Anonops #7: Meer is beter

quote:

#AntiSec Hackers Spill News of the World Chief Rebekah Brooks’ Email Login to Entire Internet (Update)

Sam Biddle — The fruits of today's Sun UK hack are starting to dangle down: LulzSec (out of retirement?) and Anon are tweeting logins of some serious British media brass. Foremost? Rebekah Brooks, the epicenter of England's voicemail hacking scandal. Update: phone numbers!

The tweet divulged the email and password info for one Rebekah Wade—Brooks' maiden name—along with many others from Murdoch's tabloid upper crust:

Harvey Shaw—Publishing Operations Team Manager, News International—Phone number

Pete Picton—Sun Online Editor—Phone number

Lee Wells—Editorial Support Manager at News International—Email and Password

Bill Akass—Managing Editor, News of the World—Email and password

Chris Hampartsoumian—Former Online Editor at timeonline.co.uk—Phone number

Danny Rogers—Sun Online Editorial Manager—Email and password

This trickle is probably only the start. LulzSec appears to be hard at work squeezing more logins out of The Sun's servers:

We are battling with The Sun admins right now - I think they are losing. The boat has landed... >:]

In other words, expect more—though the only login fish bigger than Brooks would be Murdoch's.

Update: AntiSec operators have tweeted phone numbers for The Sun's online editor, Pete Picton, along with two other (lesser) Sun editorial figures.

quote:

How LulzSec hacked the Sun's website


Weakness in disregarded server was used to gain access to News International systems and then redirect traffic to fake web page, and then to LulzSec's Twitter feed

The LulzSec attack on News International's systems to redirect readers from the Sun to a fake story, and to try to get at its internal email store, appears to have been two-pronged.

Some of the more skilled hackers, including some from the hacker collective Anonymous, had been probing it in detail for about two weeks before the hack. One was to break into its email archive; the other was to hack and "deface" the site itself, by putting up a fake story – the same method LulzSec originally came to attention by doing when it hacked the PBS site to claim that Tupac Shakur was not dead.

However as far back as 2009 a weakness was found in the "Contact us" form of the Sun's site that meant that it could be used to attack the database holding emails for the system.

Some former News International employees' names and mobile phone numbers have been given out on Twitter by people affiliated to the hacker collective Anonymous. However, they are not current: some include people who left the company in 2007. But that also implies that they may have access to email archives dating back to when some phone hacking occurred.

Monday night's hack of the Sun occurred because one of the hackers found a weakness in a "retired" server for the News International "microsites" – used for small or unimportant stories – running Sun's Solaris operating system.

The most likely candidate for that hack – which would use the weakness discovered in 2009 – is the "mailback" page at http://www.new-times.co.uk/cgi-bin/newtimesmailback, which on Tuesday morning had been deactivated, along with the whole of the new-times site.

The server hosted the outdated "new-times.co.uk" site put up when the Times was building its paywall.

The hacker used that and then ran a "local file inclusion" program to gain access to the server – meaning they had extensive control over it.

That then gave them access across large parts of the News International network, possibly including the archived emails, and to the Sun's "content management system" (CMS) – which formats news onto pages. That will have included the code for the "breaking news" element of the Sun's main webpage; changing the entire content on the page would be too obvious.

By including a line of Javascript in the "breaking news" element, the hackers were able to ensure that anyone visiting the Sun's home page would, as the ticker was automatically refreshed, they would be redirected to anywhere that the hackers chose.

Initially they made it redirect to a fake page they had created at new-times.co.uk/sun which attempted to look and read like a Sun story claiming that Rupert Murdoch had been found dead. That page used a template of another story that first appeared on 14 July, suggesting that the hackers either grabbed an archived story or have had access since then.

After the team at News International tried to regain control, the hackers then redirected the main News International page to the Twitter page for LulzSec.

But the problems for the News International team aren't over. A number of email addresses and passwords were being tweeted last night on various feeds – implying that the hackers may have gained access to the email archive and be preparing to release it. If that happens, the effects could be titanic.

quote:

Invallen FBI bij hackersgroep Anonymous

De FBI heeft vandaag op verschillende plaatsen in New York huiszoekingen gedaan in het kader van een onderzoek naar de hackersgroep Anonymous. Op een adres in de wijk Brooklyn en drie op Long Island werden computers in beslag genomen, zegt een FBI-woordvoerder.

Anonymous is een los georganiseerde groep van hackers die sypathiseren met de klokkenluiderswebsite Wikileaks. De groep heeft de verantwoordelijkheid opgeëist voor een groot aantal aanvallen op websites van bedrijven en overheidsinstellingen in de hele wereld.

Doelwit waren onder meer de websites van creditcardbedrijven Visa en Mastercard, omdat die weigerden donaties voor Wikileaks en zijn oprichter Julian Assange te verwerken. Ook werden de sites van de Scientology-kerk en van Kiss-bassist Gene Simmons aangevallen.

quote:

Federal Government Indicts Former Demand Progress Executive Director For Downloading Too Many Journal Articles

“This makes no sense,” said Demand Progress Executive Director David Segal; “it’s like trying to put someone in jail for allegedly checking too many books out of the library.”

