We are anonymous inside the hacker world of lulzse

More documents

Recommendations

Info

Asperger syndrome, rarely left his room, taking dinner from a plate that his mother would leave outside his bedroom door. But his dedication to becoming powerful online had paid off; over the years he amassed servers and what he claimed was a 1.3 million-computer monster botnet. Other online sources put the number at a still-enormous one hundred thousand computers. Though he rented the botnet, he also sublet it for extra cash. Like Civil and Switch, Ryan was happy to brag about his botnet to operators and hackers and keep its true power a secret from new volunteers. Later in February, for instance, when about fifty people on AnonOps announced they were attacking small government websites in Italy, Ryan quietly used his botnet for them. As the attacks were happening, whenever anyone typed “!botnum” to learn the number of people using LOIC, it would say 550. “Did you just add 500 computers to your botnet?” Topiary would privately ask Ryan. “No,” Ryan would reply. “I just changed the LOIC commands to make it look like 512 people were using it.” What this meant was that Ryan not only wielded the real firepower, he was deliberately manipulating other Anons so that they would think they were causing the damage instead. It was not hard to do this. If you were controlling the network of LOIC users, you could spoof the number of people using the tool by typing +500 or even +1000 into the corresponding IRC channel. This ability to fake numbers was an open secret in #command, but people brushed the topic aside whenever it came up. Anonymous was “Legion,” after all. “It didn’t seem sketchy at all,” said one source who knew about the botnets being used to support AnonOps in December 2010 and January 2011. “More fun trickery I guess.” The upper tier of operators and botnet masters also did not see themselves as being manipulative. This is partly because they did not distinguish the hive of real people using LOIC from the hive of infected computers in a botnet. In the end they were all just numbers to them, the source added. If there weren’t enough computers overall, the organizers just added more, and it didn’t matter if they were zombie computers or real volunteers. Botnets, not masses of volunteers, were the real reason Anonymous could successfully take down the website of PayPal twice, then MasterCard.com for twelve hours on December 8 and Visa.com for more than twelve hours on the same day. According to one source, there were at most two botnets used to support AnonOps before November 30, rising to a peak of roughly five botnets until February, before the number of botnets went down to one or two again. Only a handful of people could call the shots with bots. For the most part, they were not lending their firepower for money. “People offered things because they believed in the same idea,” claimed the source. More than that, they liked showing off how much power they had. Naturally, with ego such a big driver of the early December attacks, discussions in #command soon broke down. After Civil, Switch, and the nine hundred people fruitlessly using LOIC hit Mastercard.com, the small group in #command decided, on a hubristic whim, to attack Amazon.com the next day, December 9, at 10:00 a.m. eastern standard time. That’s when the operators realized that Civil and Switch had disappeared. The operators pushed the attack time to December 9 at 2:00 p.m., hoping the botmasters would return. At 1:30 p.m., the entire AnonOps IRC network went down. It turned out that Civil and Switch had been squabbling with some of the operators in #command and were now using their botnets to attack AnonOps in retribution. When the IRC network came back online about an hour later with a few hundred participants, nobody wanted to attack Amazon anymore. There weren’t enough bots and there didn’t seem to be a point. Topiary estimated that LOIC users represented on average 5 percent to 10 percent of the damage done against sites like PayPal, MasterCard, and Visa in early December 2010, and in the months that followed less than 1 percent, as fewer people stayed involved. Another source close to the operators at the time estimated more graciously that the LOIC tool contributed about 20 percent of DDoS power during AnonOps attacks in December and January. The truth became especially hard to accept when, seven months later, the FBI arrested fourteen people who had taken part in the PayPal attacks by downloading and using LOIC. These users included college students and a middle-aged woman. “People who fought for what they believe in shouldn’t be told what they did was in vain,” the source close to the operators said. In a small way, LOIC did help. It made people feel they were contributing to something, which encouraged more to join. Plus, Civil, Switch, and other botmasters might not have helped if they hadn’t seen the groundswell of support. Regardless, Topiary decided to stick to the party line on December 10 when he was contacted by a reporter from state-backed TV network Russia Today and invited to give his first ever live television interview, an audio discussion over Skype. He was nervous in the moments leading up to the interview, but when it came to it, he proclaimed as confidently as he could that the hive had hit back at PayPal and others. “We lied a bit to the press,” he said, many months later, “to give it that sense of abundance.” The press liked reporting on this new powerful phenomenon of a hive that nobody seemed able to quantify. “They liked the idea and amplified the attention.” “Lying to the press” was common in Anonymous, for understandable reasons. Here was a network of people