKinnon a 'scapegoat for Pentagon insecurity'

US mil still wide open to attack, says reformed hacker

Next gen security for virtualised datacentres

As accused Pentagon hacker Gary McKinnon hopes against hope to avoid being extradited to the US, another reformed military systems meddler considers his own case - and how different the outcome was.

McKinnon is probably days away from extradition. Only a last minute plea to the Home Secretary "Wacky" Jacqui Smith - based on McKinnon's recent diagnosis with Asperger Syndrome - now stands between the Scot and a US trial for hacking into US government and military systems. Friends and family staged a demonstration outside the Home Office on Tuesday in a bid to draw attention to McKinnon's plight.

The handling of McKinnon's case is in marked contrast to how US authorities handled a similar one ten years ago. Like McKinnon, reformed computer hacker Mathew Bevan was charged with breaking into US military computer systems. Bevan was also curious about searching for evidence that the US military had harvested technology from crashed UFOs. Bevan's alleged crimes were cited as examples of cyberterrorism at Senate hearings in 1996.

But no attempt was ever made to extradite Bevan to the US. Instead he was prosecuted in the UK. The case eventually fell apart after 18 months, when prosecutors decided not to proceed.

Bevan put the legal fight behind him and has since gone on to become an ethical hacker and security consultant. Speaking exclusively to El Reg, Bevan said McKinnon is being used in a political game that has more to do with securing funds than deterring or preventing attacks.

"Clearly, lessons have not been learned since I breached similar systems and as I have always suggested - perhaps stopping the intrusions is not the goal of the administration," Bevan said. "Tacitly allowing access to machines by ensuring that default passwords or in fact access methods without passwords is suggestive of a system that really does not care too much about many of the machines connected to it."

Bevan questions why Windows PCs on US military networks are connected to the internet via direct IPs. Thousands of attackers regularly use the same remote access port accessed during McKinnon's hack, but little or no action has been taken in their cases, Bevan adds.

McKinnon has said that many other hackers had gained access to the same systems he was accessing, questioning why US authorities singled him out for prosecution. The fact that McKinnon did nothing to disguise his tracks and lived in a country with a friendly extradition regime probably has a fair bit to do with this.

Bevan supports McKinnon's contention that he was far from alone in rooting around US military systems. "You ask any military hacker about the machines they broke in to and they will tell you they were not the only people on those systems. Of course, they weren't the only people, as there were great numbers of people whiling away their time hacking computers."

Pork barrel ploy

McKinnon, according to Bevan, was far more than simply unlucky.

"Why is it that only a tiny number of those people ever face prosecution? It is clearly not because the others cannot be found. You cannot believe that out of so many people, Gary just happened to be caught."

McKinnon is being used as a scapegoat in a bid to secure extra funding to protect US military networks, according to Bevan, who reckons a commercial organisation would never get away with such trickery.

"I think it's all about timing and whether or not the hacker will make a good scapegoat whilst allowing the administration to request further money. The fear machine can keep churning out propaganda as per normal, but don't expect those machines to actually get better security. They are not businesses, have no shareholders and therefore do not have to answer to the same stringent rules and tests that the computer systems of corporations would."

Bevan compared hacking attacks to an infestation by pests. Both stem from a failure to follow basic housekeeping rules, he argued.

"My cynical side believes that those 'pesky hackers' are treated just like any bug infestation, the odd one or two or even a handful is not much of an issue until the place becomes overrun. It is then that you can call in the exterminators and make a big fuss about the problem, of course it never addresses that the usual problem with an infestation is someone has not been keeping their place tidy. You leave scraps around for rats to find and in a short time you will have many, many more rats sniffing around for the goodies."

With such lax security, the US authorities are lucky that McKinnon only had peaceful intentions in mind, Bevan noted.

"Gary is a self-confessed stoner and perpetrated the 'biggest military hack of all time' whilst completely wasted. This is clearly a sign of how lax the security of these systems was. If Gary had been clear minded and deliberate about what he wanted to achieve and was a malicious person rather than the pacifist he is - where exactly would we be now?"

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.