ie8 fix
Game time

Will LulzSec arrests stop high-profile hacks? Don't bet on it

The arrests may have taken out the group known as "LulzSec," but there are still untold numbers of the hacktivist group Anonymous who remain active.

(Credit: James Martin/CNET)

The group of hackers known as "LulzSec" frequently taunted government pursuers over the last year as they published sensitive data snatched from myriad public and corporate Web sites.

Tuesday, we may have learned what happens when you mock the feds for too long. Authorities announced that five men in the U.K., Ireland, New York, and Chicago had been charged with hacking-related offenses. They also said the alleged LulzSec leader, known as Sabu, had entered a guilty plea on August 15 to 12 counts of computer hacking conspiracies and other crimes. According to the U.S. Attorney's Office in New York, Hector Xavier Monsegur, 28, was arrested and released in June on $50,000 bond. One of the men charged, Jake Davis, also known as Topiary, was arrested in the United Kingdom last July.

The alleged members of LulzSec are accused in computer attacks against Fox Broadcasting, PBS, and global intelligence firm Stratfor. The group is accused of stealing confidential information--including passwords--and releasing it publicly, hijacking e-mail accounts and even secretly listening in on a conference call in which the FBI and Scotland Yard talked about trying to catch them.

But for all the media excitement generated by the arrests, their impact is likely to be minimal. LulzSec may be silenced--at least for now- but network security experts believe the LulzSec crackdown is unlikely to spell the end of the spate of high-profile, politically motivated hacks carried out by LulzSec's brethren in the online activist collective Anonymous.

Even law enforcement officials who had been taunted for so long by their suspects were reluctant to call their news a major blow to Anonymous. Indeed, speaking with CNET on condition of anonymity, a member of Anonymous downplayed the impact of the arrests.

"People get arrested from Anonymous all the time, including 25 last week," by Interpol, he said. "It's not like these arrests will bring the entire group down. They were involved but they weren't kingpins like the FBI says."

In search of Sabu
Officials have declined to comment on a Fox report that Monsegur served as an informant after he was arrested, but there had been rumors that he was snitching. A hacker using the moniker "Virus" posted a chat log to Pastebin on August 16 between Sabu and others that Virus claims is proof that Sabu had snitched after he was tricked. "Be careful who you are friends with because they will sell you out very quickly," Virus warns.

Sabu dismissed those claims in a subsequent post in October, saying "Am I snitch/informant? Let's be real--I don't know any identities of anyone in my crew... And the last thing I'd ever do is take down my own people. I am a grown ass man I can handle my own issues," he wrote. "I've been to jail before--I don't fear it. In fact there is very little I am afraid of especially these days."

Monsegur, an unemployed father of two, would have had plenty of time to spend boasting of activities and dissing the feds via his Twitter account, "The Real Sabu." "The federal government is run by a bunch of [expletive] cowards. Don't give in to these people. Fight back. Stay strong," the account tweeted yesterday.

Sabu was so high profile and antagonistic that other hackers tried to uncover his identity last summer. In fact, a Pastebin post from last June named Monsegur as Sabu, so it could be that rival hackers did the leg work for the feds. Other chat logs that have been posted publicly revealed that Sabu was the leader. "He was the Pablo Escobar of the LulzSec team," famed hacker Kevin Mitnick said.

Monsegur is accused of being the "rooter," the hacker who identifies vulnerabilities in computer networks that can then be exploited. And despite officials referring to the group's "sophisticated hacking" skills, the group relied mostly on run-of-the-mill SQL injection and distributed denial-of-service (DDoS) attacks.

"They were pretty stupid about a lot of things," said Scot Terban, a security analyst and consultant. This included using a stolen credit card number to order car engines and having them delivered to his home address, logging into Internet Relay Chat with his real IP address instead of going through a proxy like TOR, and using aliases that could be linked to him on the Web from other activities, Terban said, referencing court documents.

