We are anonymous inside the hacker world of lulzse

The deleting code rm -rf/* is well known among Web trolls, who at one time made a practice of telling Mac and Linux users to type the
code into their copy of Terminal, the application that allows users to engage with their computers using a command-line interface.
This can lead users to inadvertently wipe out their hard drives. According to KnowYourMeme.com, the trolling scheme against PC
users has been around since the early 2000s, but became popular through its promulgation on 4chan around 2006. Users of /b/ would
post digital flyers or start discussion threads saying, for example, that Microsoft had included a folder called system32 on all PCs and
that this folder held 32 gigabytes of “worthless crap.” They added that the company did this to sell more system-cleaning software,
and that the way to get back at money-hungry Microsoft was to delete the file. This was, of course, completely untrue.
Here is a translation of the UNIX code rm -rf/* itself: “rm” is the command short for remove; a blank space then indicates the end of the
command. The “-” begins the options, with “r” meaning “recursively delete all directories” and “f” meaning “override file
permissions.” “/*” means that everything after the root of the tree (“/”) is to be affected. The entire command means “remove
everything forcefully.”
The assertion that “many news outlets bought this line”—i.e., the line that LulzSec had hacked InfraGard in response to the Pentagon
announcement—was sourced from a number of news reports. Among them is the digitaltrends.com story “LulzSec Hacks FBI
Affiliate, Infragard.”
Details about the arrest of Sabu were sourced partly from Fox News reports, including the one entitled “Infamous International Hacking
Group LulzSec Brought Down by Own Leader,” and partly from an interview with an anonymous source who had knowledge of the
arrest and FBI investigation. Further details about Sabu’s arrest and his later appearance in a secret court hearing are laid out in
chapter 26.
Details about Cisco’s promotional tweet appearing on Twitter searches for LulzSec were sourced by my own observations and were
corroborated by Cisco spokesman John Earnhardt, who said that LulzSec was a “term of interest” in the security industry. The day
after I wrote a blog post on the promotion for Forbes, entitled “How Cisco Is Capitalizing on LulzSec Hackers’ Popularity” and
published on June 15, 2011, the promotion disappeared.
Joseph K. Black, founder of the Black & Berg IT security company, most likely faked the attack on his own website. This assertion is
based on interviews with Topiary, who said that no one in the group had hit or had planned to hit Black & Berg, and on interviews
with Jennifer Emick, who spent some time investigating Black. I also base this conclusion on my opinion that Black is not a credible
source. Cyber security and antivirus expert Rob Rosenberger wrote a column for SecurityCritics.org on February 15, 2011, in which
he referred to Black as a “charlatan” whose activities until that point already “qualified as ‘unethical behavior’ done for shameless
self-promotion.” The cyber security site attrition.org later wrote a damning indictment of Black on February 28, 2011, in an article
entitled “Joseph K. Black: Social Media Experiment Gone Horribly Wrong,” which offered the prediction that Black would never
obtain his professed dream job of “National Cybersecurity Advisor.” It posted screenshots of his Twitter feed from January of 2011,
including tweets such as “I just did my 2nd line of coke and it’s only 4.15; WOW!” Another tweet, directed toward Attrition itself,
said, “Your [sic] just jealous that the Feds haven’t taken you off the grid yet. Sucker.Im untouchable.I got the Feds in my pocket.Im
comfy.” In October of 2011, Black was pursued by police in a thirty-five-minute car chase over four U.S. counties, after which he got
out of his car holding a small dog and pointed his finger at the police, making shooting noises. He was promptly Tasered (source:
“Omaha Man Caught after Early Morning Pursuit,” the North Platte Bulletin, October 31, 2011). By early 2012, Black & Berg had
folded and Black had posted a photo of himself on an about.me Web page, where he listed himself as “Advisor to Anonymous and
#Antisec operations.” In the photo, Black was standing in front of a mirror, wearing a hoodie, sunglasses, and a gold chain necklace.
Black did not respond to a question e-mailed to him on the matter of his website’s defacement, or to an interview request. Ironically,
in spite of the overwhelming evidence that the deface on Joseph K. Black’s website had been self-inflicted for publicity purposes,
British prosecutors would later list an attack on Black & Berg among the charges against Jake Davis and three other young men
associated with LulzSec.
Details about other copycat hacker groups, such as LulzSec Brazil and LulzRaft, were sourced from the groups’ own Twitter feeds,
announcements, and press reports, and from interviews with LulzSec members.
Topiary’s statement “I’m starting to get quite worried some arrests might actually happen” was made in an interview with me.
Chapter 22: The Return of Ryan, the End of Reason
Details in this chapter about activities within LulzSec, dialogue about the disappearance of Sabu, and descriptions of Ryan were sourced
from interviews with LulzSec’s founding members. Details about Topiary’s first call with Sabu were sourced from interviews with
Topiary.
The name David Davidson comes from the widely panned 2000 comedy film Freddy Got Fingered, starring Tom Green. It has often
been used online as a joke name, but perhaps not enough to be considered an outright Internet meme.
Ryan first rekindled his relationship with LulzSec’s members by offering to let the group house its IRC network on his servers. This was
a welcome offer, although eventually the crew would be hopping between servers owned by AnonOps and the public IRC networks
provided by EFnet, Rizon, and 2600.
Topiary did not believe that the dox released for Ryan earlier that year by Evo was real. He also believed that the real Ryan was
relatively safe, since Ryan claimed, for instance, to have his neighbor receive all his packages, which were addressed to a fake name
anyway, before passing them over to him, so that he never had to give out his real address.
The Skype number 1-614-LULZSEC was off at all times and redirected to another Google number, which was also offline and
redirected instantly to the main Skype account that Topiary and Ryan were using. This account had been registered via a fake Gmail
account on a random IP address.
I have sourced the assertion that Assange was “chuckling” to himself from interviews with Topiary, who said that when he was first
talking to Assange on IRC, Assange claimed that he and others in WikiLeaks had “laughed” when they heard about the DDoS attack
on the CIA.