In a Beacon Hill studio interview, McAfee consultant and identity‑theft specialist Robert Siciliano discusses the recent hacktivist attack on the Boston Police Department (BPD) website, claimed by the group Anonymous in retaliation for the department’s handling of Occupy Boston. Siciliano explains that hacktivists exploit known web vulnerabilities to deface sites and potentially harvest data from public‑facing portals such as tip lines. While no confirmed data breach was reported for this incident, he warns that similar attacks on law‑enforcement and federal sites have exposed personal information, credit‑card numbers, and intellectual property. He emphasizes that no system is 100 % secure and recommends proactive measures: employing ethical hackers to identify weaknesses, regularly updating passwords and software, and maintaining robust anti‑malware, anti‑spyware, and anti‑phishing defenses. The conversation underscores the broader risk to both public agencies and citizens who interact with compromised government websites.
Chapters
Also on the way, shut down by hackers. We're going to talk to a security expert about the attack launched against the Boston Police website.
Boston Police hope to have their website's blog back online later today. It's been down since Friday after a group called Anonymous took crediting— took credit for the hacking that happened last week. The group says they did it in retaliation for the way that BPD treated occupiers. Joining us now from our Beacon Hill studio with some insight is Robert Siciliano, McAfee consultant and identity theft expert. Thanks for being with us.
Good morning.
All right, let's talk about this, because you hear about stuff like this happening, but maybe not when it comes to a group like a law enforcement group. How does something like this happen to an organization like BPD?
Well, this is, uh, hacktivism at its finest. These are, uh, rogue renegade hackers. These are ego hacks.
Okay.
And they look for vulnerabilities in these websites to make a statement. And here they made a statement about, um, Occupy Boston. Uh, more so this is an annoyance than anything else. There hasn't been any actual data leakage that would compromise identities, but it does, you know, defacing the Boston Police Department doesn't make them look good either.
Sure, no, it doesn't. You know, without giving anyone any ideas out there, how easy is something like this to do?
Well, unfortunately, most websites have some form of vulnerability or the other. It's not easy, but it certainly can be done with the right tools of technology.
Okay, well, and this is probably what a lot of folks are thinking. Menino said this Friday, and it's really probably the concern of a lot of folks out there might have after hearing this, he said if they could hack that If they can do that, what else could they hack? Is that a concern?
Certainly. The capabilities of these unethical criminal hackers goes far beyond just ego hacks and defacing public websites. Many times they have compromised big huge databases, downloaded millions and millions of credit card numbers, personal identifying information, compromised identities, even got intellectual property. Hacking is at its epidemic proportions at this point. We are certainly in the year of the hacker and the hacktivist. And both public and private enterprises need to batten down the hatches.
Well, and it's not just putting, you know, BPD at risk necessarily, but any of the consumers, so to speak, of their website. So in a sense, it's not just an attack on them, but attack on any of us who might be using the website. Is that true?
Without a doubt. Some of these websites, even the public-facing BPD, in some cases they may have tip lines where consumers might enter their personal information— names, phone numbers, email addresses, and so forth. And when that information is compromised, then it can actually affect the public in that way.
In this specific incident, though, any folks out there be at risk because this was hacked?
Well, you know, ultimately, um, uh, I'm not sure if it has been disclosed whether or not the public's information in this particular breach has been compromised. I know in other public-facing websites with other law enforcement across the country, it has. Ultimately, if you have made a tip, I would contact the Boston Public— Boston Police Department and find that out if in fact your information may have been compromised.
Let me ask you this, because obviously we're talking about this here because it happened here, but how big of a problem is this not only locally but on a federal level?
Well, there have been many federal government websites that have been compromised as well in many different ways.
Right.
And you have IT professionals working for government and private industry that have been gearing up for quite some time now. They do have systems in place to protect themselves, but there is no such thing as 100% security. There's always going to be some way, some form of getting in. The idea is to reduce the damage in so that, um, again, identity's not compromised or it results in some type of damage to our critical infrastructures.
All right, so what's your recommendation at this point for folks who might be worried about something like this happening to their site or to their information?
Well, ultimately, you want to have what's called ethical hackers that will work towards breaking into your own sites, look for— looking for those vulnerabilities. If they can find those vulnerabilities, chances are the bad guys can. So you have security professionals looking at your sites, locking them down, and doing things like updating and changing usernames and passwords and updating your antivirus and malware protection, anti-spyware, anti-phishing, and so forth.
All right, Robert Siciliano, thanks for being with us at our Beacon Hill studio.
