STE WILLIAMS

NATO Members Warned About Anonymous

NATO leaders have been warned that the Anonymous “hacktivist” collective might have the capability to threaten member states’ security.

A report for the alliance by Lord Jopling, UK general rapporteur and Tory peer, provides a general (mostly factual) overview of the changing nature of the internet.

One key section deals with the use of social media tools to exchange information by people on the ground during the ongoing Arab Spring protests; another deals with the ongoing WikiLeaks affair and its fallout – and also covers the hack by Anonymous in solidarity with the whistle-blowing site.

Anonymous is becoming more and more sophisticated and could potentially hack into sensitive government, military, and corporate files. According to reports in February 2011, Anonymous demonstrated its ability to do just that. After WikiLeaks announced its plan of releasing information about a major bank, the US Chamber of Commerce and Bank of America reportedly hired the data intelligence company HBGary Federal to protect their servers and attack any adversaries of these institutions. In response, Anonymous hacked servers of HBGary Federal’s sister company and hijacked the CEO’s Twitter account.

Today, the ad hoc international group of hackers and activists is said to have thousands of operatives and has no set rules or membership. It remains to be seen how much time Anonymous has for pursuing such paths. The longer these attacks persist, the more likely countermeasures will be developed, implemented, the groups will be infiltrated and perpetrators persecuted.

Lord Jopling’s report is essentially a policy backgrounder and not a call to action. The document leaves it open as to how exactly members of the hacktivist collective might be “persecuted”, but the general thrust seems to be that this ought to be an extension of previous law enforcement crackdowns. NATO’s role if any in all this seems to be in locking down government and military servers rather than spearheading some military cyber-offensive, much less “taking out” Anonymous-affiliated chat channels.

Only a few years ago, cyberwar barely got a mention in NATO conferences, even in the wake of high-profile cyberattacks on Estonia in April 2007. The ongoing WikiLeaks saga along with the arrival of the industrial-control plant sabotaging Stuxnet worm have changed the game, and this is the real significance of Jopling’s report.

Source

HBGary Chief Quits After Anonymous Hack

HBGary Federal chief exec Aaron Barr has resigned in a bid to allow the firm to draw a line under the continuing revelations from the Anonymous hack attack.

Barr was the prime mover in plans to out senior members of Anonymous at the B-Sides security conference last month. But hunter became hunted after the more skilled members of Anonymous hacked into HBGary Federal’s computer network before publishing its email database.

The emails included the revelation that Morgan Stanley, a HBGary client, was hit by the Operation Aurora attacks of late 2009, as well as messages that purported to show HBGary was planning a dirty tricks campaign against WikiLeaks. (more…)

Anonymous Wikileaks supporters mull change in tactics

‘Coldblood’, a member of the group Anonymous, tells Jane Wakefield why he views its attacks on Visa and Mastercard as defence of Wikileaks.

Web attacks carried out in support of Wikileaks are being wound down as activists consider changing tactics.

Attacks against Amazon were called off late on 9 December and re-directed towards net payments firm Paypal.

Analysis suggests the earlier attacks were made more effective by the involvement of hi-tech criminals.

At the same time one wing of the activist group suggested ditching the attacks and doing more to publicise what is in the leaked cables.

Site saving

The attacks have been carried out using a tool, called LOIC, that allows people to bombard a site of their choosing with data or let the target be chosen by those running the Anonymous campaign.

Luis Corrons, technical director of Panda Labs, said during its investigation of Anonymous’ attacks its analysts got talking to some of the activists via Internet Relay Chat (IRC).

One of those activists said he had a botnet of 30,000 machines under his control that he was planning to use on behalf of Wikileaks.

“The guy said he had this botnet which was nothing special and was not specifically designed to do these attacks but could be used to do them,” said Mr Corrons.

A botnet is a network of hijacked home computers that have been compromised by their owners visiting a booby-trapped webpage that installs code to hand over control to a hi-tech criminal.

Mr Corrons said a botnet with 30,000 machines in it was “about average size”. Most of the spam sent around the net is funnelled through machines that are in botnets.

It was becoming clear, he said, that some attacks were aided by the 30,000 machines under the cyber criminals control.

“We know for sure the botnet was used in at least one attack on Paypal,” he said.

