eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Online “hacktivism” continues to expand and diversify as protesters find new ways to use the electronic realm to display their support or displeasure for offline politics, and researchers with anti-botnet specialists Damballa are following the maturation of some new models for cyber-protesting that they’re citing as fairly impressive in terms of their overall advancement of the practice.
Damballa vice president of research Gunter Ollman outlined his presentation delivered on the topic at the CSI 2009 conference – being held in Washington this week, in a blog post that highlights some of the more sophisticated techniques being employed by online hacktivists, charting their work as what he believes to be representative of what we should expect to see from such campaigners in years to come.
Ollman specifically calls to light the use of “opt-in” botnets, through which protestors are increasingly volunteering to donate some of their computing resources to enable cause leaders to carry out DDoS campaigns and other attacks aimed at whatever constituencies they seek to assail.
The expert specifically warns that some corporate entities may need to take a closer look at such capabilities and brace for the day when disgruntled former customers might align to target their operations using such botnets. Thus far most reported hacktivist activities have targeted government entities, such as during the concentrated DDoS campaigns carried out against the government of Estonia in 2007 that were reportedly enacted by Russia-based attackers unhappy with the separatist nation’s removal of WWII-era statues and other former Soviet Union iconography.
“It used to be that the disgruntled and disaffected could grab a banner and picket for their cause outside of the local government or global conglomerate headquarters and get their message noticed by all to see,” Ollman writes. “You can still do that, but governments and conglomerates have embraced the Internet with their work-from-home policies and technologies so that the only people inconvenienced by these physical protests are the protesters themselves.”
Nowadays, it appears that there is growing recognition among protestors that they can have an even more disruptive impact, and further distance themselves from potential prosecution for carrying out their efforts, by enlisting the power of the Web to rattle whomever it is that they seek to object to.
And lest anyone should think that the use of opt-in botnets to carry out hactivism is a far-off concept, the expert said that based on his research people are already lining up to offer their distributed computing capacity to those with whom they’ve partnered to advance a specific movement.
“We’ve already seen some of the tools and baby-steps in to taking protesting online, but what will it look like when things get really start to get serious,” Ollman observed.
Further, by utilizing the power of social networks to recruit supporters and organize their efforts, those leading electronic protests will likely be able to attract “hundreds of thousands of compatriots” willing to empower their campaigns in an on-demand fashion, he said.
Another likely outcome will be that protestors will move beyond time-honored DDoS techniques such as Web site denials and e-mail flooding to go as far as interrupting VoIP-based telephony services.
If activism is all about getting your voice heard, and drowning out the message of your adversaries, the future for hacktivism would appear to be promising, or threatening, depending on which side you find yourself on.
Follow eWeek Security Watch on Twitter at: eWeekSecWatch.
Matt Hines has been following the IT industry for over a decade as a reporter and blogger, and has been specifically focused on the security space since 2003, including a previous stint writing for eWeek and contributing to the Security Watch blog. Hines is currently employed as marketing communications manager at Core Security Technologies, a Boston-based maker of security testing software. The views expressed herein do not necessarily represent the views of Core Security, and neither the company, nor its products and services will be actively discussed in the blog. Please send news, research or tips to SecurityWatchBlog@gmail.com.