12 ms·

Anonymous vs. HBGary: the aftermath

145 points by hardik988 16y ago

ajays 16y ago
Not much substance in the article, but: HBG come across as whiny little losers ("oh noes! we are being threatened!!"), and Anon seems to have gotten bored and moved on.
- wladimir 16y ago
  I have somewhat mixed feelings about it, but I think I like it how, with modern technology, civilian semi-organized groups can challenge and shame such shady and clearly power obsessed companies. It feels like a kind of balancing force against the most dystopian possible future.
  - intended 16y ago
    That palantir page was really disturbing to see. I have to be glad that it was leaked.
    - bane 16y ago
      This case, and the lawsuit with i2 has firmly put Palantir on my list of "sleazy companies" not to do business with or try to go work for.
  - intended 16y ago
    That palantir page was really disturbing to see. I have to be glad that it was leaked.
- JanezStupar 16y ago
  Propaganda. HBGary have some friends in government - Anon do not (some may, but most of them are kids). HBGary was being extremely naughty and now need to divert attention. It's in the mutual interest of "adults" to step together sweep everything under the rug and go after the "kids". They will again make the mistake of assuming that anon is an organized entity, anon (as hive mind) has probably already lost interest in HBG and moved on. The harassment if indeed true is probably coming from fans and sympathizers of anonymous - so the government will probably go after some people who are not but indeed are members of anonymous (this phrase can only make sense in the context of anon's nature). Or as my dear Machiavelli put it: "Though Men make Mistakes about Things in General, they do not make Mistakes about Particulars". I believe that this quote sums mob ethos fantastically. The anon might be goalless, formless group. But their targets tend to be worthy of targeting. And another observation - the people who are harassing HBG now are the IMHO the kind of people that are usually so risk averse that they won't participate in anything that might endanger their comfortable existence. Yet here they throw themselves into action to serve as cannon fodder for the core Anon group :).
- masklinn 16y ago
  > Not much substance in the article That's because it's a followup to half a dozen Ars articles on the spat (see the "The HBGary Saga" insert halfway down the page), 3 of which were 3 pages long and one reached 5 pages ("Black ops: how HBGary wrote backdoors for the government").
Luyt 16y ago
..."they struck gold with an SQL injection attack on HBGary Federal's content management system. [...] They quickly grabbed and decrypted user passwords from the website" A security firm cracked by scriptkiddie tricks? Storing passwords in the database, instead of hashes? Hmmm...
- fleitz 16y ago
  From the information available it appears the passwords were hashed but not salted.
  - tomjen3 16y ago
    If that is true, then they must have used some really, really simple passwords for them to be cracked in such a short time.
    - Garbage 16y ago
      Hint: MD5 and Rainbow tables
    - fleitz 16y ago
      From the available info there were indeed simple passwords and password reuse between systems of different security levels. openssl speed md5 The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes md5 23895.04k 85345.30k 231322.03k 412608.40k 546306.56k If you look at the openssl numbers from my workstation, you'll find I can generate hashes for 1.5 million 16 byte passwords per second. The nice part about rainbow tables is that they are easy to compute in a distributed nature. Take a couple hundred EC2 boxes and you can generate HUGE tables, if you're smart with how you use S3 you can write the tables directly to S3. Cracking unsalted passwords is a very simple time/memory trade off. Given the issues with MD5 with a good math background you might even be able to reverse the password. (eg. create a known password that computes to the same hash) If you got creative with some FPGAs or GPUs you could do far better.
fleitz 16y ago
From the article: "Instead, he believes that Anonymous has "decided to continue their antics. They're in it for the laughs… this is a real funny game for them." Not content with the damage they have inflicted, they "harass a company that's trying to get back to work." Each time a new story about the company appears in the press, Butterworth said that these attacks spike again." If the press is bad for HBGary why do they participate in it? A no comment would have been sufficient. I think HB Gary is participating in the press to incite attacks so they can present themselves as victims, collect evidence, have someone charged, and declare victory. Seriously, a sheet of paper written in sharpie. They're expecting me to believe that the RSA holds a security conference with out badges, with out video monitoring and that some anon in a Guy Fawkes mask walks up to the table and places a threatening did it for the LULZ paper on their booth with no one noticing. Maybe, V for Vendetta is a real movie and such a person really exists who can easily pass through intelligence services and evade video monitoring. If I was HB Gary I'd have extensive surveillance on the booth to catch just such a thing. I'll use the Aaron Barr method of finding anons and assume the anon who placed the paper is employed by HB Gary. This from a company whose services are retained for their ability to plant false documents. The sign should read 'We got laughed out of the security conference for using weak passwords, storing them weakly, and reusing passwords in addition to being vulnerable to basic SQL injection.' In my opinion, officers of HBGary Federal