The exhibit floor at the RSA computer security conference in San Francisco last week, where hacking attacks were discussed.  SAN FRANCISCO — Hackers operating under the banner Anonymous have been poking a finger in the eye of one private company after another for two years now.  They steal files from inside corporate computer systems and occasionally, as in the case of Stratfor last week, dump company e-mail online for all to see.  The Stratfor hack, in which Anonymous claimed to have joined forces with WikiLeaks, drove home a clear lesson about the era of ubiquitous “hactivism,” or hacking as a form of protest.  Despite the arrests of dozens of suspected members of Anonymous and its offshoots worldwide, it is far from diminished. Nor have most of its corporate targets been irreparably damaged by the attacks.  Rather, what Anonymous has done, experts said at the big RSA computer security conference here last week, is raise the alarm about the unguarded state of corporate computer systems.  By and large, the Anonymous break-ins take advantage of gaping computer holes and gullible human beings. The hackers ferret out weak passwords and take advantage of unencrypted e-mail stashes. They persuade company employees — one is all it takes — to click on rogue Web sites or divulge a confidential piece of information, in an exercise known as social engineering.  “Anonymous is a wake-up call,” said Roger Cressey, senior vice president of Booz Allen Hamilton, a defense and intelligence contractor that was attacked by the group last summer. “Any company that is patting themselves on the back and saying that they’re not a target or not susceptible to attack is in complete and utter denial.”  More to the point, a company that is a target of Anonymous may also be the target of a far more potent adversary. The social engineering tactics that Anonymous members have repeatedly used are often similar to those used by criminal hackers and state-sponsored actors who penetrate company systems in order to steal valuable secrets, whether for monetary gain or competitive edge.  Anonymous draws public attention — and by extension, that of executives and shareholders. It puts a face — or rather, a mask — on a far more pernicious problem: online espionage.  “The attacks by them pale in comparison to the nation-state stuff and the criminal element,” said Eddie Schwartz, chief security officer for RSA, the organizer of the computer security conference and a maker of security tokens, which was itself the target of a highly publicized breach by suspected state-backed hackers. “There is an awakening. There is a lot more visibility in the press.”  An Anonymous attack can leave a measurable toll. In 2010, its activists broke into Sony’s systems, exposing names and credit card numbers of millions of customers; Sony said last May that the cleanup would cost it $170 million. Last year, Anonymous extracted the password of an executive at the security firm HBGary and helped itself to a pile of internal company e-mail.  News of the breach at the geopolitical analysis firm Stratfor began trickling out on Christmas Eve, when the company’s site was defaced. At first, a group called Antisec, an Anonymous offshoot, claimed responsibility, announcing that it had penetrated the company’s network. It posted the names, addresses and credit card details of 75,000 people who subscribed to Stratfor newsletters. Soon came a dump of credentials for 860,000 user accounts, not all of whom may have been paid subscribers.  Mary Landesman, a senior security researcher at Cisco who has closely studied the Stratfor breach, said the attack appears to have been twofold: a relatively commonplace attack, known as an SQL injection, on four servers that stored e-mails dating back several years, as well as a breach of a vulnerable third-party e-commerce system that Stratfor would have used to process its paid subscribers.  A company’s vulnerabilities, whether human or machine, are far easier to spot, Ms. Landesman pointed out, if a sprawling army of thieves is plotting the break-in. “The more eyes, the greater chance of success,” she said.
One benefit of an attack by a group like Anonymous: it can gird a company against more serious online espionage.