8 ms·
LulzSec Exposed
- getsat 15y agohttp://pastebin.com/yut4P6qN http://pastebin.com/yut4P6qN Guess this was a joke/defamation attempt after all.
- shii 15y agoYep, the dox linked here are pretty old. Topiary, Kayla and a bunch of others listed are members of Anon as well, giving the theory of Lulzsec and Anon being related more credibility.
- invalidOrTaken 15y agoAnd looks like it backfired: "Someone just sent over $7200 worth of BitCoins. Whoever you are... thank you... Balance: 7853.35 USD #Speechless" http://twitter.com/#!/LulzSec http://twitter.com/#!/LulzSec
- shareme 15y agowhoops I guess you really are not anonymous on internet after all
- thyrsus 15y agoIndeed; the trial, if any (Private Manning?), will be interesting for the evidence collection techniques.
- nakkiel 15y agoManning is a totally different story that doesn't even fall the same branch of law. Plus state security in the US is somewhat touchy I hear. They're kids, they're gonna be all-right.
- mestudent 15y agoIt appears some of them aren't kids, and from what we have seen computer crime is taken seriously when it is done against the government or popular things (Sarah Palin's email password reset and leak got the guy 1 year).
- shareme 15y agoClass A misdemeanor and in most states it actually punishment wise an actual felony..
- deleted 15y ago[deleted]
- jvandenbroeck 15y agoIdd, I think if they want to find you - there's a fat chance they will.
- ulvund 15y agohttp://idioms.thefreedictionary.com/fat+chance http://idioms.thefreedictionary.com/fat+chance
- jvandenbroeck 15y agoHaha thanks, I've been using that word in the wrong context for ages:p
- sandal 15y agoThe phrase you're looking for is "good chance"
- weavejester 15y agoIt looks like they were just connecting to a private IRC server directly from their own machines. It is possible to remain reasonably anonymous online, but only if you take certain precautions.
- rbanffy 15y agoBut only as much as the other side doesn't take some even more extraordinary measure to locate you.
- r00fus 15y agoI mean, any self respecting hacker should have seen Sneakers. Best computer security movie of all time.
- scythe 15y agoOnly two things are infinite: the universe, and script kiddies, and I'm not sure about the former. There will always be another garishly-named group willing to sql-inject and xss the low-hanging fruit.
- omouse 15y agoSony isn't low-hanging fruit.
- weavejester 15y agoGiven that a lot of their sites have been broken into with relatively unsophisticated means, such as SQL injection, I think that many Sony sites are certainly in the "low-hanging fruit" category.
- Apocryphon 15y agoMaybe in terms of vulnerability, but certainly not in terms of importance.
- chromic 15y agoLow-hanging fruit simply means "reward" for little effort. The low-hanging fruit may very well be the biggest, sweetest of the bunch.
- scythe 15y agoI wouldn't be so sure. They are spread all over the world and have a rather disjoint corporate structure (as previously noted, Sony Pictures is distinct from the Sony running PSN), so while some branches may be quite secure, others are very possibly not. I didn't hear the technical details of the latest Sony exploit, but somehow I doubt they were that impressive.
- deleted 15y ago[deleted]
- 15y ago
- deleted 15y ago[deleted]
- jvandenbroeck 15y agohaha I think they pissed of the wrong people hacking FBI affiliates:p Check this email, it's the USA looking to hack Libya's oil infrastructure: http://pastebin.com/Jf406RVs http://pastebin.com/Jf406RVs I didn't know war got that advanced:)
- stef25 15y agoOne of these companies' names is Treadstone71, straight from the Bourne trilogy.
- shubble 15y agoIn some public NATO reports, they said that during the Kosovo thing, NATO hackers took out specific Serbian radar installations to cover for the strike planes. I guess the Serbians didn't get the memo about putting critical infrastructure on a routable network...
- deleted 15y ago[deleted]
- leon_ 15y agowhat am I reading? anyone care to translate that?
- younata 15y agoSure! starts off with <Topiary> telling everyone to get off this network, ED IRC (it could be a server in their own network, but if that were the case their network would already be breached) <pwnsauce> calls for a new operation (similar to how anon has various operations). Then <Topiary> admits to hiring a botnet to help them. <joepie91> chimes in, talking about an irc server exploit is basically killing his computer. <storm> asks for an exploit, <lol> says he has it, but is scared to get it out and give it to him (meaning that, for all his "security knowledge" he still managed to get viruses on his stuff. About half an hour later, <Topiary> insults a few people they want to crack, and mentions an apache 0 day exploit. The rest is them asserting their masculinity, and a mention of the gawker root. oh, and then a message saying one of the guys is in FBI custody, but I assume that's not part of what you wanted translated.
- burke 15y agoED almost certainly refers to http://encyclopediadramatica.ch/Get_On_IRC_Fgt http://encyclopediadramatica.ch/Get_On_IRC_Fgt (usually semi-NSFW)
- 18pfsmt 15y agoThanks. This train wreck caught my eye this weekend and I can't, for the life of me, identify with these people. I am ambivalent about lulzsec's actions, but I understand both sides' issues. Not sure what to make of it, and I am trying to ignore it (simply failing).
