Category Archives: guest post

On Anonymous declaring “War” on Singapore PAP government – Note from a regular IT dude

This post is contributed by a friend of mine, Wei Kiat, who is a regular IT dude. He has some interesting perspectives to share on the recent Anonymous and Messiah saga. If you found what was written here useful, do share this post to stop the fear-mongering:

1. Fear Mongering & the State of things

There had been a number of cyber attacks over the past few days by someone who calls himself “Messiah”. The attacks sparked panic island-wide, with people fearing about a “cyber” doomsday where everything would magically stop working and the whole island in chaos. I thought it would be prudent to set the records straight, to help layman understand what these attacks actually entail and to prevent the spread of needless panic and fear. Cases of blind-leading-blind when it comes to attacks and its implications are too rampant.

The usual disclaimer:

1) I’m not an IT security professional or a white or black hat hacker, merely a programmer, IT consultant & entrepreneur. If I have made any factual mistakes, please kindly feedback and I will rectify them.
2) The following are my theories. Many of my assumptions on the capabilities of Messiah I do not know as facts. I may be wrong. Please take it with a kilogram of salt.

Now, let’s consider Messiah’s technical capabilities.

2. Messiah’s Technical Capabilities

2.1 The Difference between “Web Systems” & “Internal Systems”

In other to understand what really went on behind cyber attacks over the past few days, for the sake of simplicity, let’s divide computer systems into two main categories, web systems and internal systems. By “web systems”, I refer to all the servers and systems behind an organization’s website. By “internal systems”, I refer to mission critical systems used by an organization for their day to day functions. For example, LTA’s website is on a “web system”, LTA’s traffic controller system is an “internal” system.

The attacks over the last few days all involved web systems, which are easier targets for attack because these systems are more public while generally having weaker security mechanisms. There is no sign that Messiah was able to gain access to any internal systems to date. Fear-mongers have been preaching and misleading people in thinking that as an example, if LTA’s website got hacked, our traffic lights will stop working. That is simply not the case, and Messiah has not yet demonstrated his ability to carry out ”infrastructure crippling” attacks. Sad to tell you, but ERP will still continue to work even if LTA’s website is down.

2.2 Understanding attacks on “Web Systems”

To help layman in understanding the nature of attacks on websites, let’s imagine that every time you type in a URL on your web browser, a tiny truck comes out of your computer (a web request), look up the destination on street directory (a DNS server), drives to the warehouse (website server) to pick something up (the actual website) and bring it back to you (website loads on your screen).

To attack a website, the attacker can either prevent your tiny truck from ever reaching the factory while leaving the factory untouched, or enter the factory to shut it down (a.k.a hack into the server.)

Attacks over the past few days can be categorized into two main types: defacement attacks (when the website got vandalized, such as Straits Times’ Blog) and service availability attacks (when the website becomes inaccessible for a period of time, such as the supposed hack on government websites).

2.2.1 Defacement Attacks

A very strange pattern emerged. It seemed as if only sites running open source CMS (content management systems) and/or or cheaply outsourced were defaced. For example, only the blog section of Straits Times was hacked, because out of the entire Straits Times site, only the blog section uses an open source CMS. Hacking into a CMS involves gaining access to either (1) the CMS admin dashboard or (2) the web server. The CMS admin dashboard is a simple system that allows non-IT personnel to update the content of a website. Hacking into the CMS admin dashboard does not mean the hacker has complete access the entire web server.

Gaining access to CMS admin dashboard is easy. For open source CMS solutions, exploits are always discovered and published, in order for security fixes to be written and distributed in a very short amount of time. However, most solution vendors in Singapore hand off CMS to their clients immediately after project conclusion, and seldom advice their clients to do constant upgrades, opening huge opportunities for attack. Many CMS admin dashboards also use the same default username, such as “admin”. In most cases, such accounts are shared among different staff, so to help everyone in remembering the password, plain english passwords are commonly used. It is then easy to use a simple dictionary attack to hack. Dictionary attack simply involves using a program to try different passwords at high speed. Given enough time (days, months, years, centuries), any account could be hacked this way.

From the very specific targets of attack (only open source CMS sections of a website were hacked i.e. Straits Times Blog, and only websites using open source CMS were hacked i.e. CHC website), I think it is safe to conclude that Messiah did not attempt or did not have the necessary skills to hack into an actual server.

