
FBI did it for what?
The LULZ!
Suspects purported to be members of LulzSec have been rounded up on two continents. The international law enforcement operation was apparently aided by the infamous hacktivist group's alleged erstwhile leader, "Sabu", who secretly pled guilty to a battery of charges last August. Police arrested three men and charged a further …
This post has been deleted by its author
Wouldn’t surprise me in the least….
My first reaction was that the FBI had set up the whole thing as some sort of fund-raising operation, however the real story is equally strange.
First of all, Rupert Murdoch's fox news reported the story as follows:- “Monsegur and his web minions had just completed a month-long reign of terror, hacking the CIA, Fox, Sony and several financial institutions, causing, according to some estimates, billions of dollars in damage around the world”. This from a country where NASA can’t even secure it’s own web site[1], it’s hardly rocket science is it?
Would that be the same Rupert Murdoch's whose News International has just recently paid $951,000 to Charlotte Church for hacking her mobile phone looking for news stories, seems the Murdock corporations only consider hacking illegal when somebody does it to them.
Also, a member of the garda with email, this is unusual as nearly 40% of Irish cop-shops are not networked[2] without access to email and their IT system “Pulse”.
The Federal Bureau of Idiots are also saying that the people who “hacked” into and “infiltrated” its secret conference call have been arrested, however its not really hacking or infiltration if you provide the tools to the hacker to access the call, that’s called entrapment.
The only hacking that O’Cearrbhaill done was to hack into the gmail account[3] of a member of the garda who had forwarded an email from the FBI to his personal gmail account, that listed the time, the phone number, and the pin for the conference call. O’Cearrbhaill then used IRC to look for a VOIP of sufficient quality to connect to the conference call, where he made contact with Hector Monsegur.
I know from experience that most conference call systems have a facility to list the phone numbers of people on the call so I’m just wondering why the feds didn’t use this facility to help secure the conference call? Oh hang on, they knew O’Cearrbhaill was joining the conference call from information Monsegur supplied and they wanted him to join the call so they could catch him and try and get him extradited for PR purposes.
Suspicious? Moi? Never!
I was going to post this anonymously but there's probably no point.
[1] http://www.theregister.co.uk/2012/03/05/nasa_security_congressional_testimony/
[2] http://www.thejournal.ie/two-out-of-five-garda-stations-dont-have-email-access-353291-Feb2012/
[3] Gmail hacked again, what a surprise
If I recall correclty, one of LulzSec's targets was a military contractor, from which they managed to extract a very extensive list of the email addresses of US military personnel, (and which they subsequently made public). I wonder if that would be suitable grounds for charging LulzSec with espionage.
Also I have to say that I am very surprised by this turn of events, and how it turns out that the internet is FAR less anonymous than Lulzsec and Anonymous believed.
What is _not_ surprising, and is in perfect accord with the common wisdom that it's easy to be an internet tough guy sitting in front of one's computer, is that Tough Guy Sabu rolled on his comrades.
I'm not surprised by this turn of events. Groups like Anonymous and splinter Lulzsec might pretend to be "anonymous" but ultimately they have a inner circle of organisers, a surrounding ring of soldiers and then an outer cloud of hangers on. It may be anonymous but it's no different from any other gang.
If you can get into the inner circle you are in a good position to identify who the others are. I assume they turned Sabu because someone either informed or he made some stupid mistake and used the intervening time to identify the rest of the circle and ensure there was enough evidence to charge them with something.
"unless it's all fake, made-up by the FBI, *pretending* to have arrested LulzSec to save face (like ... let's see ... who comes to mind ... darn, I forgot ! It was in may last year though)."
Then you won't have any difficulty finding it. Hint; google is your friend. Alternatively: http://tinyurl.com/2rfwr ; http://live.lmgtfy.com/ ; http://lmgtfy.com/?q=FBI+pretending+to+arrest+ha%3E%3Cors+May+2011
> Is SQL injection still a real attack?
