We are anonymous inside the hacker world of lulzse

Minions.” Another helpful source for corroborating personal details on Monsegur was the New York Times story “Hacker, Informant
and Party Boy of the Projects,” published on March 8, 2012, in which reporters spoke to Monsegur’s neighbors to piece together a
picture of the man. Interviews with sources close to Hector Monsegur and the FBI investigation also contributed to the information in
this chapter.
Details about the incident at Monsegur’s high school with the head of security were sourced from an essay purporting to be written by
Sabu on August 14, 2001, and bearing all his usual stylistic and verbal hallmarks. It was published via Pastebin on June 7, 2011 (the
day of his arrest), and also sent to me via e-mail by a source. Full essay here: http://pastebin.com/TVnGwSmG.
The details about Monsegur’s internships as a teenager were sourced from a web archive of the iMentor website from August 2002,
which listed Monsegur as a member of the staff and provided a short biography that mentioned his stints at the NPowerNY
Technology Service Corp and the Low-Income Networking and Communications Project (LINC) at the Welfare Law Center.
Text for The Hacker Manifesto by the Mentor can be found here: http://www.mithral.com/~beberg/manifesto.html. I have exchanged emails
with Lloyd “the Mentor” Blankenship to corroborate details about his writing of the 1986 essay.
Sabu/Monsegur provided me with links that still showed the deface message he published on the Puerto Rican government websites.
Further details on the U.S.-China cyber war that Sabu involved himself in were corroborated by news reports such as Wired’s “It’s
(Cyber) War: China vs. U.S.,” published in April of 2001, and CNN’s “China-U.S. Cyber War Escalates,” published on May 1,
2001. Further details about Monsegur and his attempts to start a group for local programmers in 2002 also come from a “dox” file
posted by a security researcher nicknamed Le Researcher, who pasted a variety of screenshots of e-mails, deface messages, and forum
posts on http://ceaxx.wordpress.com/uncovered/. Sabu’s message on AnonOps, in which he asks how to find Wired’s John Abell,
came from the online database http://blyon.com/Irc/.
Details about the anticorruption protests in Tunisia were widely reported in late December of 2010 and early January of 2011, and
details of the government’s phishing campaign, aimed at spying on potential dissenters, were published by Al Jazeera and Ars
Technica. Censored sites would typically say “Error 404: page not found.” An officially blocked site will usually say “Error 403,” so
the use of 404 suggested unofficial censorship. One journalist and blogger, Sofiene Chourabi, had reportedly been blocked from
accessing his Facebook account; his 4,200 friends were also hacked. Other journalists claimed that their entire blogs were deleted of
content, and suspected the Tunisian Internet Agency was behind it. Many Tunisians also claimed they were unable to change their
Facebook passwords. The phishing operation was sophisticated, hitting several high-profile targets in a single day, and was carried
out by a malware code, according to Al Jazeera, which cited “several sources.” The TechHerald’s Steve Ragan reported seeing
examples of the embedded script and new source code injected in Gmail, Yahoo, and Facebook, confirming with four different
experts that the embedded code was “siphoning off login credentials” and that “code planting of this scale could only originate from
an ISP (Internet Service Provider).”
Details of the antiphishing script developed by Tflow are available on the script-sharing website http://userscripts.org, under the user
name “internetfeds.” Sabu, Topiary, and one other senior figure in Anonymous said that Tflow originally wrote the script. Tflow had
written a browser JavaScript plug-in that effectively stripped the government’s added Java code and redirected Tunisian Internet users
away from its phishing servers (essentially fake Gmail, Yahoo, and Facebook sites) and back to the original, true hosts. Tunisian
Internet users first had to install the Greasemonkey add-on for Firefox. Then it was just a matter of opening Firefox and going to
Tools, then to Greasemonkey and New User Script, to paste in the code. Having clicked “Okay,” Tunisians could within a minute or
two access Facebook, Twitter, Blogger, Gmail, and Yahoo without exposing their login details.
I have sourced the story about Sabu remotely controlling a Tunisian man’s computer to deface the website of the country’s prime
minister from interviews with Sabu himself, conducted in April of 2011. It’s still not clear exactly how Sabu hit the Tunisian DNS,
but one expert who knew him suggests he may have used a so-called smurf attack to bring down the domain servers of the Tunisian
government. This refers to a unique type of denial of service (DoS, without the d for “distributed”) attack that can be carried out from
a single computer. Instead of using a botnet, it uses servers with significant space and speed to transfer the junk data. A smurf attack,
specifically, needs broadcast servers. It sends a ping request to one or more of the servers, communicating (falsely) that the return IP
address is the target. In hackerspeak, they are sending “spoof packets.” The broadcast server then tells its entire network to respond to
the target machine. One computer by itself can send perhaps 500 megabytes worth of packets at most, but a smurf attack allowed
Sabu to amplify 40 gigabytes worth. A screenshot of the deface message that was uploaded to Prime Minister Ghannouchi’s site is
available online.
Chapter 10: Meeting the Ninja
Opening paragraphs of this chapter are sourced from online interviews with Topiary. His deface message on the government of Tunisia
was until recently viewable here: http://pastehtml.com/view/1cw69sc.html. The point about cyber attacks on the governments of
Libya, Egypt, Zimbabwe, Jordan, and Bahrain came from testimony by Topiary and was corroborated with various online news
reports. I saw the deface of the Fine Gael website myself and confirmed it on the phone with a press spokesman for the Irish political
party.
The description of Kayla’s style of writing, which includes “lol”s and smiley faces, is based on my own observations as well as those of
Anonymous members. Her view of hacking as an addiction comes from a later, online interview.
The online poll by Johnny Anonymous was described to me in a Skype interview with Johnny Anonymous himself, conducted on
March 7, 2011.
Descriptions of Kayla’s obsessive attempts to keep her identity hidden are sourced from interviews with Kayla, conducted largely by email,
in March of 2011. I was first introduced to Kayla (and Sabu, Tflow, and the others who would later make up LulzSec) by
Topiary. Details of Kayla’s life experiences and getting hacked by a man who “screamed” down the phone at her came from
interviews also conducted in March of 2011. Kayla’s involvement in the Gawker hack, which has been reported by Gawker itself,
was mentioned in an Internet Relay Chat interview with the hacker on May 23, 2011, in which she described in detail how she and a