Paranoia: LulzSec leader Sabu was working for us, says FBI

[Peter Lemkin]

Anonymous Rocked by News That Top Hacker Snitched to Feds

• By Quinn Norton
  
• Email Author
  
• March 7, 2012 |
  
• 1:50 am |
  
• Categories: Anonymous
  

Follow @quinnnorton


On the heels of 25 arrests of Spanish-speaking anons last week, Anonymous was rocked Tuesday by the news that Hector Xavier Monsegur, the legal name of prominent antisec known as Sabu, has been cooperating with the FBI to hunt down other anon hackers from Lulzsec and Antisec.
The chatter on the anon IRC servers and anon-associated Twitter accounts ranged Tuesday from denial about Sabu's involvement to outrage and hatred for Monsegur. One who worked with Sabu as part of Antisec, the miltant and pranksterish arm of Anonymous, described themselves as "emotionally devastated" and "shocked" by the news.
"Sabu was in my opinion a great guy. I was woken up today with the message that the arrests happened. It came to me like an emotional bitchslap," said the anon in an online chat. "I know why I got kicked out of antisec now," the anon continued, intimating that Sabu did so to protect him/her from prosecution.

Another anon described Sabu as a mentor figure, saying Sabu had encouraged and taught him/her about Python programming.
"I honestly wouldn't have learned without him actually taking the time to give me some really pro tips… and show me that there was almost no limits to what you could do with it if you were doing it right."
But in the timeframe of Monsegur's arrest which occurred without public notice in the summer, this anon saw a change in Monsegur's behavior. Monsegur became more distant, and while he'd always displayed an un-Anonymous desire for fame that drew criticism, "after a certain point everything just became about him-him-him. And he'd randomly send out some almost cryptic messages about how it was all for Anonymous etc etc, but at a certain point I just stopped buying that. I think a lot of people did."
According to several anons, around this time Monsegur became interested in a wider range of operations, including those he'd not had previous involvement in.
But despite the changes and ultimate betrayal, many anons aren't ready to condemn Monsegur after hearing about the arrests of fellow anons due to his cooperation with the feds.
"It was either 124 years for Sabu, or 10 years each for the others," said the former antisec anon. "I get why he did it, but he damaged the collective because of his own problems. And Anonymous is not your personal army. Nor is antisec."
The possible 124-year sentence for Monsegur's crimes struck anons as out of proportion for his crimes. As one put it, "Sabu is approximately one Topiary and some cash less heinous than Bernie Madoff, according to the FBI using their measurement of prison time," referring to the purported age of one of the Lulzsec members Monsegur snitched on and the relatively light sentence of the billion-dollar ponzi scheme fraudster.
The information from Monsegur has led to further charges for Ryan Ackroyd and Jake Davis, who were previously charged for alleged participation in a hacking spree last spring. His cooperation also led to the arrest and indictment of Darren Martyn, and Donncha O'Cearrbhail in connection with Lulzsec, and Jeremy Hammond in connection with Antisec. In particular, Hammond is being prosecuted for the high-profile hack of Stratfor, a private intelligence firm relied on by major corporations, which led to the distribution of Stratfor's internal e-mail by Wikileaks last week.
Jeremy Hammond of Chicago appears to be a noted activist and hacker who has had previous brushes with the law, who has given a defcon talk on electronic civil disobedience, and even been profiled by Chicago Magazine.
On the day of the arrest, Monsegur's guilty plea was unsealed, claiming 12 counts, including conspiracy to commit computer hacking, and conspiracy to commit bank fraud, among other charges. No details of a plea deal that lead to his cooperation have been released.
As for the long run, many anons don't believe the effects will be profound.
"So the amount of information that both Sabu and crediblethreat (Hammond) have is pretty impressive," said an anon speaking to Wired. "We can assume now that the FBI has all of that information. So long as Anons had taken measures to remain Anonymous when dealing with those people it will be business as usual."
Anons also reposted a video recapping the group's outsized influence in 2011, perhaps as a way to suggest that the arrests wouldn't slow a group that has evolved from a malicious group of pranksters into a force to be reckoned with on the world's stage.