Panda itself has come under attack with its blog knocked offline for hours by an attack very similar to those Anonymous has been carrying out. Mr Corrons said that, so far, it did not why it was being attacked or who was attacking it.

Fresh leaks

There are also suggestions that the Anonymous group might be about to drop the web attacks in favour of another tactic.

A message posted on the 4chan image board, out of which Anonymous has grown, suggests dropping LOIC in favour of publicising information in the diplomatic cables that Wikileaks is releasing.

Searching for the less-well publicised cables and spreading the information they contain around the web could be more effective than simply knocking out sites deemed to be enemies of Wikileaks, it said.

The message also suggests using misleading tags on posts and YouTube videos to trick people into reading or viewing the information.

“They don’t fear the LOIC, they fear exposure,” read the message.

It is not yet clear if the call to change tactics has been taken up by the Anonymous group at large.

In related news, Wikileaks looks set to have a rival as former staffers of the whistle-blowing website prepare to launch. Set up by Daniel Domscheit-Berg, Open Leaks is expected to launch in mid_December and will host and post information leaked to it.

Is taking part in these attacks illegal?

The short answer is yes, according to Struan Robertson, legal director at law firm Pinsent Masons.

He told the BBC that in the UK, taking part in the attacks would be a breach of the Computer Misuse Act.

He said that anyone found guilty of taking part could face “up to ten years imprisonment”.

“Even downloading the [software] tools to assist in committing these attacks… are themselves guilty of an offence,” he said.

He said this could carry a sentence of up to two years in the UK.

Different countries will have different laws and penalties.

However, security expert Peter Wood said that in practice it would be very difficult to track down the people involved because the attacks used “anonymising software” to hid their tracks online.

The tool launches what is known as a distributed denial of service (DDoS) attack which tries to knock a website offline by bombarding it with so much data that it cannot respond.

The LOIC tool has been downloaded more than 46,000 times but, said Anonymous activists in a tweet, this did not translate into enough people using it to knock the retail giant off the web.

Instead, the attack was re-directed towards Paypal and its computer systems which, according to a status page, has intermittently suffered “performance issues” ever since.

Early on 10 December Moneybookers was chosen as the next target and its site was occasionally unreachable from about 1100 GMT.

The chances of success could be boosted by a new version of LOIC written in web programming language Javascript that allows anyone with a browser, including on a mobile phone, to launch attacks.

However, defences against the attacks were being drawn up as security firms scrutinise the code behind LOIC to work out how attacks happen. Some suggest that well-written firewall rules would be able to filter out most of the harmful traffic.

Criminal chain

Information is also starting to emerge about the other resources that supporters of Anonymous have been able to bring to bear. Research by security firm Panda suggests that some of the earlier attacks on payment firms were aided by hi-tech criminals.

Who are Anonymous?

‘Anonymous’ is commonly used to describe a leaderless collective of people who come together online, commonly to stage a protest.

The groups vary in size and make-up depending on the cause. Members often identify themselves in web videos by wearing the Guy Fawkes masks popularised by the book and film V for Vendetta.

Its protests often take the form of disrupting websites and services.

Its use of the term Anonymous comes from a series of websites frequented by members, such as the anarchic image board 4Chan.

These allow users to post without having to register or provide a name. As a result, their comments are tagged “Anonymous”.

In the past, groups have staged high-profile protests against plans by the Australian government to filter the internet and the Church of Scientology.

The latter spilled over into the real world with protests by masked members outside churches. An offshoot of Anonymous called Project Chanology focuses purely on this cause.

Many Anonymous protests tackle issues of free speech and preserving the openness of the net.

Join in the Wikileaks DDoS war from your iPhone or iPad

The online “infowar” precipitated by the media circus surrounding Wikileaks and Julian Assange continues, with DDoS attacks occurring against a bewildering variety of websites assessed as having either aided or failed to aid the leak-publisher – or often merely for commenting on the brouhaha.

Meanwhile, interest has focused on the methods used to mount the DDoS attacks. It appears that in general most of the muscle is coming from botnets of the usual sort: ones made up of zombie machines infected with malware using the same methods as ordinary online criminals and spammers (and just as illegal).