borne out of a culture of messing with others, a paranoid world whose inhabitants never asked each other personal questions and habitually lied about their real lives to protect themselves. It was also part of Anonymous culture to make up random, outrageous statements. If, for instance, someone was about to leave his or her computer for a few minutes to get coffee, he or she might say, “Brb, FBI at the door.” Not only was there a sense of a higher purpose to Anonymous that made it seem okay to inflate figures and lie to the media; Anons were also part of a secret institution that no one in the real world understood anyway. Anons particularly disliked journalists who would come into the #reporter channel asking, “So who are you attacking next?” or pushing for a quick quote. A few would first exaggerate, saying that there were tens of thousands of people attacking a site. At one point an Anon told a magazine reporter that Anonymous had “colonies” all over the world, a physical headquarters, and that its name was based on a real man named Anonymous. “So who is Anonymous?” a reporter asked about the supposed man. “He’s this guy,” the Anonymous supporter said. “He lives in our headquarters in West Philadelphia.” That was actually an Internet meme: tell an elaborate story, then catch the person out by quoting the introductory rap to the sitcom The Fresh Prince of Bel Air. Later in February 2011, Topiary would create an IRC channel called #over9000—in reference to another famous meme, which involved a few core Anons discussing a bogus hacking operation to mess with a journalist from the Guardian. The reporter had asked for access to “secret” inner channels. “We need to troll her hard,” Topiary had told the others. The group went on to spam the room with cryptic messages like: “Charlie is c85 on excess, rootlog the daisy chain and fuzz out dawn
The group went on to spam the room with cryptic messages like: “Charlie is c85 on excess, rootlog the daisy chain and fuzz out dawn mode.” Lying was so common in Anonymous that people were rarely surprised to hear different versions of events, or to find out that the nickname they thought they were talking to was being hijacked by someone else. There was a constant suspension of disbelief and skepticism about almost everything. Even when people professed genuine admiration for someone or for the ops that were taking place on PayPal and MasterCard, their opinions could change just days later. It wasn’t that people in Anonymous were shallow or that there was little value to their experiences—it was just that events and relationships on the Internet moved far more quickly and dramatically than in real life. The data input for Anons could be overwhelming, and often the result was detachment—from emotions, from morals, and from awareness of what was really going on. But there was one truth in particular that at least a dozen Anons would later regret ignoring. It was about LOIC. Not only was their all-important weapon useless against big targets like PayPal, it could lead the police straight to their doors. Chapter 8 Weapons that Backfired When nearly eight thousand people had rushed into the main AnonOps IRC channel on December 8, eager to avenge WikiLeaks, the dozen or so operators in #command were stunned and then overwhelmed. Hundreds had been clamoring for direction, and the obvious one was to download and use LOIC. The operators made sure that at the top of the main chat channels there was a link to downloading the program, along with a document explaining how to use it. But no one knew for sure if LOIC was safe. There were rumors that LOIC was tracking its users, that the feds were monitoring it, or that it carried a virus. More confusingly, the LOIC that Anons were downloading in droves during Operation Chanology three years ago was very different from the LOIC that they were downloading now for Operation Payback. In the fast-moving world of open source software, developers were tweaking things all the time, and there was no one deciding if they should be helping or hindering Anonymous. One person who took a closer look at LOIC realized it was doing the latter. Around the same time that the PayPal attacks were getting under way, a highly skilled software developer hopped onto AnonOps IRC for the first time. The programmer, who did not want to reveal his nickname or real name, had worked with WikiLeaks in the past and was keen to help attack its detractors. When he downloaded LOIC from the link at the top of the main chat channels, he thought to look at the program’s source code. “I took it apart,” he said, “and it looked like shit.” The big problem was that the application was sending junk traffic directly from users’ IP addresses. It did nothing to hide their computer in the network. This meant the people who used LOIC without also using anonymizing software or a proxy server were just asking to get arrested. The programmer quickly sent private messages to a few of the operators and let them know his concerns, asking them to remove the LOIC link at the top of the channel. About half of them agreed—but the other half refused. According to the programmer, the operators who refused didn’t understand the technology behind LOIC. Making things more complicated was the range of operators, all offering different interpretations of LOIC on the chat network. AnonOps had different levels of operators—network operators at the top, and channel operators below them. The channel operators were like middle managers, with the ability to kick people out of channels with a few simple commands. One young female student who went by the nickname No managed to work her way up to channel operator by the time of the PayPal