The anon kicked out of Antisec by Sabu put it this way in a chat with Wired on the IRC:

Anon: we need to pick our lives back up
Anon: and go on
Anon: antisec
Anon: anonymous
Anon: everything
Anon: I'll keep on doing what I have always done for Anonymous
Anon: You have seen it today
Anon: http://musterroom.com/ antisec goes on [referring to an Antisec-signed defacement of a small law enforcement chat site]
Anon: anonymous goes on
Anon: I think it was merely a speedbump for the collective
Anon: but a massive emotional bitchslap for individuals

Depending on what frame you look at Anonymous through, this may be true. While these arrests are devastating for the mediagenic hacking wing of Anonymous, other parts of the collective that more involved in traditional activism remain largely untouched. Anonymous activity against SOPA and other legislation in the USA, like the recent HR 347, and ACTA in Europe, are gaining steam. And the freedom ops involved with supporting protesters in the Middle East continue unphased.
That said, in what's inevitably going to be a long war between the law and those in Anonymous who believe in a greater justice outside of the law, the law won a big battle Tuesday, no matter how anons try to spin it.
Photo: Newton Grafitti/Flicker

• Post Comment |
  
• 23 Comments and 158 Reactions |
  
• Permalink
  

Hackers Vie for More Than $1 Million to Take Down Browsers

• By Kim Zetter
  
• Email Author
  
• March 6, 2012 |
  
• 10:31 pm |
  
• Categories: Cybersecurity, Hacks and Cracks
  

As alleged hackers from LulzSec and Anonymous contemplate the possibility of a life behind bars, other hackers are limbering up in Canada this week to vie for more than $1 million in prize money for their hacking prowess.
The annual Pwn2Own contest at the CanSecWest security conference is in its sixth year and aims to improve the security of the internet by challenging researchers to find zero-day vulnerabilities and develop exploits to attack them, while disclosing the findings to vendors to allow the companies to patch their products before the vulnerabilities can be exploited in the wild. The contest provides the makers of browser software and other applications with valuable information about security flaws in their products, without having to spend the time and resources to uncover the vulnerabilities themselves.
The targets this year are four browsers Microsoft's Internet Explorer, Apple Safari, Mozilla Firefox and Google Chrome. Contestants aim to own a browser or "pwn" in hackerspeak by using exploits to get the browser to run arbitrary code of the hacker's choice.
The browsers being targeted will be running on systems with fully patched versions of the Windows 7 or Lion operating systems.
Contestants earn points for various levels of exploits and the amount of time it takes to develop them, with the top three point-earners winning money awards. A working zero-day exploit against the latest version of any of the browsers, for example, earns the hacker or his team 32 points.
The person or team with the most points at the end of the contest will receive $60,000 from Hewlett-Packard, which sponsors the contest. Second place brings $30,000 and third place, $15,000. Additionally, the winners will receive the laptops on which the browsers were running during the contest. This year the laptops include two Asus Zenbooks and a Macbook Air.
The first year the contest was held in 2007, it took a contestant just five hours to discover an exploitable flaw in the Safari browser, and another four hours to write an exploit to attack it.
This year, Google has sweetened the pot with its own parallel contest focusing just on its Chrome browser. Although Chrome was one of the target browsers in last year's contest, no contestant took aim at it, leaving Google to go home with an empty exploit bag. This year to entice researchers, Google decided to sponsor its own contest, with up to $1 million in cash awards to anyone who can uncover vulnerabilities and develop working exploits for Chrome.
Google has pledged to pay multiple awards in the amounts of $60,000, $40,000 and $20,000, depending on the severity and characteristics of the exploits, up to $1 million. Winners will also receive a Chromebook.
"[W]e have a big learning opportunity when we receive full end-to-end exploits," Google's Chrome security team wrote in a blog post last month. "Not only can we fix the bugs, but by studying the vulnerability and exploit techniques we can enhance our mitigations, automated testing, and sandboxing. This enables us to better protect our users."
The breakdown for Chrome exploit awards is as follows:

$60,000 "Full Chrome exploit": Chrome / Win7 local OS user account persistence using only bugs in Chrome itself.

$40,000 "Partial Chrome exploit": Chrome / Win7 local OS user account persistence using at least one bug in Chrome itself, plus other bugs. For example, a WebKit bug combined with a Windows sandbox bug.

$20,000 "Consolation reward, Flash / Windows / other": Chrome / Win7 local OS user account persistence that does not use bugs in Chrome. For example, bugs in one or more of Flash, Windows or a driver. These exploits are not specific to Chrome and will be a threat to users of any web browser. Although not specifically Chrome's issue, we've decided to offer consolation prizes because these findings still help us toward our mission of making the entire web safer.

 All winners will also receive a Chromebook.

Running parallel to the two contests will be a full schedule of security talks from Wednesday to Friday, focusing on such topics as vulnerabilities in the HDMI (High-Definition Multimedia Interace), bypassing firewall filtering and the legal issues around security research of mobile devices.

