The Inquirer-Home

The BBC hacked my computer

20,000 PCs taken over by Spencer Kelly
Thu Mar 12 2009, 11:51

Click-blokePATRONISING BBC tech news show Click has bragged to the world plus dog, that it created a botnet of more than 20,000 PCs using software it downloaded from the World Wide Wibble.

Click, which famously described the chip as the "brains of the computer" and a modem "like a taxi" set up the botnet as part of an investigation into global cyber crime.

We guess its rationale was that if idiots like telly people can set up a botnet, imagine what someone with brains could do.

Almost 22,000 computers made up Click's network of hijacked machines, which has now been disabled and its victims notified to make their systems more secure from telly presenters.

Spencer Kelly managed to buy his own low-value botnet by visiting chatrooms on the internet. He said that if this had been done with criminal intent it would be breaking the law. We are not sure that is actually true as you are receiving stolen data. You are also breaking and entering a person's network and nicking their bandwidth without permission which does make you technically a criminal.

Click ordered its PCs to carry out denial of service attacks on two test e-mail addresses set up by the programme. It apparently took a few hours for the inboxes to start to filling up with thousands of junk messages.

By prior agreement, Click launched a Distributed Denial of Service (DDoS) attack on a backup site owned by security outfit Prevx. Apparently it took only 60 machines to overload the site's bandwidth.

The result is loads of dire warnings about the perils of bot nets and shedloads of long 'easy to follow' explanations from the 'zany' BBC tech presenter. µ

L'Inq
BBC

Share this:

Comments
WELL SAID DAVE!!!

I TOTALLY AGREE WITH THE STATEMENT BELOW I COULD NOT HAVE SAID IT BETTER MYSELF!!!
On the other side of the coin, 20,000 'users' now know better the risks associated with the internet, and will hopefully take more care on line.
Why is it cool to slag off the 'click' program? It clearly isn't made for techies, it's made for people who know nothing, but are interested. Like my mum, who despite my best efforts still allows all sorts to run on her machine, and clicks things innocently.
If the prgram made people more alert to the risks, then surely this is a 'good thing'...???
Yes, it may be ultimtely on dodgy legal ground, I was pretty wary of what they were doing when I saw it, but given that the people 'attacked' will probably now have decent security, and suffered next to no loss in the demonstration, surely it would be very bitter of them to take action against the program?

posted by : rojay, 21 March 2009 Complain about this comment
I feel like crap!! lol

After reading this I feel like CRAP!!!

I can't believe I used to watch this crapy Click program a while back...thank God! I gave up on this program a year back. lol

posted by : Jay, 16 March 2009 Complain about this comment
I want to see the bagground

Plzz upload a picture of the bagground i want to see it and read it...
I can't find in a good quaility yet... plzz upload it :)

posted by : Danili, 15 March 2009 Complain about this comment
Was your computer hacked?

It would be nice to hear from one of the people who took part in the program. Apparently they were informed of their participation (a desktop background with a message from click! of all things). However it may not be very likely that they watched click!, since apparently the Beeb wanted to save some money and bought the bots mainly from eastern Europe. For this reason also it is not very likely they will run into any legal trouble (people from Romania or Hungary are likely to not sue). However, I think the discussion demonstrates that this was a pretty good experiment.

posted by : Pekka, 15 March 2009 Complain about this comment
Nick Farrells who live in glass houses...

... shouldn't throw stones.

And somebody who describes spamming as "denial of service attacks on [ ... ] e-mail addresses" should not criticize others for calling the CPU the "brains" of the computer.

posted by : DaveK, 14 March 2009 Complain about this comment
Shoot the messenger, ignore the beast?

All the comments seem to discuss the ethics of what BBC has done. What about the message they delivered?

How can we make everyone's computers less vulnerable? Making everyone upgrade their systems is obviously not the answer. Upgrading the interconnect may help a little, but still faces the same problem.

It's easy for people to spout off on obvious issues (what the BBC did). It's much harder to say something useful about the bigger, much more complex issue (what to do about botnets & such).

posted by : CityZen, 13 March 2009 Complain about this comment
Can I has interwebs

The best (worst) part of Click has to be inbetween "Over to Kate" and "That was Kate".
Typical content:
"This week I looked at a site where you can create and care for your very own pony!"

posted by : BritSwedeGuy, 13 March 2009 Complain about this comment
Investigative Journalism

Feels like a bit of journo-envy. Presumably, if the INQ had thought of this first it would have been a great idea. C'mon INQ, you guys are in freefall. Years ago you had the ability to take the 'high ground' vs. things like Click - those days are gone and your standards suck. If it were me, I'd fire your journos and get Drashek to write a bot for you, you'd also solve your grammar and spelling issues!

posted by : Another View, 13 March 2009 Complain about this comment
Click is ok, but then it's all we have.

