We are anonymous inside the hacker world of lulzse

Sabu hated white hat security firms. That much Topiary knew. And now he was talking about the subject more than ever in private,
particularly about a revival of the anti-security movement. Sabu’s beef with white hats went back a long way. Anti-security got going in
1999, when a vulnerability in widely used Solaris servers that was known to only a couple hundred hackers in the world led to their hacking
into a wide range of companies and organizations. Then they started stealing e-mails from white hat security firms. The reason was they hated
a new edict in cyber security called full disclosure. The idea was that if cyber security experts (white hats) publicly disclosed a website’s
vulnerabilities quickly, they got fixed more quickly. But black hats preferred to keep the flaws hidden so that they would stay within the
underground community and continue being exploited.
Antisec had seen its share of hacktivist groups like LulzSec, and one of the first was a notorious clique called ~el8. The shadowy hackers
would target white hat security researchers and companies, steal their passwords and e-mails, and publish them in a regular e-zine. It was a
single white page with el8 elaborately spelled out in symbols at the top, not too dissimilar from the Pastebin posts of LulzSec and filled with
new web scripts, exploits, stolen e-mails, and jeering commentary. The group called its work project mayhem, or “pr0j3kt m4yh3m.” The
phrase was borrowed from the movie Fight Club, and their e-zines heavily referenced the film. The bulletins never spelled out ~el8’s
motivations, but project mayhem appeared to be a violent incarnation of the Antisec movement. Many in the white hat industry figured ~el8’s
real motivation was to fight full disclosure so that black hats and gray hats would be the only people who knew about the Internet’s secret
vulnerabilities.
“One of these days, these kids are going to have to pay a mortgage and get a job,” said Eric Hines, an executive of one of the white hat
firms that was attacked, in a Wired article. “And they’re not going to become lawyers or doctors—they’re going to do what they’re good at.
And that means getting a career in the security industry.”
Sabu had nurtured a dislike for white hats even after the 1999 Antisec movement dwindled. Emick believed Sabu was simply resentful
after getting turned down for a job in IT security. Either way, the sentiment was rubbing off on Topiary as the two had more one-on-one
discussions. Sabu would point out that white hats charged $20,000 for penetration testing, stuff that the LulzSec crew could do for free. He
explained that Topiary himself could have done what HBGary was charging $10,000 for. The message was that white hats were like
unscrupulous car mechanics, tricking people into believing they needed to pay thousands when the real cost was much lower.
This line of reasoning was very different from the original Antisec argument over full disclosure. That’s because a decade later, the Web
was now so chock-full of websites, data, and vulnerabilities that white hats weren’t pushing for full disclosure anymore. The view had
flipped, and fully disclosing server flaws was veering into a criminal offense. The notorious Internet troll Andrew “weev” Auernheimer, who
had come up with the meme “Internets is serious business,” had learned that the hard way. In 2010, he and a few hacker friends from their
trolling group Goatse Security poked around in AT&T’s website and found a security hole that led to internal data on 114,000 iPad users.
Weev “fully disclosed” it, albeit through mainstream media and not a cyber security newsletter. The following January, six months after
journalists at Gawker did an exposé on the AT&T security flaw for iPad users, the U.S. Department of Justice announced that it was
charging weev with fraud and conspiracy to access a computer without authorization.
A successful revival of Antisec could keep the authorities busy with more people like weev. Sabu wanted to keep the focus on white hats,
like the old days, so it was crucial to find some real dirt on Hijazi’s tiny firm Unveillance. The company made money by hunting for
malicious botnets, but digging around in its e-mails, Sabu and the others thought they found evidence that he was working with others to
snoop on Libyan web users. They decided to confront him on IRC under different guises to let him know they had all his e-mails and that
they could do worse. On May 26, they e-mailed him his password, with the subject line, “Let’s talk,” and said they wanted to see his botnet
research.
Hijazi immediately picked up the phone and called the FBI. When he finally got through to someone and tried to explain what was
happening, Hijazi got the impression the people on the other line weren’t interested, or perhaps didn’t understand what he was talking about.
They referred him to an agent in his local office. When he called that number and told a local staffer that malicious hackers were trying to
access his botnet research, he was surprised when that individual replied, “What’s a botnet?”
Eventually, an agent advised Hijazi to start logging all of his conversations with the group and to play along to see if he could get any
information on them. On the other side of the fence, Sabu, Topiary, and Tflow were trying to position Hijazi to admit that he wanted to hire
the hackers to attack his competitors. Both sides ended up lying to each other to obtain information, which made for a confusing encounter
filled with misinterpretation.
“The point is a very crude word: extortion,” Topiary had told Hijazi under the name Ninetails, adding that Hijazi would be paying for their
silence. “You have lots of money, we want more money.”
The team kept offering to help Hijazi by attacking his corporate competitors. Playing along like he was supposed to, he eventually replied:
“I can’t ask you to get someone and stay a ‘legit’ firm. Agreed?” When Topiary read this he believed that Hijazi was falling into their trap
and that it was proof of yet another corrupt white hat, just as Sabu had predicted.
“Can I take a guess at who you are?” Karim had later asked.
“Karim, we’ve been expecting you to be secretly guessing since day one,” Topiary replied under a second nickname, Espeon. “Do share.”
“808chan.”
Sabu burst out laughing. “Are you serious bro?” he asked, using the nickname hamster_nipples. “How dare you call us a fucking chan.”
“Then tell me,” replied Karim, who was keeping his responses as measured as possible while playing their game.
“If we tell you who we are, you will shit yourself and shut the fuck up,” Sabu said. “But yes we are very well known.” The group kept
prodding Hijazi, calling him dense and warning him about what they could do with his e-mails. But Hijazi had to pretend to be oblivious—he
knew just as well as Sabu and the others that playing stupid was one of the most effective ways to social-engineer someone. It could
sometimes trick him into revealing facts about himself.
“Why be hostile? Just curious,” Hijazi said.
“We’re not a chan,” replied hamster_nipples, who seemed to have an issue with status. “Don’t refer to us as a chan. We are security
researchers.”
“No worries,” said Hijazi. “You’re not a chan.”
“Heh,” hamster_nipples said. “You’re testing my patience.”
Though Sabu came across as menacing in the resulting chat logs (released by both LulzSec and Hijazi himself), Hijazi’s press officer later