were engaged in stalking people online and selling private information about individuals for commercial purposes, as well as engaged in defaming these individuals with false information to the FBI. Given the demographic of anonymous it's quite likely that some of these individuals were children. I'm not sure if this is illegal in the US, but if they collected and prepared to sell personal information without consent about Canadian citizens they'd likely be in violation of Federal Law. (PIPEDA) Also, regarding the millions of dollars in damages, these claims would be impossible to verify with a private company. Public companies on the other hand are required to file damages to the company both tangible and intangible. In a lot of hacking cases you'll see millions of dollars claimed, but if you look at the 10-Qs (SEC Required docs) you'll see no such filing. If you want a case to look at in particular for this, look at what happened to Kevin Mitnick. Why is it ok for HBGary to take money to compromise computers, but when Anonymous engaged in expression of speech they are targetted by federal investigators? This is a company that used intelligence assets against pro-union websites. My personal feelings regarding unions aside, this is attempting to violate the rights of individuals to peaceably assemble. Even if it isn't illegal per se, it's highly unethical. If HB Gary only engaged in ethical business practices there would be little damage from the disclosure of the emails. The damage results from the conspiracy to commit activities that are likely criminal. A better question to ask is given the emails why Federal charges have not been laid against HBGary? http://en.wikipedia.org/wiki/National_Labor_Relations_Act http://en.wikipedia.org/wiki/National_Labor_Relations_Act
grudolf 16y ago
On the first photo, was that "Defeating malware" or "Delivering malware"?
quacker 16y ago
The characterization of Anonymous as some single or unique entity is misleading. The sign at the booth and the fax HBGary received were (likely) not perpetrated by the hackers who did the damage. Anyone in the right mood might have gone through with it, fueled by the success of the original attack. And the point made at the end of the article that Barr's list of supposed identities contained many innocent people was very true.
- iuguy 16y ago
  I would expect hijinks from the guys at Mandiant or any other exhibitor constituting even tangential competition (or anyone from Palantir for that matter) could include something like that sign. There's something clearly going on that we're not being told - but then again, bear in mind that they're a private company so it's not like there's an obligation to disclose.
barrkel 16y ago
From what I've read elsewhere, in terms of online crimes, the FBI is treating Anonymous second only to child porn (http://www.dailycampus.com/mobile/news/fbi-raids-house-on-n-eagleville-1.1961646 http://www.dailycampus.com/mobile/news/fbi-raids-house-on-n-...). Probably a function of the power and money behind the people they've attacked (the Visa/Mastercard DDoSes in particular).
- jbooth 16y ago
  That, and the fact that their existence is a direct challenge to the FBI's collective ego.
VladRussian 16y ago
the more i read about this HBGary the more i feel that justice is being served. These fat and lazy morons thought that because they've been doing dirty things for government they are above the law and basic ethical rules ... Of course, they are above the law that enforced by their government friends, yet there is the Karma law and "we the People".
- daeken 16y ago
  "These fat and lazy morons..." Can we avoid juvenile attacks like these, please? C'mon, this is HN, not Kindergarten.
barrkel 16y ago
"What happened to Barr? Anonymous loudly and angrily demanded that Penny Leavy fire him, since his list of Anonymous names could allegedly have gotten "innocent people" into serious trouble. Leavy made clear that HBGary Federal was a separate company from HBGary, one in which she owned only a 15 percent stake, and that she couldn't simply "fire" the CEO." I found the comments on this article interesting: http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-022211 http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losin... "They claimed that the company was under separate management, and that HBGary, Inc. only had a 15% stake in the company. However, the Operating Agreement for HBGary Federal, LLC, reveals that Greg Hoglund and Penny Leavy were two of the original six Founding Directors of HBGary Federal. Futher, Penny Leavy herself signed the incorporation application with the California Secretary of State. This Operating Agreement confims the 15% stake held by HBGary, Inc. in HBGary Federal, but it also reveals that Penny Leavy herself holds a 48% share in the company. Her 48% share, plus that of HBGary, Inc. (15%) puts their combined ownership stake at 63%. In terms of dollars invested, their investment in HBGary Federal amounts to some 87.5% of the total monies invested. "This operating agreement can be downloaded from: http://cryptome.org/0003/hbg/HBG-Fed-OA.pdf http://cryptome.org/0003/hbg/HBG-Fed-OA.pdf " Exhibit B in the Cryptome PDF (page 31) does indeed show Penelope Christine Leavy with 48%, in addition to HB Gary Inc's 15%.
forgotAgain 16y ago
The biggest worry here is that HBGary is not being held accountable for their criminal activities. They have been using tools and psy-ops practices developed for the military against U.S. political targets. That is against the law.
forsaken 16y ago
The power of anonymous is that you can become part of anonymous at any point.
jeffthebear 16y ago
The Cobert Report summary: http://ca.gawker.com/5769950/ http://ca.gawker.com/5769950/

