An "accidental" ethical hacker. That's how Robert McAdam describes himself.
Attached to the New South Wales Police for many years, McAdam was lured to the private sector during his time at IBM while working on the Sydney Olympics.
He left Big Blue to pursue his dream of running his own company and founded Pure Hacking, a Sydney-based security consultancy.
When and how did your career in computer crime investigation begin?
McAdam: Quite by accident, I was working for IBM as a Project Manager on the Olympics and it was suggested by a colleague that I come across to the Security Practice. Given my work history in policing, and now Pure Hacking, I have a core personal value around making others safe.
What's a normal day at Pure Hacking like?
McAdam: Ensure the electronic systems are functioning as expected (and they always do). Read the latest security advisories, check sites which have been hacked over the last 24 hours, and respond to current and new client queries.
Then we start hacking.
What is the most challenging crime you've ever pursued?
McAdam: A financial institution was being extorted. A hacker had infiltrated the systems and was extorting the business for financial gain. At the time, the business thought it was over. Pure Hacking stopped the extorter and the business is still running today so it's a great result. Can't provide more details.
Who, in your opinion, is the most dangerous cybercriminal and why?
McAdam: A bored employee. They are the most dangerous because they are in a trust relationship. The most common offender in most crimes are those you trust -- the Internet is no different.
Which group/gang is the most dangerous online and why?
McAdam: We've only dealt with individuals acting independently for personal gain, not organised crime.
Describe, in-length if possible, your most successful bust?
McAdam: With a 9 year career in policing, there are many war stories. In IT Security, law enforcement is not a focus. For those issues, the client wants the problem fixed and that's it.
We've read stories about criminal gangs allegedly blackmailing online betting companies, threatening denial of service attacks unless they
pay up ... is this a common occurrence and if not, do you see this type of activity increasing? Is it advisable for victims to report such activity if they're threatened?
McAdam: In Pure Hacking's experience, this is not a common occurrence (common being a daily or weekly event). The victims really should contact the authorities in these circumstances as they have significant resources either directly or indirectly. These resources may be available in-house, or through their relationships with other law enforcement agencies. It pays to tap into another's network -- especially when it's all that they do.
What are the top five cybercrimes?
McAdam: As follows:
- Virus writing
- Ignorant users opening up attachments
- Social engineering -- relying on good manners or ignorance to gain illegal access
- Replicas of Web sites
- Using the Internet as a vehicle to wage a personal attack on an individual -- relating to domestic violence issues
What more needs to be done to fight cybercrime?
McAdam: Education, Education, Education. The tools exist to protect an environment and businesses misconfigure them, or let security lapse. Security is an ongoing process.
Which area of law enforcement requires the most funding to fight cybercrimes and why?
McAdam: Again, education. Simply stated, the criminals know and profit from individuals' ignorance.
The youth of today are brought up in an environment surrounded by computers and high-tech gadgets. Do you forsee a time when the number of computer crimes will exceed traditional crimes (such as petty theft, mugging, bank robberies etc)?
McAdam: In relation to crimes, petty theft and bank robberies are at different ends of the spectrum for the victims and the offenders.
I do not see Internet crime exceeding traditional crimes because the level of knowledge required to bring a bank down [offline] is usually significant. In contrast, to obtain a firearm and to walk into a bank is relatively simple.
I believe it is the same trend on the Internet as in the 'real world'. Repeat offenders will generate most of the problems.
Would you recommend Internet Explorer or other browsers such as Firefox and Opera for financial transactions over the Net?
McAdam: Firefox has significantly less vulnerabilities, but poor site design and programming means that a site can only operate securely on the IE platform. Pure Hacking uses Firefox when testing.
Is Linux really more secure than Windows?
McAdam: No
Updated 4 August 2005 5:30PM
this is awesome! well done!