TEDxBrussels
Mikko Hypponen: Three types of online attack
Miko Hiponen (Mikko Hypponen): 3 tipa napada na internetu
Filmed:
Readability: 4.1
1,057,532 views
Stručnjak za sajber kriminal Miko Hiponen nas vodi kroz tri tipa napada na internetu, na našu privatnost i podatke - i samo dva se smatraju zločinom. "Da li slepo verujemo bilo kojoj budućoj vladi? Jer svako pravo kojeg se odreknemo, biće zauvek oduzeto."
Mikko Hypponen - Cybersecurity expert
As computer access expands, Mikko Hypponen asks: What's the next killer virus, and will the world be able to cope with it? And also: How can we protect digital privacy in the age of government surveillance? Full bio
As computer access expands, Mikko Hypponen asks: What's the next killer virus, and will the world be able to cope with it? And also: How can we protect digital privacy in the age of government surveillance? Full bio
Double-click the English transcript below to play the video.
00:20
In the 1980s
0
5000
3000
1980-ih
00:23
in the communist Eastern Germany,
1
8000
3000
u komunističkoj Istočnoj Nemačkoj,
00:26
if you owned a typewriter,
2
11000
4000
ako ste imali pisaću mašinu,
00:30
you had to register it with the government.
3
15000
2000
to ste morali da prijavite kod vlade.
00:32
You had to register
4
17000
2000
Morali ste da predate
00:34
a sample sheet of text
5
19000
2000
list teksta kao uzorak
00:36
out of the typewriter.
6
21000
2000
sa vaše pisaće mašine.
00:38
And this was done
7
23000
2000
Ovo se radilo
00:40
so the government could track where text was coming from.
8
25000
3000
kako bi vlada mogla da prati
odakle dolazi tekst.
odakle dolazi tekst.
00:43
If they found a paper
9
28000
3000
Ako bi našli papir
00:46
which had the wrong kind of thought,
10
31000
3000
sa pogrešnom vrstom misli,
00:49
they could track down
11
34000
2000
mogli su da uđu u trag
00:51
who created that thought.
12
36000
2000
onom ko je bio njen tvorac.
00:53
And we in the West
13
38000
3000
Mi na Zapadu
00:56
couldn't understand how anybody could do this,
14
41000
3000
nismo mogli da razumemo
kako bi neko mogao da radi ovo,
kako bi neko mogao da radi ovo,
00:59
how much this would restrict freedom of speech.
15
44000
3000
koliko bi ovo ograničilo slobodu govora.
01:02
We would never do that
16
47000
2000
Mi nikada ne bismo to uradili
01:04
in our own countries.
17
49000
3000
u svojim zemljama.
01:07
But today in 2011,
18
52000
3000
Ali danas u 2011.
01:10
if you go and buy a color laser printer
19
55000
4000
ako kupite laserski štampač u boji
01:14
from any major laser printer manufacturer
20
59000
3000
bilo kog većeg proizvođača laserskih štampača
01:17
and print a page,
21
62000
2000
i odštampate stranicu,
01:19
that page will end up
22
64000
2000
ona će imati
01:21
having slight yellow dots
23
66000
3000
blage žute tačke
01:24
printed on every single page
24
69000
2000
na svakoj pojedinačnoj stranici
01:26
in a pattern which makes the page unique
25
71000
3000
u šablonu koji stranicu čini jedinstvenom
01:29
to you and to your printer.
26
74000
4000
za vas i vaš štampač.
01:33
This is happening
27
78000
2000
Ovo se dešava
01:35
to us today.
28
80000
3000
nama danas.
01:38
And nobody seems to be making a fuss about it.
29
83000
4000
I niko ne diže prašinu zbog ovoga.
01:42
And this is an example
30
87000
3000
Ovo je primer
01:45
of the ways
31
90000
2000
načina na koji
01:47
that our own governments
32
92000
3000
naše vlade
01:50
are using technology
33
95000
2000
koriste tehnologiju
01:52
against us, the citizens.
34
97000
4000
protiv nas, građana.
01:56
And this is one of the main three sources
35
101000
3000
Ovo je jedan od tri glavna izvora
01:59
of online problems today.
36
104000
2000
problema na internetu danas.
02:01
If we take a look at what's really happening in the online world,
37
106000
3000
Ako pogledamo na to
šta se zaista dešava u svetu interneta,
šta se zaista dešava u svetu interneta,
02:04
we can group the attacks based on the attackers.
