Priyanka's twitter update could be security threat

[Ankit Fadia, India's uber hacking expert, appears to heavily promote Viagra, or been hacked by evil spammers that found a way to subtlety deface the web page. - http://attrition.org/errata/sec-co/fadia01.html - WK]


By Kumar Saurav
Mid Day
2009-11-23
Mumbai

Not just Priyanka Chopra, but any celebrity or public figure's Twitter updates can jeopardize national security, claims 24 year-old ethical hacker Ankit Fadia

Mumbai-based cyber security consultant Ankit Fadia, who claims that his website Hacking Truths was judged as the second best hacking site in the world by the FBI, says social networking sites are the latest threat to India's security. The potency and penetration of social networking in the country has made it possible for anyone to track and connect with film stars, politicians and other public figures who were once beyond reach.

Karan Johar, Priyanka Chopra, Aishwarya Rai, Shashi Tharoor and Barack Obama are just a few from a whole bunch of celebrities who update their Twitter status regularly. But "are they doing it wisely?" is what Fadia asks.


Why are you apprehensive about celeb tweeting?

If you follow celebs, you'll observe that they disclose information on where they are shooting, what their shooting schedule looks like and the hotel they are put up at. Unintentionally, they are inviting trouble, because troublemakers are hungry for such information.


Any instances?

Singer Britney Spears' account on Twitter is hacked almost once every two months. One of the hackers even claimed on her wall, that he's her public relation officer and that Britney is dead, with details about the date and venue of her funeral.

Indian politico Shashi Tharoor's account has been hacked several times too. Even Big B and Aamir Khan's blog were hacked. Once a blog, website, social networking account is hacked, a hacker has full control over it.
He can spread rumours, communicate with fellow criminals, and indirectly make you a partner in their crime.


How would you rate the technical stylishness of terrorists?

They are far ahead. When I was asked by the US intelligence to decode some scripts after the 9/11 attacks, I was stunned to see the kind of technology they used to communicate. The agencies had tracked some emails where a few individuals were frequently exchanging photographs of Canadian rockstar Avril Lavigne. Hidden text messages that aren't visible to the naked eye, were being exchanged through these pictures.


What about Mumbai's 26/11 terror attacks?

For 26/11, they had used highly secured Voice Over Internet Protocol
(VOIP) like Skype to communicate with each other. The data on VOIPs'
servers is so huge that by the time you track them, the damage has been done and criminals are out of reach. The 26/11 terrorists had used the "proxy bouncing" technique, where in they were sending messages through a Saudi Arabia based server, while they were actually sitting in Pakistan.


Why is tracking such messages so difficult?

They know the loopholes, and how to use them affectively. Suppose three terrorists A, B and C want to communicate with each other, what they do is create a Twitter account and follow each other, thus forming a closed group. So if A posts a message saying "Plant Bomb at Parliament at 11 am", just B and C will be able to see the message. And since Twitter is based in the US, Indian authorities wouldn't have control over this exchange of messages.

Tracking messages is another problem. I will track a suspicious mail only if it's sent. If A wants to communicate with B, he will type an email and save it as a draft instead of sending it. Now B, whose has A's password will log in to A's account, read the mail in the "Draft"
folder. Since the mail hasn't been sent, it becomes almost impossible to track it.


How do spammers and hackers operate in social networking sphere?

There are viruses, worms, spyware and malware that spread through social networking websites. One day, you receive a private message from one of your friends (who is already infected) containing a link to a Youtube video. Halfway through the video, it will prompt you to download some video plugin. Since the message comes from your friend, you trust it, but the moment you click it, you get infected. Get rich quick schemes, earn money online scams and various money laundering attacks now come through social networking sites.