We are anonymous inside the hacker world of lulzse

a mixture of Anons, script kiddies, general fans who had heard about LulzSec from media reports, and white hat hackers. Over time the
LulzSec crew came to believe that around half the makeup of that channel, which anyone could access, was a mixture of spies from enemy
groups like Jester’s and Feds. In their new, public #LulzSec chat room on 2600, the crew were disguised by their maritime-related names:
Whirlpool for Topiary, Kraken for Kayla, and Seabed for Sabu.
As Sabu observed these developments, he grew concerned that the crew was getting too excited about having fun on the 2600 network—a
place they had attacked but where they had also set up their own public meeting room. It was impossible to distinguish the real fans from the
spies who wanted to manipulate the crew for information and access. At one point it looked like Kayla had gone back into Santa Claus mode
and offered some stolen voucher codes from Amazon to someone outside the crew. When Sabu found out about the conversation, Kayla
explained that she had merely given someone a few of the coupons so they could be tested and eventually sold on the black market. Sabu,
who was already wary of Kayla’s connection to Laurelai, was perturbed.
“Ok guys,” he suddenly said. “I don’t have to say this more than once I hope. But people on 2600 are not your friends. 95% are there to
social engineer you. To analyze how you talk and make connections. Don’t go off and befriend any of them.”
He didn’t mind that the reprimand pierced the lighthearted atmosphere. Four other secondary-crew members quickly insisted that they were
being careful about hiding their identities, doing so by speaking in broken English so they would appear to be foreign. But Sabu added that if
anyone gave them private info, they should log it and show it to the team. If they were sent a link, look at it from a secure connection.
“Be smart about shit,” he concluded. “If any of you get owned, I’ll LOL.”
Kayla then piped up, as if she wanted to show the others that she was on the same page with Sabu. “Another protip,” she said. “Even if
you are American, don’t spell it ‘color,’ use ‘colour,’ which is wider used around the world. Just saying ‘color’ means you are American.”
Sabu didn’t seem to be listening and gave Kayla a new order. He wanted her to change the topic of the public #LulzSec chat room to say
that anyone with 0days and leaks should message her new pseudonym in the channel.
“Make sure we take advantage of that,” he said. “See what niggers got access to.” Kayla signed out. Sabu enjoyed the banter that took
place in #pure-elite between the organizational talk, but he was constantly reminding the group to stay focused on finding new exploits and
keeping the group as tight-knit as possible. It made for a tense atmosphere, but it was necessary. The team’s profile was rising faster than they
had ever expected. Googling the name LulzSec on June 1 had yielded twenty-five thousand mentions on the Internet. In less than twenty-four
hours, that number had risen to two hundred thousand.
Chapter 20
More Sony, More Hackers
By the first of June, the LulzSec team and its associates had gathered a long list of vulnerabilities found by team members like Kayla,
Pwnsauce, and Sabu. None were stored on an official group document since that was too risky—instead, whoever found a vulnerability kept
it on his or her own computer and shared it with the group when needed. Here LulzSec was setting itself apart from Anonymous, not just
because it was picking media companies but because of its focus on stealing data. HBGary had shown that stealing and selectively leaking
data could be far more damaging—and “lulz-worthy” with all the attention it was getting—than a straightforward DDoS attack.
When the team found a vulnerability, the hope was that it would lead to critical secret data they could publish. Often following up a lead
would happen spontaneously. Kayla had found the PBS security hole earlier in May, but the group had only followed it up because of the
WikiSecrets documentary. Finding the security hole was one thing, but exploiting it took more work, and they would have to have a good
reason to turn it into an operation. With one vulnerability they had recently found, though, the target company itself was reason enough.
Sony’s lawsuit against George Hotz in April, the resultant DDoS attack from Anonymous, and the devastating data theft by a small group
of black hat hackers had snowballed into a new craze among hackers to hit Sony in any way possible. It meant that Sony had become
something of a piñata for hackers. Partly the black hats found it funny to keep hitting the company over and over, and partly they believed
Sony deserved it for waiting two weeks after the original data breach had been discovered before reporting it.
The PBS heist was finished, and the 2600 network was still smoldering from the attack, but Sabu and Topiary were now knee-deep in
organizing data stolen from Sony’s servers: hundreds of thousands of users, administrators, internal upcoming albums releases from Sony,
along with 3.5 million music coupons. Three weeks prior, the group had been poking around looking for vulnerabilities in Sony websites,
finding and publishing the security vulnerabilities in the website of Sony Japan but also looking at Sony’s Hong Kong site and others.
Whenever someone found a vulnerability, he would paste the web address in his private chat room, and someone else would go into the
source code to see how it could be exploited. There was no order to this; people simply contributed when they were around.
Just for the heck of it, Sabu checked SonyPictures.com, the main website for Sony’s $7.2 billion film and television franchise. To his
astonishment, there was a gaping hole in the innocuous Ghostbusters page that left the network wide open, once again, to a simple SQL
injection attack.
“Hey guys, we need to dump all this now,” he said excitedly. He rushed to map out the area and gather everyone together so they could
start taking different sections. “We’ve owned something big here. Sony are going to crash and burn.”
When the group entered the network they found a massive vault of information. It took a while to make sense of the data, but soon they
had found a database with two hundred thousand users.
More shocking was that all of the data, including passwords, were stored in plaintext. The only encrypted passwords were those of server
admins, and the team managed to crack those anyway.
It was a damning indictment of Sony’s security, just weeks after the big PlayStation Network data breach. Small schools and charities had
better database encryption than Sony. In fact, by this time, rumor had it that the PlayStation Network had been hacked because a disgruntled