31.10.2012 Views

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

though, <strong>the</strong>y were usurped by what would become <strong>the</strong> two most popular weapons in <strong>the</strong> Anonymous arsenal: botnets and <strong>the</strong> Low-Orbit Ion<br />

Cannon (LOIC).<br />

Botnets would not be used significantly by Anonymous for a few more years, but <strong>the</strong>y were easily <strong>the</strong> more powerful <strong>of</strong> two key weapons.<br />

These were large networks <strong>of</strong> “zombie” computers usually controlled by a single person who gave <strong>the</strong>m commands from a private IRC<br />

channel. It’s rumored that botnets were used just once or twice during <strong>the</strong> first Anonymous attacks on Chanology, though few details <strong>are</strong><br />

known. Often botnets <strong>are</strong> made up <strong>of</strong> between ten thousand and one hundred thousand computers around <strong>the</strong> <strong>world</strong>. The biggest botnets,<br />

ones that have <strong>the</strong> power to take out <strong>the</strong> servers <strong>of</strong> small governments, have upward <strong>of</strong> a million computers. The computers belong to average<br />

people like you and me, oblivious to what is going on—<strong>of</strong>ten we’ll have joined a botnet by accidentally downloading infected s<strong>of</strong>tw<strong>are</strong> or<br />

visiting a compromised website. Perhaps someone sent us a spam e-mail with a link promising free photo prints or a cash prize, or we clicked<br />

on an interesting video that disguised malicious code.<br />

Nothing appears to be amiss after such s<strong>of</strong>tw<strong>are</strong> downloads. It installs itself quickly and quietly and for <strong>the</strong> most part remains dormant.<br />

When <strong>the</strong> botnet controller issues commands to a network <strong>of</strong> “bots,” a signal is sent to <strong>the</strong> infected computer, and <strong>the</strong> small program that was<br />

downloaded starts up in <strong>the</strong> background without <strong>the</strong> owner’s realizing it. (Who knows—your computer could be taking part in a DDoS<br />

attack right now.) The network <strong>of</strong> thousands <strong>of</strong> computers will act toge<strong>the</strong>r, as if <strong>the</strong>y were one single computer. Typically, botnets will use<br />

<strong>the</strong>ir bots to send spam, find security vulnerabilities in o<strong>the</strong>r websites, or launch a DDoS attack on a corporate website while <strong>the</strong> controller<br />

demands a ransom to stop. In underground <strong>hacker</strong> culture, larger botnets translate to greater street cred for <strong>the</strong> controllers, or botmasters.<br />

It’s unclear how many computers in <strong>the</strong> <strong>world</strong> have been assimilated into botnets, but <strong>the</strong> number is at least in <strong>the</strong> tens <strong>of</strong> millions, with <strong>the</strong><br />

greatest number <strong>of</strong> bot-infested computers in <strong>the</strong> United States and China. In 2009 <strong>the</strong> Shadowserver Foundation reported that <strong>the</strong>re were<br />

thirty-five hundred identified botnets in <strong>the</strong> <strong>world</strong>, more than double <strong>the</strong> number in 2007. In March 2010 Spanish police arrested three men<br />

behind a botnet called Mariposa, Spanish for “butterfly.” Discovered by white-hat <strong>hacker</strong>s (cyber security specialists) and law enforcement<br />

agents in 2008, <strong>the</strong> monster botnet was made up <strong>of</strong> as many as twelve million zombie computers and had been used to launch DDoS attacks,<br />

send out e-mail spam, and steal personal details. The ringleaders made money on <strong>the</strong> side by renting it out.<br />

Renting a botnet was far less risky than making one yourself, and with <strong>the</strong> right skill set and contacts, <strong>the</strong>y were surprisingly easy to come<br />

by. A 2010 study by <strong>We</strong>b infrastructure company VeriSign showed <strong>the</strong> average rate for renting a botnet from an underground marketplace<br />

was $67 for twenty-four hours and just $9 for one hour. Renting a botnet that could take out <strong>the</strong> servers <strong>of</strong> a small government might cost<br />

around $200 an hour. Botnets used by Anonymous in both <strong>the</strong> Chanology attacks <strong>of</strong> 2008 and Op Payback in 2010–11 were both rented and<br />

self-created, and sources say <strong>the</strong>re was also a range <strong>of</strong> botnet sizes. But it was <strong>the</strong> super botnets, controlled by a small handful <strong>of</strong> people, that<br />

could do <strong>the</strong> most damage.<br />

The second weapon in <strong>the</strong> Anonymous arsenal was <strong>the</strong> Low Orbit Ion Cannon, whose acronym is pronounced “lo-ick.” In terms <strong>of</strong><br />

power, it was piddling against a botnet—like <strong>the</strong> difference between a long-range missile and a handgun—but <strong>the</strong> s<strong>of</strong>tw<strong>are</strong> was free and easy<br />

for anyone with a computer to access. From <strong>the</strong> start <strong>of</strong> Chanology onward, LOIC started replacing Gigaloader in popularity. The origins <strong>of</strong><br />

