Attacks/Breaches
12/14/2011
01:21 PM
50%
50%

Kiss Off: Anonymous Hacker Took On Gene Simmons, Feds Say

Feds bust alleged member of Anonymous for launching an "Operation Payback" attack against website of Kiss frontman Gene Simmons.

Federal authorities Tuesday announced the arrest of Kevin George Poe, 24, of Manchester, Conn., on charges that he spearheaded a distributed denial-of-service (DDoS) attack against a website over a five-day period in 2010.

Notably, the attack was launched against the website of Gene Simmons, the vocalist and bassist for the hard-rock group Kiss--which he founded in the 1970s--and more recently star of the reality television show "Gene Simmons' Family Jewels".

Authorities said Poe, who used the handle "spydr101," was arrested Tuesday "without incident at the federal courthouse" on charges of conspiracy and unauthorized impairment of a protected computer. He appeared Tuesday in U.S. District Court in Hartford, Conn., and was ordered released the same day on a $10,000 bond. He's due to appear in federal court in Los Angeles at a future, yet-to-be-determined date, and faces up to 15 years in prison.

[ Check out the 8 Most Notorious Cybercrime Busts Of 2011. ]

In addition to the charges mentioned, an indictment returned last week by a federal grand jury in Los Angeles accused Poe of being a member of the Anonymous hacktivist collective. Simmons apparently drew the ire of the Anonymous set after he lambasted their peer-to-peer (P2P) downloading proclivities during a 2010 MIPCOM entertainment content media conference panel discussion, where he lamented the failure of the music industry "to sue every fresh-faced, freckle-faced college kid who downloaded material."

"Make sure your brand is protected," Simmons said. "Make sure there are no incursions. Be litigious. Sue everybody. Take their homes, their cars. Don't let anybody cross that line."

According to the indictment, Poe used a favorite Anonymous tool--the Low Orbit Ion Cannon (LOIC), which generates DDoS attacks--to attack Simmons's website.

While LOIC was launched by press-savvy Anonymous members with great fanfare, many of its users have ended up in jail. Notably, many failed to realize that the tool would add their IP address into the packets they generated, which were then directed at target websites. In numerous cases, attacked sites--including PayPal--collected those IP addresses, then shared them with authorities. As a result, the FBI has been able to trace back the attacks to the people who launched them; multiple arrests have ensued.

Likewise, authorities said they found an IP trail that led them back to Poe. “We performed a forensic evaluation of the website servers, and we were able to obtain an IP address that led us directly to Mr. Poe. The IP address, coupled with additional information obtained during the FBI’s investigation, resulted in the indictment," said Thom Mrozek of the U.S. Attorney's Office in Los Angeles, in an interview.

But he noted that the investigation had taken time, suggesting that Poe may have taken steps to hide his tracks. "There was a significant amount of forensic work involved. We are dealing with a group that is quite sophisticated and will take efforts to conceal their identity," he said.

IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques. It's time to break free. Download our Disaster Recovery Disaster supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.