However, some of the battling communities – for instance the loosely organised hacktivist collective Anonymous, aligned in support of Assange and Wikileaks – also use collaborative tools where supporters can voluntarily attach their machines to a botnet in order to assist with a DDoS attack. The preferred tools are usually some version of the Low Orbit Ion Cannon (LOIC) software. Machines running LOIC can then be controlled via IRC or some other channel (again the campaigners are aping criminals by using Twitter of late).

Downloading and installing LOIC (the code is freely available at such places as Sourceforge) is simple enough, but evidently off-putting enough that not many people are doing it. The LOIC hivemind net run by Anonymous has generally had only a few hundred machines in it, far too few to mount a serious DDoS, and most of the grunt has been delivered by larger malware-based botnets controlled by individual Anonymous members (just one reportedly containing more than 30 times as many machines as the anonops.net hivemind).

But in the last day or two, a new wrinkle has begun to gain prominence. It is now possible to visit a webpage which will convert your browser into a pocket LOIC instance, delivering DDoS packets from whatever device you are using to browse – not necessarily even a computer.

As Panda Labs analyst Sean-Paul Correll notes:

Only a browser is needed, so you can even launch the attack from your fone, I just tested it with my iPhone … Of course I tested that it was real and worked, but I didn’t send any attack out.

Such a webpage will typically give you the option of adjusting how many requests per second to send to the target website (handy in the case of a phone or perhaps a fondle-slablet device with a limited data package and/or bandwidth) and allow you to attach an insulting message of your own devising.

This would appear to be rather less sophisticated than a proper IRC or Twitter-controlled LOIC install, but has the merit of being simpler. Whether this tremendously simple way of joining in botnets will finally mobilise large numbers of pro- or anti-Wikileaks vigilantes remains to be seen. For now, it appears that the effective DDoS attacks – and other more sophisticated meddling going on – are emanating from relatively small numbers of people.

It would seem that in general most people are aware how relatively unimportant and easily replaceable a part Julian Assange and Wikileaks have played in the release of the classified US files, which continue to mildly interest the outside world. ®

Bootnote
1) Reader be warned: Participating willingly in a DDoS attack is a crime in many countries. Even if this doesn’t bother you, you download software and visit webpages of this sort at your own significant risk: campaigners on both sides have shown little in the way of scruples, and ordinary criminal scammers are now exploiting the situation too.

Hacker Attack WikiLeaks foes

LONDON — In a campaign that had some declaring the start of a “cyberwar,” hundreds of Internet activists mounted retaliatory attacks on Wednesday on the Web sites of multinational companies and other organizations they deemed hostile to the WikiLeaks antisecrecy organization and its jailed founder, Julian Assange.

Within 12 hours of a British judge’s decision to deny Mr. Assange bail in a Swedish extradition case, attacks on the Web sites of WikiLeaks’s “enemies,” as defined by the organization’s impassioned supporters around the world, caused several corporate Web sites to become inaccessible or slow down markedly.

Targets of the attacks, in which activists overwhelmed the sites with traffic, included the Web site of MasterCard, which had stopped processing donations for WikiLeaks; Amazon.com, which revoked the use of its computer servers; and PayPal, which stopped accepting donations for Mr. Assange’s group. Visa.com was also affected by the attacks, as were the Web sites of the Swedish prosecutor’s office and the lawyer representing the two women whose allegations of sexual misconduct are the basis of Sweden’s extradition bid.

On Thursday, Gregg Housh, an activist with the loosely affiliated group of so-called hacktivists, said the group was redoubling its efforts to bring down PayPal, which is better protected than some other sites. The assertion was backed up by an independent security analyst who closely monitors the Internet and saw evidence of the onslaught.

No other major Web sites appeared to be suffering disruptions in service early Thursday, however, suggesting that the economic impact of the attacks was limited.

The Internet assaults underlined the growing reach of self-described “cyberanarchists,” antigovernment and anticorporate activists who have made an icon of Mr. Assange, a 39-year-old Australian.

The speed and range of the attacks Wednesday appeared to show the resilience of the backing among computer activists for Mr. Assange, who has appeared increasingly isolated in recent months amid the furor stoked by WikiLeaks’s posting of hundreds of thousands of secret Pentagon documents on the wars in Afghanistan and Iraq.