attacks, and she became known for banning people from the main #operationpayback channel if they tried to tell others not to use LOIC. (Ironically, police ended up tracking down No and arresting her a few months later because she had used LOIC.) New volunteers and operators alike also assumed there was safety in numbers. Anonymous, as the saying went, was everyone and no one. “Can I get arrested for doing this?” a person called funoob asked in the #setup channel on December 8. “Nah, they won’t arrest you,” answered someone called Arayerv. “Too many people. You can say you have spyware. They can’t charge you.” Another called whocares concurred: “If you get arrested just say you don’t know but it’s probably a virus.” “I hope in a way to get arrested,” one called isuse joked. “The trial would be hilarious.” (Those who did go to trial for using LOIC later on most likely don’t agree.) “They honestly believed that because of the amount of people it would be impossible to prosecute any single individual,” the programmer later remembered. “No one talked about prosecutions. They didn’t want to hear about your IP being exposed or anything like that.” And the overwhelming sense of camaraderie and accomplishment dominated reasonable argument. The world’s media were paying attention to Anonymous and its extraordinary hive mind; the last thing they needed was to start fiddling with the technology they were relying on and slowing things down. Even when Dutch police swiftly arrested sixteen-year-old AnonOps IRC operator Jeroenz0r and nineteen-year-old Martijn “Awinee” Gonlag on December 8 and 11, 2010, people on AnonOps initially didn’t believe it. “BS, no one is getting arrested,” said a user called Blue when links to the arrest stories started getting passed around. Then, when more articles about the arrests started appearing online, a flood of new Dutch supporters poured into AnonOps. There were so many that a new channel was started to host them all, called #dutch. Around December 13, a rare digital flyer was released warning anyone who had recently used LOIC that they were at “high risk” of arrest and needed to delete all chat logs. The organizer shitstorm said: “Ridiculous. This is an obvious ploy to try and scare people away.” “It’s a troll,” another organizer told Panda Security’s Correll.
Page 2 and 3: Begin Reading Table of Contents Cop
Page 4 and 5: his HBGary Federal account, possibl
Page 6 and 7: culture and key figures within it.
Page 8 and 9: dreadful fascination at his phone a
Page 10 and 11: Aaron Barr would never have come fa
Page 12 and 13: “nigger,” “faggot,” or just
Page 14 and 15: owns my ass.” With his other hand
Page 16 and 17: In 2008 he helped instigate Operati
Page 18 and 19: death threats and threatened to bom
Page 20 and 21: another poster described “Phase 2
Page 22 and 23: though, they were usurped by what w
Page 24 and 25: We are Legion We do not forgive We
Page 26 and 27: day in federal prison. In the meant
Page 28 and 29: Since childhood, Bailey had harbore
Page 30 and 31: oughly three hundred regular chat p
Page 32 and 33: 1. Get the latest LOIC from github.
Page 36 and 37: “It’s a troll,” another organ
Page 38 and 39: had joined mentoring program iMento
Page 40 and 41: choose a unique nickname on AnonOps
Page 42 and 43: time. Kayla actually had several IR
Page 44 and 45: was headquartered and where Barr wo
Page 46 and 47: “So are we going to focus on Anon
Page 48 and 49: Starting in early January, many sup
Page 50 and 51: “Well in my lifetime I’ve perfo
Page 52 and 53: uh, actual intelligence.” There w
Page 54 and 55: definitely unimpressed—the claims
Page 56 and 57: nude photos. Four years later, an e
Page 58 and 59: “Is this a new trend :D to see wh
Page 60 and 61: network collapsed, they would move
Page 62 and 63: large notice board with paperwork a
Page 64 and 65: April 2011, while he and Sabu were
Page 66 and 67: since they had a wider array of ski
Page 68 and 69: will get in trouble and might be gr
Page 70 and 71: passwords for almost every journali
Page 72 and 73: or online for most of the day and s
Page 74 and 75: a mixture of Anons, script kiddies,
Page 76 and 77: Sabu hated white hat security firms
Page 78 and 79: “Just looked at this guy’s sour
Page 80 and 81: otnets. Topiary shot back with a se
Page 82 and 83: wasn’t Sabu. “You got the wrong
Page 84 and 85:
them that he was back. Topiary at f
Page 86 and 87:
websites, bigger ones. He had a rap
Page 88 and 89:
“Y’all were the inspiration I n
Page 90 and 91:
LulzSec. Tflow created a torrent fi
Page 92 and 93:
The Fate of Lulz LulzSec’s signif
Page 94 and 95:
opposite of Kayla. And yet there wa
Page 96 and 97:
one of the LulzSec accounts in resp
Page 98 and 99:
on the network. He decided to try t
Page 100 and 101:
morning of their meeting, William
Page 102 and 103:
techniques like the Cain and Abel p
Page 104 and 105:
hackers in private IRC rooms. It wa
Page 106 and 107:
the open at the same time: the susp
Page 108 and 109:
Kayla’s story had become more imp
Page 110 and 111:
Stephane Fitch, who also introduced
Page 112 and 113:
writes a spoof news article about t
Page 114 and 115:
following twenty names in the ranki
Page 116 and 117:
to websites that showed the steps o
Page 118 and 119:
Minions.” Another helpful source
Page 120 and 121:
“extreme version of Calvinism”
Page 122 and 123:
2011, however, we held our first re
Page 124 and 125:
that were first leaked online by Pa
Page 126 and 127:
on the CIA. Details about Julian As
Page 128 and 129:
Descriptions of Ryan Mark Ackroyd w
Page 130 and 131:
Parmy Olson is the London bureau ch
show all

We are anonymous inside the hacker world of lulzse

Create successful ePaper yourself

Delete template?

Save as template?