Welcome!

Blog Feed Post

What the LulzSec Bust Says About Cyber Criminal Investigations

In a recent high-profile bust, the FBI arrested five alleged leaders of the collective Anonymous and related hacking group LulzSec. Understandably, the majority of law enforcement, white hats, and journalists rejoiced at the FBI’s newfound cyber prowess. After months of embarrassment through denial of service attacks, major data leaks, and website defacements, it looked as though law enforcement and the federal government had finally won against the rising menace of cybercrime, alleged by FBI Director Robert Mueller to soon surpass terrorism as a national security concern. They had bested Sabu, the leader of LulzSec, so thoroughly that he joined their side and helped bring down the most dangerous men in cyberspace. Headlines declared that lawmen had finally brought order to the Wild Wild Web. Yet while I applaud what the FBI achieved  an adept operation, LulzSec wasn’t taken down by digital whiz kids, and certainly not by cybersecurity practitioners employed by the Bureau, but by old fashioned investigations and human intelligence.

The key to the entire bust was Hector Xavier Monsegur, better known under the hacking alias Sabu. Outside of data dump repository and hacker hangout Pasebin, Sabu first briefly entered the spotlight when he was arrested as the alleged leader of LulzSec in July. The cybersecurity crowd reacted with highly cautious excitement. Many did not believe that the FBI had managed to apprehend the real leader, LulzSec denied the news, and Anonymous gave their standard “we are legion” and “you can’t arrest an idea” responses to setbacks. Then, suddenly, there was nothing from either camp until Sabu reemerged several months later. Given the severity of the charges against him, this seemed to confirm that the FBI had been mistaken or exaggerated his importance.

In reality, Sabu actually was the major hacker that the FBI alleged. While LulzSec’s attacks were often basic, such as SQL injections and distributed denial of service and opponents have accused Anonymous of being “script kiddies” running premade attacks, Sabu’s skills were respected worldwide. He was recognized as the elite hacker of the group and had been hacking since 1999. This level of “street cred” proved invaluable for the FBI after he turned informant.

Sabu’s initial arrest, by a pair of FBI agents with bullet proof vests instead of laptops, had more to do with old fashioned sleuthing than hacking. Sabu was famous, but  also famously obnoxious. That, combined with the illegality and questionable morality of many of LilzSec’s attacks, earned him numerous enemies in the hacking community. Hackers like The Jester would post possible leads online, complete with evidence for the FBI to examine. While generating this information took some forensics skill, all the FBI had to do was develop sources like in any intelligence operation or investigation. If anything, collecting evidence against Monsegur was even simpler as it didn’t take a forensics lab to make sense of the clues, which were posted for everyone to see. Once the FBI had a lead, it was just a question of manpower and diligence. Monsegur eventually slipped and logged into a chat room without obscuring his IP address, allowing the FBI to find him.

The rest of the operation proved even more conventional. The FBI turned Monsegur into an informant not with computers but with simple leverage. A laundry list of charges meant that Monsegur could be imprisoned for over a century, and he was the guardian of two young children whom he gained custody over while their mother, his aunt, was in prison. If he went away, there would be nobody to raise them. After some good cop, bad cop, Monsegur began cooperating within the first 24 hours.

Monsegur was describes an ideal informant, working consistent 8-16 hour days for the FBI, gathering incriminating information from the hackers who looked up to him in chat rooms. He would even investigate attacks to tip law enforcement off before they took place to prevent or minimize the damage, and once used his influence to call off an embarrassing attack on the CIA. So that nobody knew who he was working for, he would give misleading online interviews to journalists while monitored by the FBI or, in some cases, the FBI would give the interviews in his name.

In the aftermath, the government gained what looked like a stunning victory over an elusive foe and a boost to its cyber credentials when in reality, the operation that beheaded LulzSec had more in common with turning Sammy the Bull against the Gotti family than a duel in cyberspace. The FBI still can’t compete with hackers at what they do best. The feds remain grossly outnumbered and, despite marked improvements in this area, lacking in talent. The FBI struggles to recruit truly skilled hackers, even white hats, because they don’t match the squeaky-clean applicant profile, have little love for law enforcement, and would be more valued in the private sector or black market. Still, that doesn’t mean that law enforcement can’t win. As we saw when Anonymous considered challenging the cartels, cyber eventually gets real, and nobody actually lives in cyberspace. The FBI’s LulzSec busts are an example of how it can successfully target hackers doing what it does best, proving the effectiveness of human intelligence operations even against cybercrime.

