HK 'soft target' for computer hackers

PUBLISHED : Monday, 26 June, 2000, 12:00am
UPDATED : Monday, 26 June, 2000, 12:00am

The SAR is vulnerable to computer attack, with small businesses particularly at risk from hackers and e-mail viruses, information technology experts warn.

The acting director of the Information and Technology Services Department - the Web site of which was attacked twice this month - called for greater emphasis on protecting computers from hackers such as those responsible for last week's e-mail virus attacks.

Acting Director Cheng Yan-chee also said the Hong Kong Productivity Council would follow through on its plan to create a computer emergency-response team by the end of this financial year. While police had no comment on the investigations, computer science professor Samuel Chanson said he expected the hunt to be long and tiring.

'Experienced hackers can come and go without a trace, they're very difficult to track,' said Dr Chanson, of the Hong Kong University of Science and Technology, who trains officers in the police force's computer crime section.

'We're not part of the commonly targeted cities [such as New York or London], but we're definitely not very safe because the level of awareness of protecting one's machine - especially among small businesses - is very low.' Hong Kong was not substantially different from the rest of the world in terms of its 'hacker profiles', he said. 'If the hacker is in Hong Kong, the person is young, a high school or university student, and likely to be a loner.' In this respect, the 'movie stereotype' of a single hacker silhouetted by the glow of his computer screen is accurate. What is incorrect is the amount of time it takes to hack into a site.

'It's not exciting work, and it doesn't take just a few seconds,' he said. 'I've never hacked into anything, but I have supervised students hacking into sample sites. A bright computer science student takes at least a week to get into a system . . . it's all trial and error.' His students, he added, could acquire the skills to launch a virus programme in a few weeks, at the longest a month.

Police would start the hunt by searching for a trace of the hacker, usually by searching through the routing paths of incoming e-mails or scanning the records of operating systems.

'Clever hackers, though, never start a hack from their own machines,' he said, recalling the fact that police investigating the 'ILOVEYOU' virus were led to a false address in Manila. 'Right now, the level of hacking activities in Hong Kong is relatively low, but we're afraid activity may increase if we don't do something about it.' Police reported more than 200 hacking incidents last year but less than 50 in 1998.