Anonymous Strikes Back, Hacks "Internet Security" Firm

[Kouen Hasuki]

Anonymous hacked the website and computer systems of one of the internet security firms that was aiding the FBI in tracking them down.

Image of the Notice Here Tweet Here

While most of America was comatose from eating too many wings and bowls of chili, Anonymous went to work bringing down one of the companies trying to nail its nebulous membership. Last week, we reported how 40 Anonymous members had their premises searched by the FBI while 5 suspected members were arrested in the UK by Scotland Yard. HBGary Federal aided those investigations and Anonymous retaliated by bringing down the HBGary website yesterday and replacing it with an image of an open letter outlining their motives. Some 66,000 company emails were also stolen and posted en masse on The Pirate Bay, in order to prove that any information collected by HBGary was worthless and unable to be sold to the FBI. In addition, HBGary CEO Aaron Barr's Twitter account was compromised and used to post his address, social security number and cell phone number.

"Today we taught everyone a lesson. When we actually try to bite back against those who try to bring us down, we bite back hard. #gameover," read a Tweet posted from Aaron Barr's account (which is still under Anonymous control.)

The open letter replacing the HBGary website clearly addressed the group's intentions in this attack. Anonymous mocked the attempts by this computer "security" company for being so easily corrupted, and pointed out that most of the information collected by HBGary was erroneous anyway. "We've seen your internal documents, all of them, and do you know what we did? We laughed. Most of the information you've 'extracted' is publicly available via our IRC networks," the statement read. "The personal details of Anonymous 'members' you think you've acquired are, quite simply, nonsense. So why can't you sell this information to the FBI like you intended? Because we're going to give it to them for free."

How did Anonymous pull it off? Through a combination of hacking knowledge and simple chicanery. The group broke into HBGary's email server, and then used an email that looked like it came from the company's cofounder Greg Hoglund to convince a system admin to divulge passwords.

"They broke into one of HBGary's servers that was used for tech support, and they got emails through compromising an insecure Web server at HBGary Federal," said Hoglund. "They used that to get the credentials for Aaron, who happened to be an administrator on our email system, which is how they got into everything else."

Hoglund might have had a grudging respect for Anonymous before, even as he was investigating their membership, but he reacted the same that Gene Simmons did: by making threats that seem more like bluster than bravery. "They didn't just pick on any company, but we try to protect the US government from hackers. They couldn't have chosen a worse company to pick on."

Is that right? How exactly do you plan to fight a group that has no organization, Hoglund?

Source: Naked Security & Krebs on Security

[MondayHopscotch]

This is the first I've heard of any of this. But it's super interesting! Good thread

[Lee]

Honestly every time i read about something Anon has done, i clap, and then i kind of cry a little inside.

To say that their methods were sad is an understatement.

You are a god damned INTERNET SECURITY COMPANY, you should KNOW BETTER than to give some random person emailing you, admin email account details.

I feel sad for Anon, because they've been getting attacked just for being anon lately.

And i feel sad for the company because i mean... that's rule #1.

[Kouen Hasuki]

Honestly every time i read about something Anon has done, i clap, and then i kind of cry a little inside.

To say that their methods were sad is an understatement.

You are a god damned INTERNET SECURITY COMPANY, you should KNOW BETTER than to give some random person emailing you, admin email account details.

I feel sad for Anon, because they've been getting attacked just for being anon lately.

And i feel sad for the company because i mean... that's rule #1.

All the security in the world means nothing up against Human Stupidity

[Colamisu]

All the security in the world means nothing up against Human Stupidity

Proper security would protect against individual human stupidity, no matter who they are. That's why in movies, launching nukes always takes two people turning keys simultaneously from different locations or some goofy shit like that.

[MondayHopscotch]

Proper security would protect against individual human stupidity, no matter who they are. That's why in movies, launching nukes always takes two people turning keys simultaneously from different locations or some goofy shit like that.

Let's hope its like that in real life, too! So we don't have people who sending nukes off to other countries because they got a convincing email telling them to do so.

[Lee]

Let's hope its like that in real life, too! So we don't have people who sending nukes off to other countries because they got a convincing email telling them to do so.

If i remember correctly, there is a two key system, but the main bulk of security precautions in nuclear silos is put into the training of the two people in the hole.

Hell, i don't even know if that's how they do nukes anymore, two people in a hole that is.

[ResidentPsycho]

pretty good read, i checked out the twitter account, had a few lulz.

[JKDarkside]

This is one of those disgusting times when Anon crossed the line. This is you done goofed bad, where there they heckled a girl in real life and got the FBI involved because she didn't strip on a webcam. Here they're posting private e-mails online on the pirate bay, perfectly disgusting.

Hopefully the next Anon will do something to someone who actually deserves it.

[Cosmic]

How did Anonymous pull it off? Through a combination of hacking knowledge and simple chicanery. The group broke into HBGary's email server, and then used an email that looked like it came from the company's cofounder Greg Hoglund to convince a system admin to divulge passwords.

♪ Someone's getting fiiiired~ ♫

[Bobdrakke]

Mixed feelings here, crossed the line and losing public moral perception of fighting the big guy corp/gov.

The researcher is no better admitting to breaking the law and your real id is out in the wild. I wonder if he will still present his findings at rsa conference after this incident.

[Mistral]

Let's hope its like that in real life, too! So we don't have people who sending nukes off to other countries because they got a convincing email telling them to do so.

I wonder if I should tell you this, but until only a few decades ago, America's nuclear arsenal (specifically, the Minutemen ICBMs) could be released only through a codes that had to come from Strategic Air Command. That code, which any officer could tell you just from the standard operational tests: 0000000.
It's still better than the British air-dropped bombs, which were protected by glorified bicycle locks until they were withdrawn from service in the 90s, and their Tridents, which are still protected by a single code written on a letter in a safe on the sub itself.

As for the topic itself, it feels like overkill to me as well. Still, it's not like even Anon can police itself. Well, if anything, though, it feels like it's something that would only stiffen resolve.

[Lee]

This is one of those disgusting times when Anon crossed the line. This is you done goofed bad, where there they heckled a girl in real life and got the FBI involved because she didn't strip on a webcam. Here they're posting private e-mails online on the pirate bay, perfectly disgusting.

Hopefully the next Anon will do something to someone who actually deserves it.

Honestly, i would feel the same way, but only if the big bad internet security firm was actually competent.

[JKDarkside]

Mixed feelings here, crossed the line and losing public moral perception of fighting the big guy corp/gov.

You mean the guys hunting them down for doing illegal activity? Yeah, real evil.

[Lee]

You mean the guys hunting them down for doing illegal activity? Yeah, real evil.

I think he was talking about how Anon had lost their way.

But i might be reading into it too heavily.