31.10.2012 Views

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

used skull-and-crossbones imagery and generally took <strong>the</strong>mselves too seriously.<br />

It was not unusual in Anonymous to hop from one operation to ano<strong>the</strong>r, reflecting <strong>the</strong> sometimes limited attention spans <strong>of</strong> its groups<br />

and supporters. Along with Operation Metal Gear, <strong>the</strong>re was Operation Wisconsin, Operation Eternal Ruin, and operations focused<br />

on Libya and Italy, each <strong>of</strong> which had anywhere from two to a dozen people involved. In early 2011, <strong>the</strong> original version <strong>of</strong><br />

Operation Payback, launched against copyright companies, came back for round two by targeting more copyright-related websites.<br />

Topiary observed, however, that its proponents kept switching targets—for instance, <strong>the</strong>y called agcom.it a target, causing a few<br />

people to be fired but failing to generate enough momentum to take <strong>the</strong> site down—providing o<strong>the</strong>rs with a reason to move on to<br />

something else. Frequently switching targets is one <strong>of</strong> <strong>the</strong> crucial reasons why Operation Payback had dwindled to around fifty<br />

people in October <strong>of</strong> 2010 and nearly died out—until WikiLeaks came along by chance, and thousands <strong>of</strong> people suddenly jumped<br />

in.<br />

Chapter 14: Backtrace Strikes<br />

The opening paragraphs <strong>of</strong> this chapter <strong>are</strong> sourced from interviews with Jennifer Emick, with some added details—including <strong>the</strong> name<br />

<strong>of</strong> her Skype group, <strong>the</strong> Treehouse—coming from Anonymous-related blogs.<br />

Details about <strong>the</strong> arrests in <strong>the</strong> Ne<strong>the</strong>rlands and Britain <strong>are</strong> sourced from various mainstream news reports. The U.K.’s Metropolitan<br />

Police announced on January 27 that <strong>the</strong>y had arrested five people in morning raids across <strong>the</strong> country. According to a report in The<br />

TechHerald at <strong>the</strong> time, <strong>the</strong>y were allegedly tracked with “little more than server logs and confirmation from <strong>the</strong>ir ISP.”<br />

Descriptions <strong>of</strong> what Emick was finding on DigitalGangsters.com were originally sourced from Emick and corroborated by my own<br />

observations <strong>of</strong> <strong>the</strong> website, especially its “About” page. I also interviewed a member <strong>of</strong> <strong>the</strong> forum site nicknamed Jess, who was a<br />

close friend <strong>of</strong> <strong>the</strong> twenty-three-year-old Seattle woman on <strong>the</strong> site who went by <strong>the</strong> name Kayla and whose real name is Kayla<br />

Anderson. Jess confirmed that <strong>the</strong> woman is not <strong>the</strong> same Kayla <strong>of</strong> LulzSec, though she and her friend considered <strong>the</strong> <strong>hacker</strong> known<br />

as Xyrix as an acquaintance. It was most likely a coincidence, she added, that Xyrix was being connected to both a Kayla from<br />

DigitalGangsters.com and <strong>the</strong> Kayla <strong>of</strong> LulzSec. Emick doubted this account when I put it to her in November <strong>of</strong> 2011 and believed<br />

that <strong>the</strong>re was a connection between <strong>the</strong> two Kaylas.<br />

Incidentally, Corey “Xyrix” Barnhill has denied being Kayla, both by leaving comments on online news reports about Kayla and by emailing<br />

me directly. The AnonOps Kayla also told me and certain members <strong>of</strong> Anonymous that she went along with rumors that she<br />

was Xyrix because it helped obfuscate her real identity.<br />

The descriptions <strong>of</strong> YTCracker and <strong>the</strong> story about <strong>the</strong> hack on DigitalGangsters.com were sourced from phone interviews with Bryce<br />

“YTCracker” Case himself, as well as from my observations <strong>of</strong> <strong>the</strong> deface message that was posted on his site when Corey “Xyrix”<br />