<strong>the</strong> s<strong>of</strong>tw<strong>are</strong> program <strong>are</strong> a little unclear, but it is widely thought to have first been developed by a programmer nicknamed Praetox, who was<br />

eighteen at <strong>the</strong> time, lived in Oslo, Norway, and enjoyed programming and “running in <strong>the</strong> woods,” according to his website.<br />

Praetox made all sorts <strong>of</strong> things on his computer, including cheats for <strong>the</strong> online role-playing game Tibia and a program that would make<br />

windows on a computer desktop look transp<strong>are</strong>nt. He was also versed in chan culture and used <strong>the</strong> cartoon image <strong>of</strong> a “Pool’s closed” sign<br />

for his YouTube account. The name LOIC itself comes from a weapon in <strong>the</strong> Command & Conquer video game series, and <strong>of</strong> all his<br />

creations it would be Praetox’s legacy.<br />

Praetox appears to have originally created LOIC as an open source project, which meant anyone could improve it. Eventually, a<br />

programmer nicknamed NewEraCracker made some tweaks that allowed LOIC to send out useless requests or “packets” to a server, making<br />

it what it is today. At <strong>the</strong> time, packets were part <strong>of</strong> everything one did on <strong>the</strong> Internet. Visiting a web page involved receiving a series <strong>of</strong><br />

packets, as did sending an e-mail, with a typical packet containing 1–1,500 bytes. They can be comp<strong>are</strong>d to addressed envelopes in <strong>the</strong> postal<br />

service. “Packet sniffing” meant trying to figure out what was <strong>inside</strong> a piece <strong>of</strong> mail by looking at what was on <strong>the</strong> envelope. The data <strong>inside</strong><br />

a file could be encrypted, but <strong>the</strong> packet itself would always identify <strong>the</strong> sender and receiver.<br />

A DDoS attack was, in one way, like overwhelming someone with thousands <strong>of</strong> pieces <strong>of</strong> junk mail that <strong>the</strong>y had no choice but to open.<br />

One defense was to “filter <strong>the</strong> packets,” which would be like asking a doorman to not allow any mail from a certain sender. But DDoS<br />

protection costs money, and it was difficult to filter <strong>the</strong> junk packets from LOIC, since <strong>the</strong>y were coming from many different users.<br />

Ultimately, if enough people used <strong>the</strong> program and “aimed” it at <strong>the</strong> same site at <strong>the</strong> same time, <strong>the</strong>y could overload it with enough junk<br />

traffic to take it <strong>of</strong>fline. The effect was similar to a botnet’s, except instead <strong>of</strong> having infected computers, <strong>the</strong> participants were voluntarily<br />

joining <strong>the</strong> network. A key difference was effectiveness. The effect <strong>of</strong> LOIC was far more unpredictable than that <strong>of</strong> traditional botnets, since<br />

popularity and human error came into play. You might need four thousand people to take <strong>the</strong> website <strong>of</strong> a major corporation down, in <strong>the</strong><br />

same way you’d need four thousand people wielding handguns to destroy a small building. You’d need just a few hundred people to take<br />

down a tiny homemade website belonging to an individual. The upside was that downloading LOIC was free and easy—you could get it<br />

from a torrent site or 4chan’s /rs/ board.<br />

One <strong>of</strong> <strong>the</strong> hundreds <strong>of</strong> people who downloaded LOIC and took part in some <strong>of</strong> <strong>the</strong> first impromptu Scientology attacks was a college<br />

student named Brian Mettenbrink. An Iowa State University student with a mop <strong>of</strong> brown hair and a beard, Mettenbrink, eighteen, was<br />

sitting in front <strong>of</strong> his desktop computer in a dorm room, browsing through his favorite website, 7chan, when he first saw posts about a<br />

Scientology raid in January 2008. He did not c<strong>are</strong> about Scientology, but he was interested in exploring <strong>the</strong> <strong>world</strong> <strong>of</strong> IT security and reasoned<br />

that taking part in an attack like this was a good way to learn about <strong>the</strong> o<strong>the</strong>r side <strong>of</strong> <strong>the</strong> industry. Besides, with so many o<strong>the</strong>r people<br />

contributing to <strong>the</strong> attack, he wouldn’t get caught.<br />

Mettenbrink, who had been regularly visiting 4chan since he was fifteen, went to <strong>the</strong> site’s /rs/ board and downloaded LOIC. The<br />

download took a few seconds, and it included a “readme” file to explain how to use it. The program gave <strong>the</strong> impression that it was<br />

connecting users to an army <strong>of</strong> rebel fighters. When Mettenbrink first opened LOIC, <strong>the</strong> main window that popped up had a Star Wars–<br />

<strong>the</strong>med design: dark and light green text boxes, and a Photoshopped mock-up <strong>of</strong> <strong>the</strong> Anti-Orbital Ion Cannon used in Star Wars: The Clone<br />

Wars, blasting a thick green laser beam toward a planet.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!