- TheloniusPhunk 15y agoNot surprised. Hacking Sony is one thing. Hack the FBI and you end up in a dark room somewhere. I almost feel bad for these kids, if they are indeed kids.
- rbanffy 15y agoThey certainly act like kids. And, independent of that, I feel sorry for them. And I am nowhere near as sorry as they will be.
- redthrowaway 15y agoThis wasn't the FBI, it was some other hacker who was pissed at him. The screenshots [1] show that quite clearly. That guy likely just turned xyz over to the feds after doxing him (and rooting him, and taking over most of his online accounts) [1]
- peterwwillis 15y agoWhat's really funny is that going after an official FBI site would have gotten less of a backlash from real hackers. Attacking Infragard is like slapping a bunch of hackers (white-hat and black) in the face, so they're going to be a lot more motivated to expose the perpetrators. It's all pretty silly.
- olalonde 15y agohttp://89.248.164.63/dox/xyz/xyz01.jpg http://89.248.164.63/dox/xyz/xyz01.jpg looks like a kid to me...
- bxr 15y agoSo they got exposed because they were acting like a bunch of children and taking no precautions? Man, if people who don't know what they're doing are this successful, imagine what it means about people who are. And how any laws we make about computer security are just security theater.
- ilikepi 15y agoNo need to imagine; just look at Stuxnet.
- willidiots 15y agoWhen you talk about IT security with people with real secrets (governments), they talk about LulzSec-types being the "lowest risk" category of attackers. The mid-risk category are the real professionals; they leave no trace, you never hear about them, you never know they were on your system, they just take your data and sell it. The highest-risk category is true information warfare, targeted attacks by other governments and large entities. As the previous replier said, just look at Stuxnet. You don't have to be a government for this to be a real threat. Imagine if Nintendo had compromised Sony's servers, and somehow loaded corrupt firmware onto the Playstation update system... These threats are real and constant, and anyone with sensitive data needs to be aware of them. Simply firing up iptables and disabling root SSH isn't sufficient - you need to be aware of the intricacies of your system on a day-to-day basis.
- shii 15y agoExactly, I am almost certain this was floating on carders' forums weeks if not months before.
- JonnieCache 15y agoTo be honest, if your opponent has a couple of million dollars or more to spend on hacking you, and you aren't willing to expend several multiples of that on defence, you should probably give up on the convenience of having your secret data on the internet and just have it encrypted on HDDs surrounded by handpicked armed guards who owe you a blood debt. Computers and especially networks are just fundamentally insecure for the purposes of high-value information. This is the same reason why internet voting will never be a good idea.
- philthy 15y agoNot surprising since they are just a bunch of weekend warriors and kids. Any real smooth operator wouldn't be working out of his house, and especially not on a personal browsing machine. From the opposite perspective of that, the government hasn't seen diddly when it comes to digital terrorism. Just wait until the FBI can't track down the culprits from their broadband bill and drive over to their parents house and make the arrest...
- Bud 15y agoUh, when will that be? From what I observe, it just keeps getting progressively easier for the FBI to do that. Not harder.
- JonnieCache 15y agoI would imagine the professionals are using other peoples cracked wifi networks, then routing through tor or a similar onion routing system, eventually hitting a VPN endpoint on some anonymous-hosting account in russia, etc etc. The truly paranoid might like to rent a botnet and build their own tor network on top of it or something like that. In short: the fundamental nature of TCP/IP is such that if you are sufficiently motivated, and dont mind horrible latency, even the FBI/tptacek cant identify you.
- tptacek 15y agoI'm thrilled to report that it isn't my business at all to track down people on the Internet, and so I am not a good standard for what is and isn't feasible vis a vis IP traceability. We break apps and build products and that is just about it. (We've also never done business, to my knowledge, with the government.)
- philthy 15y agoI think you need to read up on cyber crime and cyber criminal groups. Your thesis is correct but only accounts for those who are not independent from the internet. A professional attacker wouldn't ever use the machine and network they were accessing the Internet from for anything else other then their attacks. No compromising search terms, emails, chats, page visits, internet billing, etc. I'm talking a machine totally devoid of personal information or anything that could potentially reveal the identity/location/details of the attacker. Now imagine this was scalable and you constantly were changing your point of access and machine. Actual cyber criminals (the ones cleaning out credit card companies, banks, high level blackmail, stolen secrets, etc, the shit you really only ever hear rumors about because it's too dangerous to leave executive circles at companies.) especially in Eastern Europe have access to an almost unlimited supply of cheap machines, false identities, "tunneled" networks and connections inside major established institutions and companies, and strict criminal group rules, make it almost impossible to identify anyone. Don't be naive this shit goes on everyday.
- saulrh 15y agoThey seem to be still tweeting new cracks. Wonder how long it'll take them to realize that they're being arrested by the FBI. (edit: seriously, though, something seems just a bit off here.)