38
109000
3000
napade možemo grupisati
na osnovu napadača.
na osnovu napadača.
02:07
We have three main groups.
39
112000
2000
Imamo tri glavne grupe.
02:09
We have online criminals.
40
114000
2000
Imamo internet kriminalce.
02:11
Like here, we have Mr. Dimitry Golubov
41
116000
2000
Kao što je gospodin Dimitri Golubov ovde
02:13
from the city of Kiev in Ukraine.
42
118000
2000
iz grada Kijeva iz Ukrajine.
02:15
And the motives of online criminals
43
120000
3000
Motivi internet kriminalaca
02:18
are very easy to understand.
44
123000
2000
su veoma laki za razumeti.
02:20
These guys make money.
45
125000
2000
Ovi ljudi zarađuju novac.
02:22
They use online attacks
46
127000
2000
Koriste internet napade
02:24
to make lots of money,
47
129000
2000
da zarade hrpe novca,
02:26
and lots and lots of it.
48
131000
2000
veoma mnogo novca.
02:28
We actually have several cases
49
133000
2000
Zapravo imamo nekoliko slučajeva
02:30
of millionaires online, multimillionaires,
50
135000
3000
internet milionera, multimilionera,
02:33
who made money with their attacks.
51
138000
2000
koji su novac zaradili svojim napadima.
02:35
Here's Vladimir Tsastsin form Tartu in Estonia.
52
140000
3000
Ovde je Vladimir Cacin iz Tartua u Estoniji.
02:38
This is Alfred Gonzalez.
53
143000
2000
Ovo je Alfred Gonzales.
02:40
This is Stephen Watt.
54
145000
2000
Ovo je Stiven Vot.
02:42
This is Bjorn Sundin.
55
147000
2000
Ovo je Bjorn Sundin.
02:44
This is Matthew Anderson, Tariq Al-Daour
56
149000
3000
Ovo su Metju Anderson, Tarik Al-Daur
02:47
and so on and so on.
57
152000
2000
i tako dalje.
02:49
These guys
58
154000
2000
Ovi ljudi
02:51
make their fortunes online,
59
156000
2000
zarađuju bogatstva na internetu,
02:53
but they make it through the illegal means
60
158000
3000
ali ih zarađuju kroz ilegalne tokove
02:56
of using things like banking trojans
61
161000
2000
korišćenjem stvari poput bankarskih trojanaca
02:58
to steal money from our bank accounts
62
163000
2000
kako bi krali novac sa bankovnih računa
03:00
while we do online banking,
63
165000
2000
dok se mi bavimo internet bankarstvom,
03:02
or with keyloggers
64
167000
2000
ili praćenjem unosa na tastaturi
03:04
to collect our credit card information
65
169000
3000
kako bi skupljali podatke
o našim kreditnim karticama
o našim kreditnim karticama
03:07
while we are doing online shopping from an infected computer.
66
172000
3000
dok kupujemo preko interneta
sa zaraženog kompjutera.
sa zaraženog kompjutera.
03:10
The U.S. Secret Service,
67
175000
2000
Američka Tajna služba,
03:12
two months ago,
68
177000
2000
pre dva meseca,
03:14
froze the Swiss bank account
69
179000
2000
zamrzla je švajcarski bankovni račun
03:16
of Mr. Sam Jain right here,
70
181000
2000
gospodina Sema Džejna ovde
03:18
and that bank account had 14.9 million U.S. dollars on it
71
183000
3000
i taj račun je imao 14,9 miliona dolara
03:21
when it was frozen.
72
186000
2000
kada je zamrznut.
03:23
Mr. Jain himself is on the loose;
73
188000
2000
Sam gospodin Džejn je u bekstvu;
03:25
nobody knows where he is.
74
190000
3000
niko ne zna gde je on.
03:28
And I claim it's already today
75
193000
3000
I tvrdim da je već danas
03:31
that it's more likely for any of us
76
196000
3000
verovatnije da će bilo ko od nas
03:34
to become the victim of a crime online
77
199000
3000
biti žrtva kriminala na internetu
03:37
than here in the real world.
78
202000
3000
nego u stvarnom svetu.
03:40
And it's very obvious
79
205000
2000
Veoma je očigledno
03:42
that this is only going to get worse.
80
207000
2000
da će se stvari samo pogoršavati.
03:44
In the future, the majority of crime
81
209000
2000
Većina zločina će u budućnosti
03:46
will be happening online.
