Opening the Hive
Posted: February 22, 2011 Filed under: anonymous, cyber security, U.S. Military, We are so F'd, Wikileaks | Tags: aaron barr, anonymous, cyber security, HBGary, Wikileaks 30 CommentsWe’ve been following the Wikileaks saga here at Sky Dancing, and at the end of January/beginning of February, an interesting twist appeared in the story. As you might know, a ‘hacktivist’ group called Anonymous brought down commercial servers and did various other things on the ‘net in support of Wikileaks back when the story about Assange’s alleged rapes surfaced late last year. This was in response to giants like Visa and Mastercard refusing to process donations to Wikileaks. The damage Anonymous did was real, but fleeting and group sunk momentarily back into the dark regions of the ‘net.
Aaron Barr*, the CEO of a company called HBGary Federal (an offshoot of cyber security firm HBGary) had his company develop a plan to bring down Wikileaks, partly by leaning on its big name supporters such as Glenn Greenwald.
Barr’s company developed this plan after pitching another plan to the US Chamber of Commerce which was meant to provide cyber spying, data collection and other services to the Chamber. And they came up with a proposal for the US Air Force (in response to a call for submissions) to create software allowing massive astroturfing via ‘persona management software’.
Barr decided to prove his company’s abilities by attempting to discover the identities of the key members of Anonymous. He did so by visiting IRC chat-rooms used by Anonymous and correlating what was said there with Tweets, Facebook posts and so on. He would then examine the corresponding Facebook users friends to determine location and so on. After a while, he claimed to have identified 3 main members of Anonymous, and released that news, without naming names, at the end of January. He boasted about what he had supposedly done to Anonymous in IRC. The FBI picked up on the press releases and Barr was planning to present data about Anonymous in a meeting with agency reps on Feb 11. Although Barr claimed he did not intend to release identities, no-one believed him. Internal company emails suggest Barr wanted to use the brouhaha with Anonymous, the members of which he seemed to think were the equivalent of script kiddies, to gin up publicity for his failing company.
The best laid plans… On Feb 5th and 6th Anonymous struck back, controlling and defacing HBGary’s websites, penetrating their webserver and email server, copying and releasing thousands of emails, snooping on Barr’s electronic activity for over 30 hours (undetected), hacking into and controlling Barr’s Twitter account, wiping his IPad and destroying about 1TB of company backups on company servers, and more in a series of sophisticated attacks using both technology and social engineering. It was so bad that HBGary’s president went to the IRC chatrooms to beg Anonymous to leave off. Their reaction? Fire Barr and give some money to the Bradley Manning defense fund, and we will. They also pointed out that they released the emails and documents supposedly identifying them, scoffing that they were nonsense and innocent people were going to get arrested.
The whole story is at Ars Technica in a series of excellent articles. Instead of recounting the saga here, I’m going to send you there. The story is fascinating. I’ll wait here until you are through :).
Ars Technica Links:
Anonymous to security firm working with FBI: “You’ve angered the hive” By Jacqui Cheng
Read this and the one noted below for the full story:
How one man tracked down Anonymous—and paid a heavy price By Nate Anderson
(Virtually) face to face: how Aaron Barr revealed himself to Anonymous By Nate Anderson
Another important article:
Spy games: Inside the convoluted plot to bring down WikiLeaks By Nate Anderson
Anonymous speaks: the inside story of the HBGary hack By Peter Bright
Black ops: how HBGary wrote backdoors for the government By Nate Anderson
One of the most fascinating parts to me about this story is the sheer hubris of Aaron Barr. An experienced man with a military background, he ignored the advice of his lead programmer, who was very dubious that the methods Barr was advocating would work. He ignored the potential of the members of Anonymous with which he was toying, he ignored the boundaries between good and evil, between private and public. Of course his company was going under and he needed to drum up business. I suppose this is always the excuse, isn’t it?
It’s amazing to me that a cyber security company left their website open to SQL injection. I’m not the best of programmers, and even I know to avoid this. Its leadership did not seem to think that their company could be attacked or penetrated, and do not seem to have run routine security checks on the company’s internet presence, officers and more. I mean, an SQL injection? Sheez. Of course, Anonymous used some pretty nifty social engineering to get the proper password and account names for the CEO of HBGary.
That they could do so is astonishing. I suppose HBGary Federal is on the bumbling side of what the cyber community, white and black hats, can do with computers and the internet. It’s scary to think what the efficient people can do.
I’m also fascinated by the things our government will buy, or start to buy, in this case. As BB wrote about recently, our government can get taken suprisingly easily by high tech fraudsters. Now, I don’t think Barr was actually committing fraud. He believed what he had was true (and maybe it IS true, who knows?). But Barr, and our government, show a startling inability to separate reality from wishful thinking. ‘Experts’ from little companies like HBGary Federal, ‘scientists’ employed by big corporations like Monsanto, load the deck in their favor. The government rarely looks beyond these presentations and reports and does the citizens of this country a costly disservice by being so blind.
Anonymous has recently turned it’s hive mind attention to Libya, and I leave you with their parting salutation in their message to the UN:
We are Anonymous
We are Legion.