- lwat 15y agoThe kid that got busted by the FBI was not actually a lulzsec member, he was just hanging around the lulzsec public IRC channels. Lulzsec response here: http://pastebin.com/yut4P6qN http://pastebin.com/yut4P6qN
- dmix 15y agoThe kid who apparently got caught was using Windows. http://89.248.164.63/dox/xyz/3.png http://89.248.164.63/dox/xyz/3.png
- christoph 15y agoBrowsing around that site, there seems to be a lot of information... much of which i'm guessing probably shouldn't be on a public website?
- JonnieCache 15y agoThat site is a cache of items which shouldnt really be public. Thats what the term 'dox' in the url means: (sensitive) documents.
- jimmyjim 15y agoThere's a Putty icon in the task bar.
- drivebyacct2 15y agoAnd at least 2 VMs. I like the picture of the kid doing coke.
- newobj 15y agoI'm glad they were doing it for the lulz. Some day someone's going to be doing it, not for the lulz, and the price we'll have to pay for this kind of massive developer/it-sec incompetence will be extremely high. Hopefully this has served as a wake-up call to people who weren't already aware how low the fruit has been hanging.
- chrislomax 15y agoYou say you are glad they were doing it for fun and wait for someone to do it not for fun? How do you know it's not already been done? A true hacker wouldn't expose their actions and would continue with the exploit. I think these kids have exposed the true lack of security around the world in general and it has raised some serious attention for other people to take a look at their own defence, which is good in some respects. What they have also successfully done is lowered peoples trust in massive corporations which in turn is going to hurt the economy globally, which is not good in any respect. I think they should have hacked it then made the companies aware, not the whole world. It's hard enough getting someone to trust and pay for services from a company when they think they are safe, they really won't when there is no trust there at all.
- nakkiel 15y agoI have only one thing to say: if companies were taking the necessary steps to protect their customers and treat them as if they actually mattered there wouldn't be any problem. And I'll remind everybody that we are dealing with SQL injections and plain-text passwords. And it's 2011.
- atourgates 15y agoAm I misinterpreting your comment? You said, the hackers "lowered people's trust in massive corporations [...] which is not good in any respect." It seems pretty clear to me that Sony is most decidedly not deserving of consumer's trust - and without these public disclosures, we would have never known that. Certainly - as I learned in the Gawker security breach - it sucks to have your login details broadcasted to the rest of the internets. But, after a few hours restting passwords across the internet, I was good to go. I expect the affected consumers in this case will have a similar experience. And, that experience is a far better one than having your data stolen by a more malicious group of hackers, who use it for far more damaging means, without your knowledge. So, I don't believe that this group of hackers are any kind of heroic. But even if their motivation is suspect, I do believe they're performing a type of public service. Teaching us all that it's the height of ludicrous to hand over your sensitive data to Sony, and expect them to keep it reasonably secure from basic script-kiddie tactics.
- jackie_singh 15y agoI was on ED IRC #lulzsec when they accused me of being a spy for the military. I laughed.
- aw3c2 15y agoAre they? Or is this just some random guy who wants to get other random guy(s) in deep trouble? edit: Indeed, following the thread reveals http://seclists.org/fulldisclosure/2011/Jun/88 http://seclists.org/fulldisclosure/2011/Jun/88 -> http://pastebin.com/mmvBT7n5 http://pastebin.com/mmvBT7n5 The root entry dated May 13.
- msc 15y agohttp://twitter.com/#!/LulzSec/status/77782030020128768 http://twitter.com/#!/LulzSec/status/77782030020128768
- grimen 15y agoWow, I would def not consider myself a security expert but I seriosly have higher standards than this when it comes to security. Most obvious fails on this dude: 1) Windows, 2) Gmail (if i would be a hacker i would not use this for obvious reasons), 3) specifying any personal credentials in my "hacker" acount, 4) same username (...i would not use same user-id). I mean, c'mon...I had higher expectations on this guys really (considering I'm not into those kind of networks - call be hacker noob). Let's hope the other guys was more paranoid than this. Btw, what will be the jail-sentence in US for this you think? Let's hope he's a minor - looks like a teenager.
- gbrindisi 15y agoMaybe not. As reported here some logs are old: http://seclists.org/fulldisclosure/2011/Jun/88 http://seclists.org/fulldisclosure/2011/Jun/88 http://pastebin.com/mmvBT7n5 (May 13th, 2011) boards.808chan.org/fail/res/263.html (2010)
- bromagosa 15y agoAre you serious? Hackers using windows? :'(
- jff 15y agoAlmost: script kiddies using Windows. It helps the script distributors, by making it easier to target the script kiddies with embedded botnet software :)
- Apocryphon 15y agoSeeing as how Anon has moved up to hacktivism against third world dictatorships and other government agencies, I wonder if LulzSec is a splinter group.
- derrida 15y agoLast I checked they were alive and well. As for them supposedly being Amateurs, no... no they are not. The attacks they are pulling they could get away with if they kept the secret. But something is motivating them.