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder and partner at Cognitio Corp and publsher of CTOvision.com

Latest Stories
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Tintri VM-aware storage is the simplest for virtualized applications and cloud. Organizations including GE, Toyota, United Healthcare, NASA and 6 of the Fortune 15 have said “No to LUNs.” With Tintri they mana...
IoT offers a value of almost $4 trillion to the manufacturing industry through platforms that can improve margins, optimize operations & drive high performance work teams. By using IoT technologies as a foundation, manufacturing customers are integrating worker safety with manufacturing systems, driving deep collaboration and utilizing analytics to exponentially increased per-unit margins. However, as Benoit Lheureux, the VP for Research at Gartner points out, “IoT project implementers often ...
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, will compare the Jevons Paradox to modern-day enterprise IT, e...
SYS-CON Events announced today the Enterprise IoT Bootcamp, being held November 1-2, 2016, in conjunction with 19th Cloud Expo | @ThingsExpo at the Santa Clara Convention Center in Santa Clara, CA. Combined with real-world scenarios and use cases, the Enterprise IoT Bootcamp is not just based on presentations but with hands-on demos and detailed walkthroughs. We will introduce you to a variety of real world use cases prototyped using Arduino, Raspberry Pi, BeagleBone, Spark, and Intel Edison. Y...
Complete Internet of Things (IoT) embedded device security is not just about the device but involves the entire product’s identity, data and control integrity, and services traversing the cloud. A device can no longer be looked at as an island; it is a part of a system. In fact, given the cross-domain interactions enabled by IoT it could be a part of many systems. Also, depending on where the device is deployed, for example, in the office building versus a factory floor or oil field, security ha...
Is your aging software platform suffering from technical debt while the market changes and demands new solutions at a faster clip? It’s a bold move, but you might consider walking away from your core platform and starting fresh. ReadyTalk did exactly that. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, will discuss why and how ReadyTalk diverted from healthy revenue and over a decade of audio conferencing product development to start an innovati...
Fifty billion connected devices and still no winning protocols standards. HTTP, WebSockets, MQTT, and CoAP seem to be leading in the IoT protocol race at the moment but many more protocols are getting introduced on a regular basis. Each protocol has its pros and cons depending on the nature of the communications. Does there really need to be only one protocol to rule them all? Of course not. In his session at @ThingsExpo, Chris Matthieu, co-founder and CTO of Octoblu, walk you through how Oct...
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
Whether they’re located in a public, private, or hybrid cloud environment, cloud technologies are constantly evolving. While the innovation is exciting, the end mission of delivering business value and rapidly producing incremental product features is paramount. In his session at @DevOpsSummit at 19th Cloud Expo, Kiran Chitturi, CTO Architect at Sungard AS, will discuss DevOps culture, its evolution of frameworks and technologies, and how it is achieving maturity. He will also cover various st...
There are several IoTs: the Industrial Internet, Consumer Wearables, Wearables and Healthcare, Supply Chains, and the movement toward Smart Grids, Cities, Regions, and Nations. There are competing communications standards every step of the way, a bewildering array of sensors and devices, and an entire world of competing data analytics platforms. To some this appears to be chaos. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Bradley Holt, Developer Advocate a...
Identity is in everything and customers are looking to their providers to ensure the security of their identities, transactions and data. With the increased reliance on cloud-based services, service providers must build security and trust into their offerings, adding value to customers and improving the user experience. Making identity, security and privacy easy for customers provides a unique advantage over the competition.
SYS-CON Events announced today that Niagara Networks will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Niagara Networks offers the highest port-density systems, and the most complete Next-Generation Network Visibility systems including Network Packet Brokers, Bypass Switches, and Network TAPs.
SYS-CON Events announced today that Secure Channels will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The bedrock of Secure Channels Technology is a uniquely modified and enhanced process based on superencipherment. Superencipherment is the process of encrypting an already encrypted message one or more times, either using the same or a different algorithm.
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
So, you bought into the current machine learning craze and went on to collect millions/billions of records from this promising new data source. Now, what do you do with them? Too often, the abundance of data quickly turns into an abundance of problems. How do you extract that "magic essence" from your data without falling into the common pitfalls? In her session at @ThingsExpo, Natalia Ponomareva, Software Engineer at Google, provided tips on how to be successful in large scale machine learning...