• Post Comment |
  
• 4 Comments and 62 Reactions |
  
• Permalink
  

LulzSec Leader Was Snitch Who Helped Snag Fellow Hackers

• By Kim Zetter
  
• Email Author
  
• March 6, 2012 |
  
• 10:07 am |
  
• Categories: Anonymous, Hacks and Cracks
  

A top LulzSec leader turned informant last year after he was secretly arrested, providing information to law enforcement that led to the arrests Tuesday of other top members of the hacking group, including one alleged to be deeply involved in December's Stratfor hack, federal authorities said Tuesday.
Hector Xavier Monsegur, a 28-year-old New Yorker who used the online name "Sabu," has been working undercover for the feds since the FBI arrested him without fanfare last June, a story first reported by Fox News. Monsegur provided agents with information that helped them arrest several suspects on Tuesday, including two men from Great Britain, two from Ireland and an American in Chicago.
The charges against them would complete any hacker's resume. They are accused of breaking into computer systems, deleting data, stealing confidential information "including encrypted and unencrypted sensitive personal information for thousands of victims," according to court documents (.pdf).
Monsegur, an unemployed father of two, led the loosely organized group of hackers from his apartment in a public housing project in New York. He pleaded guilty Tuesday to various hacking-related charges. Documents (.pdf) in his case were unsealed in New York federal court on Tuesday. The government did not say what type of plea deal was made with Monsegur, who theoretically faces a maximum 124-year sentence.
The record unsealed Tuesday generally references him as CW-1. Federal authorities declined comment on whether Monsegur was the informant. But in court records, Stephanie Christensen, an assistant U.S. attorney in Los Angeles, said (.pdf) Monsegur "is actively cooperating with the government and has indicated an intent to continue working proactively with the government. Defendant has provided the government with detailed information concerning the activities of certain individuals who are suspected of being involved in the unauthorized computer intrusions or hacks' into various computer networks of several well-known corporations."
Those arrested include Ryan Ackroyd, aka "Kayla" of Doncaster, United Kingdom; Jake Davis, aka "Topiary" of London; Darren Martyn, aka "pwnsauce" of Ireland; Donncha O'Cearrbhail, aka "palladium" of Ireland; and Jeremy Hammond, aka "Anarchaos"of Chicago.
Hammond, a member of Anonymous a group loosely affiliated with LulzSec is believed to be the main actor behind the hack of U.S. private intelligence company Stratfor in December, which resulted in the seizure of more than 5 million company e-mails, customer credit card numbers and other confidential information. The government said in a court filing that Hammond "used some of the stolen credit card data to make at least $700,000 worth of unauthorized charges." (.pdf) The Stratfor hackers publicly said they were using the cards to make donations to charity, and provided screenshots.
The secret-spilling site WikiLeaks has begun to publish the Stratfor e-mails via media partners around the world.
The records show that Texas-based Stratfor encrypted its clients' passwords, "but stored other client information, including credit card numbers and associated data, in clear text."
Sabu was one of the most outspoken and brazen of the LulzSec crew that rampaged across the internet last spring, though several of them were publicly arrested last year. However, Sabu fell silent in the summer, leaving a parting Tweet quoting the The Usual Suspects. But then he reappeared in September, denying that he'd been arrested. But many anons suspected that Sabu had been arrested, since other anons had published his identity online.
An anonymous blog post from November made the case that Sabu had turned state's evidence.

His reappearance was not much of a surprise, as it has been a frequent public rumored (and secretly verified) that Sabu was identified, apprehended by the FBI and turned to an informant. Over the past several months, all of the original LulzSec member except Sabu himself have been arrested. Even though Sabu has been publicly doxed and completely owned on several occasions. You may be asking yourself, why is he still free? The answer is Intel. The longer he is "free" is the longer that the FBI and other LEAs can gather information on other hackers and move in for more arrests. Simple as that.
Besides Sabu's rampant snitching and informing on this old friends, the Anonops IRC network has been hacked and rooted. Great news all around.

Brian Knappenberger, who has nearly completed a documentary on Anonymous called We Are Legion that is screening next week at SXSW, said he suspected as much when Sabu's Twitter feed stopped for a month and many Anons suspected it as well.
"When he went dark and tweeted the famous Usual Suspects line about the greatest trick the devil ever pulled was convincing the world he didn't exist, I thought then he was snatched up by the FBI. Then he came back a month later and like nothing ever happened like he took a break or just went on vacation," Knappenberger said. "I had a conversation with someone who said A little bird told me there is a reason they are not arresting Sabu' but whenever anyone said that on Twitter, Sabu would respond with string of obscenities."
The other four defendants, who the feds said were affiliated with Anonymous, are accused of a myriad of hacks on Fine Gael, HBGary Federal and Fox Broadcasting Company, according to court records.
The four called themselves "Internet Feds," the government said.
The authorities added that Ackroyd, Davis, Martyn and Monsegur, "as members of LulzSec," conspired to hack PBS "in retaliation for what LulzSec perceived to be unfavorable news coverage in an episode of the news program Frontline,'" which had broadcast a documentary on WikiLeaks in May.
Additonal reporting and writing by David Kravets and Ryan Singel