Oh good lord yes. It's still in the 2011 edition of the CWE/SANS Top 20.[1]
If you read accounts of terrible software in production use, such as the ones that frequently appear in The Daily WTF, you'll see SQL injection vulnerabilities still show up quite often.
Is it embarrassing, as you suggested? Absolutely. But embarrassment has never been a prominent motivator of change in software development. Most software is somewhere between complete crap and mostly crap, and security (along with user experience) is one of the worst areas.[2]
1. https://www.sans.org/top25-software-errors/ - see CWE-89, right at the top of "insecure interaction" vulnerabilities.
2. Platt's _Why Software Sucks_ is a nice introduction to the problem. It should really be required reading for anyone who writes software. Or uses it.
Well, that's because if we don't trust our government, we either end up being monitored, tracked, followed, arrested, interrogated, tortured, killed, or all of the above.
I couldn't find a sheep icon, so I used what I thought would be the closest thing to one. BAAAAAHH...
"You guys trust the government too much..."
Well, to be fair, it is a bit of a pickle. The government:
- Is made up of a bunch of public figures who all have their own agenda
- Can't be trusted to have an agenda that's (necessarily) in the interests of the people at large, though they often claim to be.
- Operates with limited public accountability.
- Operates with limited public oversight, which can often be revoked in the interests of "national security"
- Doesn't know as much about tech-related issues as it thinks it does
On the other hand, Anonymous et. al.:
- Is made up of a bunch of secret figures who all have their own agenda
- Can't be trusted to have an agenda that's (necessarily) in the interests of the people at large, though they often claim to be.
- Operates with no public accountability.
- Operates with no public oversight
- Doesn't know as much about tech-related issues as it thinks it does
Bit of a devil's choice, really. Though in my book, "limited public accountability" still trumps "no public accountability."
I think you're missing the obvious huge advantage of having two such organizations at odds with each other. Each has the motive and means of opening up the other's kimono a little bit, so we can see what nasty stuff lies inside. Yes, there is collateral damage in the form of pointless DoS attacks or using Anonymous as a reason to claim the need for new anti-hacking laws. But they'd each be doing these things anyway, by directing their efforts at each they have less to devote at us!
"The problem is that if you break the law, you will eventually get caught and prosecuted."
More accurately, if you *keep* breaking the law, you will eventually be caught and prosecuted. If this individual (or others) had pulled off perhaps just half a dozen of these attacks, they could have escaped capture forever apparently.
Probably not, but you'd be wrong. Regardless of what you think of law enforcement, they have a job to do - occasionally they enforce laws as well. The hackers here were breaking the law, and got caught. It's actually quite simple when you get down to it.
It's a bit like Wikileaks: to leak confidential information is basically illegal. What can get you off in court is motive: if you do this as a whistleblower (which you can only claim when your information is specific to an issue) you may get away with it - but the fact itself remains illegal.
Said hackers have not exactly helped themselves - if you decide to piss off organisations with vast resources at their disposal you shouldn't be surprised if they get just a little bit more clever than usual. That's forgetting rule 1 of hacking. there is *always* someone smarter out there. Get cocky, get burned..
This post has been deleted by its author
People here are making a great deal of assumptions. The police have arrested a lot of people claiming them to be big time hackers of one sort or another. What's happened? Have the attacks and disclosures stopped? No. So, either there are a lot more people out there willing to do this, or they haven't actually got the hackers. After all, if you're a small time hacker and get arrested, might you not claim to be something bigger and try to get a deal where one was not available before?
I have no idea if these people are who they claim them to be, but I wouldn't trust the authorities here more than the Syrian regime. They're playing their own game for their own reasons and disinformation is part and parcel of that.
If I were engaging in financial crimes, like most people on Wall Street today, I'm very happy over the manner in which police resources are utilized today, to attack protesters of fraud rather than the frauds. As a New Yorker, this is a good thing for the tax base here. Many of the Wall Street felons destroying our Country are based here, and some even pay some taxes.
