31.10.2012 Views

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

We are anonymous inside the hacker world of lulzse

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

otnets. Topiary shot back with a second <strong>of</strong>ficial statement saying that <strong>the</strong>y had never intended to go through with <strong>the</strong> extortion, only to<br />

pressure Hijazi to <strong>the</strong> point where he would be willing to pay for <strong>the</strong> <strong>hacker</strong>s’ silence and <strong>the</strong>n expose him publicly. It was a war <strong>of</strong> words<br />

built on <strong>the</strong> gooey foundations <strong>of</strong> lies and social engineering.<br />

Topiary still called on journalists and o<strong>the</strong>r writers to “delve through” Hijazi’s e-mails c<strong>are</strong>fully, hoping for <strong>the</strong> same kind <strong>of</strong> enthusiasm<br />

<strong>the</strong>re had been around Aaron Barr’s e-mail hoard. But <strong>the</strong>re was none. For a start, Hijazi just didn’t have enough dirty laundry. More, <strong>the</strong><br />

infamy <strong>of</strong> LulzSec was overshadowing any more sobering, sociopolitical points <strong>the</strong> group was dimly making with each attack—that it didn’t<br />

like Fox, or that WikiSecrets “sucked,” or that NATO was upping <strong>the</strong> stakes against <strong>hacker</strong>s, or whatever Unveillance might have been<br />

doing in Libya. It was quite an array <strong>of</strong> targets; LulzSec seemed to be attacking anyone it could, because it could.<br />

This was getting to some <strong>of</strong> <strong>the</strong> secondary-crew members. The <strong>hacker</strong> Recursion came into <strong>the</strong> #pure-elite room late on June 3 after<br />

watching <strong>the</strong> Infragard events unfold. He hadn’t taken part in <strong>the</strong> hack and was shocked when he read <strong>the</strong> news reports.<br />

“Holy shit,” Recursion told <strong>the</strong> o<strong>the</strong>rs. “What <strong>the</strong> fuck happened today?”<br />

“A lot,” said Sabu, adding a smile. “Check Twitter.”<br />

“LulzSec decl<strong>are</strong>d war on <strong>the</strong> U.S.?” Joepie <strong>of</strong>fered sardonically.<br />

“I caught <strong>the</strong> jist <strong>of</strong> it,” Recursion answered before seeming to trail <strong>of</strong>f. He didn’t say anything more on <strong>the</strong> subject, but twenty minutes<br />

later, after presumably holding a private conversation with Sabu, he left <strong>the</strong> channel, for good.<br />

Sabu was disappointed in anyone who bailed on him in battle. It felt disrespectful. But he moved on quickly to guide <strong>the</strong> remaining troops.<br />

Sabu came back to <strong>the</strong> room and addressed <strong>the</strong> handful <strong>of</strong> participants. “<strong>We</strong>ll guys. Those <strong>of</strong> you that <strong>are</strong> still with us through this, maintain<br />

alert, make sure you’re behind VPNs no matter what. And don’t fear. <strong>We</strong>’re ok.”<br />

“Sabu, did we lose people?” asked Neuron.<br />

“Yeah.”<br />

“Who?”<br />

“Recursion and Devurandom quit respectfully,” he answered, “saying <strong>the</strong>y <strong>are</strong> not up for <strong>the</strong> heat. You realize we smacked <strong>the</strong> FBI today.<br />

This means everyone in here must remain extremely secure.” It was a grave reminder <strong>of</strong> <strong>the</strong> potential charges LulzSec was racking up if its<br />

team members were to get caught.<br />

A few <strong>of</strong> <strong>the</strong> members started describing how <strong>the</strong>y were streng<strong>the</strong>ning <strong>the</strong>ir security. Storm was getting a new netbook and completely<br />

wiping his old computer. Neuron was doing <strong>the</strong> same. He used a virtual private network called HideMyAss. This was a company based in<br />

<strong>the</strong> United Kingdom that Topiary used and had recommended.<br />

“Did you wipe <strong>the</strong> PBS [chat] logs?” Storm asked Sabu.<br />

“Yes. All PBS logs <strong>are</strong> clean.”<br />

“Then I’m game for some more,” said Storm. Sabu typed out a smiley face.<br />

“<strong>We</strong>’re good,” he said. “<strong>We</strong> got a good team here.”<br />