82
211000
3000
biti na internetu.
03:50
The second major group of attackers
83
215000
2000
Druga velika grupa napadača
03:52
that we are watching today
84
217000
2000
koje posmatramo danas
03:54
are not motivated by money.
85
219000
2000
nije motivisana novcem.
03:56
They're motivated by something else --
86
221000
2000
Motiviše ih nešto drugo -
03:58
motivated by protests,
87
223000
2000
protesti,
04:00
motivated by an opinion,
88
225000
2000
mišljenja,
04:02
motivated by the laughs.
89
227000
3000
ismevanje.
04:05
Groups like Anonymous
90
230000
2000
Grupe poput Anonimusa
04:07
have risen up over the last 12 months
91
232000
3000
su porasle u poslednjih 12 meseci
04:10
and have become a major player
92
235000
2000
i postale veliki igrač
04:12
in the field of online attacks.
93
237000
3000
na polju internet napada.
04:15
So those are the three main attackers:
94
240000
2000
To su tri glavna napadača:
04:17
criminals who do it for the money,
95
242000
2000
kriminalci koji to rade zbog novca,
04:19
hacktivists like Anonymous
96
244000
3000
haktivisti poput Anonimusa
04:22
doing it for the protest,
97
247000
2000
koji to rade iz protesta
04:24
but then the last group are nation states,
98
249000
3000
i poslednja grupa su države,
04:27
governments doing the attacks.
99
252000
3000
vlade koje vrše napade.
04:31
And then we look at cases
100
256000
2000
A onda vidimo slučajeve
04:33
like what happened in DigiNotar.
101
258000
2000
poput onog u DigiNotaru.
04:35
This is a prime example of what happens
102
260000
2000
Ovo je vrhunski primer toga šta se desi
04:37
when governments attack
103
262000
2000
kada vlade napadnu
04:39
against their own citizens.
104
264000
2000
svoje sopstvene građane.
04:41
DigiNotar is a Certificate Authority
105
266000
3000
DigiNotar je autoritet za sertifikate
04:44
from The Netherlands --
106
269000
2000
iz Holandije -
04:46
or actually, it was.
107
271000
2000
zapravo bio je.
04:48
It was running into bankruptcy
108
273000
2000
Prošlog leta su
04:50
last fall
109
275000
3000
išli ka bankrotu
04:53
because they were hacked into.
110
278000
2000
jer ih je neko hakovao.
04:55
Somebody broke in
111
280000
2000
Neko je upao
04:57
and they hacked it thoroughly.
112
282000
3000
i detaljno ih hakovao.
05:00
And I asked last week
113
285000
2000
Prošle nedelje sam pitao,
05:02
in a meeting with Dutch government representatives,
114
287000
4000
na sastanku sa predstavnicima
holandske vlade,
holandske vlade,
05:06
I asked one of the leaders of the team
115
291000
5000
pitao sam jednog od vođa tima
05:11
whether he found plausible
116
296000
3000
da li misli da je verovatno
05:14
that people died
117
299000
3000
da su ljudi umrli
05:17
because of the DigiNotar hack.
118
302000
3000
zbog hakovanja DigiNotara.
05:20
And his answer was yes.
119
305000
5000
Njegov odgovor je bio potvrdan.
05:25
So how do people die
120
310000
2000
Kako ljudi umiru
05:27
as the result of a hack like this?
121
312000
3000
kao posledica ovakvog hakovanja?
05:30
Well DigiNotar is a C.A.
122
315000
2000
DigiNotar je autoritet za sertifikate.
05:32
They sell certificates.
123
317000
2000
Oni prodaju sertifikate.
05:34
What do you do with certificates?
124
319000
2000
Šta se radi sa sertifikatima?
05:36
Well you need a certificate
125
321000
2000
Sertifikat vam je potreban
05:38
if you have a website that has https,
126
323000
2000
ako imate sajt koji ima https,
05:40
SSL encrypted services,
127
325000
3000
SSL šifrovane servise,
05:43
services like Gmail.
128
328000
3000
servise poput Gmail-a.