145 points by hardik988 16y ago

ajays 16y ago

Not much substance in the article, but: HBG come across as whiny little losers ("oh noes! we are being threatened!!"), and Anon seems to have gotten bored and moved on.

wladimir 16y ago
I have somewhat mixed feelings about it, but I think I like it how, with modern technology, civilian semi-organized groups can challenge and shame such shady and clearly power obsessed companies. It feels like a kind of balancing force against the most dystopian possible future.
- intended 16y ago
  That palantir page was really disturbing to see. I have to be glad that it was leaked.
  - bane 16y ago
    This case, and the lawsuit with i2 has firmly put Palantir on my list of "sleazy companies" not to do business with or try to go work for.
- intended 16y ago
  That palantir page was really disturbing to see. I have to be glad that it was leaked.
JanezStupar 16y ago
Propaganda. HBGary have some friends in government - Anon do not (some may, but most of them are kids). HBGary was being extremely naughty and now need to divert attention. It's in the mutual interest of "adults" to step together sweep everything under the rug and go after the "kids". They will again make the mistake of assuming that anon is an organized entity, anon (as hive mind) has probably already lost interest in HBG and moved on. The harassment if indeed true is probably coming from fans and sympathizers of anonymous - so the government will probably go after some people who are not but indeed are members of anonymous (this phrase can only make sense in the context of anon's nature). Or as my dear Machiavelli put it: "Though Men make Mistakes about Things in General, they do not make Mistakes about Particulars". I believe that this quote sums mob ethos fantastically. The anon might be goalless, formless group. But their targets tend to be worthy of targeting. And another observation - the people who are harassing HBG now are the IMHO the kind of people that are usually so risk averse that they won't participate in anything that might endanger their comfortable existence. Yet here they throw themselves into action to serve as cannon fodder for the core Anon group :).
masklinn 16y ago
> Not much substance in the article That's because it's a followup to half a dozen Ars articles on the spat (see the "The HBGary Saga" insert halfway down the page), 3 of which were 3 pages long and one reached 5 pages ("Black ops: how HBGary wrote backdoors for the government").

Luyt 16y ago

..."they struck gold with an SQL injection attack on HBGary Federal's content management system. [...] They quickly grabbed and decrypted user passwords from the website" A security firm cracked by scriptkiddie tricks? Storing passwords in the database, instead of hashes? Hmmm...

fleitz 16y ago
From the information available it appears the passwords were hashed but not salted.
- tomjen3 16y ago
  If that is true, then they must have used some really, really simple passwords for them to be cracked in such a short time.
  - Garbage 16y ago
    Hint: MD5 and Rainbow tables
  - fleitz 16y ago
    From the available info there were indeed simple passwords and password reuse between systems of different security levels. openssl speed md5 The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes md5 23895.04k 85345.30k 231322.03k 412608.40k 546306.56k If you look at the openssl numbers from my workstation, you'll find I can generate hashes for 1.5 million 16 byte passwords per second. The nice part about rainbow tables is that they are easy to compute in a distributed nature. Take a couple hundred EC2 boxes and you can generate HUGE tables, if you're smart with how you use S3 you can write the tables directly to S3. Cracking unsalted passwords is a very simple time/memory trade off. Given the issues with MD5 with a good math background you might even be able to reverse the password. (eg. create a known password that computes to the same hash) If you got creative with some FPGAs or GPUs you could do far better.

fleitz 16y ago

From the article: "Instead, he believes that Anonymous has "decided to continue their antics. They're in it for the laughs… this is a real funny game for them." Not content with the damage they have inflicted, they "harass a company that's trying to get back to work." Each time a new story about the company appears in the press, Butterworth said that these attacks spike again." If the press is bad for HBGary why do they participate in it? A no comment would have been sufficient. I think HB Gary is participating in the press to incite attacks so they can present themselves as victims, collect evidence, have someone charged, and declare victory. Seriously, a sheet of paper written in sharpie. They're expecting me to believe that the RSA holds a security conference with out badges, with out video monitoring and that some anon in a Guy Fawkes mask walks up to the table and places a threatening did it for the LULZ paper on their booth with no one noticing. Maybe, V for Vendetta is a real movie and such a person really exists who can easily pass through intelligence services and evade video monitoring. If I was HB Gary I'd have extensive surveillance on the booth to catch just such a thing. I'll use the Aaron Barr method of finding anons and assume the anon who placed the paper is employed by HB Gary. This from a company whose services are retained for their ability to plant false documents. The sign should read 'We got laughed out of the security conference for using weak passwords, storing them weakly, and reusing passwords in addition to being vulnerable to basic SQL injection.' In my opinion, officers of HBGary Federal were engaged in stalking people online and selling private information about individuals for commercial purposes, as well as engaged in defaming these individuals with false information to the FBI. Given the demographic of anonymous it's quite likely that some of these individuals were children. I'm not sure if this is illegal in the US, but if they collected and prepared to sell personal information without consent about Canadian citizens they'd likely be in violation of Federal Law. (PIPEDA) Also, regarding the millions of dollars in damages, these claims would be impossible to verify with a private company. Public companies on the other hand are required to file damages to the company both tangible and intangible. In a lot of hacking cases you'll see millions of dollars claimed, but if you look at the 10-Qs (SEC Required docs) you'll see no such filing. If you want a case to look at in particular for this, look at what happened to Kevin Mitnick. Why is it ok for HBGary to take money to compromise computers, but when Anonymous engaged in expression of speech they are targetted by federal investigators? This is a company that used intelligence assets against pro-union websites. My personal feelings regarding unions aside, this is attempting to violate the rights of individuals to peaceably assemble. Even if it isn't illegal per se, it's highly unethical. If HB Gary only engaged in ethical business practices there would be little damage from the disclosure of the emails. The damage results from the conspiracy to commit activities that are likely criminal. A better question to ask is given the emails why Federal charges have not been laid against HBGary? http://en.wikipedia.org/wiki/National_Labor_Relations_Act http://en.wikipedia.org/wiki/National_Labor_Relations_Act