2.2.2 Service Availability Attacks

How about supposedly bringing down a couple of government websites as well as Straits Times, Stomp and Hardwarezone (all owned by SPH) for a couple of minutes? For this post, let’s assume the government websites were down because of a cyber attack, not a “scheduled maintenance”.

Server hacks are hard to recover from if there’s damage done. Looking at how fast we recovered from those attacks, it is possible to speculate that the servers were never actually hacked. Using the tiny truck analogy from above, the attacker simply prevented your tiny truck from ever reaching the factory (so when you try to access a website, it could not load). Two common methods are known as DoS (denial of service) and DNS Spoofing or poisoning.

Denial of service attack is an attack that doesn’t require much skills. To prevent your tiny truck from reaching the factory (connecting to the web site), the attacker simply had to send millions of tiny trucks to the same factory at the same time so that the highway became so congested your truck couldn’t get through.

While I am not too familiar with DNS poisoning, DNS servers are like street directories. DNS poisoning attack messes up the directories, causing your tiny truck to lose its way and can never reach the factory.

Let me repeat, both DoS and DNS poisoning attacks do not involve actual hacking (e.g the factory in the analogy above was never compromised). There is no need to infiltrate any government or SPH servers to execute these attacks.

2.3 What does this say about Messiah?

In summary, Messiah was only able to breach certain web systems; he was not reported to have breached any internal systems. In cases where web systems were breached, Messiah was only able to do so via the CMS. He was never able to hack into the actual web server. For websites that does not use weak CMS, he simply did a service availability attack. This doesn’t sound like someone who is an extremely skilled hacker as proclaimed in the video.
Conversely, the skill-set required for the attacks we have seen so far are very different from those crazy hardcore attacks we have seen Anonymous do on news reports. I am speculating that Messiah may not even be from Anonymous.

3. What’s next?

I think Messiah will continue looking for easy exploits among high profile websites, and when he or they can’t hack, they will simply do a DoS or DNS poisoning attack to make a statement.

I trust the security capabilities of our government sites, and I still believe that unless there are different hackers who join today, our data on government servers and infrastructures will remain safe.

As an average Joe, I don’t think there’s much to fear about these attacks because:

1) As concluded above, Messiah doesn’t seem competent enough to actually compromise important servers
2) Once again, “web systems” and “internal sustems” are different. Hacking into LTA website does not equate hacking into LTA. Your traffic lights will still work. They are different things.
3) Assuming that even if he or they have the ability, there is no reason for Messiah to try to gain unauthorized data, or to abuse or leak them. The youtube video called for support from Singaporeans. There will be more haters than supporters if such things happened.
4) The attacks so far are more in line trying to “make a statement” than to retrieve or leak any sensitive data. This trend may continue.

Hope this post help provide some insights into the confusing world of cyber security, and to maybe help with allaying the fear and reducing confusion after all the blind-leading-blind articles that have been popping up lately.

That said, organizations and individuals should remember to always exercise prudence and preemptive diligence when it comes to security. Cyber attacks are very real and may strike you when you least expect it.

Advertisements

On National Service – Guest Post by Ohad Levinkron, Israel

Singapore is not the only country in the world with a conscripted army. There is also Israel, South Korea and Taiwan, among others.

After stirring up a debate on the review of the NS system in Singapore, I am opening this blog up for guest blog posts from conscripted military personnels from around the world.

To kick start, here is an account written by Ohad Levinkron, a friend I got to know during my trip to Israel last year:

Maybe we should start with some background. I’m from Israel.

Yep, that’s the really small country we call the Jewish State, located somewhere in the Middle East. We call it that because it was founded, about 60 years ago, as a home for the Jewish people. We used to live here once, about 2000 years ago, then stuff happened, and to make a (really) long story short we’ve been wandering the planet ever since. That is, up until now. Anyway, I guess Singaporeans already know something about living in small, young countries.