Incredile that computers are everywhere, yet on tv we only have Click (pretty lame), and The Gadget Show on C5. And that's it.

I'm shocked that Sony, Samsung, LG, Acer, Dell, HP etc haven't got together with some TV types and created a tv show that features their products and how to use them better.

A WhatPC for TV.

posted by : interested_party, 13 March 2009 Complain about this comment
puu

OSX yea yea its rubbish bite me. What use is an over inflated operating system that has nothing to offer. Literally no games no software that isn't supported on windows thats worth using. Heck even apples are shipped with win so OSX = poo

Also BBC Click is annoying hope they get arrested for being cocky smacktards. BBC programs are so dumbed down its ridiculous.

Take the program about the A380 for example with Richard Hammond you have to be a complete moron to think that was hard graft.

No the bbc has to stop coming up with stupid ridiculous demonstrations that in most cases a 5 minute animation of some sort could explain.

An expose on something thats being going on ages is more stating the obvious and passing off the turd as chocolate. Bite me

Cliffnotes
OSX = teh sawk
BBC = teh noob

I make no apologies for grammer anyone who makes fun of someone else's grammer by pointing out the obvious is a complete tool who has nothing good to say because he's too moronic to string along a couple of run on sentences about something which he knows nothing about so he doesn't get carried away in some ridiculous manner that no one can understand what the feck he's writing.

Bloody apple fanbois.

posted by : PF, 12 March 2009 Complain about this comment
The botnet was 'bought'...

...therefore it was already formed. The PC's were already hacked. The BBC essentially rescued them.

I think the program was a very good idea, and enlightening, even to me. I'm a reasonably high level techie, but I've never seen a botnet in operation before.

(Although, by buying the botnet they did contribute to the funding of the IT criminal underworld!)

posted by : ML, 12 March 2009 Complain about this comment
Bloomin beeb

"On the other side of the coin, 20,000 'users' now know better the risks associated with the internet, and will hopefully take more care on line."

Oh, that's OK then, who needs the law eh, so long as your intentions were good. Doesn't matter if the software used crashed anyones machines causing them to loose work, or slowed down their internet at the point they were doing anything important. It's their fault for being unprepared; there's no way you could possibly explain botnets without actually building one, and there's no way the BBC has a few hundred machines of their own they could've used.

"Why is it cool to slag off the 'click' program? It clearly isn't made for techies, it's made for people who know nothing, but are interested. Like my mum, who despite my best efforts still allows all sorts to run on her machine, and clicks things innocently."

Because it's often horribly innacurate, badly researched and often appears biased towards MS/intel (this may just be lazy though.)

Take the introduction of the Zune, where the most negative sounding person in the report was the guy from MS, or the introduction of 64bit x86 chips from intel, which mentioned AMD once if I remember correctly. The smaller of the 2 major PC chipmakers released a processor that changed the landscape enough to force the largest chip maker to adopt it's ISA, this was a significant event in the IT world, it would be nice if it'd been reported as such.

Basically, I think people just want the programme to hold itself to the same standards of journalism as the rest of the BBC's news outfit. Aiming at non technical people is fine, but doing it by being lazy and generalising isn't.

"If the prgram made people more alert to the risks, then surely this is a 'good thing'...???"

It's how it did it that's wrong, if they broke into someones house to prove a point would that be OK? If Niki Cambell started mugging old ladies on Watchdog to prove a point is that OK?

"Yes, it may be ultimtely on dodgy legal ground, I was pretty wary of what they were doing when I saw it, but given that the people 'attacked' will probably now have decent security, and suffered next to no loss in the demonstration, surely it would be very bitter of them to take action against the program?"

No, it would be entirely correct. The BBC could've made a botnet entirely on their own corporate PCs and proved exactly the same point, but they went the sensationalist route instead.

posted by : FIA, 12 March 2009 Complain about this comment
So this would be okay?

If you walk down an alley and I rob you, just a few dollars/pounds and then I tell you that this isn't a safe area and you should not carry money, it's okay, because I told you about it afterward.

posted by : GZ, 12 March 2009 Complain about this comment
hmmm

A warning would have been nice, but would they have known what to do?
Protect your computer and watch this show no more.

posted by : David, 12 March 2009 Complain about this comment
Six months in the making?

According to their twitter page;
http://twitter.com/bbcclick

"Six months in the making and finally the botnet show is ready. Presenter, Spencer Kelly in the Click edit suite. D http://twitpic.com/20yuw"

Six months?

posted by : Pete, 12 March 2009 Complain about this comment
BBC = full of crap

@ Pete - Agreed! They won't have to reveal their 'sources' because they are the press. They won't reveal them, which is utter hypocracy. They claim they are warning us of computer dangers, when they could actually do some good - tell the coppers where they got the bot - and they wont. They're just like every other snotty nosed kid who watched a 1980's hacker movie and thought it would be cool to do it, too.

