We are anonymous inside the hacker world of lulzse

April 2011, while he and Sabu were still discussing the idea. “We figured it’d be too far to call ourselves a hacking team with a cheesy
banner, so we haven’t decided much.”
Kayla had been flitting about online, so they created an IRC channel called #Kayla_if_you_are_here_come_in_this_channel. Once Kayla
came back, she said she was interested, and the three of them started throwing ideas around. One was to set up a new IRC network for
Anonymous, since Ryan’s leak in April had turned hundreds of users off its channels. Detractors had bombarded the network with DDoS
attacks, and while regular visitors had dwindled, the number of people claiming to be operators had swelled to forty. With AnonOps now so
top-heavy, there was chaos in nine different “command” channels, leader-of-leader channels, and secret channels to talk about other
operators. The network was about to crash under its own weight, and Anonymous needed a safe, organized place to meet. But by early May,
the AnonOps operators had got it together. They had whittled their servers down from eight to two, and their operators from forty to eight.
An IRC network now looked less necessary.
“I probably would have quit if we hadn’t talked so much and ended up getting Kayla back,” Topiary would say many months later. “In a
way I wish Sabu hadn’t trusted me so much.” In a few days, AVunit came back from his break and joined the group too. There were now
four of the old team back together who were interested in doing something big—they weren’t sure what exactly—to reinspire Anonymous.
There was no turning back now.
One late morning, during a period when the team was still mulling over what they could do together, Topiary got out of bed, got on his
laptop, and saw Sabu online, along with Kayla. It must have been about five in the morning in New York.
“Guys I was up all night looking at sites to go after,” Sabu said. “And I found this big FBI site.” Topiary’s breath quickened for a moment.
“I’ve got access to it,” he added.
Sabu then pasted a long list of around ninety usernames and encrypted hashes (which corresponded to their passwords) from a website
called Infragard. The list of names represented half the site’s user base. Topiary and Kayla immediately started trying to crack them, excited
by the prospect of “hacking the FBI.” Just a few minutes in, Topiary Googled Infragard, and he realized they were dealing with a nonprofit
affiliate of the FBI, not the organization itself. He thought briefly about asking how Sabu had found the security hole or pointing out that it
wasn’t exactly a “big FBI site.” But he didn’t want to dampen the team’s excitement.
All the users had been verified by the FBI to gain access and all worked in the security field; some were even FBI agents. Yet their
password choices were questionable, at best. One of the users had used “shithead” as a password for everything online; another had
“security1.” Only about a quarter of the users had passwords the team couldn’t crack. It is a general rule in IT security that any password that
isn’t a combination of letters, numbers, and symbols is weak. It is not particularly hard to memorize “###Crack55##@@” or “this is a
password 666,” but both of these would be extremely difficult to crack. (The hardest passwords to decipher are phrases, which are also easier
for password holders to remember.)
After someone downloaded the entire database of users and then converted it into a simple text file, Sabu loaded the 25 percent of
password hashes that the team couldn’t crack into the don’t-ask-don’t-tell password cracking service he’d used for HBGary Federal,
HashKiller.com. Sometimes kids used the site to send encrypted messages to one another, with the challenge to crack them. When nefarious
hackers broke into the user base of a website, they would typically dump all the so-called MD5 hashes into a database and start cracking the
easy ones first, then let HashKiller’s forum users do the rest.
An MD5 hash was a cryptic language that corresponded to words or files, and it typically looked like this:
11dac30c3ead3482f98ccf70675810c7
This particular string of letters and numbers translated to “parmy,” so the result on the site would look like:
11dac30c3ead3482f98ccf70675810c7:parmy
That information would then be stored in HashKiller’s database, so if anyone tried to crack the password “parmy” and had the MD5 hash, he
could do it instantly. The result from Hashkiller.com would look like this:
Cracking hash: 11dac30c3ead3482f98ccf70675810c7
Looking for hash…
Plain text of 11dac30c3ead3482f98ccf70675810c7 is parmy
It was that simple. This was why it was a bad idea to use single-word passwords, like “parmy” or—even worse, because it is commonly
known—“shithead.” Each password always had the same MD5 hash. And once it was in HashKiller.com, everybody knew it. A lack of
context kept things relatively secret: everyone could see the hashes and cracked passwords in plaintext but nothing else. Using the site was
free, and Sabu had only to sit back and wait for the passwords to be cracked by volunteers.
Once someone cracked the admin’s password, the surprisingly easy “st33r!NG,” Sabu created a web page that he secretly attached to the
website for Infragard Atlanta, known as a shell. It was the same sort of page that the site’s administrators would use to control its content,
allowing him to add new pages or delete others. The difference was that the admins knew absolutely nothing about Sabu’s page. Since the
page for the original control panel had been xootsmaster, Sabu named his new shell page /xOOPS.php. He could have just gone through the
main control panel since he had the right password, but that would mean clicking through a series of options and a long list of directories. The
shell was a more simply designed page that made it quicker and easier to mess with things.
The team lurked on the site for a few weeks while sitting on its entire username and password base: twenty-five thousand e-mails from the
personal accounts of the site’s users, a mixture of security consultants and FBI agents. Topiary and his friends had all their passwords, full
names, and e-mails. If Topiary had been feeling malicious, he could have logged into the PayPal accounts of one of the more senior users and
started splashing money all over the place.
“That would be bad,” he said at the time.
They had access that could let them deface the site in seconds, but they would wait it out. The crew was still feeling the heat from