05:46
Now we all, or a big part of us,
129
331000
2000
Svi mi ili velik deo nas,
05:48
use Gmail or one of their competitors,
130
333000
2000
koristi Gmail ili neki od njegovih suparnika,
05:50
but these services are especially popular
131
335000
2000
ali ovi servisi su naročito popularni
05:52
in totalitarian states
132
337000
2000
u totalitarnim državama
05:54
like Iran,
133
339000
2000
poput Irana,
05:56
where dissidents
134
341000
2000
gde disidenti
05:58
use foreign services like Gmail
135
343000
3000
koriste strane servise poput Gmail-a
06:01
because they know they are more trustworthy than the local services
136
346000
3000
jer znaju da su pouzdaniji od lokalnih
06:04
and they are encrypted over SSL connections,
137
349000
3000
i da su šifrovani preko SSL mreža,
06:07
so the local government can't snoop
138
352000
2000
tako da lokalna vlada ne može da prisluškuje
06:09
on their discussions.
139
354000
2000
njihove razgovore.
06:11
Except they can if they hack into a foreign C.A.
140
356000
3000
Ali može, ako hakuje
strani autoritet za sertifikate
strani autoritet za sertifikate
06:14
and issue rogue certificates.
141
359000
2000
i izda lažne sertifikate.
06:16
And this is exactly what happened
142
361000
2000
I upravo ovo se desilo
06:18
with the case of DigiNotar.
143
363000
3000
sa slučajem DigiNotar.
06:24
What about Arab Spring
144
369000
2000
A šta sa Arapskim prolećem
06:26
and things that have been happening, for example, in Egypt?
145
371000
3000
i stvarima koje su se dešavale,
recimo u Egiptu?
recimo u Egiptu?
06:29
Well in Egypt,
146
374000
2000
Pa u Egiptu,
06:31
the rioters looted the headquarters
147
376000
2000
protestanti su opljačkali štab
06:33
of the Egyptian secret police
148
378000
2000
egipatske tajne policije
06:35
in April 2011,
149
380000
2000
u aprilu 2011.
06:37
and when they were looting the building they found lots of papers.
150
382000
3000
i kada su pljačkali zgradu
našli su puno papira.
našli su puno papira.
06:40
Among those papers,
151
385000
2000
Među ovim papirima
06:42
was this binder entitled "FINFISHER."
152
387000
2000
bila je fascikla s imenom "FINFISHER."
06:44
And within that binder were notes
153
389000
3000
Unutar te fascikle bile su beleške
06:47
from a company based in Germany
154
392000
2000
kompanije stacionirane u Nemačkoj
06:49
which had sold the Egyptian government
155
394000
3000
koja je egipatskoj vladi prodala
06:52
a set of tools
156
397000
2000
komplet alata
06:54
for intercepting --
157
399000
2000
za presretanje -
06:56
and in very large scale --
158
401000
2000
i to na veoma velikim razmerama -
06:58
all the communication of the citizens of the country.
159
403000
2000
svih komunikacija građana te zemlje.
07:00
They had sold this tool
160
405000
2000
Ovaj alat su prodali
07:02
for 280,000 Euros to the Egyptian government.
161
407000
3000
egipatskoj vladi za 280 hiljada evra.
07:05
The company headquarters are right here.
162
410000
3000
Kompanijino sedište je upravo ovde.
07:08
So Western governments
163
413000
2000
Tako da vlade Zapada
07:10
are providing totalitarian governments with tools
164
415000
3000
daju totalitarnim vladama alate
07:13
to do this against their own citizens.
165
418000
3000
da ovo rade protiv svojih građana.
07:16
But Western governments are doing it to themselves as well.
166
421000
3000
Ali Zapadne vlade rade isto to
i same sebi.
i same sebi.
07:19
For example, in Germany,
167
424000
2000
Na primer, u Nemačkoj,
07:21
just a couple of weeks ago
168
426000
2000
samo pre par nedelja,
07:23
the so-called State Trojan was found,
169
428000
3000
otkriven je takozvani "Državni trojanac",
07:26
which was a trojan
170
431000
2000
koji je bio trojanac
07:28
used by German government officials
171
433000
2000
koji su koristili nemački zvaničnici
07:30
to investigate their own citizens.
172
435000
2000
da istražuju sopstvene građane.
07:32
If you are a suspect in a criminal case,
173
437000
4000
Ako ste osumnjičeni u krivičnom slučaju,
07:36
well it's pretty obvious, your phone will be tapped.
174
441000
2000
poprilično je očigledno
da će vam prisluškivati telefon.
da će vam prisluškivati telefon.
07:38
But today, it goes beyond that.
175
443000
2000
Ali stvari danas idu dalje od toga.
07:40
They will tap your Internet connection.
