09:17 AM

FBI Busts Suspected LulzSec Hacker In Sony Breach

Authorities have charged three men as part of ongoing investigations into LulzSec and Anonymous attacks against government servers and Sony websites.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
An alleged member of hacking group LulzSec, 23-year-old Cody Kretsinger, was arrested in Phoenix on Thursday by the FBI. The same day, the bureau arrested a man in San Francisco who's suspected of participating in Anonymous-related attacks, and announced similar charges against a third man, based in Ohio.

Related search warrants were also executed in Minnesota, Montana, and New Jersey, according to Fox News, which broke the story.

A federal indictment, unsealed Thursday morning, alleges that Kretsinger is the LulzSec member known as "recursion." He's accused of participating in online attacks against Sony Pictures from May 27, 2011, until June 2, 2011, the full extent of which Sony is still investigating, said authorities. The indictment also alleges that Kretsinger used a proxy server to try and mask his IP address, and that he and his co-attackers used SQL injection attacks to compromise the Sony Pictures website, after which they posted 150,000 stolen usernames and passwords on the LulzSec website, and then announced the exploit on Twitter.

[ Protect yourself and your systems. Read 14 Enterprise Security Tips From Anonymous Hacker ]

Another federal indictment, also unsealed Thursday, alleges that Christopher Doyon, 47, of Mountain View, Calif., and Joshua Covelli, 26, of Fairborn, Ohio, participated in a 2010 distributed-denial-of-service attack against servers run by the Santa Cruz County government in California. According to the indictment, the attack was conducted under the banner of the People's Liberation Front, which works with Anonymous.

Unconfirmed news reports said that the man arrested by authorities on Thursday in San Francisco was Doyon. Reports also said he was homeless.

"The arrests, if legit, could have a significant impact on hacking," said Rob Rachwald, director of security strategy at Imperva, in a blog post. "Hackers may not be as willing to trumpet their activities--a major driver of hacktivism. Further, it may impede recruitment of new hackers who could now be a little more gun-shy."

LulzSec, also known as Lulz Security or the Lulz Boat, said it was ending its self-publicized 50-day hacking spree in June. But according to chat logs obtained by the Guardian, some members exited LulzSec early, over fears that the group had gone too far. Notably, recursion appeared to quit the group on June 3, together with "devrandom," after LulzSec members hacked the Atlanta chapter of FBI affiliate InfraGard. The leader of LulzSec, "Sabu," dismissed their exit, saying they were "not up for the heat."

Sabu, among other known LulzSec members, remains at large, and apparently at work. This week, a post to his Twitter account threatened reprisals if Troy Davis--then on death row in Georgia--was executed. "Word is the Supreme Court gave a 7 day reprieve for the execution. He still can be executed within this week. DON'T YOU DARE," said the post. Davis was executed by lethal injection on Wednesday.

Arrests of accused members of LulzSec and Anonymous have been intensifying in recent months, both in the United States and abroad. In July, the FBI arrested 14 people on charges of having participated in Anonymous attacks against PayPal. The same month, Italian authorities arrested 15 people over Anonymous attacks. British authorities, meanwhile, have made multiple related arrests. Notably, they arrested teenager Jake Davis in July, alleging that he served as the LulzSec spokesman known as "Topiary."

According to Rachwald, many LulzSec and Anonymous hackers have made two significant errors: they attracted significant attention, and they didn't properly cover their tracks. "If you look at hacking historically, over the past 20 years many of the high-profile attacks or those that involve serious losses to governments or commercial companies have ended up with law enforcement finding the perpetrators eventually, such as Albert Gonzalez," he said, referring to the mastermind behind the hack of TJX.

Interestingly, the hack of TJX--resulting in the theft of 45.6 million credit and debit card numbers--continued for a year and a half before being discovered, and it took authorities another year and a half to indict and arrest Gonzalez. But LulzSec and Anonymous members, by trumpeting their own exploits, appear to have handed investigators numerous, timely leads, enabling authorities to identify and arrest suspects much more quickly.

Attend Enterprise 2.0 Santa Clara, Nov. 14-17, 2011, and learn how to drive business value with collaboration, with an emphasis on how real customers are using social software to enable more productive workforces and to be more responsive and engaged with customers and business partners. Register today and save 30% off conference passes, or get a free expo pass with priority code CPHCES02. Find out more and register.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
Microsoft Report Details Different Forms of Cryptominers
Kelly Sheridan, Staff Editor, Dark Reading,  3/13/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.