Mr. Assange has come under renewed attack in the past two weeks for posting the first tranche of a trove of 250,000 secret State Department cables that have exposed American diplomats’ frank assessments of relations with many countries, forcing Secretary of State Hillary Rodham Clinton to express regret to world leaders and raising fears that they and other sources would become more reticent.

The New York Times and four other news organizations last week began publishing articles based on the archive of cables made available to them.

In recent months, some of Mr. Assange’s closest associates in WikiLeaks abandoned him, calling him autocratic and capricious and accusing him of reneging on WikiLeaks’s original pledge of impartiality to launch a concerted attack on the United States. He has been simultaneously fighting a remote battle with the Swedish prosecutors, who have sought his extradition for questioning on accusations of “rape, sexual molestation and forceful coercion” made by the Swedish women. Mr. Assange has denied any wrongdoing in the cases.

American officials have repeatedly said that they are reviewing possible criminal charges against Mr. Assange, a step that could lead to a bid to extradite him to the United States and confront him with having to fight for his freedom on two fronts.

The cyberattacks in Mr. Assange’s defense appear to have been coordinated by Anonymous, a loosely affiliated group of activist computer hackers who have singled out other groups before, including the Church of Scientology. Last weekend, members of Anonymous vowed in two online manifestos to take revenge on any organization that lined up against WikiLeaks.

Anonymous claimed responsibility for the MasterCard attack in Web messages and, according to Mr. Housh, the activist associated with the group, conducted waves of attacks on other companies during the day. The group said the actions were part of an effort called Operation Payback, which began as a way of punishing companies that tried to stop Internet file-sharing and movie downloads.

Mr. Housh, who disavows a personal role in any illegal online activity, said that 1,500 supporters had been in online forums and chat rooms organizing the mass “denial of service” attacks. His account was confirmed by Jose Nazario, a senior security researcher at Arbor Networks, a Chelmsford, Mass., firm that tracks malicious activity on computer networks.

Most of the corporations whose sites were targeted did not explain why they severed ties with WikiLeaks. But PayPal issued statements saying its decision was based on “a violation” of its policy on promoting illegal activities.

Paul Mutton, a security analyst at netcraft, a British Internet monitoring firm, confirmed Mr. Housh’s account of the renewed attack on PayPal Thursday and said it had caused sporadic outages through the day. A spokesman for PayPal was not immediately reachable to confirm or deny the accounts.

The sense of an Internet war was reinforced Wednesday when netcraft reported that the Web site being used by the hackers to distribute denial-of-service software had been suspended by a Dutch hosting firm, Leaseweb.

A sense of the belligerent mood among activists was given when one contributor to a forum the group uses, WhyWeProtest.net, wrote of the attacks: “The war is on. And everyone ought to spend some time thinking about it, discussing it with others, preparing yourselves so you know how to act if something compels you to make a decision. Be very careful not to err on the side of inaction.”

Mr. Housh acknowledged that there had been online talk among the hackers of a possible Internet campaign against the two women who have been Mr. Assange’s accusers in the Swedish case, but he said that “a lot of people don’t want to be involved.”

A Web search showed new blog posts in recent days in which the two women, identified by the Swedish prosecutors only as Ms. A. and Ms. W., were named, but it was not clear whether there was any link to Anonymous. The women have said that consensual sexual encounters with Mr. Assange became nonconsensual when he stopped using condoms.

The cyberattacks on corporations Wednesday were seen by many supporters as a counterstrike against the United States. Mr. Assange’s online supporters have widely condemned the Obama administration as the unseen hand coordinating efforts to choke off WikiLeaks by denying it financing and suppressing its network of computer servers.

Mr. Housh described Mr. Assange in an interview as “a political prisoner,” a common view among WikiLeaks supporters who have joined Mr. Assange in condemning the sexual abuse accusations as part of an American-inspired “smear campaign.”

Another activist used the analogy of the civil rights struggle for the cyberattacks.

“Are they disrupting business?” a contributor using the name Moryath wrote in a comment on the slashdot.org technology Web site. “Perhaps, but no worse than the lunch counter sit-ins did.”

John Markoff and Ashlee Vance contributed reporting from San Francisco, and Alan Cowell from Paris.