Attacks/Breaches
5/15/2013
11:18 AM
Connect Directly
RSS
E-Mail
50%
50%

LulzSec Hacker 'Pirates' Face Sentencing

Four members of Anonymous spinoff faced sentencing Wednesday for leaking data and launching distributed denial of service attacks against Sony, the Pentagon and other major sites.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Four men accused of launching online attacks under the banner of LulzSec appeared in a London courtroom Wednesday for sentencing.

Ryan Cleary, 21; Jake Davis, 20; Ryan Ackroyd, 26; and Mustafa Al-Bassam, 18, had previously plead guilty to hacking charges as part of LulzSec's online attack sprees, which caused tens of millions of dollars in damages. All had been remanded on bail pending their sentencing hearing.

"The defendants are colloquially known as cyber attackers based in the U.K. and elsewhere and they waged what was an undoubtedly sophisticated and orchestrated campaign between February and September 2011," prosecutor Sandip Patel told the sentencing hearing, reported Britain's Daily Mail.

[ Busted! Sometimes hackers make mistakes. Read How South Korea Traced Hacker To Pyongyang. ]

At press time, lawyers for the four LulzSec participants had yet to present mitigating factors to the sentencing hearing, over which Judge Deborah Taylor is presiding. The hearing is expected to conclude Wednesday or Thursday.

Patel told the court Wednesday that the men's information security attacks were "anarchic self-amusement" that lacked even the political ethos espoused by some Anonymous participants, reported Reuters. "They saw themselves as latter-day pirates," he said. "They identified vulnerable computer systems, when they found them they would break into them and pillage them."

The damage that resulted from the group's exploits could be extensive. Sony said it cost $20 million in clean-up costs after LulzSec hacked into Sony servers and published customers' credentials and credit card numbers. The Pentagon said it spent $120,000 on cleanup following a LulzSec hack.

"This is not about young immature men messing about. They are at the cutting edge of a contemporary and emerging species of criminal offender known as a cyber-criminal," Patel said.

Over the course of its short existence, LulzSec compromised numerous sites, defacing some, launching distributed denial-of-service (DDoS) attacks against others, and sometimes seizing and publishing sensitive data to Pastebin, Pirate Bay or its own site.

The group's DDoS targets included the CIA, News International, Britain's Serious Organized Crime Agency, Sony and Westboro Baptist Church. Other victims included the Arizona State Police, 20th Century Fox, News International, Britain's National Health Service, and the Serious Organized Crime Agency (SOCA), which is responsible for investigating computer crimes in Britain.

Patel said that LulzSec was lead by U.S. hacker Sabu, whose real name is Hector Xavier Monsegur. Unbeknownst to his fellow LulzSec participants, Sabu was quietly busted by the FBI in June 2011 and immediately turned informer. Despite LulzSec participants' attempts to mask their true identities -- even to each other -- Sabu helped the bureau and its overseas cybercrime investigation counterparts round up the other members.

According to prosecutors, Davis (aka Topiary) was in charge of LulzSec's communications strategy, and maintained its Twitter feed and website. He "smirked in the dock" Wednesday when prosecutors detailed his role in LulzSec, reported Britain's The Independent.

Ackroyd, a former soldier who pretended to be a 16-year-old girl named Kayla, helped select targets and conduct reconnaissance. He was "probably the most sophisticated known conspirator," said Patel, and had a reputation for being a "highly sophisticated rooter." Meanwhile, Bassam (tFlow) also helped identify websites sporting known vulnerabilities that could be exploited. Authorities said he was still a high school student when LulzSec was in operation.

Prosecutors told the court that Cleary (aka Viral) -- unlike Sabu, Ackroyd, Davis and Bassam -- wasn't a core member of the group, but was desperate to take part, and provided his botnet, built over six years, for LulzSec's exploits. "At any one time he had up to 100,000 computers directly and actively under his control," said Patel.

Cleary previously plead guilty to possessing "indecent images" relating to child pornography, which investigators found on hard drives seized during the investigation. After being granted conditional bail in June 2011, he was again -- temporarily -- taken into custody after attempting to contact Sabu in December 2011.

Patel, who characterized Cleary as being "trigger happy," said the LulzSec participant earned up to $4,500 per month by renting his botnet out to other attackers.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.