31.10.2012 Views

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

disruptive, hacking into auto companies and ordering car engines and disturbing his neighbors by playing loud music, <strong>of</strong>ten until 4:00 a.m. in<br />

<strong>the</strong> home where his grandmo<strong>the</strong>r no longer lived. Monsegur was unemployed and drifting.<br />

Then in early December, out <strong>of</strong> nowhere, Anonymous burst onto <strong>the</strong> scene with WikiLeaks, <strong>of</strong>fering a cause that Monsegur could be<br />

passionate about. He watched <strong>the</strong> first attack on PayPal unfold and saw echoes <strong>of</strong> his work with Hackweiser and his protest attack for <strong>the</strong><br />

island <strong>of</strong> Vieques, but on a much grander scale. He would later say that Anonymous was <strong>the</strong> movement he had been waiting for all those<br />

years “underground.”<br />

On December 8, when AnonOps had its highest surge <strong>of</strong> visitors for <strong>the</strong> initial big attack on PayPal, Monsegur signed into <strong>the</strong> public chat<br />

room, using <strong>the</strong> nickname Sabu for <strong>the</strong> first time in almost a decade. It was chaos on AnonOps IRC, with hundreds <strong>of</strong> trolls and script kiddies<br />

(wannabe <strong>hacker</strong>s) all talking over one ano<strong>the</strong>r.<br />

“<strong>We</strong> need <strong>the</strong> name <strong>of</strong> <strong>the</strong> wired employee who just spoke on cnn,” he said, referring to Wired magazine’s New York City bureau chief,<br />

John Abell. “john swell? john awell? pm me <strong>the</strong> name please.!!!” As Sabu, he repeated <strong>the</strong> request three times. Eventually he zeroed in on<br />

Tflow, who was dropping advanced programming terms. After Sabu and Tflow talked via private messages, nei<strong>the</strong>r <strong>of</strong> <strong>the</strong>m revealing his<br />

true location or any o<strong>the</strong>r identifying information, Tflow showed Sabu into <strong>the</strong> secret channel for <strong>hacker</strong>s, #InternetFeds.<br />

#InternetFeds was secure and quiet. In <strong>the</strong> open AnonOps chat rooms, hundreds clamored for large, impossible targets like Micros<strong>of</strong>t and<br />

Facebook. There was little point trying to reason with <strong>the</strong> horde and explain why those targets wouldn’t work, that you needed to find a<br />

server vulnerability first. It was like trying to explain <strong>the</strong> history <strong>of</strong> baseball to a noisy stadium full <strong>of</strong> people itching to see a home run. It had<br />

been <strong>the</strong> same in Chanology, when <strong>the</strong> #xenu channel was backed by <strong>the</strong> quiet planning in #marblecake. Discord grew in #operationpayback<br />

over who should feel <strong>the</strong> wrath <strong>of</strong> Anonymous next; <strong>the</strong> WikiLeaks controversy was receding from <strong>the</strong> headlines, and <strong>the</strong> <strong>hacker</strong>s had grown<br />

bored with trying to attack Assange’s critics. Sabu, Kayla, and <strong>the</strong> o<strong>the</strong>rs in #InternetFeds increasingly talked about focusing <strong>the</strong>ir efforts on<br />

ano<strong>the</strong>r growing news story: revolution in <strong>the</strong> Middle East.<br />

Sabu was already interested in <strong>the</strong> region, having attended a protest march or two for Palestine when he was younger. Now he and <strong>the</strong><br />

o<strong>the</strong>rs were seeing articles about demonstrations in Tunisia that had been sparked by documents that WikiLeaks had released. Tunisia’s<br />

government was known for aggressively censoring its citizens’ use <strong>of</strong> <strong>the</strong> Internet. <strong>We</strong>bsites that were critical <strong>of</strong> <strong>the</strong> government were<br />

hacked, <strong>the</strong>ir contents deleted and <strong>the</strong>ir servers shut down. Locals who visited prodemocracy e-newsletters and blogs would <strong>of</strong>ten be met<br />

with error messages.<br />

In early January <strong>of</strong> 2011, <strong>the</strong> government censorship appe<strong>are</strong>d to get worse. Al Jazeera reported that <strong>the</strong> Tunisian government had started<br />

hijacking its citizens’ Facebook logins and password details in a process known as phishing. Normally this was a tactic <strong>of</strong> cyber criminals;<br />

here, a government was using it to spy on what its citizens were saying on social networks and mail services like Gmail and Yahoo. If<br />

