http://www.reuters.com/article/2014/02/26/worldcup-brazil-hackers-idUSL1N0LU0V520140226

 

Hackers target Brazil's World Cup for cyber attacks

Wed Feb 26, 2014 11:49am EST

kickoff to June 12, 9th paragraph, and year of London Olympics to 2012, 31st paragraph)

By Esteban Israel

SAO PAULO Feb 26 (Reuters) - Brazilian hackers are threatening to disrupt the World Cup with attacks ranging from jamming websites to data theft, adding cyber warfare to the list of challenges for a competition already marred by protests, delays and overspending.

In a country with rampant online crime, a challenging telecommunications infrastructure and little experience with cyber attacks, authorities are rushing to protect government websites and those of FIFA, soccer's governing body.

Furious about the 33 billion reais ($14 billion) in federal funds being spent on World Cup preparations, more than a million Brazilians took to the streets last June in a wave of mass demonstrations, calling for better public services, greater transparency, and a crackdown on corruption.

Now, hackers say they will join the fray.

"We are already making plans," said an alleged hacker who goes by the nom de guerre of Eduarda Dioratto. "I don't think there is much they can do to stop us."

Reuters contacted Dioratto and other self-proclaimed members of the international hacker network known as Anonymous by finding them online. Though unable to confirm their true identities, Reuters spoke with them in the interest of understanding their threats and what impact they might have on the World Cup.

They said the event offers an unprecedented global audience and an opportune moment to target sites operated by FIFA, the government, other organizers or corporate sponsors.

"The attacks will be directed against official websites and those of companies sponsoring the Cup," a hacker known as Che Commodore said in a late-night Skype conversation.

While most of the fretting ahead of the tournament is focused on the completion of stadiums by kickoff on June 12, experts agree that little attention is being paid to Brazil's telecommunications infrastructure.

Problems include overstrained networks, widespread use of pirated software and low investment in online security. To make matters worse, Brazil is home to one of the world's most sophisticated cyber-criminal communities, which is already disrupting ticket sales and other World Cup commerce.

"It's not a question of whether the Cup will be targeted, but when," said William Beer, a cybersecurity expert with the consultancy firm Alvarez & Marsal. "So resilience and response become extremely important."

Brazil says it is ready, or as ready as it can be.

"It would be reckless for any nation to say it's 100 percent prepared for a threat," said General José Carlos dos Santos, the head of the cyber command for Brazil's army. "But Brazil is prepared to respond to the most likely cyber threats."

A FIFA spokesperson declined to comment on online security.

FAST, DAMAGING AND SIMPLE

Known internationally for their high-profile attacks against the U.S. Central Intelligence Agency, Sony and even the Vatican, Anonymous flexed its muscle in Brazil in 2012 when it disabled the websites of some of the country's biggest banks, including Banco do Brasil, Itaú Unibanco and Bradesco.

During that attack, dubbed #OpWeekPayment by the hackers, they launched denial-of-service (DDoS) attacks, in which thousands of computers simultaneously access target websites, jamming them. The method would be their preferred weapon this time, too.

"It's fast, damaging and relatively simple to carry out," explained Che Commodore.

With that in mind the army created a Cyber Defense Center, which leads a multi-agency task force for the Cup. Besides DDoS attacks, they may also face website defacement and data theft.

The worst-case scenario would be an attack sophisticated enough to cripple Brazil's power grid, communications or air-traffic control systems. But General dos Santos said in a recent interview that authorities aren't expecting anything that bad.

"The probability for that is much lower," he said.

For their part, the Anonymous members said they would not do anything to target the Brazilian people. The government and event organizers, however, are another matter.

And despite the government's preparations, the hackers say they are fully up to speed, and not terribly impressed by what they see as meager defenses.

"It's nothing out of this world", said an activist called Bile Day. "Security remains very low."

Indeed, security experts said Brazil could be caught ill-prepared. The country, with no geopolitical enemies, is not used to being on guard and, as such, may not even be aware of the extent of its vulnerabilities.

"Brazil is a big target, it's neutral and has a challenging infrastructure," said Marcos Oliveira, an executive with U.S. network security firm Blue Coat. "It's the perfect storm."

Aside from the banks, which now invest heavily in online security, Brazilian companies pay little attention to the problem. And more than half of Brazil's computers run pirate software, which makes them more vulnerable to a denial-of-service attack.

GROWING BREACHES

Brazil is not entirely untested.

The government grew far more sensitive to cybersecurity issues last year after reports that the U.S. National Security Agency spied on President Dilma Rousseff and millions of ordinary Brazilians.

Officials have also tracked a growing number of online security breaches during other big events in recent years. In 2012, during a United Nations conference on climate change in Rio de Janeiro, the cyber command detected 140 attempted security breaches. Attacks climbed to more than 300 for last year's Confederations Cup, a dress rehearsal for the World Cup.

"We expect that number to be much higher for the Cup," said General Dos Santos. And they will likely increase once again when Rio hosts the 2016 Olympics.

ATOS, a French company in charge of information technology networks for the Rio Olympics, said it detected around 255 million security events during London 2012.

"It's huge," said Michele Hyron, who heads the ATOS team for the Rio games. "And it had absolutely no impact on the Games."

Problems can occur ahead of the events, though, especially in a country with fast-growing Internet access and booming online banking services, but little regulation for either.

Seeking to capitalize on the massive demand for World Cup tickets, criminals are already finding ways to steal from would-be buyers online.

Most of the attacks are so called "phishing," where users are redirected to fake sites of banks and firms and tricked into entering their credit card data. Online security firm Kaspersky said it is blocking between 40 and 50 fraudulent sites using the theme of the Cup daily.

"The World Cup is the theme of the moment," said Fabio Assolini, a security analyst with Kaspersky in São Paulo, "and cyber criminals are taking full advantage of that." (Editing by Paulo Prada and Jonathan Oatis)