We are anonymous inside the hacker world of lulzse

They had access that could let them deface the site in seconds, but they would wait it out. The crew was still feeling the heat from
HBGary, the #HQ log leaks, and Backtrace, and they weren’t quite sure what they were becoming yet. So they settled for spying on the
users’ Gmail accounts, just watching the mails roll by. Nothing particularly significant was being discussed, but the group decided that if one
of them got arrested, they would publish everything.
“Most professional and high-level hacks are never detected,” one hacker with Anonymous who went on to support Sabu and Topiary’s
team said months later. Not long after the Infragard breach, another group of hackers broke into the computer network of Japan’s parliament,
stealing login information and e-mails. It had taken three months before anyone figured out what had happened. The hack had involved
infecting the computers with a virus, most likely by sending employees e-mails that carried Trojans. This was how script kiddies worked, the
Anonymous hacker said dismissively. It was loud, common, and didn’t require much skill.
Sniffing around passively without anyone knowing always made sense. You could steal a database, sell it to spammers, and move on to
other ways of hustling for money. With Anonymous, there was also that obligation to cause a stir. But it depended what you had hacked into.
The Anon claimed that when he breached a network, most of the time he acted “passively.” At one point, for instance, he and another team
had found a hole in a large foreign-government server leading to data on various hospitals. His team did not disclose the data and instead
notified the admin of the problem. They even deleted their own copy of the data, since releasing the information would be
“counterproductive.” On that same hack, however, they also found an administrative server for that same foreign government that contained
all IP ranges for its online services. “We sure released that,” he said.
The paradox for hackers who became part of Anonymous was that there was suddenly a reason to go public with their leaks to make a
point. With Infragard, Sabu, Kayla, and Topiary were taking the sniffing-passively route. What the group did with this information would set
them apart from other hackers who sought money, curiosity, or a sense of personal achievement. They just needed the right moment.
Chapter 17
Lulz Security
Soon it became clear to Sabu, Topiary, and Kayla what they were really discussing: the creation of a new hacking team. It would be, in one
way, like WikiLeaks. It would publish classified information that hadn’t been leaked, but stolen. The idea didn’t sound as nerdy as Topiary
had thought a few months back.
They decided unanimously that they did not want to be constrained by the broad principles underlying Anonymous, which were:
1. choosing targets because they were oppressors of free expression
2. not attacking the media.
The idea was to do whatever it took to inspire Anonymous with new lulz, and maybe even grab the limelight again. In Topiary’s mind, this
would lead to something far greater than any of the pranks he had ever pulled. The whole idea of lulz didn’t sit comfortably with Sabu, who
was more interested in hacking as a form of protest. But he realized Anonymous needed some inspiration, and he figured he could steer
Topiary and the others toward more serious pursuits. Kayla was just happy at the chance to tear up the Internet again, and since they needed
to target more than just the Infragard website, she started looking for the Web’s hidden security holes the same way she had secretly done for
WikiLeaks’s q.
Kayla had a powerful web script that let her scan the Internet for any website with a vulnerability. This process of looking for security
holes in many different websites at the same time was called automated scanning, or crawling. When she was ready to start using it, Kayla
hooked the bot to Sabu’s chat server and then cast it out like a net. She had only to type commands into the chat box, like find SQLI, to direct
it. The bot constantly churned out new addresses of web pages that had vulnerabilities, then filtered them again. She had spent hours
configuring the script so that certain types of URLs would show up in different colors. There were hundreds each day, and about 20 percent
led to security holes. About 5 percent led to databases of ten thousand users or more. Over the course of two days, Kayla scoured the
websites of hotels, airports, and golf clubs, even Britain’s National Health Service, leading the team to hundreds of thousands of user details.
They started stealing (or dumping) the info and came up with eight databases containing fewer than five thousand usernames and passwords
and two big ones, of five hundred thousand and fifty thousand.
By now Tflow, AVunit, and the Irish hacker from #InternetFeds named Pwnsauce had joined, making them a team of six. It was a number
and set of names that would remain fixed to the end. Pwnsauce was a skilled and amiable young man who had been involving himself with
Anonymous since October of 2010, when he helped with the attacks on anti-piracy groups. Now he was happy to help comb the Internet for
security holes.
“Sabu, I may have a lead here,” he said at one point after finding something. When asked why he was working with the team, he said that
while he agreed with the aims of Anonymous, “moreso I am here because of the people.”
“I’ve never found more respectable and hardworking people in my life than those in this group,” added Topiary, who had been part of the
conversation. “And likable.”
Anonymous attracted hackers with a conscience, Pwnsauce explained. In a past life he had consorted with a “horrible mix” of hackers who
“either did not know what they were doing or who solely wanted to steal from people.” These were people who stole credit card details from
small retail outlets and chains. Mom-and-pop shops and gas stations were frequently the easiest to hack when they stored credit card
information at the end of the day, data that often included the security codes on the backs of people’s cards—even though saving them was
illegal. They saw these targets as easy pickings, but Pwnsauce had found a more interesting and varied bunch of people on AnonOps, and
since they had a wider array of skills, he claimed to have learned three times as much about programming and the Internet itself from