Hackers spell trouble for e-business

Everyone knows e-business models are very different from traditional ones, but this week's example may have stretched the patience of investors and customers alike. On the Internet, it emerged, the most successful companies in the world - from Amazon.com to CNN.com - could have their businesses shut down by teenage pranksters.

But even as the clamour rose for someone to do something, specialists came forward to suggest there were no easy solutions, no silver security bullet. The very accessibility of the World Wide Web is what leaves it open to attack.

If anything, things could get worse. Irish technology experts predicted this week that as more businesses go online, the hacking opportunities increase. Already, the Web pages of several well-known Irish companies, such as Eircom and 98FM, have been defaced by "crackers" - destructive computer hackers.

The full might of the United States' FBI has been pitched against the latest offenders; US Attorney General Ms Janet Reno said it was crucial that the perpetrators be brought to justice, and that the Internet was perceived as a secure place to do business.

But law enforcement officials have admitted they have no real idea where to start looking, and that their ability to prevent future attacks was limited.

"There are tools out there that a 15-year-old kid could use to launch these attacks. This is not something that takes a great deal of sophistication," said Mr Ron Dick, of the FBI's national infrastructure protection centre.

The FBI stressed that self-policing, rather than government action, would ultimately protect industry from sort of data-bombardment that closed eBay, Amazon.com Buy.com, Yahoo, CNN.com, E*Trade, Datek, and ZDNet. This would include preventing company computers from being inadvertently used as part of an attack on another site.

This was an essential element of the latest assaults. The cracker, or crackers, secretly planted programmes in other computers, these remained dormant until the appointed minute, then began bombarding the websites with data. This method makes the detection and tracing of the cracker even more difficult.

While all break-ins represent a breach in security, the technology industry tends to break hackers down into different groups. The crackers that changed Eircom's website, for example, are perceived as little more than electronic vandals.

"These are the kind of people who would normally have daubed graffiti on buildings; they just want to be noticed," says Mr Daragh Scaife, chief technology officer for Oniva, the e-business consultancy firm.

More dangerous are the hackers who target a particular system often for personal or ideological reasons. Worst are individuals or groups who are trying to make a profit from information gained through breaking into systems, he says.

He says most specialists will admit there is no such thing as an unhackable system: "Even if you have a building that is completely secure, all you need is a weak person on the inside to turn off the alarm - you can see exactly the same thing happening in the electronic world."

One defence against most hackers is to make the system so secure that anyone capable of breaking in would have to spend so much time and effort, and have so much skill, that such a person could make far more money working as a programmer.

Many companies concerned about their security take this theory a step further, hiring former hackers to break into their systems, exposing all the weaknesses that could be used by other hackers and crackers.

Another issue thrown up by the events of this week revolves around insurance. Many of the companies attacked have so far refused to say whether they were insured for damage or loss of business caused by hackers, but insurance firms say many of the largest companies are not covered.

The insurance framework for e-business is still emerging, and the area could prove a messy one. Should companies, for example, be able to claim for business lost while the computer systems were crashed? Or would insurers pay third parties when their clients' computers are inadvertently used in an attack?

It seems certain, however, that after this week insurers will insist on companies installing intrusion detection systems before coverage even starts.

More difficult to predict is the long-term effect of the high-profile attacks. Many people will not distinguish between data-bombarding a website and capturing credit card information that might be on it, and this could erode public confidence in e-business.

smaccarthaigh@irish-times.ie