Are these the tweets of an informant? The Twitter account of "The Real Sabu" had this to say yesterday. A final tweet last night, ahead arrests of alleged members of hacking group LulzSec, says in German: The revolution says I am, I was, I will be."

Are these the tweets of an informant? The Twitter account of "The Real Sabu" had this to say yesterday. A final tweet overnight, ahead of arrests of alleged members of hacking group LulzSec, says in German: The revolution says I am, I was, I will be."

The real nasty hacking targeting feds may stop, at least for a while, Terban said. "In general I think it's going to break the back of the AntiSec mentality of going around and hacking things and dumping data," Terban said. "Now they've all learned that they can't necessarily just skate and get away with it."

Josh Corman, director of security intelligence for Akamai who has been studying the hackers, said it was too soon to tell if this is going to hurt the Anonymous movement long term or help it.

"It may improve their operational security" to keep identities more hidden in case of infiltrators, he said.

Mitnick knows from first-hand experience just what hacker groups like Lulz and Anonymous are up against. One of the most celebrated early hackers, Mitnick got busted on hacking charges after leading the FBI on a goose chase about 25 years ago.

"If you poke the tiger, eventually the tiger is going to bite you," Mitnick said. "When you screw with law enforcement, they take it personal--and these guys were doing that, compromising police Web sites and publishing home addresses and phone numbers."

Recounting his personal chronology of being on the lam, Mitnick recalled that he kept his circle of acquaintances to one or two hacking partners at most, and he still wound up getting informed upon.

"The larger your circle the greater your risk...If I was a member of Anonymous, which I'm not, I would be really concerned about the same thing happening to me. How many people know my real world identity?"

Below is a timeline of major LulzSec events. Dates may be approximate as it is often difficult to determine exactly when a network was compromised:

February 2, 2011 - Anonymous hacks HBGary Federal site

May 15 - LulzSec claims credit for hacking UK ATMs and Fox Network's X Factor site

May 23 - LulzSec leaks data from Sony Music Japan

May 30 - LulzSec defaces PBS.org

June 2 - Group leaks customer data from Sony Pictures

June 3 - Hacks on Nintendo and InfraGard Atlanta

June 6 - Sony Entertainment source code and Sony BMG hacks

June 7 - Monsegur, aka Sabu, arrested on identity fraud charges

June 9 - LulzSec compromises U.K. National Health Services site

June 13 - Data stolen from videogame maker Bethesda Software

June 14 - Senate site compromised

June 15 - DDoS on CIA site

June 16 - Thousands of passwords dumped

June 20 - DDoS on U.K.'s Serious Organized Crime Agency

June 21 - British police arrest 19-year-old Ryan Cleary

June 23 - Arizona law enforcement sites compromised

June 25 - LulzSec announces that they are quitting after 50 days

June 28 - Zimbabwe, Brazil, UMG, Viacom hacked

June 29 - Arizona Dept. of Public Safety data dump

June 29 - FBI searches home of Ohio man

June 30 - another Arizona law officer data dump

July 4 - Apple server targeted

July 8 - Chilean government site, IRC Federal hacked

July 11 - hackers claim Booz Allen Hamilton hack

July 18 - LulzSec deface Murdoch's The Sun

July 19 - 16 arrested in U.S.

July 22 - U.S., Italian cyber crime site hacked

July 27 - Topiary arrested (Identified this week as Jake Davis)

August 6 - Italian police sites attacked

August 15 - Monsegur pleads guilty to computer hacking charges

August 18 - Hackers claim data stolen from Vanguard Defense Industries

September 22 - Arrest of Cody Andrew Kretsinger, 23, of Phoenix

December 25 - Stratfor data stolen

(CNET's Roger Cheng contributed to this report.)
News
Xbox One: Say goodbye to the TV remote
Microsoft wants to revamp the way we watch TV, change channels, and switch between different media with the new Xbox One. CNET's Sumi Das on how the voice and motion controls are integrated with the TV viewing experience.
Play Video
 

Member Comments

ie8 fix