If you are going to commit crimes be sure to bribe and or promise in the future to hire the underfunded incompetent junior regulators first. The difference between these id10ts and the Massey Energy and Big Branch mine disaster is these tools probably didn't kill anyone directly but they sure will do a lot more time.
I am just a bit hazy, but didn't LulzSec publish a police list last year that included snitches? Snitches that might have gotten put in ditches? Not sure. Or was that some other group? In any case, your assertion that nobody got killed needs a bit of follow up.
If it was this Lulzy group, then perhaps a bit of a turnaround to get snitched as their top hat got bitched.
Surely members of LulzSec weren't daft enough to exchange real names - don't these people watch Reservoir Dogs?
So how does Sabu know, who the other people are?
Or has the FBI been by his side monitoring the traffic he helped orchestrate and then tracking that to other people.
And given how hard it is to create an e-mail with an original name "Gary12345Banana@ X.com", how hard will it be to prosecute someone because you have evidence that www.plxdonothackmeforthelulz.com was hacked by a person using Hunky_Boss_Man as a handle - a handle that the accused has been known to use.
All I'm really saying is, this will surely be some interesting and precedence making trials.
Yes kiddies, we've ARRESTED the BIGGEST BADDEST HACKER IN THE ENTIRE WORLD!!
This from the same people who arrest three guys with four pot plants and breathlessly exclaim that they had a A STREET VALUE OF SEVENTY GAZILLION DOLLARS!
My guess is that the War on Hackers® will be more or less as successful as the War on Drugs® and the War on Terror®.
".....My guess is that the War on Hackers® will be more or less as successful as the War on Drugs® and the War on Terror®." Personally, I think you only have to worry if they start a War On The Terminally Dumb. Then you're in the frontline.
Said it before - the World has plenty of prisons full of people that thought they were so smart and the cops so dumb. The Lulztwits have just given more evidence to support that theory.
"Presumably Americans? Remember they still put full stops after abbreviations like Dr. and Mrs.."
K&R, BSD KNF, 1TBS, Allman, GNU, or Whitesmiths?
They are all read and made sense of by any properly written C compiler. Surely the human brain can make better sense of any given written string of text than a fucking computer? Arguments over "house rules" on punctuation are bloody stupid on a world stage. Can you read it and understand it in your given language? Then kindly shut up, stop exposing your xenophobia, and get on with your life.
Furrfu!
This post has been deleted by its author
The fundamental problem with the Internet is its lack of feedback.
If I stole someone's wallet in a pub, then I'd get walloped. But the lack of real - people type - feedback that the internet affords, means bad behaviour has rare consequences. To keep the buzz, you have to be more outrageous. It's like stress, or mental illness, you're the last person to know it's happening to you. I don't believe half the people would talk to other people on the internet the way they do, if they could actually see the person they've just upset. It's the ultimate sticking up the V's from inside the car.
It's a graveyard for the hurtful who are obsecenely clever, but bored. (Unlike real life which is a graveyard for the hurtful strong.)
They do this for lack of something meaningful, imho. I've been there, been bored, and so have most men I reckon. They're basically sitting in the house, in a scene straight from The hounds of baskerville while he's waiting for a case - that could be a scene from any number of days in my life, where just one more day with nothing to do, leads you to be down the park with a hammer. Who, genuinely IT focussed, hasn't been there.
That said, sooner or later they're going to come up against the people who won the cold war, because like the miner's unions (or Teamsters if you're american,) the government has to know if they're funded by someone else, so it has to know who they are. It's not like they're taking on my mother's coffee morning, they're taking on the people who run everything.
There should be lessons on how to stay out of jail, for bored IT guys, although I suspect their sentencing in this case will be one.
I'm impressed that they managed to find so many young people with IT skills beyond the usage of Word and Excel which is all they appear to teach at school today.
