We are anonymous inside the hacker world of lulzse

[USA | XP] 2025
[ITA | WN7] 1438
It was very similar to the list that BillOReilly was seeing in his room, except these were computers that were infected with a virus that had
linked them to Civil’s botnet. These were not voluntary participants. None of the computers in this room belonged to people who wanted to
be part of the attack. They were, as the phrase went, zombie computers.
If one of the bots suddenly turned off, it was probably because a random person in Nebraska or Berlin had switched off his or her
computer for the day, and the list would go down by one. Civil thus didn’t like using all fifty thousand of his bots at once; instead, he
switched between a few thousand every fifteen minutes to let the other ones “rest.” Once the botnet was firing, the people behind each
infected computer would notice that their Internet connection had become sluggish. Thinking there was a router problem, they’d usually start
fiddling with their connection or switching off all together. Constantly refreshing the bots ensured their owners didn’t switch off or, worse,
call the IT guys. (Incidentally, some believed that the best people to infect with viruses so they could join into botnets were those on /b/—they
left their computers on all day.)
Civil gave the command to fire. It looked something like this:
!fire 30000 SYN 50 296.2.2.8
A SYN was a type of packet, and this meant flooding PayPal.com with thirty thousand bots at fifty packets each for thirty seconds. The type
of packet was important because simply flooding a server with traffic wasn’t always enough to take it offline. If you think of a server like a
call center manned by hundreds of people, sending “ping” packets was like calling them all and simply saying “Hello” before hanging up.
But sending “SYN” packets was like calling all the workers and staying on the line saying nothing, leaving the other end repeatedly saying
“Hello?” The process sent thousands of requests, which the server could not ignore, then left it hanging.
Within a few seconds the PalPal site had gone down completely. It would stay down for a full hour. The thousands of Anons in
#OpPayBack cheered at having taken down the world’s biggest e-payment website. Mainstream news sites, from the BBC to the New York
Times to the Guardian, reported that the “global hacking group” Anonymous had brought down PayPal.
Panda Security’s Correll hopped on IRC using the nickname muihtil (lithium spelled backward) and sent a message to Switch himself,
asking about the size of his botnet and clarifying that he was a security researcher. Switch was surprisingly happy to answer that his friend
(presumed to be Civil) had helped in the attack by offering thirty thousand bots, while there had been five hundred in the LOIC hive, and that
Switch himself had attacked with thirteen hundred bots.
What this confirmed was that around 90 percent of all the firepower from the attack on PayPal.com had come not from Anonymous
volunteers but from zombie computers.
Topiary quietly started thinking about the true power of the hive. When he had joined the #command channel two days earlier, he had
thought that the Anonymous DDoS attacks were primarily caused by thousands of people with LOIC, with backup support from the
mysterious botnets. Now he realized it was the other way around. When it came to hitting major websites like PayPal.com, the real damage
came from one or two large botnets. Thousands of LOIC users could have taken down a smaller site like Scientology.org, but not the planet’s
biggest e-payment provider. In practice, finding someone willing to share his botnet was more useful than getting thousands of people to fire
LOIC at the same time.
Correll’s observations were reported by Computerworld.com but largely ignored by the mainstream media. Someone nicknamed skiz
pasted a link to the story in the AnonOps main chat room, saying skeptically, “They claim Anonymous used a 30,000 person botnet. :D.”
Most of these eager volunteers did not want to believe that botnets had more firepower than their collective efforts.
The operators in #command did not like to advertise it, either. Not only could that information put off others from joining, but it could
bring unwanted attention to their channel, both from other hackers and from the police. But Civil and Switch continued bragging about how
large and powerful their botnets were. Spurred on by the media reports and their audience in #command, they were eager to show off again.
The operators agreed that since they had the power to launch another attack, they should. They duly planned a second attack on PayPal for
December 9. Once again they chose the morning—eastern standard time—to get the attention of American Internet users and the media.
This time, though, there was less enthusiasm and coordination. Only a day had passed since seventy-eight hundred people had been in the
main AnonOps chat room, but the numbers using LOIC had started tapering off. Then, when it came time to fire on PayPal a second time,
volunteers in the chat room, #operationpayback, were told to wait. They were not told why. Topiary was also in #command waiting for the
attack to happen so he could write his first press release. The problem was that in some unknown part of the world Civil was still sleeping.
“Do we have anything to write about?” asked Topiary. “Because nothing’s happened.”
“No, we have to wait for Civil to come online,” was the reply.
An hour later, Civil finally signed into #command and made a few grumpy remarks. As the operators told the hive to fire their (largely
ineffective) cannons, Civil turned on his botnet and took down PayPal.com. He then signed off and went to have his breakfast.
As Topiary watched, the secret power of botnets was reconfirmed. The botnets had boosted the first PayPal attack, since the hive was so
big, but the second time around just one botnet had done all the work. The second attack also wouldn’t have happened if Civil had not been
bragging. But the operators still wanted Anonymous and the media to think that thousands of people had been responsible. Ignoring these
uncomfortable truths, Topiary wrote up a press release about the “hive” striking back.
After the second PayPal attack, there was more bragging from Civil and Switch and the AnonOps operators told them they could hit
MasterCard.com on December 12. They broadcast the date and time of the attack across the Internet, knowing that, with the botnets doing
most of the work, it would be fun but not crucial to get another horde of people firing. This time around, only about nine hundred people had
hooked up their LOICs to the AnonOps chat network and fired on MasterCard.com. It didn’t matter. Thanks to Civil and Switch, the website
for one of the world’s biggest financial companies went down for twelve hours, and right on schedule.
Over time, a handful of other people with botnets would help AnonOps. One of them was a young hacker named Ryan. Aged nineteen and
living with his parents in Essex, England, Ryan’s real name was Ryan Cleary. In the offline world, Ryan, who would later be diagnosed with
Asperger syndrome, rarely left his room, taking dinner from a plate that his mother would leave outside his bedroom door. But his dedication