Nate Anderson - Unmasked

Anonymous got lucky. When five of its hackers attacked security company HBGary Federal on February 6, 2011, they were doing so in order to defend the groups privacy. It wasnt because they hoped to reveal plans to attack WikiLeaks, create surveillance cells targeting pro-union organizations, and sell sophisticated rootkits to the US government for use as offensive cyber weaponsbut thats what they found.

In the weeks after the attack, the hackers released tens of thousands of e-mail messages and made headlines around the world. Aaron Bar, the CEO of HBGary Federal, eventually resigned; 12 Congressman called for an investigation; an ethics complaint was lodged against a major DC law firm involved with some of the more dubious plans.

Looked at from a certain angle, with ones eyes squinted just right, the whole saga could look almost noble, a classic underdog story of rogue hackers taking on corporate and government power. On the flipside, however, the attacks caused big losses to several companies, leaked highly personal information about peoples lives, and resulted in a sustained (and fairly juvenile) attack on related security firm HBGary, Inc. And the irony was not lost on those who were attacked: Anonymous demanded transparency while offering none itself.

The many contradictions of the narrative perfectly sum up Anonymous, which claims to have no leaders, no real members, and no fixed ideology. It is whatever anyone wants it to be; start an operation, drum up enough interest from others, and you are operating under the Anonymous banner. Such an approach can lead to chaos, simultaneously providing a fertile breeding ground for ideas and an opening for total anarchy. It can also cause a rift between those who want to be digital Robin Hoods and those who are merely hacking for the lulz.

Few recent stories can shed so much light on a hacking movement, illuminate classified government contracting, reveal corporate bad behavior, raise doubts about the limits of Internet vigilante behavior, and show just how completely privacy has been obliterated in the digital age as the conflict between Anonymous and the two HBGarys.

Thats why Ars Technica poured so much time into researching and writing the complete narrative of the attacks and their aftermath, and its why were pleased to bring you the complete series now, packaged together for easy reading.

Internet vigilante group Anonymous turned its sights on security firm HBGary on Sunday evening in an attempt to teach [HBGary] a lesson youll never forget. The firm had been working with the Federal Bureau of Investigation (FBI) to unmask members of Anonymous following the groups pro-WikiLeaks attacks on financial services companies , and was prepared to release its findings next week.

HBGary had been collecting information about Anonymous members after the groups DDoS attacks on companies perceived to be anti-WikiLeaks. The firm had targeted a number of senior Anonymous members, including a US-based member going by the name of Owen, as well as another member known as Q. In addition to working with the FBI (for a fee, of course), HBGarys CEO Aaron Barr was preparing to release the findings this month at a security conference in San Francisco.

Anonymous, however, felt that HBGarys findings were nonsense and immediately retaliatedbut this time with something other than a DDoS attack. Instead, Anonymous compromised the companys website, gained access to the documents that HBGary had collected on its members, and published more than 60,000 of HBGarys e-mails to BitTorrent. They also vandalized Barrs Twitter and LinkedIn accounts with harsh messages and personal data about Barr, such as his social security number and home address.

Weve seen your internal documents, all of them, and do you know what we did? We laughed. Most of the information youve extracted is publicly available via our IRC networks, Anonymous wrote in a statement posted to HBGarys site on Sunday. So why cant you sell this information to the FBI like you intended? Because were going to give it to them for free.

HBGary cofounder and security researcher Greg Hoglund confirmed on Sunday evening that the latest attacks were sophisticated compared to the groups past shenanigans. They broke into one of HBGarys servers that was used for tech support, and they got e-mails through compromising an insecure Web server at HBGary Federal, Hoglund told KrebsonSecurity . They used that to get the credentials for Aaron, who happened to be an administrator on our e-mail system, which is how they got into everything else. So its a case where the hackers break in on a non-important system, which is very common in hacking situations, and leveraged lateral movement to get onto systems of interest over time.

As for the 60,000 e-mails that are now available to anyone with a torrent client, Hoglund argued that their publication was irresponsible and would cost HBGary millions of dollars in losses due to the exposure of proprietary information. Before this, what these guys were doing was technically illegal, but it was in direct support of a government whistle blower. But now, we have a situation where theyre committing a federal crime, stealing private data and posting it on a torrent, Hoglund said.

Its unlikely that Anonymous cares about what Hoglund thinks, though. Several of the companys e-mails indicated that Barr was looking for ways to spin its info about Anonymous as a pro-HBGary PR move, which Anonymous took special issue with. The group warned HBGary that it had charged into the Anonymous hive and now the company is being stung.

It would appear that security experts are not expertly secured, Anonymous wrote.

Aaron Barr believed he had penetrated Anonymous. The loose hacker collective had been responsible for everything from anti-Scientology protests to pro-Wikileaks attacks on MasterCard and Visa, and the FBI was now after them. But matching their online identities to real-world names and locations proved daunting. Barr found a way to crack the code.

In a private e-mail to a colleague at his security firm HBGary Federal, which sells digital tools to the US government, the CEO bragged about his research project.

They think I have nothing but a heirarchy based on IRC [Internet Relay Chat] aliases! he wrote. As 1337 as these guys are suppsed to be they dont get it. I have pwned them! :)

But had he?

We are kind of pissed at him right now

Barrs pwning meant finding out the names and addresses of the top Anonymous leadership. While the group claimed to be headless, Barr believed this to be a lie; indeed, he told others that Anonymous was a tiny group.

At any given time there are probably no more than 20-40 people active, accept during hightened points of activity like Egypt and Tunisia where the numbers swell but mostly by trolls, he wrote in an internal e-mail. (All e-mails in this investigative report are provided verbatim, typos and all.) Most of the people in the IRC channel are zombies to inflate the numbers.