We are anonymous inside the hacker world of lulzse

wasn’t Sabu. “You got the wrong guy,” he said. “I don’t have a computer.” Looking into the apartment, the agents saw an Ethernet cable and
the green, blinking lights of a DSL modem.
They probed Monsegur further, launching into a traditional good cop/bad cop routine. They told him that they wanted him to work with
them as a cooperating witness, to help them corroborate the identities of the other LulzSec hackers. Sabu refused at first. He wasn’t about to
snitch on his own team.
Then they told him about the evidence they had from Facebook that showed that he had sold stolen credit cards and told him that this alone
would put him in jail for two years. What would happen to his girls if he went to prison? The good cop told Monsegur he could get a lesser
sentence if he cooperated; he had to think of his kids. Monsegur was still holding back. That’s when bad cop piped up.
“That’s it, no deal, it’s over,” the other agent said, storming out of the apartment. “We’re locking you up.” Sabu finally relented.
“It was because of his kids,” one of the agents later told Fox. “He’d do anything for his kids. He didn’t want to go away to prison and
leave them. That’s how we got him.”
The following morning at ten, Monsegur appeared in the Southern District Court of New York with his new lawyer, Peggy Cross-
Goldenberg, and agreed before a judge to let the FBI monitor his every movement—both online and in real life. It would take a few more
months for prosecutors to formally charge him on a stream of other counts related to computer hacking, but his punishment would be agreed
as part of a settlement. From Wednesday, June 8, on, Sabu was an FBI informant.
Monsegur, who had climbed to the pinnacle of the international hacker community thanks to his technical skills, charm, and political
passion, was now feeding information about his friends to the FBI.
As Hector Monsegur was being arrested in his secret New York apartment, thousands of people were talking about his crew of audacious
hackers. Twenty-five thousand more people had started following LulzSec’s Twitter feed after the Infragard hack, and it now had seventyone
thousand followers. The name was getting 1.2 million hits on Google. Topiary found that he would spend a few seconds thinking of
something silly to tweet, then he would tweet it to find it immediately quoted in a news headline. When he tweeted a link to the group’s
public IRC channel, irc.lulzco.org, one Sunday evening at six, more than 460 people quickly piled in for random chatter and a chance to rub
virtual shoulders with the most famous hackers on the planet. “Join the party,” he had announced. “We’re enjoying a peaceful Sunday.”
“LulzSec, you guys rock!” said one visitor.
“I need someone to take down my school’s cheap ass website, for the lulz,” said another.
“Hey can anyone hack this douche for me?” asked someone else who then posted an IP address. Each time another group of twenty or
thirty people joined the chat, someone would shout, “Here comes the flood!”
“You guys released my mom’s e-mail,” said another fan on Twitter. “I LOL’ed.”
Meanwhile journalists were struggling to keep up with the fast-paced developments. No sooner had LulzSec released Sony’s development
codes than it uploaded the user database for porn site Pron.com, pointing out users who had .gov and .mil e-mail addresses with the note,
“They are too busy fapping to defend their country.” One American fighter pilot had used the password mywife01 while the e-mail address
flag@whitehouse.gov had used karlmarx.
Australian IT security expert and the blogger behind cyber security blog Risky.Biz, Patrick Gray, wrote up a blog post called “Why We
Secretly Love LulzSec.” It got re-tweeted hundreds of times and said, “LulzSec is running around pummeling some of the world’s most
powerful organizations into the ground…for laughs! For lulz! For shits and giggles! Surely that tells you what you need to know about
computer security: there isn’t any.” His kicker at the end voiced what many in the cyber security industry were thinking: “So why do we like
LulzSec? ‘I told you so.’ That’s why.”
LulzSec’s flagrant use of often simple SQL injection methods had brought home how vulnerable people’s private data was, and done it
more compellingly than any IT security’s marketing campaign had. Cisco even capitalized on the interest, at one point sponsoring
promotional tweets at the top of any search results for the group on Twitter.
Then a white hat security company did the same. The next morning Topiary woke up to see news reports of LulzSec’s supposed latest
attack, defacing the home page of digital security company Black & Berg. Its home page had a large title saying “Cybersecurity For The 21st
Century, Hacking Challenge: Change this website’s homepage picture and win $10K and a position working with Senior Cybersecurity
Advisor, Joe Black.” Directly after that was: “DONE, THAT WAS EASY. KEEP YOUR MONEY WE DO IT FOR THE LULZ.” Under
the title was a photo of a U.S. federal building covered by the black-and-white image of LulzSec’s ritzy monocled man. The International
Business Times quickly posted a story headlined “LulzSec Wins Hacking Competition, Refuses $10K Award,” then quoted Joe Black
himself commenting, “What can I say? We’re good, they’re better.” When the Times asked Black how LulzSec had done it, he replied: “I’m
going to go with reconnaissance, scanning, gain access, maintain access, and cover tracks.”
But when Topiary asked the team about the Black & Berg attack, nobody knew anything about it, and this deface message didn’t have any
of the nutty creativity that marked their other attacks. Topiary didn’t know it at the time, but Black had most likely defaced his own site to get
the white hat firm some much-needed clients. (A year later the business had shut down and its founder had aligned himself with Anonymous
and Antisec.)
In another part of the world, the hard-core hacker community in Brazil was forming its own version of LulzSec, called LulzSec Brazil.
Another hacker group calling itself LulzRaft briefly emerged. Other black hat hackers sent over more leads. Each day the LulzSec crew
members were sent dozens of links to web pages that could infect them with viruses, but among them there were a few genuine security
exploits, and plenty of data dumps left and right; 1,000 usernames and passwords here, another 500,000 there. Often they were from gaming
companies, a paradoxically popular target for hackers, since so many of them were gamers too. They wanted to leak through LulzSec
because they were often too scared to do it themselves and didn’t want the data or exploit they had found to go to waste. The team had to be
choosy about what it leaked—Topiary had learned from his time with AnonOps not to say yes to every request.
Though Topiary was finding it hard to keep a steady hand on things with so much happening at once, LulzSec was about to ramp up the
pace of announcing hacks. The team was sitting on a mound of unused data, mostly provided by other hackers, that needed to get out. The
Pentagon had given them a reason to finally drop Infragard, but soon they wouldn’t be waiting for the right moment. It would just be a fire
sale of attack after attack.
Feeling the strain that Wednesday night, June 8, Topiary sent a message to Sabu asking if he was around and wanted to talk. He was