The Conversation
Subscribe
  • Academic rigour, journalistic flair
  • For curious minds
  • Expert news and views
  • Debate and ideas
  • From the curious to the serious

Hot Topics

  1. Gay marriage
  2. Australia in the Asian Century
  3. Convergence review
  4. Federal Budget 2012
  5. War on drugs
  6. Medical myths
  7. Bob Brown
  8. Square Kilometre Array
  9. Explainer
  10. Transparency and medicine

Evil descends on the NBN? Erm, not quite

Another day, another hacking exploit makes headlines. This time it’s a “self-taught, lone hacker”, David Cecil, apparently known online as “Evil”, who allegedly broke into Platform Networks' site, one of 13 service providers for the National Broadband Network (NBN). Cecil, from Cowra in New South Wales…

Aapone-20110727000334346321-nbn_hacker_orange_court-original-1311736286
Great headlines … shame about the reality. Australian Federal Police/AAP

Another day, another hacking exploit makes headlines.

This time it’s a “self-taught, lone hacker”, David Cecil, apparently known online as “Evil”, who allegedly broke into Platform Networks' site, one of 13 service providers for the National Broadband Network (NBN).

Cecil, from Cowra in New South Wales, has been charged with 48 counts of unauthorised access to, or modification of, restricted data.

He has also been charged with one count of unauthorised modification of data to cause impairment.

He is currently being held in custody and will appear in court again this Friday.

It’s still a little early to understand what exactly “Evil” is accused of doing to Platform Networks’ site but the strategy from the mainstream media has been to equate Platform Networks directly with the NBN.

“Self-taught hacker charged over NBN attack” reports the ABC. “NBN System Compromised” reports the Sydney Morning Herald.

And yet, in a statement this morning, the Australian Federal Police’s (AFP) Cyber Crime Coordinator, Brad Marden, said:

“[These attacks] wouldn’t have had a direct impact on the NBN itself. [Platform Networks] is actually a company that is contracted to the NBN to produce services for them.”

So what’s going on?

Parts of Platform Networks operations may have been compromised, although Platform Networks spokespeople say they notified the AFP as soon as they became aware of the attacks, in December 2010.

The important point, though, is that attacking Platform Networks is not the same as attacking the NBN.

Platform Networks is a Virtual Service Provider that purchases services from other companies and resells them adding additional services such as domain name resolution, web hosting, email and the like.

Among the services the company resells are different forms of network access including ADSL, 3G wireless and, from October this year, access to the NBN.

Evil, an unemployed truck driver who told online friends he had no computer skills, is suspected of mapping Platform Networks’ internal network and may have compromised a domain name server – the device that maps a domain name such as www.theconversation.edu.au to an IP address such as 122.100.15.243.

Loss of domain name services would certainly have inconvenienced Platform Network’s customers, but it is very unlikely the NBN services were ever under threat.

The NBN provides quite low level services. The company responsible for building the NBN – NBN Co – doesn’t care whether their infrastructure is carrying internet traffic or something else.

All the internet services are provided by companies such as Platform Networks.

The interesting thing about this story is not that the NBN may have been under threat or even that someone managed to break into Platform Networks.

Hacking is not that difficult to do. It is much easier to carry out an attack than to defend against them.

What’s interesting is that Platform Networks picked up the hack very early on, had procedures in place to track it, and worked closely with the AFP to gather evidence to bring it to court.

Perhaps the real story will come when details emerge as to how Platform Networks dealt with the hack when it was detected.

Join the conversation

Comments (7)

  1. Permalink
    Craig S Wright

    Craig S Wright

    (PhD; Adjunct Lecturer in Computer Science at Charles Sturt University)

    “Loss of domain name services would certainly have inconvenienced Platform Network’s customers, but it is very unlikely the NBN services were ever under threat.”

    This is an incredibly ignorant statement.

    DNS is the foundation of the internet in many ways. Users do not remember host IP addresses, they remember names. An attacker who can compromise a DNS server OWNS the network.

    For instance, if an attacker changed www.westpac.com.au from its real IP address to one pointed to a rouge system proxy that captured user logins, even SSL and encryption would not help. After all, the user is being redirected to the correct domain name and SSL ONLY validates a domain name.