“It’s even more strange because JSTOR has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added.

quote:

Sky News uncovers mysterious hacker Louise Boat

SKY NEWS has uncovered a mysterious hacker called Louise Boat, who is responsible for targeting Rupert Murdoch's rag, The Sun.

The revelation came on a news report late last night by news anchor Anna Botting, who exposed the leader of hacktivist group Anonymous as none other than Louise Boat, a shady figure that few know anything about.

The guests on the show, who we presume were security 'experts', were baffled by this hacker femme fatale, asking several times, "Who is Louise Boat?"

The question, which is sure to become part of modern day philosophical treatises, is made all the more captavating by the fact that Boat also spells her first name Luiz, probably as some kind of attempt to fit in with internet lingo.

In case anyone might think otherwise, the Twitter page that The Sun redirects to after its recent hack, specifies that it represents the Louise Boat. Presumably there are a number of people out there pretending to be this elusive hacker woman.

Even Botting, who is usually quite lucid at her late night broadcasts, admitted, "I don't know who Louise Boat is."

One of the guests on the show attempted to offer some clarity on the situation by saying, "It's some hacking ... thing." Such astute observations are what can be expected on such an illustrious news programme.

We think Botting, who has worked for Sky News since 1995, might know a bit more about Louise Boat than she's letting on, considering she was a rower at university and participaticed in the BBC's The Other Boat Race. Presumably, however, she never sailed in the Lulz Boat.

Sky News is partly owned by Murdoch's News Corporation, which was forced to withdraw its bid for parent company British Sky Broadcasting (Bskyb) last week over the hacking scandal. Part-owned by Murdoch, you say? Well, that explains it.

Sky News Reporting @LulzSec www.thesun.co.uk Hack, Call them ' Annoymous & call them louise ' fail

Read more: http://www.theinquirer.ne(...)e-boat#ixzz1Sas9QBWv
The Inquirer - Computer hardware news and downloads. Visit the download store today.

quote:

Anonymous shut down! Ringleaders brought to justice!

July 20, 2011 --

As many readers would no doubt already be aware, the FBI has just arrested 16 "members" of Anonymous in relation to DDoS attacks and intrusions.

The US Department of Justice swiftly issued a press release with the catchy, ALL CAPS title of "SIXTEEN INDIVIDUALS ARRESTED IN THE UNITED STATES FOR ALLEGED ROLES IN CYBER ATTACKS".

So this is a massive blow to "Anonymous" and its sophisticated campaign of mayhem, right?

Wrong.

One of the complaints details charges to be laid against Scott Matthew Arciszewski, 22. He's alleged to have somehow created an account on Infragard Tampa's Website and successfully uploaded a couple of files.

By the looks of things he made no attempt to hide his actions -- using his own IP address to conduct the "attack" -- then Tweeted about it and directed his followers toward his Website.

How stealthy.

What a criminal mastermind. I'll sure sleep better tonight knowing this criminal genius has been taken off the streets.

Another complaint alleges former AT&T contractor Lance Moore uploaded a bunch of commercially sensitive material to Fileape. That information was subsequently "redistributed" by LulzSec.

This guy isn't even alleged to be sailing aboard the Lulz Boat, but hey, at least the DoJ got to use the word "LulzSec" in an indictment. What a win!

The remaining 14 arrests deal with a DDoS attack against PayPal, apparently in retribution for that company's decision to suspend payment processing for Wikileaks. They were using LOIC. How 1337.

So what does this all amount to? A leaker with internal access (AT&T), a young guy who was able to pwn Infragard in about five minutes (great security, guys) and a bunch of LOIC users.

And yet the coverage I'm seeing still persists with this ridiculous idea that the arrests will be some sort of strike against Anonymous, the "group".

So here, let's try to get something straight, once and for all: Anonymous is not a group. It's not a hydra. It's not a "loose collective". Anonymous is just a designation. Why is that so hard to understand?

Let's try an analogy.

17th century pirates liked to steal booty. They sailed the high seas and pillaged. They had a common flag. But they WERE NOT A GROUP.

Sure, there were groups of pirates that sailed on ships together. There was a common outlook -- that plundering booty was a worthwhile activity, ho ho and a bottle of rum, all of that. But they were not a group.

There were pirate hangouts like pirate taverns, so there was congregation, but no leadership. Pirates were not a collective.

So let's clear it all up. The anons are the pirates, IRC channels and imageboards like 4chan are their pirate taverns, and the various Anonymous outfits like @AnonymousIRC and @AnonOPS are pirate ships with multiple pirates aboard. They're groups of pirates! Simple! See?

So when the Spanish, Turkish, British or whichever police force claims to have arrested "key members" of Anonymous I wonder if they're deliberately misleading the public and their masters, or if they genuinely just don't get it.

This current batch of arrests will "bring to justice" a bunch of people who made no attempt to conceal their actions because they're either technically useless or just didn't care.

