Tackling hostile hacking

India has awoken to Chinese e-incursions on its IT and telecommunications facilities, and has put measures in place to prevent the breach of classified information, notes GAURAV SURATI.

Many of you would have heard or read about incursions by the Chinese army (known as the People’s Liberation Army) taking place on India’s border with China, along the international border. But there are the lesser known cyber attacks (which I like to call e-incursions) taking place from Chinese hackers into the computer systems of the Indian government, businesses and academics. By computer systems I am referring to servers, computers and other networking devices that are used to store and transmit several gigabytes or often terabytes of data. A recent report from Canadian and American researchers called ‘Shadows in the Clouds’ suggests that there are systematic cyber attacks carried out by Chinese hackers in sensitive places like computers of the Ministry of Defense (MoD) in an attempt to steal secret, highly classified documents. Researchers have claimed that this spy ring has also tapped into Indian embassies in Belgium, Serbia, Germany, Italy, Kuwait and the United States to assess the Indian government’s relations with other countries throughout the world.

Hacking into DRDO’s computer systems to steal design blueprints, project details and other bits and pieces of information could be very fruitful for these infiltrators, and the information could easily get leaked.

Professional hackers armed with sophisticated hardware and software can be very hard to trace, given the complexity of the internet today. In a bid to pilfer India’s defense project documents, it’s hard to rule out that these hackers wouldn’t have tried to tap into India’s premier defense establishment DRDO (Defense Research and Development Organisation). DRDO has many branches spread right across India, and they are involved in projects like missile development, electronic warfare, avionics and tank armament. Hacking into DRDO’s computer systems to steal design blueprints, project details and other bits and pieces of information could be very fruitful for these infiltrators, and the information could easily get leaked. Any seepage of such highly sensitive information could turn out to be devastating for India and its armed forces. Even computers in the office of former National Security Adviser M K Narayanan, haven’t been spared. Earlier this year, reports from British newspapers suggested that Chinese hackers have also tried to penetrate computers of the National Security Adviser and Mr M K Narayanan has admitted to such attacks.

Under these new rules, service providers like Tata, Reliance and BSNL will now have to engage government approved, internationally certified network auditors for network forensic, network hardening, network penetration tests and risk assessment.

Given the sophistication and complexity of such attacks, it’s always difficult to trace back their exact origin. Even if originating locations are found, it is a major challenge to book and prove offences against the culprits. Obviously, the common man is left wondering what sort of security measures can be taken to thwart such attacks. Well, anti-virus, firewalls and anti-hacking security software could serve as the first line of defense. Apart from this, developing much harder to crack algorithms could be possibly the best solution to scramble (encrypt) and unscramble (decrypt) stored information. If recent reports are to be believed, the Indian government’s cyber efforts are stumped by its ability to produce only 3-4 encryption algorithms in a year. According to a new government proposal, the National Technical Research Organisation (NTRO) and Defense Intelligence Agency (DIA) will be responsible for developing offensive capabilities. Under this newly drafted strategy, NTRO and DIA will join hands to recruit IT professionals from the industry and provide them a legal shield (under the IT Act, hacking is a punishable offence) while getting them to find a solution through ethical hacking indulged in by hostile countries. ‘Ethical hacking’ is a term used to describe someone who penetrates into his own company network, seeking any vulnerability in order to make it more secure. In other words, the motive behind ethical hacking is to provide some kind of benefit to the company or a nation. Many large companies and countries like the United States maintain teams of ethical hackers in order to locate and patch up any vulnerability in their computer networks. Now the Indian government too, is taking measures to involve engineers and scientists from IITs and Indian Institute of Science (IITSc) to develop highly encrypted algorithms in large numbers.

Moreover, in order to reduce the chances of any such sabotage from a hostile country, the government, along with the Department of Telecommunication (DoT) has amended the licenses of telecommunication service providers to make them completely responsible for their networks. Under these new rules, service providers like Tata, Reliance and BSNL will now have to engage government approved, internationally certified network auditors for network forensic, network hardening, network penetration tests and risk assessment. Equipment vendors like Cisco, Ericsson and Huawei (Chinese vendor) will be required to allow service providers and the DoT or designated agencies to inspect their hardware, software, design, development, manufacturing facility as well as their supply chain. Vendors can also face fines and get blacklisted if a security breach is detected at a later stage. The rift between the Indian government and Blackberry manufacturer Research in Motion (RIM) to give message intercepting capability is the latest development in this area.

Especially after the Mumbai terror attacks and the method in which the attacks were carried out, the Indian government seems to be on the right course by not taking any chances and protecting its computer and mobile networks. On the other hand, the Indian IT and telecommunication market is too lucrative for service providers and vendors to miss out.