We are anonymous inside the hacker world of lulzse

As LulzSec’s targets got bigger, Kayla started drifting away a little from operations, more interested in taking revenge on enemies like Jester
and Backtrace. She had always been a free spirit, loyal to her friends but never aligning herself too closely with any particular cause for too
long. Sometimes, she just got bored. She also wasn’t as interested in reviving the Antisec movement as Sabu or Topiary. Instead, she started
developing an elaborate plan to creep into the #Jester chat room as a spy, embed herself, then infect the computers of its members with a keylogger
program so that she could monitor their key strokes, learn a few key passwords, and take them over. It was called a drive-by attack,
and while in this case it was an elaborate operation, typically the attack was just a matter of enticing someone to visit a website and installing
malware on their system as a result. It meant she was now spending just a couple of hours a day chatting with the crew before disappearing
for a day or more.
In the meantime there was some surprising news coming from the United States. The Pentagon had announced that cyber attacks from
another country could constitute an act of war and that the U.S. could respond with traditional military force. Almost at the same time, a draft
report from NATO claimed that Anonymous was becoming “more and more sophisticated” and “could potentially hack into sensitive
government, military and corporate files.” It went on to say that Anonymous had demonstrated its ability to do just that by hacking HBGary
Federal. Ironically, it stated that the hackers had hit Barr’s company and hijacked his Twitter account “in response” to Bank of America
hiring the security company to attack adversaries like WikiLeaks. Even NATO seemed to be inflating the abilities of Anonymous, seeing
reason and connections where there were coincidences. The hackers hadn’t known about Barr’s plans with WikiLeaks until after they had
attacked him. Even so, the news got everyone’s attention.
“Did you read the NATO doc about anonymous?” asked Trollpoll in the #pure-elite hub. Trollpoll did not sound like he was from the
United States, though it was impossible to be sure of anyone there. “They will put tanks on our houses?”
“Obama will be like ‘Lol you just DDoS my server?’” said Kayla, “‘Nuke.’”
With the world’s attention now moving to LulzSec and the fighting words from the U.S. administration, it seemed as good a time as any to
drop the FBI affiliate Atlanta Infragard. They’d had the site under their control for months and felt they now had enough on white hat Hijazi
to expose him at the same time. This would bring more heat than ever on LulzSec, but the group was on a roll and felt safe.
LulzSec’s founding team members would carry out the final Infragard swoop. As they got ready to deface the site, Sabu entered the shell,
the administrative page he had set up called xOOPSmaster, opened his terminal program so he could start playing with the source code, and,
on a seeming whim, typed rm –rf /*. It was a short, simple-looking piece of code with a notorious reputation: anyone who typed it into his
computer’s back end could effectively delete everything on the system. There was no window popping up to ask Are you sure? It just
happened. Web trolls famously got their victims to type it in or to delete the crucial system 32 file in Windows.
“Oops,” Sabu told the others. “Just deleted everything. rm –rf /*.” Kayla made the face-palm gesture, and everyone moved on. On top of
everything they had already done, deleting the Infragard website contents didn’t seem like a big deal. They then used the /xOOPS.php shell
to upload a giant image and title onto the Infragard home page—their deface. It was no serious admonishment of the FBI but another prank
aimed at Jester’s crew. The team had replaced the Atlanta Infragard home page with a YouTube video of an Eastern European TV reporter
interviewing an impeccably drunk man at a disco. Someone had added subtitles spoofing him as a wannabe hacker from 2600 who didn’t
understand what LulzSec was doing. Above the video was the title “LET IT FLOW YOU STUPID FBI BATTLESHIPS,” in a window
captioned “NATO—National Agency of Tiny Origamis LOL.”
Topiary’s official statement was a little more serious—but not much. When everyone was ready, he hit publish.
“It has come to our unfortunate attention that NATO and our good friend Barrack Osama-Llama 24th-century Obama have recently upped
the stakes with regard to hacking,” Topiary had written in their official statement. “They now treat hacking as an act of war. So, we just
hacked an FBI affiliated website (Infragard, specifically the Atlanta chapter) and leaked its user base. We also took complete control over the
site and defaced it.” Of course, LulzSec had not hacked Infragard in the past day or two or in response to the Pentagon’s announcement, but
news outlets reported the attack as a “response.”
Infragard’s web contents had been deleted, the site defaced, and details of 180 people in its user base had been published on the Web,
along with their passwords in plaintext, their real names, and their e-mail addresses. Topiary had signed off the missive, declaring, “Now we
are all sons of bitches.”
Since Topiary had been reminding the world for the past day on Twitter that an FBI hack was imminent, mainstream news agencies
jumped into the story, leading a whole new stream of people to follow the group on Twitter. Their website had now received more than 1.5
million views. Despite the damage LulzSec had done to the 2600 network, the actual magazine 2600 sounded impressed. “Hacked websites,
corporate infiltration/scandal, IRC wars, new hacker groups making global headlines,” its official Twitter feed stated, “the 1990s are back!”
Television news stations were racing to find security experts who could explain what was going on and offer some lucid opinions. “We are
facing a very innovative crime, and innovation has to be the response,” said Gordon Snow, the assistant director of the FBI’s cyber division
in an interview with Bloomberg right after the Infragard attack. “Given enough money, time and resources, an adversary will be able to
access any system.”
Yet LulzSec’s hack into Infragard had not cost that much in terms of “money, time and resources.” All told, the operation had cost $0, had
been carried out with the relatively simple method of SQL injection, and was made worse because an admin’s cracked password,
“st33r!NG,” had been reused to get administrative access to the Infragard site itself. As for time, it had taken the team thirty minutes to crack
the admin’s password and twenty-five minutes to download the database of users. Within two hours, the LulzSec team had complete
administrative access to an FBI- affiliated site, and for several weeks no one from the FBI had had a clue.
Of course, along with the Infragard drop had been LulzSec’s condemnation of Hijazi. The team had kept some of their chat logs with the
white hat and published them online as evidence that he was corrupt. And while the group members had told Hijazi that they wouldn’t
release his e-mails, they published them too.
“We have uncovered an operation orchestrated by Unveillance and others to control and assess Libyan cyberspace through malicious
means,” Topiary announced, meaning by assess that Unveillance wanted to spy on Libyan Internet users.
“We leaked Karim because we had enough proof that he was willing to hire us as hitmen,” Topiary added on Twitter. “Not a very ethical
thing to do, huh Mr. Whitehat?”
Hijazi also released a statement immediately after, explaining that he had “refused to pay off LulzSec” or supply them with his research on
botnets. Topiary shot back with a second official statement saying that they had never intended to go through with the extortion, only to