They're "low hanging anons".

But that won't stop the mainstream media from portraying this as the establishment striking back at online troublemakers.

Sigh.

quote:

http://www.reddit.com/r/A(...)earch_warrant_today/

At around 11:00 this morning, I had 4 cars and a van filled with FBI agents pull up to my house, and then invade. I have learned enough from Reddit to ask for a copy of the search warrant, which took them at least half an hour to provide, and it was a "copy" (bad signature, no seals, etc.). They ushered me and my four kids to the couch, and then proceeded to search my house, with guns drawn, and collect all our electonic devices and equipment.

When I finally got to sit down and talk to them, they said that packets were sent from our isp address during the ddos attack on paypal. They said my son was responsible (he was 13 at the time). They sat down with both of us and asked about our involvement with AnonOps. I think they were surprised (really?) that I knew about Anonymous. [http://gizmodo.com/5709630/what-is-loic]

Why would they spend all this time, energy, and funds to get a kid who was trying to be cool and follow Anon without knowing any of the consequences? What do I do to protect him? What can I expect? They seized two desk top computers.

Thanks for any feedback or guidance or information.

*EDIT Can't "lawyer up", don't have the funds. I guess my biggest question is this: Why would they spend all the time and resources on a child? If they want to get Anon, how about spending the funds they spent today on researching who to really go after? Seems like a waste of my tax payer dollars.

Edit 2 There are a lot of people calling bullshit. It is "United States District Court Northern District of Illinois, Eastern Division. Case number: . I am trying to take pictures with my phone to upload, but I am not certain that it will be clear enough, and I have a new computer (bought today, and it is not hooked up to the printer/scanner).

Edit 3 Proof - Sorry for the bad quality, taken with my Flip camera.

Edit 4 Removed some information on the advice of other redditors.

quote:

LulzSec claims to have News International emails

Member of hacking group LulzSec says it will make public 4GB of emails it claims were taken from attack on servers at the Sun

One of the members of the LulzSec hacking group has claimed on Twitter that the group has got 4GB of emails taken from the Sun and the "royal family" which may be released as soon as lunchtime on Thursday.

The claim follows a hacking attack against News International on Tuesday night during which members of LulzSec apparently broke into computer systems there and redirected readers of the Sun's website to a faked page claiming News Corp chief executive Rupert Murdoch had been found dead.

Significantly, the group also seems to have broken into the email database at News International.

Some accounts belonging to Anonymous also began tweeting email addresses and passwords for staff at News International, including what seemed to be an email account and password for Rebekah Brooks under her previous married name of Wade while at the Sun.

The password appeared to be valid based on the contents of the tweet, which included the encrypted form of the password.

News International reacted by closing down all external access to its webmail systems and forcing users to reset their passwords.

The company declined to comment at the time on whether the hackers might have had external access to email accounts, but the fact that it shut down the access suggests that it feared they might.

Equally, the hackers almost certainly would not have begun tweeting details of their find without having first exploited it.

Contacts within Anonymous have told Guardian journalists that News International's email systems were being probed last week and that downloads were being made then.

twitter:

AnonymousIRC twitterde op donderdag 21-07-2011 om 14:04:15 Here is the next NATO Restricted PDF: http://t.co/zSR7bVo | Outsourcing CIS in Kosovo (2008) | Enjyoing the war yet, NATO? #AntiSec reageer retweet

quote:

NATO HACKED: AnonymousIRC claim to have infiltrated NATO servers

The AnonymousIRC hacking organisation have claimed this afternoon that they have hacked into NATO servers.

The group tweeted a message earlier claiming they are sitting on 1gb of NATO data.

"Yes, #NATO was breached. And we have lots of restricted material. With some simple injection. In the next days, wait for interesting data "

They later said:

"We are sitting on about one Gigabyte of data from NATO now, most of which we cannot publish as it would be irresponsible. But Oh NATO...."

They later released the document, obtained by Blottr. However for security reasons, we will not be sharing this document, but can provide a screenshot that we AnonymousIRC did in fact leak the document.

quote:

Op donderdag 21 juli 2011 16:45 schreef YazooW het volgende:
Anonymous (degene die nu hacken) is gewoon een toneelstuk van grote overheden waardoor het voor hun makkelijker wordt wetten aan te nemen die de vrijheid van de gewone mens op het internet kan gaan beperken.

Dit is niet mijn mening, al denk ik er wel steeds vaker zo over. Wat denken jullie hiervan?

quote:

Op donderdag 21 juli 2011 18:27 schreef MouzurX het volgende:
Maare papierversnipperaar ik dacht dat lulsec er mee was opgehouden en op was gegaan in anti-sec en anonymous ofzo?

quote:

http://www.reuters.com/article/2011/07/21/us-cybersecurity-response-idUSTRE76K66G20110721
(Reuters) - After a brief hiatus and an FBI takedown of several alleged "hacktivists," two groups that have claimed responsibility for a recent wave of cyber vandalism say they are back.