176
445000
2000
Prisluškivaće vašu internet vezu.
07:42
They will even use tools like State Trojan
177
447000
3000
Čak će koristiti alate poput "Državnog trojanca"
07:45
to infect your computer with a trojan,
178
450000
3000
da trojancem zaraze vaš kompjuter,
07:48
which enables them
179
453000
2000
što im omogućuje
07:50
to watch all your communication,
180
455000
2000
da prate svu vašu komunikaciju,
07:52
to listen to your online discussions,
181
457000
3000
da prate vašu diskusiju na internetu,
07:55
to collect your passwords.
182
460000
3000
da skupljaju vaše šifre.
08:01
Now when we think deeper
183
466000
2000
Kada dublje razmislimo
08:03
about things like these,
184
468000
3000
o ovakvim stvarima,
08:06
the obvious response from people should be
185
471000
5000
očigledan odgovor ljudi trebalo bi da bude:
08:11
that, "Okay, that sounds bad,
186
476000
3000
"U redu, to zvuči loše,
08:14
but that doesn't really affect me because I'm a legal citizen.
187
479000
3000
ali to me baš i ne pogađa
jer sam legalan građanin.
jer sam legalan građanin.
08:17
Why should I worry?
188
482000
2000
Zašto bih brinuo?
08:19
Because I have nothing to hide."
189
484000
3000
Nemam ništa da krijem."
08:22
And this is an argument,
190
487000
2000
Ovo je argument
08:24
which doesn't make sense.
191
489000
2000
koji nema smisla.
08:26
Privacy is implied.
192
491000
3000
Privatnost se podrazumeva.
08:29
Privacy is not up for discussion.
193
494000
5000
O privatnosti se ne može diskutovati.
08:34
This is not a question
194
499000
2000
Ovo nije pitanje
08:36
between privacy
195
501000
4000
privatnosti
08:40
against security.
196
505000
3000
naspram bezbednosti.
08:43
It's a question of freedom
197
508000
3000
To je pitanje slobode
08:46
against control.
198
511000
3000
naspram kontrole.
08:49
And while we might trust our governments
199
514000
4000
Iako možda verujemo svojim vladama
08:53
right now, right here in 2011,
200
518000
3000
sada u 2011.,
08:56
any right we give away will be given away for good.
201
521000
3000
svako pravo kojeg se odreknemo
biće zauvek oduzeto.
biće zauvek oduzeto.
08:59
And do we trust, do we blindly trust,
202
524000
3000
Da li verujemo, da li slepo verujemo
09:02
any future government,
203
527000
2000
bilo kojoj budućoj vladi,
09:04
a government we might have
204
529000
2000
vladi koju ćemo možda imati
09:06
50 years from now?
205
531000
2000
za 50 godina?
09:10
And these are the questions
206
535000
3000
Ovo su pitanja
09:13
that we have to worry about for the next 50 years.
207
538000
3000
o kojima moramo da brinemo
sledećih 50 godina.
sledećih 50 godina.
ABOUT THE SPEAKER
Mikko Hypponen - Cybersecurity expertAs computer access expands, Mikko Hypponen asks: What's the next killer virus, and will the world be able to cope with it? And also: How can we protect digital privacy in the age of government surveillance?
Why you should listen
The chief research officer at F-Secure Corporation in Finland, Mikko Hypponen has led his team through some of the largest computer virus outbreaks in history. His team took down the world-wide network used by the Sobig.F worm. He was the first to warn the world about the Sasser outbreak, and he has done classified briefings on the operation of the Stuxnet worm -- a hugely complex worm designed to sabotage Iranian nuclear enrichment facilities.
As a few hundred million more Internet users join the web from India and China and elsewhere, and as governments and corporations become more sophisticated at using viruses as weapons, Hypponen asks, what's next? Who will be at the front defending the world’s networks from malicious software? He says: "It's more than unsettling to realize there are large companies out there developing backdoors, exploits and trojans."
Even more unsettling: revelations this year that the United States' NSA is conducting widespread digital surveillance of both US citizens and anyone whose data passes through a US entity, and that it has actively sabotaged encryption algorithms. Hypponen has become one of the most outspoken critics of the agency's programs and asks us all: Why are we so willing to hand over digital privacy?
Read his open-season Q&A on Reddit:"My TED Talk was just posted. Ask me anything.
See the full documentary on the search for the Brain virus.
Mikko Hypponen | Speaker | TED.com