Barnhill, Mike “Virus” Nieves, and Justin “Null” Perras had, according to Case, switched <strong>the</strong> DigitalGangster.com domains to point<br />

at <strong>the</strong>ir own servers.<br />

My own observation <strong>of</strong> DigitalGangsters.com showed posts advertising jobs that required hacking into websites via SQL injection,<br />

stealing databases <strong>of</strong> names and e-mail addresses, or just stealing addresses and sending <strong>the</strong>m to spammers. A database with<br />

passwords was worth more, since spammers could <strong>the</strong>n send spam from legitimate addresses. Occasionally a thread would start with a<br />

post seeking “freelancers” who could program in C, Objective-C, C#, VB, Java, and JavaScript. One post from June <strong>of</strong> 2010 had <strong>the</strong><br />

title “DGs [Digital Gangsters] in Washington? Be my mail man in <strong>the</strong> middle,” followed by: “Heres how it works. A delivery gets<br />

shipped to your address, You open <strong>the</strong> package remove item, Reship <strong>the</strong> item to me in a new container with a false return address.<br />

when item arrives you get paid. interested?”<br />

The description <strong>of</strong> Jin-Soo Byun was sourced from interviews with Jennifer Emick and Laurelai Bailey; <strong>the</strong> note that Aaron Barr was<br />

helping her investigation was sourced from an interview with Barr. The details about Emick setting up <strong>the</strong> initial Backtrace<br />

investigation into Anonymous, and <strong>the</strong>n tracking down “Hector Montsegur” [sic], <strong>are</strong> sourced from interviews with Emick.<br />

Descriptions <strong>of</strong> some <strong>of</strong> Sabu’s defaces come from screenshots provided by Sabu himself as well as from a blog post by Le<br />

Researcher, an anti-Anonymous campaigner who works with Emick. Ano<strong>the</strong>r group that includes longtime EFnet user Kelley<br />

Hallissey claims it doxed Sabu in December 2010 and passed his details to Backtrace in February 2011. Emick denies this.<br />

Sabu’s statement that he was “going to drive over to [Laurelai’s] house and mess him up” was sourced from Topiary’s testimony.<br />

The origins <strong>of</strong> <strong>the</strong> word backtrace point to one <strong>of</strong> <strong>the</strong> most notorious 4chan and Anonymous operations ever conducted. It started in July<br />

<strong>of</strong> 2010, when 4chan’s /b/ users began trolling an eleven-year-old girl named Jessica Leonhardt. Online, she was known as Jessi<br />

Slaughter, and was a minor e-celebrity after uploading videos <strong>of</strong> herself onto a site called StickyDrama. When o<strong>the</strong>r StickyDrama<br />

users started bullying Slaughter, she filmed a series <strong>of</strong> tearful ripostes, including one in which her mustached fa<strong>the</strong>r could be seen over<br />

her shoulder jabbing his finger at <strong>the</strong> webcam and shouting, “You bunch <strong>of</strong> lying, no-good punks! And I know who it’s comin’ from!<br />

Because I BACKTRACED it!” The broadside spawned a number <strong>of</strong> Internet catchphrases and memes, including “backtrace,” “Ya<br />

done go<strong>of</strong>ed,” and “Consequences will never be <strong>the</strong> same!” By February <strong>of</strong> 2011, Jessi Slaughter had been placed under police<br />

protection and admitted to a mental institution. The following August, her fa<strong>the</strong>r died <strong>of</strong> a heart attack at <strong>the</strong> age <strong>of</strong> fifty-three.<br />

The dialogue among Topiary, Kayla, Tflow, and AVunit, starting with <strong>the</strong> quote “They all think i’m Xyrix!” was sourced from <strong>the</strong>ir<br />

March 21, 2011, discussion on a private IRC channel called Seduce. By this point, Topiary had introduced me to Kayla (with whom I<br />

had been communicating by e-mail) and it was in this room that I first spoke to AVunit, Tflow, and Sabu. From <strong>the</strong>re I organized<br />

separate interviews with each <strong>of</strong> <strong>the</strong>m. The group was already communicating with each o<strong>the</strong>r in <strong>the</strong>ir own separate channel, and<br />

#seduce was set up for <strong>the</strong> purpose <strong>of</strong> speaking with me and providing testimony for this book. The name Seduce came from <strong>the</strong> late-<br />

February revelation in <strong>the</strong> #HQ chat log that Kayla would be talking to me; she quipped that “She wrote good stuff about us so far…<br />

she talked with Topiary. he has her seduced I guess.” Later, when <strong>the</strong> group would switch to a different IRC server, <strong>the</strong>y would<br />

create ano<strong>the</strong>r channel, named #charmy, also for talking exclusively with me. I was later told that Sabu was extremely wary <strong>of</strong> talking<br />

to me in <strong>the</strong> #seduce channel in March, and I observed that he was r<strong>are</strong>ly in <strong>the</strong> room or would make excuses to leave. On April 13,<br />

2011, however, we held our first real interview on IRC and he became more forthcoming.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!