The public image of any given group of people tends to be created by mass media. Whether it is a tribe of Amazonian warriors or a modern terrorist leader, mass culture will project its own image on them. Hackers are no different.
First Published 20th August 2018
When kids get up to no good.
4 min read | Reflare Research Team
The public image of any given group of people tends to be created by mass media. And mass media depictions of hackers over the last 5 years have mostly been about organized criminal or government-sponsored elite groups of tech-savvy specialists motivated by money, patriotism or activism. While these kinds of people make up a part of the attacker pool, focusing only on them risks narrowing our observations to their motivations and techniques. We will therefore take a recent attack against Apple as a chance to highlight a different - but equally common - type of hacker: The bored teenager.
Isn’t this just a movie trope?
Unfortunately, no. However, in the late 1990s and early 2000s, popular media latched onto this group of attackers in a way similar to how it is portraying governmental and organized criminal attackers now. There is truth to both of these stereotypical portrayals. While “money” and “political impact” are doubtlessly the drivers of many cyber attacks “boredom” and “curiosity” drive a comparable number of them.
The extremely fast-moving nature of information technology means that dedicated young people with enough time can realistically achieve a very high level of mastery compared to their peers in a specific IT subfield within months or years. This in turn can make them proficient in staging attacks using this knowledge.
What happened to Apple?
According to Reuters, a 16-year-old juvenile was arrested in Melbourne after the US Federal Bureau of Investigations (FBI) referred a breach of Apple systems to the Australian Federal Police. Details are sparse at this point in time, mostly because Australian law does not release identifying information on juvenile alleged offenders. According to reports, he hacked into Apple systems and accessed roughly 90 gigabytes worth of confidential and customer files.
The stated reason for the attack is telling. According to several news sources, the attacker claimed that he did it because he was a “fan of the company”. An even deeper look into his psyche may be gained from the folder where he stored the stolen data in, and how he got caught. According to Mashable, the folder was named “hacky hack hack” and authorities were tipped off after he bragged about the breach to friends on WhatsApp.
Why would a teenager do this?
We have addressed why teenagers are able to acquire the skills required to hit relatively strong targets like Apple above, but this leaves the question of “why”.
Surely, the risk of ruining one’s life should deter teenagers from attacking large corporate or governmental targets. Likewise, if admiration for a company is cited as motivation, shouldn’t it be motivation to not harm that company?
As always, things are more complicated than that. Teenagers are on average poor at judging the long-term risks of their actions. Developing the capacity for risk assessment is a central part of maturing. Thus, risks are often underestimated or brushed aside. And just like many teenagers daydream about singing a duet with their favourite musician or sparing with their favorite martial artist, some of the techier ones daydream about “taking on” a beloved tech company in the same manner.
The difference is that 16-year-olds wishing to sing with Katy Perry or spare against Floyd Mayweather face virtually insurmountable challenges in terms of access and skill development. A dedicated 16-year-old set on going up against Apple however is in a position to try his or her luck.
Summary
There are many different kinds of attackers behind the wide variety of cyber attacks targeting organizations today. While many of them have criminal, political or monetary interests, the threat posed by young attackers looking for a thrill cannot be ignored. While they typically cause less total damage after a breach than their counterparts would, the lack of hard motivation makes it especially difficult to protect against them.