We do not forget,
We do not forgive.
Expect us.
*For the life of me, I can’t stop myself reading Aaron BURR every time I see Barr’s name. Anyone else do that?
peej
Carissa
ecocatwoman
grayslady
mablue2
peggysue22
skydancingguestblogger
Mona (aka Wonk the Vote)
Sky Dancing 
I guess Westboro Baptist Church, that horrible thing, has gone against Anonymous too. Or ginned up an episode with Anonymous to get publicity.
http://nakedsecurity.sophos.com/2011/02/21/westboro-parish-church-and-anonymous-come-to-internet-blows/
Fascinating story about the youth in Anonymous that grew up with technology and can do all sorts of things, that I am merely figuring out today, just to understand the stories.
I am also fascinated by their (Anonymous’) sense of care, care for other human beings and sense of Justice(As the UN Letter shows.) and that they see the ‘little people’ those that are often trampled by the powerful, like Libya’s dictator Gaddafi.
This is also an interesting story on Anonymous:
Thanks for the article.
I very much agree about Anonymous’ sense of care and political awareness and was very surprised, but pleased, by the tone of many of the comments on the ArsTechnica article. They seem to reflect non-Randian political orientation. Most of the geeks I’ve known personally are pretty big Ayn Rand types, and are loveable but not in a political way.
I’m not sure the members of Anonymous are all youth, although I’m sure many are. It really is distributed as well, no central control to it. And so, it’s uncontrollable. Both scary and exhilarating.
Anyone else uncomfortable with the idea that a group call “Anonymous” has this level of power? We’re supposed to just trust in their “sense of care for other human beings?” Is law and due process and elected representation dead, and we are now at the mercy of the good or otherwise intentions of faceless mobs playing judge, jury, and executor of justice?
Sorry, but this sh*t creeps me out.
*****A
Yes, law and due process and elected representation are, essentially, dead, but those issues have nothing to do with Anonymous. Anonymous is simply a group of “hacktivists”. One can argue about how they choose to exercise free speech, but, so far, no complaints from me. I’m glad they’re out there exposing the corruption and putting burrs under the saddles of those trying to suppress free speech.
I agree. They are using different methods, but they are protesting against government power.
What creeps me out is how clueless our supposed leaders are about technology and what it can do–and how much they are willing to pay for something that basically I could do for them.
It is creepy, but even creepier is that there are lots of people like Barr with even more power and minions. Some of them even serve on our Supreme Court.
So, given the way things are, I don’t feel as abused and powerless because there is an Anonymous and it has a sense of care. A Robin Hood of digital power, it seems.
No, I’m not uncomfortable with it. They would not have had any power if HBGary Federal had followed standard cyber security protocol and secured its systems. The irony is that HBGary Federal was supposedly expert in attacking and getting around other cyber security systems, but they flummoxed their own.
The DDOS attacks on Visa and Mastercard in support of Wikileaks were taken care of within hours, because those systems ARE secure. DDOS attacks happen to government computers and websites constantly and are brushed away (not that Anonymous does those, I doubt they do).
A computer virus, call Stuxnet, was created by the US and Israel, tested in Israel, then released into Iran to destroy the computers at its first nuclear facility. Is this kind of computer action not scary as well? Even if it is ‘good’ and the actors are wearing ‘white hats’ (this time)?
http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
When computer programmers in the USA and Google and other companies in Europe conspired (and conspire) to get around the Egyptian and Libyan internet blackouts we have hailed them and strutted their capabilities. Is it somehow different when the action comes from a company and not a collection of individuals? Obviously we approve of these actions, but what if the tables were turned and it were not a dictator’s internet blackout, but say a blackout to keep terrorists under control that was being circumvented?
I don’t know, and I don’t have an answer or even a really concretely formed opinion. These issues and questions are really thorny. I don’t like black hats and I do like white hats. But the hat color seems to vary depending upon the recipient of the actions, not the actions themselves or who’s taking them.
I’m just glad you posted this. I had read other articles about HBGary, but you have really put it in perspective and made it easier to understand.
Thanks, BB. I’m fascinated by this kind of stuff, and let myself have an evening off to do all that reading over Ars Technica. I know just enough about computer security programming to know I’d be very dangerous if I tried to do it, because I’d be so bad at it!
As far as I can tell, they say they are doing a ‘Cyber Sit In’ in protest of policies, just as others did during the Civil Rights era, albeit the FBI doesn’t see it that way, but Anonymous does.
As to who they are, I suspect it is our kids (Metaphorically speaking, not that my kids are there, truth is I wouldn’t know.), gran kids considering the ages of the ones arrested in Europe:…13, 15, 16, 19, 20 and 26… The last two must be ‘senior citizens’ in the group and I suspect there may be others younger and older, but I don’t know…only guessing.
