31.10.2012 Views

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

WikiLeaks.org quickly came under attack. An ex–military <strong>hacker</strong> nicknamed The Jester DDoS’d <strong>the</strong> site, taking it <strong>of</strong>fline for more than<br />

twenty-four hours. Jester was a self-styled patriotic <strong>hacker</strong> who had been known for attacking Islamic jihadist websites; later he would<br />

become a sworn enemy <strong>of</strong> Anonymous. Now he claimed on Twitter that he was hitting WikiLeaks “for attempting to endanger <strong>the</strong> lives <strong>of</strong><br />

our troops.”<br />

To try to stay on <strong>the</strong> web, WikiLeaks moved its site to Amazon’s servers. It was booted <strong>of</strong>fline again, with Amazon claiming it had<br />

violated its terms <strong>of</strong> service on copyright. The rebuffs kept coming: a hosting firm called EveryDNS yanked out its hosting services for<br />

WikiLeaks. On December 3, online payments giant PayPal announced it was cutting <strong>of</strong>f donations to <strong>the</strong> site, saying on <strong>the</strong> <strong>of</strong>ficial PayPal<br />

blog that it had “permanently restricted <strong>the</strong> account used by WikiLeaks due to a violation <strong>of</strong> <strong>the</strong> PayPal Acceptable Use Policy.” Soon<br />

MasterCard and Visa cut funding services.<br />

It is doubtful that anyone from <strong>the</strong>se companies had any idea that a brand <strong>of</strong> Internet users known for pranking restaurant managers,<br />

harassing pedophiles, and protesting <strong>the</strong> Church <strong>of</strong> Scientology would suddenly team toge<strong>the</strong>r to attack <strong>the</strong>ir servers.<br />

The people who had set up AnonOps were talking about <strong>the</strong> WikiLeaks controversy in <strong>the</strong>ir private #command channel. They were angry<br />

at PayPal, but, more than that, <strong>the</strong>y saw an opportunity. With Anons no longer riled up about copyright, this could be <strong>the</strong> cause that brought<br />

<strong>the</strong>m back in droves. The copyright companies had been bad, but PayPal snubbing WikiLeaks was even worse. That was an unholy<br />

infringement on free information in a <strong>world</strong> where, according to <strong>the</strong> slogan <strong>of</strong> technology activists, “information wants to be free” (even if it<br />

was secret diplomatic cables). The victimization <strong>of</strong> WikiLeaks, <strong>the</strong>y figured, would strike a chord with Anonymous and brings hordes <strong>of</strong><br />

users to <strong>the</strong>ir new network. It was great publicity.<br />

Who were <strong>the</strong>se people in #command? Known also as “operators” <strong>of</strong> <strong>the</strong> new chat network, <strong>the</strong>y weren’t <strong>hacker</strong>s per se but computersavvy<br />

individuals who maintained <strong>the</strong> network and who would play a crucial role in organizing ad hoc groups <strong>of</strong> people, large and small,<br />

over <strong>the</strong> coming weeks. Many <strong>of</strong> <strong>the</strong>m got a kick out <strong>of</strong> hosting hundreds <strong>of</strong> people on <strong>the</strong>ir servers. It was <strong>of</strong>ten argued that <strong>the</strong>se operators,<br />

who had names like Nerdo, Owen, Token, Fennic, evilworks, and Jeroenz0r, were <strong>the</strong> true, secret leaders <strong>of</strong> Anonymous because <strong>of</strong> <strong>the</strong><br />

power <strong>the</strong>y could wield over communication. They avoided culpability for what Anonymous did, though, in <strong>the</strong> same way that Christopher<br />

“moot” Poole avoided litigation by claiming he was not responsible for what happened on 4chan.<br />

Now, though, <strong>the</strong> operators were doing more than just maintaining <strong>the</strong> chat network. They were organizing an attack on <strong>the</strong> PayPal blog,<br />

where <strong>the</strong> company had made its announcement about WikiLeaks. On Saturday morning, December 4, <strong>the</strong> day after PayPal said it would cut<br />

funding, <strong>the</strong> AnonOps organizers DDoS’d <strong>the</strong>paypalblog.com. The blog went down at 8:00 a.m. eastern standard time.<br />

Soon after, <strong>the</strong> Twitter account @AnonyWatcher posted “TANGO DOWN—<strong>the</strong> paypalblog.com,” adding: “Close your #Paypal<br />

accounts in light <strong>of</strong> <strong>the</strong> blatant misuse <strong>of</strong> power to partially disable #Wikileaks funding. Join in <strong>the</strong> #DDoS if you’d like.”<br />

PayPal’s blog remained <strong>of</strong>fline for <strong>the</strong> next eight hours. Anyone who visited it saw a white screen and <strong>the</strong> “error 403” message “Access<br />

forbidden!” in large type.<br />

The next day, Sunday, someone posted an announcement on Anonops.net, <strong>the</strong> <strong>of</strong>ficial website for AnonOps IRC, saying that Anonymous<br />

planned to attack “various targets related to censorship” and that Operation Payback had “come out in support <strong>of</strong> WikiLeaks.”<br />

