Long before schoolboys worked their way past website blocking, they furtively reassembled encoded newsgroup images from the likes of alt.binaries.pictures.erotica.female. Before the Internet, secondhand bookshops played a significant role in sex education.

Erudite but perversely erotic works such as Richard von Krafft-Ebing’s Psychopathia Sexualis, first published in 1886, were particularly prized, in the hope that they would remain unpurchased for several repeat visits to browse them. Although it could easily have degenerated into Woody Allen meets von Krafft-Ebing, Bret Wood’s movie of the same name must be equally valued by modern schoolboys with a penchant for cinematography and the skills needed to hack themselves a multi-region DVD player.

Maybe the time has come for someone as innovative as von Krafft-Ebing to write Psychopathia Internetualis, a psychiatric analysis of all the pathological behaviour that we experience online.

As ever, there are many parallels with the real world, such as those with the propensity to rush out and spray or daub blank surfaces with graffiti. Some of those who deface websites now claim that they are following in that long and sometimes venerable tradition, although none seems to be any match for Banksy. Even so I think all of us on this side of the fence see website defacement as anti-social if not inevitably criminal.

Zone-H, a singular focus of information about website defacement, publishes periodic analyses of events that have been registered with it. Peaks of activity appear to occur randomly, sometimes associated with massive denial of service (DOS) attacks. Over the last few years, the number of ‘submitted’ defacements rose to a peak of 1.6 million in 2011, and has steadily declined since. However numbers remain well above the half million or so which were ‘submitted’ each year over the period 2005-9.

There is a lot to be learned from analysis of the methods of attack that succeeded in capturing web servers. Most popular were password stealing, sniffing, and the like against the administrator or another admin user, exploitation of server misconfiguration or failure to patch known vulnerabilities, file inclusion, Web Application bugs, and perhaps inevitably SQL injection.

Other methods such as DNS cache poisoning, social engineering attack against DNS, URL poisoning, intrusion via external modules, and rerouting after successful firewall or router attack, are notably common. These tend to confirm security guru Bruce Schneier’s long-held thesis that humans are invariably the weakest link in any secure system.

The reasons given for attack bring us back to our draft chapter in Psychopathia Internetualis: the majority of defacements were performed because the perpetrator just wanted to be the best defacer, for fun, or as a challenge. Fewer occurred for political, patriotic, or similar reasons, or to get revenge against the website, although those are now growing considerably in frequency.

One of von Krafft-Ebing’s more lasting contributions was the word masochist, from von Sacher-Masoch’s autobiographical novella Venus in Furs; I wonder whether we will see a neologism coined to describe those bizarrely destructive people who get their kick out of defacing web sites. Anyone for ‘webvandals’?

Updated from the original, which was first published in MacUser volume 24 issue 12, 2008.