Power, glory fuel hacktivism against companies

The arrests of three Spaniards in connection with hacking Sony probably won't slow the rise in politically motivated cyberattacks, known as hacktivism. "Hacktivists believe their ethos represents the future of a cyber-connected world," says Dave Jevans, chairman of security firm IronKey. "They will continue attacks based on real or imagined positions against companies and government agencies." Sony has become a case study of hacktivism power plays. Since April 20, multiple hacking groups and individual hackers have been hammering the entertainment giant's online properties with denial of service attacks. They've also stolen account data for more than 100 million Sony customers. Sony's sin: pursuing a civil lawsuit against a PlayStation owner for modifying his gaming console. Spanish police say the suspects are members of Anonymous, a longstanding hacktivist group best known for attacking corporations that opposed WikiLeaks. Anonymous is believed to have knocked out Sony's PlayStation Network for nearly two weeks in late April, and stolen sensitive data from 77 million PlayStation Network account holders and 24.6 million Sony Online Entertainment customers, Meanwhile, a month-old hacktivist group, LulzSec, has been taking credit for smaller attacks that have disrupted Sony online properties in Greece, Turkey, Canada, Japan and Russia. "Anonymous doesn't have a centralized leadership," says Luis Corrons, technical director of PandaLabs. Unlike profit-minded cybercriminals, hacktivists are motivated by "glory, ideology, and the need to show off their skills," says Anup Gosh, founder of Web browser security firm Invincea. Consumers often become collateral damage, when hacktivists boast of their activities by making stolen data public. Companies face a damaged brand image. In Sony's case, investors hope shoppers don't choose Microsoft's Xbox 360 or Nintendo's Wii over PlayStation 3 this coming holiday season, based on security concerns. Hacktivism is expected to continue blossoming, experts say. "Given the ease and anonymity with which these attacks can be conducted and the jurisdiction issues, it is likely that the bad guys will remain in the driver's seat for the foreseeable future," says John D'Arcy, assistant professor of information technology management at the University of Notre Dame.