septembre 14, 2011
par Christophe Perrin
Il y a quelques semaines, un hacker du groupe des anonymous quittait l’organisation suite à un certain nombre de désaccords avec l’orientation prise lors des dernières actions (pour plus de détails, vous pouvez vous reporter à cet article). Suite à l’annonce de son départ sur un compte twitter, un membre du Cisco SIO a eu l’occasion d’échanger avec lui afin de mieux cerner son profil et ses motivations. Pas de sensationnel, mais un parcours somme toute classique.
JL: Can you tell us a little bit about your background?
SparkyBlaze: Well, I am from Manchester. I went through school not caring… my teachers always said I knew the stuff but I couldn’t be bothered to do anything. They were right, as nothing interested me. I am only hard-working if I am passionate about something, like computers. I went through my childhood bored as hell till I found computers. I love things like Defcon and hacker conferences and talking to other hackers. I love managing servers (and making sure they are secure).I am white, in my 20′s and planning on moving to America to study computing and ethical hacking (I think it is best if they don’t know about me and anon ;D). I plan to live there as I have always wanted to. I love guns also, but it is mostly illegal in Britain and there are no ranges to shoot on.
JL: How did you get into computers and security?
SparkyBlaze: I got into computers as I grew up around them. I like physical security and just applied my interest to computers. Then I started to learn about firewalls and exploits… things like that.
JL: And how did you get hooked up with Anonymous?
SparkyBlaze: Well I got into Anonymous like most people there. I love hacking and I believe in things such as free speech. I came across a page on Anonymous and was interested in them so I just started hanging out in IRC with them and it went from there.
JL: What are your thoughts on hacktivism?
SparkyBlaze: Hacktivism is an interesting subject. I love hacking and I believe in free speech and anti-censorship, so putting both together was easy for me. I feel that it is ok if you are attacking the governments. Getting files and giving them to WikiLeaks, that sort of thing, that does hurt governments. But putting user names and passwords on a pastebin doesn’t [impact governments], and posting the info of the people you fight for is just wrong.
JL: How do you think the rest of the world views hackers?
SparkyBlaze: Hackers and computer savvy people are just frowned upon. Hackers are the big, bad wolf and computer savvy people need to “get out of there basement.” Most people don’t know what hacking is, they use the same passwords everywhere and don’t use antivirus/firewalls. For them it’s an “out of the box” Windows install with IE7. This is the issue with people nowadays; they don’t understand the importance of computers and computer security.
JL: What is your take on the current status of the security industry?
SparkyBlaze: Information security is a mess, like I have just mentioned. Companies don’t want to spend the time/money on computer security because they don’t think it matters. They don’t encrypt the data nor do they get the right software, hardware and people required to stay secure. They don’t train their staff not to open attachments from people they don’t know. The problem isn’t the software/hardware being used… it is the people using it. You need to teach these companies why they need a good information security policy.
JL: What are some of the biggest challenges you see out there?
SparkyBlaze: In my mind social engineering is the biggest issue today. We have the software/hardware to defend buffer overflows, malware, DDoS and code execution. But what good is that if you can get someone to give you their password or turn off the firewall because you say you are Greg from computer maintenance just doing testing. It all comes down to lies, everyone does it and some people get good at it.
JL: So what sort of advice would you give enterprises and other organizations out there as they grapple with security-related issues?
SparkyBlaze: Here’s the advice I would give to companies:
- Deploy defense-in-depth
- Use a strict information security policy
- Have regular audits of your security by an outside firm
- Use IDS or IPS
- Teach your staff about information security
- Teach your staff about social engineering
- Keep your software and hardware up to date
- Watch security sites for news on computer security and learn what the new attacks are
- Let your sysadmins go to defcon ;D
- Get good sysadmins who understand security
- Encrypt your data (something like AES-256)
- Use spam filters
- Keep an eye on what information you are letting out into the public domain
- Use good physical security. What good is all the [security] software if someone could just walk in and take [your “secure” systems]?
JL: What kind of advice would you have for young folks who are interested in working in security?
SparkyBlaze: Stay away from black hat hacking. White hat hacking is a lot more fun, you get paid for it, it is legal. A conviction for hacking and leaking a database will affect you for the rest of your life.For example: You go for a job and it is down to you and someone else. You both have the same qualifications and are good at what you do. They do a background check on both of you… his is clean, yours says you hacked a server and put all the data online… Who will they give the job? It won’t be you.