@ Paul - So how many of the 22,000 hijacked machines were running Windows 95? Just because an OS isn't used often, dopesn't mean it's more secure.

No further questions ;)

posted by : mike, 12 March 2009 Complain about this comment
Ethical hacking? No it isn't.

If the intentions were ethical, they should have advised users first, then obtained consents, before exploiting the resources.

Its quite clearly a CMA offence to obtain unauthorisated access to programs and/or data on a computer without the consent of the owner, and to do so knowing that you don't have consent.

Sadly, having 'no criminal intent' won't protect anyone who breaks the law from prosecution (as thousands of prisoners will confirm).

And please tell us, who did BBC pay the money to? And was that information provided to the police?

Foolish idiots.

posted by : Pete, 12 March 2009 Complain about this comment
The BBC shouldn't have done this

As I've described on my blog, this looks very much like a breach of the Computer Misuse Act.

A TV report like this can raise awareness of the serious problem of computers being controlled by hackers. But is it appropriate for a broadcaster to use innocent people's computers without their permission for the purposes of their experiment?

Sophos has been asked many times by the media to take part in TV programmes like this, and has always made clear that we believe their legality to be questionable.

I wonder if Spencer Kelly might be the next Gary McKinnon if any US military computers were part of the botnet!?

posted by : Graham Cluley, Sophos, 12 March 2009 Complain about this comment
When do the police investigations begin?

Since the BBC is seemingly using license (*cough* tax) payer's money to fund criminal activity?

posted by : HC, 12 March 2009 Complain about this comment
risky

Maybe the bot software made clear what it was when you installed it. I wonder if it would be legal then. If not I hope the Click team doesn't get in trouble, they had good intentions after all. It's the only half decent tech show on tv.

posted by : dave, 12 March 2009 Complain about this comment
wrong attitude

I work in IT and occasionally have to deal with Tech Support guys with an attitude like this. And I have to say its people like this that I see as being far more patronising than BBC Click. I regularly have to make analogies like a CPU being the “brains of the computer” as the people I deal with wouldn’t understand “a miniaturized electronic circuit (consisting mainly of semiconductor devices, as well as passive components) that has been manufactured in the surface of a thin substrate of semiconductor material.”

I think it’s good to see people like BBC Click bringing DDoS attacks to a wider audience and making people aware of what they are.

I wonder if this mindset is one of the reasons things like Linux distributions haven’t hit the mainstream. Whenever I have to deal with the Linux community I’m reminded that it’s made up of very clever people who want to keep their little world exclusively for people who like to communicate with their OS through the Command Prompt.

posted by : David Wilce, 12 March 2009 Complain about this comment
Dear WinTard user...

So how many of the 22,000 hijacked machines were running OS X?

No further questions ;)

posted by : Paul, 12 March 2009 Complain about this comment
quick, let's kick the beeb!

On the other side of the coin, 20,000 'users' now know better the risks associated with the internet, and will hopefully take more care on line.
Why is it cool to slag off the 'click' program? It clearly isn't made for techies, it's made for people who know nothing, but are interested. Like my mum, who despite my best efforts still allows all sorts to run on her machine, and clicks things innocently.
If the prgram made people more alert to the risks, then surely this is a 'good thing'...???
Yes, it may be ultimtely on dodgy legal ground, I was pretty wary of what they were doing when I saw it, but given that the people 'attacked' will probably now have decent security, and suffered next to no loss in the demonstration, surely it would be very bitter of them to take action against the program?

posted by : Dave, 12 March 2009 Complain about this comment
BBC tut tut

when will big corporations realise BS like this wont be tolerated. It is illegal and I hope the 20,000 users get some kind of 'class action' lawsuit.

So basically while the DDOS attack was going on the 20,000 users suffered reduced internet bandwidth for whatever they are doing.

Jon G is totally correct, I am lazy to dig out my uni notes on this subject but its definitely illegal

posted by : Ernie, 12 March 2009 Complain about this comment
Oops...

Thought the BBC would know better! Wodner how long until they get their wrists slapped and told how the law actually works? :O

posted by : Brian L, 12 March 2009 Complain about this comment
La-la-la-la-la, NICK-NICK, NICK-NICK! (*)

"He said that if this had been done with criminal intent it would be breaking the law."

Oh my, Spencer, you've put your foot in it this time. You ought to read the Computer Misuse Act 1990, in particular sections 1 and 3, a little more carefully. Deliberately obtaining unauthorised access is sufficient for an offence.

(*) Sung to the tune of the "Blue Danube Waltz", of course

posted by : Jon G, 12 March 2009 Complain about this comment
aboutus
Advertisement
Subscribe to INQ newsletters
Advertisement
INQ Poll

Authorities in several countries raided Megaupload recently, shut down all of its services, seized hundreds of servers and arrested several of its executives on criminal charges.

Do you think the move was justified?