3Qs: Is a potential Facebook hack on the horizon?

The hacker group Anony­mous recently announced through a YouTube video that it plans to “kill” Face­book on Nov. 5 for sup­pos­edly abusing the pri­vacy of its users. We asked Engin Kirda, the Sy and Laurie Stern­berg Inter­dis­ci­pli­nary Endowed Pro­fessor for Infor­ma­tion Assur­ance — with joint appoint­ments in Northeastern’s Col­lege of Com­puter and Infor­ma­tion Sci­ence and Depart­ment of Elec­trical and Com­puter Engi­neering — to dis­cuss the poten­tial impli­ca­tions of the hack and pro­vide some insight into the motives behind hacking groups such as Anonymous.

How would the infa­mous hacking group Anony­mous go about car­rying out its threat to “kill” Face­book? What effect would a suc­cessful attack have on Face­book users?

I see two options here: The first option is that the group has dis­cov­ered an unknown vul­ner­a­bility on Face­book, and is plan­ning to exploit that to com­pro­mise the avail­ability of the site. The second option is a so-​​called Dis­trib­uted Denial of Ser­vice (DDoS) attack, which is common and well known on the Internet. In such an attack, the attackers typ­i­cally use groups of com­pro­mised com­puters to send many web requests at once to the tar­geted web­site. Because of the sudden increase in traffic, the web­site might not be able to deal with the increased number of requests and simply fails. As a result, the site becomes unavail­able to users.

Anony­mous says in its video that it is inviting people to par­tic­i­pate in “killing” Face­book. To me, this sounds like it is plan­ning to pro­vide tools to vol­un­teer users that would be used to gen­erate large num­bers of web requests. If such an attack were suc­cessful, Face­book would become inac­ces­sible for many of its users.

I would cau­tion everyone (espe­cially stu­dents who like to exper­i­ment) against using any tools that could be used in a DDoS attack — usage of such tools is illegal and can get you into a lot of trouble.

Face­book has launched a “bug bounty” pro­gram to keep its users safer from attacks. What other pre­cau­tions do you expect Face­book will take in order to ensure user-​​safety?

From past col­lab­o­ra­tions with Facebook’s secu­rity team, I know that they take all poten­tial secu­rity prob­lems very seri­ously. In fact, we dis­cov­ered some secu­rity issues on Face­book last year as a result of our research, and the site was very quick in fixing them. I am sure that it will be mon­i­toring its sys­tems and will be con­stantly looking for vul­ner­a­bil­i­ties it is not aware of. Unfor­tu­nately, though, there is no easy fix to DDoS attacks. The only effec­tive solu­tion right now is to have more com­puting resources avail­able than the attackers. My guess is that Face­book may try to increase its server resources if it is expecting an attack. For example, it could decide to buy more resources from cloud com­pa­nies like Akamai.

Are hacking groups, such as Anony­mous, out to make a social point or to test their skills against poten­tially impen­e­trable systems?

I think it is a mix of the two. In the case of Anony­mous, though, I think it’s more about making a polit­ical and social state­ment. Some of its hacks to date have been impres­sive but at the same time, DDoS attacks are pretty straight­for­ward and tech­ni­cally not that sophisticated.

For me, it is fas­ci­nating to see a change of mindset about how we look at cyber-​​security today. Groups like Anony­mous are demon­strating how vul­ner­able many com­pa­nies and orga­ni­za­tions are and how the lives of ordi­nary people can be affected if the secu­rity of cyber-​​systems is not taken seri­ously. I am very excited to say that North­eastern has been growing fast and gaining vis­i­bility in this area.