Not everyone was good though, and not all logs were clean. The alo<strong>of</strong> LulzSec secondary-crew member known as M_nerva, <strong>the</strong> one who<br />

had said “good night” to <strong>the</strong> o<strong>the</strong>rs just a few days before and not said too much else afterward, had just ga<strong>the</strong>red toge<strong>the</strong>r six days’ worth <strong>of</strong><br />

chat logs from <strong>the</strong> #pure-elite channel and repeated Laurelai’s frantic act in February. He leaked it. On June 6, <strong>the</strong> security website<br />

seclists.org released <strong>the</strong> full set <strong>of</strong> #pure-elite chat logs held on Sabu’s private IRC server. The leak revealed, embarrassingly, that not<br />

everyone in #pure-elite could be “100 percent trusted,” and that for all its bravado, LulzSec had weaknesses. The team jumped into action,<br />

knowing that <strong>the</strong>y had to send a message that <strong>the</strong>y did not accept snitches, even if M_nerva had allegedly been persuaded to leak <strong>the</strong> logs by<br />

ano<strong>the</strong>r <strong>hacker</strong>, named Hann. They knew <strong>the</strong>y could find out who M_nerva really was because among <strong>the</strong> o<strong>the</strong>r black hats supporting<br />

LulzSec was someone who had access to pretty much every AOL Instant Messenger account in existence. Since many people had set up an<br />

AIM account at one time or ano<strong>the</strong>r, <strong>the</strong>y only needed to cross-check <strong>the</strong> nickname and IP to come up with a real name and address. It turned<br />

out M_nerva was an eighteen-year-old from Hamilton, Ohio, named Marshall <strong>We</strong>bb. The crew decided to hold on to <strong>the</strong> information for<br />

now.<br />

With Sabu’s trust betrayed, <strong>the</strong> older <strong>hacker</strong> was now more paranoid than before. Topiary felt vindicated. He had known that a leak could<br />

happen if Sabu kept inviting people into #pure-elite, and it did. But he didn’t push <strong>the</strong> point. When he brought it up with Sabu, <strong>the</strong> <strong>hacker</strong><br />

brushed <strong>of</strong>f <strong>the</strong> topic quickly. He had nothing to say about it. Instead, Sabu worked on making <strong>the</strong> wider group more secure by separating it<br />

into four different chat rooms. There was a core channel, which now had invited fifteen participants, and #pure-elite, <strong>the</strong>n chat rooms called<br />

upper_deck, for <strong>the</strong> most trusted supporters, lower_deck, kitten_core, and family. Members could graduate up <strong>the</strong> tier system depending on<br />

how trustworthy <strong>the</strong>y were. Neuron and Storm, for instance, eventually were invited into upper_deck, so that <strong>the</strong>y could be phased into <strong>the</strong><br />

main channel for LulzSec’s core six members: Sabu, Topiary, Kayla, Tflow, AVunit, and Pwnsauce.<br />

The heat wasn’t coming only from <strong>the</strong> media attention; Topiary was seeing <strong>hacker</strong>s with military IP addresses trying to compromise <strong>the</strong><br />

LulzSec IRC network and users every day. Already, rumors were spreading that LulzSec had been founded by <strong>the</strong> same crew that had hit<br />

HBGary. Enemy <strong>hacker</strong>s were posting documents filled with details <strong>the</strong>y had dug up online about each member, much <strong>of</strong> it wrong but some<br />

<strong>of</strong> it hitting close to home. LulzSec’s members needed to switch <strong>the</strong>ir focus from finding targets to protecting <strong>the</strong>mselves.<br />

Kayla suggested a mass disinformation campaign. Her idea was to create a Pastebin document revealing that Adrian Lamo owned <strong>the</strong><br />

domain LulzSec.com; <strong>the</strong>n to add details <strong>of</strong> o<strong>the</strong>r Jesterfags and claim <strong>the</strong>y were members <strong>of</strong> LulzSec; <strong>the</strong>n to spam <strong>the</strong> document<br />

everywhere. It was a classic social-engineering tactic, and it sometimes worked.<br />

“But saying more or less that LulzSec is CIA,” Trollpoll <strong>of</strong>fered. It was outrageous, but some people would see sense in <strong>the</strong> idea that <strong>the</strong><br />

CIA was using freelance <strong>hacker</strong>s to hit Iran or Libya and would build <strong>the</strong>ir own conspiracy <strong>the</strong>ories around it.<br />

Topiary and Kayla wrote up a document titled “Criminals <strong>of</strong> LulzSec,” under <strong>the</strong> guise <strong>of</strong> a fictitious social engineer called Jux who<br />

claimed to have been invited into <strong>the</strong> group’s private channel, saying, “I believe <strong>the</strong>y <strong>are</strong> being encouraged or hired by CIA.” In <strong>the</strong><br />

document, Jux claimed Lamo was a key member <strong>of</strong> <strong>the</strong> group, along with a Pakistani <strong>hacker</strong> named Parr0t, a Frenchman named Stephen,<br />

and an unnamed <strong>hacker</strong> from <strong>the</strong> Ne<strong>the</strong>rlands. The document was viewed more than 40,000 times, retweeted by notorious <strong>hacker</strong> Kevin<br />

Mitnick, and mentioned in a few tech blogs as a rumor.<br />

When Gawker’s Adrian Chen started reaching out to LulzSec via Twitter to try to investigate <strong>the</strong>m, <strong>the</strong> crew, still bitter about his exposé

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!