Attacks/Breaches

12/14/2011
01:21 PM
50%
50%

Kiss Off: Anonymous Hacker Took On Gene Simmons, Feds Say

Feds bust alleged member of Anonymous for launching an "Operation Payback" attack against website of Kiss frontman Gene Simmons.

Federal authorities Tuesday announced the arrest of Kevin George Poe, 24, of Manchester, Conn., on charges that he spearheaded a distributed denial-of-service (DDoS) attack against a website over a five-day period in 2010.

Notably, the attack was launched against the website of Gene Simmons, the vocalist and bassist for the hard-rock group Kiss--which he founded in the 1970s--and more recently star of the reality television show "Gene Simmons' Family Jewels".

Authorities said Poe, who used the handle "spydr101," was arrested Tuesday "without incident at the federal courthouse" on charges of conspiracy and unauthorized impairment of a protected computer. He appeared Tuesday in U.S. District Court in Hartford, Conn., and was ordered released the same day on a $10,000 bond. He's due to appear in federal court in Los Angeles at a future, yet-to-be-determined date, and faces up to 15 years in prison.

[ Check out the 8 Most Notorious Cybercrime Busts Of 2011. ]

In addition to the charges mentioned, an indictment returned last week by a federal grand jury in Los Angeles accused Poe of being a member of the Anonymous hacktivist collective. Simmons apparently drew the ire of the Anonymous set after he lambasted their peer-to-peer (P2P) downloading proclivities during a 2010 MIPCOM entertainment content media conference panel discussion, where he lamented the failure of the music industry "to sue every fresh-faced, freckle-faced college kid who downloaded material."

"Make sure your brand is protected," Simmons said. "Make sure there are no incursions. Be litigious. Sue everybody. Take their homes, their cars. Don't let anybody cross that line."

According to the indictment, Poe used a favorite Anonymous tool--the Low Orbit Ion Cannon (LOIC), which generates DDoS attacks--to attack Simmons's website.

While LOIC was launched by press-savvy Anonymous members with great fanfare, many of its users have ended up in jail. Notably, many failed to realize that the tool would add their IP address into the packets they generated, which were then directed at target websites. In numerous cases, attacked sites--including PayPal--collected those IP addresses, then shared them with authorities. As a result, the FBI has been able to trace back the attacks to the people who launched them; multiple arrests have ensued.

Likewise, authorities said they found an IP trail that led them back to Poe. “We performed a forensic evaluation of the website servers, and we were able to obtain an IP address that led us directly to Mr. Poe. The IP address, coupled with additional information obtained during the FBI’s investigation, resulted in the indictment," said Thom Mrozek of the U.S. Attorney's Office in Los Angeles, in an interview.

But he noted that the investigation had taken time, suggesting that Poe may have taken steps to hide his tracks. "There was a significant amount of forensic work involved. We are dealing with a group that is quite sophisticated and will take efforts to conceal their identity," he said.

IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques. It's time to break free. Download our Disaster Recovery Disaster supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8010
PUBLISHED: 2018-05-21
This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerabilit...
CVE-2018-8012
PUBLISHED: 2018-05-21
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
CVE-2018-1067
PUBLISHED: 2018-05-21
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is ...
CVE-2018-7268
PUBLISHED: 2018-05-21
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information suc...
CVE-2018-11092
PUBLISHED: 2018-05-21
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.