    So, what could somebody do when they have compromised a DNS server on a network?
    1 Capture and redirect traffic, usernames and passwords
    2 Change data on the fly and subvert information
    3 engage in MiTM (man in the middle) attacks against systems

    Basically, when DNS falls, EVERYTHING on the internet fails.

    1. Permalink
      Philip Branch

      Philip Branch

      (Senior Lecturer in Telecommunications at Swinburne University of Technology)

      That's a fairly harsh comment Craig. As someone who used to work for a Domain Name registrar I think I have a reasonably good grasp of the importance of domain names.

      I don't accept that my comment was in the least bit ignorant. From what I can see Platform Networks handled this well. They seem to be an organisation who have systems in place to manage hacks like this. If someone did briefly gain control of their DNS system then, given how they handled everything else, I would expect them to be in a position to restore their DNS system as soon as the first complaining phone calls came in. So "inconvenienced" is, I think, an appropriate description.

      1. Permalink
        Craig S Wright

        Craig S Wright

        (PhD; Adjunct Lecturer in Computer Science at Charles Sturt University)

        I admit, I was a little grumpier than I sould have been that night.

        From what I see, the only reason this was "handled well" was that the person attacking them had no idea really. He was not particularly skilled and the DNS servers were not secured well.

        The comment made by Platform Network's managing director David Hooton of "Privacy-wise there's certainly not been any issues at all. This has been basically DNS servers and items which have been not containing customer data at all." Was totally ridiculous.

        Basically, give me DNS and I own your systems. I can do this in a manner that you and the clients of a system have no idea of (even with SSL (other than when a client cert is implemented and that is rare as).

        You may think their security is OK, but I think it was terrible. Too many holes from the analysis I saw.

        If a decent attacker had found that system, they would have basically owned it for a long time without detection based on the systems deployed.

        1. Permalink
          Craig S Wright

          Craig S Wright

          (PhD; Adjunct Lecturer in Computer Science at Charles Sturt University)

          Better... One report.
          "Mr Hooton declined to discuss how the company planned to defend itself against future hacking.

          "That's something which is an operational security item that we can't really discuss. Privacy-wise there's certainly not been any issues at all. This has been basically DNS servers and items which have been not containing customer data at all."

          Basically translated, "I have no idea so I will fail back to security by obscurity"

          Maybe a visit to CIS (http://www.cisecurity.org/) would help them, they could learn the basics of locking down a server. Nothing difficult.They failed the first time.

    2. Permalink
      Matthew Phipps

      Matthew Phipps

      (logged in via Twitter)

      I'm afraid that is an "incredibly ignorant statement" itself. Despite your credentials, I don't think you understand how SSL/TLS works. Let me break it down:

      When you access Foobar Bank at "https://foobar.com", you receive a TLS certificate. This certificate contains a public key and some metadata. This metadata could contain a full-fledged EV certificate with a real name, address and phone number plus the assurance that the site is owned by a real-world, traceable legal entity. Or it could contain…

      show full comment

      1. Permalink
        Craig S Wright

        Craig S Wright

        (PhD; Adjunct Lecturer in Computer Science at Charles Sturt University)

        Hi Mathew,
        “Despite your credentials, I don't think you understand how SSL/TLS works” Actually I know how it works extremely well.

        “could contain a full-fledged EV certificate”
        Yes it “could” but most users do not actually know the difference in the first place. What you will find is that it is rare for a user to check the certificate and the signing chan. Even if they do, there have been social engineering attacks that have resulted in fake Microsoft CA certs and more. Most sites do not use EV…

        show full comment

        1. Permalink
          Craig S Wright

          Craig S Wright

          (PhD; Adjunct Lecturer in Computer Science at Charles Sturt University)

          On another note, I have a class scheduled for SEC 660 where we will be demonstrating attacks against DNS and SSL/TLS based web servers and other systems.

          We will take the students through attacking DNS and using this to create a transparent SSL-MitM Proxy (that is man-in-the-middle) and actually teach them how to do this.If you do not believe this is possible, come along and learn just how erasy it really is.

          This is why DNSSEC is so critical.

          See the link for details.

          http://www.sans.org/mentor/details.php?nid=25839