grudolf 16y ago

On the first photo, was that "Defeating malware" or "Delivering malware"?

quacker 16y ago

The characterization of Anonymous as some single or unique entity is misleading. The sign at the booth and the fax HBGary received were (likely) not perpetrated by the hackers who did the damage. Anyone in the right mood might have gone through with it, fueled by the success of the original attack. And the point made at the end of the article that Barr's list of supposed identities contained many innocent people was very true.

iuguy 16y ago
I would expect hijinks from the guys at Mandiant or any other exhibitor constituting even tangential competition (or anyone from Palantir for that matter) could include something like that sign. There's something clearly going on that we're not being told - but then again, bear in mind that they're a private company so it's not like there's an obligation to disclose.

barrkel 16y ago

From what I've read elsewhere, in terms of online crimes, the FBI is treating Anonymous second only to child porn (http://www.dailycampus.com/mobile/news/fbi-raids-house-on-n-eagleville-1.1961646 http://www.dailycampus.com/mobile/news/fbi-raids-house-on-n-...). Probably a function of the power and money behind the people they've attacked (the Visa/Mastercard DDoSes in particular).

jbooth 16y ago
That, and the fact that their existence is a direct challenge to the FBI's collective ego.

VladRussian 16y ago

the more i read about this HBGary the more i feel that justice is being served. These fat and lazy morons thought that because they've been doing dirty things for government they are above the law and basic ethical rules ... Of course, they are above the law that enforced by their government friends, yet there is the Karma law and "we the People".

daeken 16y ago
"These fat and lazy morons..." Can we avoid juvenile attacks like these, please? C'mon, this is HN, not Kindergarten.

barrkel 16y ago

"What happened to Barr? Anonymous loudly and angrily demanded that Penny Leavy fire him, since his list of Anonymous names could allegedly have gotten "innocent people" into serious trouble. Leavy made clear that HBGary Federal was a separate company from HBGary, one in which she owned only a 15 percent stake, and that she couldn't simply "fire" the CEO." I found the comments on this article interesting: http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-022211 http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losin... "They claimed that the company was under separate management, and that HBGary, Inc. only had a 15% stake in the company. However, the Operating Agreement for HBGary Federal, LLC, reveals that Greg Hoglund and Penny Leavy were two of the original six Founding Directors of HBGary Federal. Futher, Penny Leavy herself signed the incorporation application with the California Secretary of State. This Operating Agreement confims the 15% stake held by HBGary, Inc. in HBGary Federal, but it also reveals that Penny Leavy herself holds a 48% share in the company. Her 48% share, plus that of HBGary, Inc. (15%) puts their combined ownership stake at 63%. In terms of dollars invested, their investment in HBGary Federal amounts to some 87.5% of the total monies invested. "This operating agreement can be downloaded from: http://cryptome.org/0003/hbg/HBG-Fed-OA.pdf http://cryptome.org/0003/hbg/HBG-Fed-OA.pdf " Exhibit B in the Cryptome PDF (page 31) does indeed show Penelope Christine Leavy with 48%, in addition to HB Gary Inc's 15%.

forgotAgain 16y ago

The biggest worry here is that HBGary is not being held accountable for their criminal activities. They have been using tools and psy-ops practices developed for the military against U.S. political targets. That is against the law.

forsaken 16y ago

The power of anonymous is that you can become part of anonymous at any point.

jeffthebear 16y ago

The Cobert Report summary: http://ca.gawker.com/5769950/ http://ca.gawker.com/5769950/