So apart from my country being really small, it’s not in the greatest place you could think of. I mean, the location does have its advantages – Our forefathers walked this place, we all feel very attached to it, the beaches are pretty nice too, but security-wise, well, it could be better. Basically, in the last couple of millennia there weren’t that many of us around here, and when we started coming back the people around here weren’t very into that. Those are today’s Palestinians. Now these guys happened to be Arab, as are every one of the countries in our neighborhood, so it was pretty clear who was winning the regional popularity contest. Sadly, though, this didn’t just end up with them not speaking to us during lunch breaks, and every decade or so we find ourselves in some sort of war. There are better years and there are worse, but while the casual tourist may not notice this much, the conflict is something Israelis face constantly.

So there’s a brief intro* to the Middle East conflict for you.

Now all that leads up to one fine day, about 15 years ago. Back then I was a bored 11th grader, sitting in class as usual, paying as little attention as I possibly could. On that particular day, however, the teacher passed out a form. It was a form from the army (which generally aroused much excitement amongst us), and it was about giving the army permission to see all of our grades.

I think I was about the only one who didn’t sign it. What if I don’t get good grades, I thought to myself. Do I really want some government official to see my private info? Who knows where it’s going to end up, and who’s going to see it in 30 years, when I run for public office? (At the time I didn’t think about who was going to care). Well, holding on to those principles didn’t last very long. After a few months all my friends started getting summoned to exams for special units, and I had to go and chase those units down just to beg them to look at my grades. There’s principles for you.

In the end I was fortunate enough to get into a good unit, and serve in interesting and meaningful ways. In fact, I had so much fun that beyond the obligatory 3 years I even signed up for a couple more. I was also lucky to do my service in a comfortable office, and not in some watch tower, freezing my pants off and risking my life in the middle of some sleepless night. Most of my friends were in similar positions, as I met many of them in those formative years in service. Not all, though. Some were just wasting away their best years doing some useless clerical job. Many were out on the front lines (effectively in our back yard), dealing with the everyday routine of our conflict. Some got hurt. Most were affected, unoblivious to security issues for the rest of their lives – whether identifying with the system they were a part of, or shunning it away. Almost everyone came out with their best friends for life.

Eventually I did get out, and went on to study. When I was an undergrad, one of my best friends set me up with an interview for a small start-up company in the internet business. He had known one of the founders from University, and it also helped that the three of us had served in the same army unit. I didn’t actually know the guy during my service, but I believe the official “stamp of approval” from being in that unit, and the feeling of comradery we shared, did play some part in getting me the job. Further along, another army buddy offered me a position at a company he had set up. After graduation, when I was looking for my first “real” job, my army record again played no small part in impressing the future boss. I would be very conservative to estimate that 50% or more of the people in our company got in based on their military record, and I don’t think this is unusual. This by no means indicates they don’t deserve to be there – many are of the brightest I know, and of the best in their field; But that army clerk, signing off one kid to the barracks while his friend went to a high-techy R&D unit, played no small part in their lives.

In a country like ours, military service is inseparable from who we are. Almost all kids aged 18 enlist for 2-3 years. A common saying goes that this is only the beginning; Later they are released into reserve duty, which may mean up to a month of every year, of (frequently voluntarily) leaving work and family behind and going off to serve. One of the main issues of our 2013 elections was the exemption of certain groups of people from service. The injustice of this was enough to trigger widespread demonstrations in public, and heated debate at our homes. And every few years the situation here escalates, and we are again reminded that reserve duty is not just in theory. But army duty doesn’t just divide us, it also brings us together. These shared experiences we have: boot camp, and our drill sergeant; painting the grass green and the other stupidities of military bureaucracy; waiting for mom and dad to visit over the weekend, embarrassing us in front of our friends but bringing along some home-cooked food to make up for it – Like our history, they are much of what makes this strange mix of immigrants one united nation.

Is it a necessary result of our situation? Or one of its causes? Mandatory service in Israel is not really up for debate. We can’t even imagine what Israel would be like without it. But it surely has a big impact on our individual lives, and our society.

I believe that in a mature and open society, important issues should be eligible for public debate. After getting a glimpse of the discussion through Alvin’s (wonderful) blog, I can only hope that NS in Singapore will continue to be so. As an Israeli, I think we could learn from your example.

*Disclaimer: I think it’s also pretty accurate, but feel free to check out the details yourself.

If you would like to contribute a guest blog post on the topic of conscription or know of someone who would like to contribute, please email me at alvinologist@gmail.com.