<strong>of</strong>ficials sniffed dissenters, <strong>the</strong>y sometimes arrested <strong>the</strong>m. Locals needed to keep changing <strong>the</strong>ir Facebook passwords to keep <strong>the</strong> government<br />

out. At a time when <strong>the</strong> country <strong>of</strong> more than ten million people was on <strong>the</strong> edge <strong>of</strong> a political revolution, protesters and regular citizens alike<br />

were struggling to avoid government spies.<br />

The <strong>hacker</strong>s in #InternetFeds came up with an idea, partly thanks to Tflow. The young programmer wrote a web script that Tunisians<br />

could install on <strong>the</strong>ir web browsers and that would allow <strong>the</strong>m to avoid <strong>the</strong> government’s prying eyes. The script was about <strong>the</strong> length <strong>of</strong> two<br />

sides <strong>of</strong> paper, and Tflow tested it with ano<strong>the</strong>r Anon in Tunisia, nicknamed Yaz, <strong>the</strong>n pasted it onto a website called userscripts.org. He and<br />

a few o<strong>the</strong>rs <strong>the</strong>n advertised <strong>the</strong> link in <strong>the</strong> #OpTunisia chat room on AnonOps, on Twitter, and in digital flyers. It got picked up by a few<br />

news outlets. The hacktivist Q was one <strong>of</strong> <strong>the</strong> #InternetFeds members and also one <strong>of</strong> <strong>the</strong> dozen channel operators in <strong>the</strong> #OpTunisia<br />

channel. He began talking with Tunisians on AnonOps—<strong>the</strong> ones who were web-savvy enough to access it via proxy servers—and<br />

encouraged <strong>the</strong>m to spread news <strong>of</strong> <strong>the</strong> script through <strong>the</strong>ir social networks.<br />

“OpTunisia fascinated me,” Q later said in an interview. “Because we actually did make an impact by pointing <strong>We</strong>stern media to <strong>the</strong> things<br />

happening <strong>the</strong>re.” Within a few days, news <strong>of</strong> <strong>the</strong> script had been picked up by technology news site ArsTechnica and it had been<br />

downloaded more than three thousand times by Tunisian Internet users.<br />

Sabu was impressed, but he wanted to make a different kind <strong>of</strong> impact—a louder one. Thinking back to how he had defaced <strong>the</strong> Puerto<br />

Rican government websites, he decided he would support <strong>the</strong> Tunisian revolution by embarrassing its government. It helped that Arab<br />

government websites were relatively easy to hack and deface.<br />

Sabu and a few o<strong>the</strong>rs from #InternetFeds discovered <strong>the</strong>re were just two name servers hosting Tunisia’s government websites. This was<br />

unusual—most governments and large companies with <strong>We</strong>b presences ran on several name servers, so a <strong>hacker</strong> taking down a few usually<br />

didn’t do much damage. In Tunisia’s case, however, shutting down just two name servers would take <strong>the</strong> government completely <strong>of</strong>fline.<br />

“It was a very vulnerable set-up,” one <strong>hacker</strong> that was in #InternetFeds recalled. “It was easy to shut <strong>the</strong>m <strong>of</strong>f.”<br />

To take <strong>the</strong> Tunisian servers <strong>of</strong>fline, Sabu did not use a botnet. Instead, he later claimed, he hijacked servers from a web-hosting company<br />

in London that allowed him to throw ten gigabytes worth <strong>of</strong> data per second at <strong>the</strong> Tunisian servers. These were broadcast servers, which<br />

could amplify many times <strong>the</strong> amount <strong>of</strong> data spam <strong>of</strong> a basic server; it was like using a magnifying glass to enhance <strong>the</strong> sun’s rays and<br />

destroy a group <strong>of</strong> ants. Sabu single-handedly kept <strong>the</strong> Tunisian servers down for five hours. Soon, though, authorities on <strong>the</strong> o<strong>the</strong>r side were<br />

filtering his spo<strong>of</strong>ed packets, like <strong>the</strong> owner <strong>of</strong> a mansion telling his butler not to bring in mail from a particular person. The traffic he was<br />

sending was losing its effect. Undeterred, Sabu called an old friend for help, someone he knew from his days <strong>of</strong> dabbling in cyber crime.<br />

While Sabu hit <strong>the</strong> first name server, <strong>the</strong> o<strong>the</strong>r took down <strong>the</strong> second.<br />

Tunisia was where Sabu really got involved in Anonymous for <strong>the</strong> first time. He not only took down <strong>the</strong> government’s online presence; he<br />

and a few o<strong>the</strong>rs also trudged through dozens <strong>of</strong> government employee e-mails.<br />

But <strong>the</strong> government fought back again. It blocked all Internet requests from outside Tunisia, shutting itself <strong>of</strong>f from foreign Internet users<br />

like Sabu. Sabu wanted to deface <strong>the</strong> site <strong>of</strong> Tunisian prime minister Mohamed Ghannouchi, but he would have to do that from <strong>inside</strong> <strong>the</strong><br />

country, and he wasn’t about to get on a plane. So on January 2, he signed into <strong>the</strong> #OpTunisia chat room with its dozen channel operators<br />

and several hundred o<strong>the</strong>r Anons from around <strong>the</strong> <strong>world</strong>, including Tunisia. There was talk <strong>of</strong> using proxies and potential DDoS attacks;<br />

questions about what was going on. Then Sabu hit <strong>the</strong> caps lock key and made his grand entrance.<br />

“IF YOU ARE IN TUNISIA AND ARE WILLING TO BE MY PROXY INTO YOUR INTERNET PLEASE MSG ME.” The room<br />

went almost silent. After a few minutes, Sabu got a private reply from someone with an automated username like Anon8935—if you didn’t<br />

choose a unique nickname on AnonOps, <strong>the</strong> network would give you one similar to this—a man who claimed to be in Tunisia. Sabu didn’t

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!