Graham Cluley, Sophos: TinKode arrested for suspected hack of NASA and Pentagon servers

February 2, 2012

Police in Romania believe that they may have apprehended the notorious hacker TinKode, who in the past has hacked into government and military websites, exposing their poor security.

The 20-year-old man, named as Razvan Manole Cernaianu, allegedly attacked Pentagon and NASA computer systems, revealed security holes, and published information about SQL injection vulnerabilities he had discovered.

The Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT) has said in a statement that the alleged hacker also offered a computer program to hack into websites on his blog, and published a video showing internet attacks he had orchestrated against the US authorities.

TinKode's targets were not just based in the United States, however. For instance, in November 2010, the British Royal Navy's official website was compromised by the Romanian hacker, who claimed to have exposed the site's passwords.

And last year, MySQL's website was hit by - oh, the irony.. - an SQL injection attack.

Associated Press reports that the US Embassy in Bucharest claimed that Cernaianu, who is reportedly an IT student, "used sophisticated hacking tools to gain unauthorized access to government and commercial systems."

That may be so, but in my estimation over the last few years TinKode's motivation has been more about mischief-making than the more malicious attacks we often see, fueled by a desire for publicity via his active Twitter and Facebook accounts.

Perhaps now is a good time to remind everyone who thinks it's cool or amusing to expose an organisation's weak security that hacking into a site is still a crime, regardless of what your incentive may be.

DIICOT is said to have worked with the FBI and NASA on the investigation.

Graham Cluley is senior technology consultant at Sophos. You can follow him on Twitter for regular updates.