Anonymous hacked the website and computer systems of one of the internet security firms that was aiding the FBI in tracking them down.
While most of America was comatose from eating too many wings and bowls of chili, Anonymous went to work bringing down one of the companies trying to nail its nebulous membership. Last week, we reported how 40 Anonymous members had their premises searched by the FBI while 5 suspected members were arrested in the UK by Scotland Yard. HBGary Federal aided those investigations and Anonymous retaliated by bringing down the HBGary website yesterday and replacing it with an image of an open letter outlining their motives. Some 66,000 company emails were also stolen and posted en masse on The Pirate Bay, in order to prove that any information collected by HBGary was worthless and unable to be sold to the FBI. In addition, HBGary CEO Aaron Barr’s Twitter account was compromised and used to post his address, social security number and cell phone number.
“Today we taught everyone a lesson. When we actually try to bite back against those who try to bring us down, we bite back hard. #gameover,” read a Tweet posted from Aaron Barr’s account (which is still under Anonymous control.)
The open letter replacing the HBGary website clearly addressed the group’s intentions in this attack. Anonymous mocked the attempts by this computer “security” company for being so easily corrupted, and pointed out that most of the information collected by HBGary was erroneous anyway. “We’ve seen your internal documents, all of them, and do you know what we did? We laughed. Most of the information you’ve ‘extracted’ is publicly available via our IRC networks,” the statement read. “The personal details of Anonymous ‘members’ you think you’ve acquired are, quite simply, nonsense. So why can’t you sell this information to the FBI like you intended? Because we’re going to give it to them for free.”
How did Anonymous pull it off? Through a combination of hacking knowledge and simple chicanery. The group broke into HBGary’s email server, and then used an email that looked like it came from the company’s cofounder Greg Hoglund to convince a system admin to divulge passwords.
“They broke into one of HBGary’s servers that was used for tech support, and they got emails through compromising an insecure Web server at HBGary Federal,” said Hoglund. “They used that to get the credentials for Aaron, who happened to be an administrator on our email system, which is how they got into everything else.”
Hoglund might have had a grudging respect for Anonymous before, even as he was investigating their membership, but he reacted the same that Gene Simmons did: by making threats that seem more like bluster than bravery. “They didn’t just pick on any company, but we try to protect the US government from hackers. They couldn’t have chosen a worse company to pick on.”
Is that right? How exactly do you plan to fight a group that has no organization, Hoglund?
Source: Naked Security and Krebs on Security