I read some article that said they go and discuss issues and they vote on where they are doing their activism. Their one major complaint seems to be that they object to any censorship to speak to one another via the internet (They want access to communication) , see communication as a Human Right and seem very aware of political doings and social issues around the world. I attended some seminars on the leaps (growth…evolution) of humankind and they said (This is several years ago) that we are entering a high curve, higher than that of the last century. In other words, youth like these, are going to develop and perhaps have the ability to make some rather revolutionary innovations beyond social ones. I guess, we as parents, and grandparents need to nurture the youth of today and offer more care so that the developments continue on a positive note. One observation I made is that they don’t seem interested in violence or war.
In the end, their protests are rather a report card on us adults and our parents, in that we really have left things in disarray and we have accepted many things that we shouldn’t have, by our mere silence and allowed dictatorships to continue for decades and inhumane acts that could have been stopped. These younger citizens of the world, are not going to be silent on these issues…in essence, the fact that they have to resort to this, let’s us know we have to do better, we are not meeting the grade/expectations despite what we may think…having given up far too many liberties while being ruled by fear.
I saw their IRC (I hope I got that right), but don’t understand it, but I did get the gist that they are all about transparency but aren’t into airport scans (They seem to like privacy there just like us.).
So, I am watching with amazement and concern too…
What a great comment. You’ve expressed a lot of what I feel about Anonymous.
The poster I chose for my post above is a link to a series of art for the group. I really, really like the art. I love the poster because it basically says, ‘E pluribus unum’ in math. If you divide 1 by 0 you get nothing, or everything, or anything. It’s undefined. And in computers if you make a division by 0 mistake your code will crash, overflow, and possibly create a security hazard. Very effective artwork, I think.
OK, now you are wigging me out, with 2012 and all the math… 😆 http://en.wikipedia.org/wiki/Maya_civilization#Mathematics
Josh asked about this the other day on Twitter and yes, mathematicians, and artists both work in a mystical way… Please do put up a link to the art, as I have been impressed with their graphics designs and the visuals of communicating a theme/interpretation of events:
http://qcanon.ning.com/photo/tunisieegypte-1?xg_source=activity
Sima @ 7:05
That poster is perfect.
It’s really eye catching!!
I second Sima’s comment!
Awesome reading indeed. Thanks for the post and the replies.
Sima, I’m still working my way through the Ars Technica pieces you gathered up for us, but I just wanted to say thanks and well done!
All the Aaron Barr mentions actually made me think of “Politico’s Andy Barr reports on birthers…” Lol
Thank you! And now I’m going to be thinking Andy Barr as well… heh.
I was thinking Bob Barr…
Here’s a direct link to one of the collections of artwork that I found. Some of it’s dark, but a lot of it is very effective. Anonymous is tuned in, that’s for sure.
The Barr story just floored me that a “firm” highly connected to the US government in cyber security improperly used their influence and then was hacked by a bunch of kids. It made me feel better about the future generation.
Yea, it does me too. I just can’t get over the arrogance of it all on Barr’s part. He surely wasn’t that innocent and naive to think they’d take his tinkering, and possible complicity in their arrest and imprisonment, as simply someone ‘studying’ something.
Here’s another good poster:
Is this Anonymous identified with the 4chan group?
Probably not directly any more, although Anonymous did originate there in 2003 (hence their usage of Guy Fawkes masks). Anonymous has spread and grown since then. For example, here’s a picture from the Independent showing protesters against the internet copyright legislation in Spain. Although it’s not mentioned in the caption, it’s obvious that the people with masks are Anonymous members.
http://www.independent.co.uk/news/the-past-seven-days-in-photographs-806086.html?ino=9
Here’s wikipedia on it all:
http://en.wikipedia.org/wiki/4chan#Links_to_Anonymous_and_Project_Chanology
http://en.wikipedia.org/wiki/Anonymous_%28group%29
Well, lovely that they’re opposed to Scientology, but not so lovely if they’d interfere with laws aimed at preventing child porn. I wonder how well the rights of women are represented in the probable boys club that comprises Anonymous.
*****A
Impossible to know about the rights of women and Anonymous by the very nature of the beast. By that same nature, there’s no way to know how many members are women. I suspect we’d be surprised, however, simply from my own experiences during the rise of what is now the Internet.
About as well as the rights of women in Egypt.
Adrienne in CA,
Please see this:
Chris Forcand arrest
On December 7, 2007, the Canada-based Toronto Sun newspaper published a report on the arrest of the alleged Internet predator Chris Forcand.[17] Forcand, 53, was charged with two counts of luring a child under the age of 14, attempt to invite sexual touching, attempted exposure, possessing a dangerous weapon, and carrying a concealed weapon.[18] The report stated that Forcand was already being tracked by “cyber-vigilantes who seek to out anyone who presents with a sexual interest in children” before police investigations commenced.[17]
A Global Television Network report identified the group responsible for Forcand’s arrest as a “self-described Internet vigilante group called Anonymous” who contacted the police after some members were “propositioned” by Forcand with “disgusting photos of himself.” The report also stated that this is the first time a suspected Internet predator was arrested by the police as a result of Internet vigilantism.[19]
http://en.wikipedia.org/wiki/Anonymous_%28group%29#Chris_Forcand_arrest