Now that these talented exceptions have been successfully removed from the employment market, this senior softy feels slightly more secure in his job. Thank you FBI et al.!
Time to toddle along to news:alt.usenet.kooks and nominate these people for the Ron Bobo award. The award is described thus:
"The ultimate achievement in the Kook Arts. Given in recognition of the lifetime work of those who rise above and beyond the call of net.looniness, the Bobo is reserved for those whose sheer quest at whatever it is they're pursuing knows Absolutely No Bounds, whether they be global humiliation, jail time, even death. Several Bobo honorees are, in fact, in jail or deceased. Think of it as the Internet's version of the Darwin Award."
The AUK pages are being rehashed, but you can find a copy of the FAQ and stuff here http://web.archive.org/web/20070505091641/http://www.caballista.org/auk/awards.html
I think it fair to say that these people have just qualified. Go to news:alt.usenet.kooks and make a nom if you want. If the skiddies don't know Usenet (most of the new breed of children don't know text only medium) they can go to google groups, where I suspect they'll find themselves more at home, though they need to be careful what they say. They could be LARTed, and there are ways to make sure that a k00k gets its just deserts. I'll be watching.
I forgot to remind you that I was not 'kookifying' (as you so ineptly put it; people like me are known as kookologists, thus 'kookologising' is the correct term), merely pointing out that he is a contenduh for the Ron Bobo award. That is a different matter all together, and has bugger all to do with the KoTM, KoTY or KoTD awards or similar. The Bobo is special, and is for those who are prepared to destroy themselves online, and these boys (girls if any are involved) have done just that. Watch AUK for the news. It'll happen, believe me.
You'll find that the like of the late and great Earl Curley has this award, and his sanity was very definitely in doubt. The Bobo award is, as indicated, a form of Darwin award, and no one is barred from such awards. To understand the origin of Formosa's law see this link; http://www.answers.com/topic/formosa-s-law
The dead cannot by definition be bothered.
HTH,
that is why really hackers*
-always work alone.
-never tell any other soul what they have done, they might participate in hacking discussions, but they will never try to get attention by saying "well, I hacked this site".
-learn for the sake of learning, and never keep trophies.
* yes, I started using this word as well
It's hard to claim that any of this lot were in the right by hacking all and sundry, but you have to make the punishment fit the crime, and I can't help but wonder that "124 years and six months" is a bit much for what seems to amount in most cases here to kids acting irresponsibly. Surely a bit of community service is more likely to rehabilitate than prison. Justice, after all, should be about outcomes, not about vengeance.
If you knock over 124 liquor stores and each offense carries a 6 month penalty, that's a maximum of 62 years in prison. Hacking is no different except it's a heck of a lot easier to knock of 124 liquor stores in a couple of sessions. Real world, real consequences. The sooner idjits learn that, the better off we will all be.
Today's Guardian takes the expected view that these people are zorro-like heroes because they smash other people's computers. Why is a person a dick if they rob/vandelize property, but a hero if they trash other people's computers?
The terms 'genius' and 'brilliant' are bandied as usual, and the back story is also somewhat familiar: Disgruntled IT worker, a bit inadequate, unemployed, has a hack. Thinks he is brainier than the cops, his old boss, FBI, everyone. He isn't, and winds up in custody.
If anyone was clever here, it was the engineers at the FBI, but that idea is not something the Guardian could compute.
" @JAKE DAVIS, a/k/a “topiary,” a/k/a “atopiary,” [29, of Lerwick, Shetland Islands]
Topiary was 18 no? Meh, either way, Sabu facing 129 years? Crazy Americans. 129 years for being a grass though, never trust a crim heh. Anarchist he was not, just a power tripping nerdo who will be written into Internets history for.....Well not for the Lulzboat, he ditched that and ran. Another Sabu will take his place, then another. This is the joy of Anon, no, this is the joy of the Internets.