At around <strong>the</strong> same time, a digital flyer was being circulated on image boards and IRC networks, with <strong>the</strong> title Operation Avenge Assange<br />

and a long note that stated, “PayPal is <strong>the</strong> enemy. DDoS’es will be planned.” It was signed, “<strong>We</strong> <strong>are</strong> Anonymous, <strong>We</strong> do not forgive, <strong>We</strong> do<br />

not forget, Expect us.”<br />

These flyers came from new channels on AnonOps called #opdesign and #philosoraptors, which later combined to make #propaganda.<br />

Here, anyone who wanted to help with publicity collaborated on writing press releases and designing digital flyers to advertise future attacks.<br />

O<strong>the</strong>rs would <strong>the</strong>n post <strong>the</strong> flyers all over 4chan and Twitter. Ano<strong>the</strong>r channel, #reporter, was where Anons could answer <strong>the</strong> questions <strong>of</strong><br />

any bewildered journalists who had figured out how to access IRC. Topiary was jumping between <strong>the</strong> publicity channels, more interested in<br />

spreading <strong>the</strong> word than firing weapons.<br />

At around 5:00 p.m. eastern standard time on Monday, December 6, <strong>the</strong> organizers from AnonOps started DDoSing PostFinance.ch, a<br />

Swiss e-payment site that had also blocked donations to WikiLeaks. The site would stay down for more than a day.<br />

The attack was “getting in <strong>the</strong> way <strong>of</strong> customers doing business with <strong>the</strong> company,” Sean-Paul Correll, a researcher with Panda Security,<br />

said in a blog post that day. Correll, who was on <strong>the</strong> <strong>We</strong>st Coast <strong>of</strong> <strong>the</strong> United States, stayed up into <strong>the</strong> early hours to monitor <strong>the</strong> attacks,<br />

which seemed to keep coming.<br />

That day, nine hundred people suddenly jumped into #operationpayback, <strong>the</strong> main public chat room on AnonOps IRC, which had been<br />

quiet for months. About five hundred <strong>of</strong> <strong>the</strong>se people had volunteered <strong>the</strong>ir computers to connect to <strong>the</strong> LOIC “hive.” By now LOIC had an<br />

automatic function; you only needed to set it to hive mode and someone in #command would set <strong>the</strong> target and time. They would type simple<br />

instructions into <strong>the</strong>ir configured IRC channel—“lazor start” and “lazor stop.” Normal users didn’t have to know who <strong>the</strong> target was or when<br />

you were supposed to fire. They could just run <strong>the</strong> program in <strong>the</strong> background.<br />

At 2:00 p.m. eastern standard time on Tuesday, AnonOps started attacking <strong>the</strong> website <strong>of</strong> Swedish prosecutors against Assange, who was<br />

now looking at extradition to Sweden where he faced questioning for sexual misconduct against two women in that country. Many in<br />

Anonymous saw <strong>the</strong> case as a whitewash. Once again, some five hundred people were using LOIC, and now more than a thousand people<br />

were in <strong>the</strong> main chat channel. At 6:52 p.m., AnonOps announced a new target: EveryDNS.com, <strong>the</strong> server provider that had yanked <strong>the</strong> rug<br />

from under WikiLeaks.org. One minute later, that site was down. At 8:00 p.m. <strong>the</strong> target switched to <strong>the</strong> main site <strong>of</strong> Senator Joseph<br />

Lieberman, <strong>the</strong> chairman <strong>of</strong> <strong>the</strong> U.S. Senate Homeland Security and Governmental Affairs Committee, which had first pushed Amazon to<br />

stop hosting WikiLeaks. All <strong>of</strong> <strong>the</strong>se sites were going down for minutes or sometimes hours at a time, one by one, like dominoes.<br />

By <strong>the</strong> early hours <strong>of</strong> December 8 on <strong>the</strong> <strong>We</strong>st Coast, Correll had tallied ninety-four hours <strong>of</strong> combined downtime for <strong>the</strong>se sites since<br />

December 4. The worst-hit were PostFinance and <strong>the</strong> PayPal blog. But this was just <strong>the</strong> beginning.<br />

Word was spreading that if you wanted to help WikiLeaks, all <strong>the</strong> action was happening on AnonOps IRC. Newcomers could get a quick<br />

overview <strong>of</strong> what was happening from different chat rooms: #target was for talking about future or current attacks and #lounge was a place to<br />

just shoot <strong>the</strong> breeze. In #setup, new recruits could find a link to download LOIC and get help using it from experienced users.<br />

The room contained a link to a digital flyer with step-by-step instructions titled “HOW TO JOIN THE FUCKING HIVE—DDoS LIKE<br />

A PRO.”

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!