How one man tracked down Anonymous—and paid a heavy price

http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-tracked-anonymousand-paid-a-heavy-price.ars

by steveklabnik • 15 years ago

432 154 15 years ago

Based on my own minimal experience, the majority of these IRC channels are just a small group of "Anonymous" doing whatever they want, different channels will get publicised at different times through different means, "Anonymous" doesn't exist in any way beyond being a label people use, I guess it could be compared to "emo" or "jock" in high school; they have no "leadership" but people join these groups and label themselves as such.

> The show was run by a couple of admins he identified as "Q," "Owen," and "CommanderX"—and Barr had used social media data and subterfuge to map those names to three real people, two in California and one in New York.

isn't Q the bot that runs on quakenet as a proxy admin?

dekz2• 15 years ago

Possibly, but these if these "relations" are created purely from IRC dicussion, I don't think that happens on quakenet.

shin_lao• 15 years ago

Q is probably a reference to Star Trek character's Q:

http://memory-alpha.org/wiki/Q

khafra2• 15 years ago

I don't know what the chances are that Barr's actually that stupid/crazy, but Citricsquid is saying there's a reasonable chance the IRC admin Barr "tracked down the real identity of" was actually a bot.

blahedo• 15 years ago

Huh. Maybe, but I assumed James Bond's Q was more likely:

http://en.wikipedia.org/wiki/Q_(James_Bond)

mcs• 15 years ago

Type cookie you idiot!

Devilboy2• 15 years ago

Aaron Barr is not big on typing from the looks of it.

DrStalker3• 15 years ago

Isn't anonymous less an organized group with leaders and more a bunch of people who hang out and occasionally someone says "hey, it would be cool if we all did <thing>" and whoever is listening joins in?

cookiecaper8• 15 years ago

Yes, but traditional media has a hard time grasping the concept. It's just a lot of directionless guys that latch onto whatever cause seems palatable at the time and requires no more effort than running LOIC/other simple DDOS programs. Basically the definition of script kiddies, there's just a large concentration of them on one message board system.

Helianthus163• 15 years ago

This is true, but doesn't mean there aren't coordinators, actually skilled hackers who embrace the directionlessness even as they give it direction. It isn't _just_ foot-soldiers.

DrStalker3• 15 years ago

So, a human powered botnet that follows commands at random based on how much fun they are?

Devilboy2• 15 years ago

At least one person on Barr's list as one of 'leaders' of Anonymous has responded:

http://blogs.crikey.com.au/thestump/2011/02/07/i-confess-im-...

stcredzero18• 15 years ago

He could be using the Richard Feynman gambit.

"Feynman! Did you take the doors?"

"Oh, yeah!" I said. "I took the door.

radu_floricica3• 15 years ago

Power law still applies. Most likely 90% of serious action is done by the same 0.1% contributors (same as it is on HN or reddit or anywhere else).

It may be a real difference if the 0.1% can be easily replaced, Stand Alone Complex style. Say they're all arrested one day, and a month after something happens (Julian Assange is extradited, there's a revolution in Iran, whatever piques Anonymous' interest). There's a good chance many people at the same time will think that something needs to be done, see that nothing is happening, and do it. Not as good as the "old guard" maybe, but they'll probably try.

We can't really know how well this replacement mechanism works...

stcredzero18• 15 years ago

Implying that the 0.1% have never been caught?

rapicastillo2• 15 years ago

If we go with the fact that Anonymous is infact a true distributed environment, then the replacement mechanism will be very easy. I think Anonymous is a kind of humanized group-comm architecture sans a coordinator.

NonOrthodox• 15 years ago

Actually no. I had been in their IRC for some time during the first couple weeks of the Wikileaks leaks, and it isn't like that. They are a group that, just like any other, like HN, have certain common and shared values and talk, discuss and act by them. In their case, basicly, they are pro free-speech, pro internet and privacy.

They, like we here in HN, organize themselves around those ideas. Sometimes they act together against someone that goes against their values, like they just did to Aaron, and sometimes they act towards other positive goals like they did in Egypt. It is not about being cool, having fun or anything like that. That is just one of the ways they attract kids and other people to join them in their attacks and other actions. There is no central leadership, no hierarchy, but all their actions are done following certain values and ethics that you cannot really grasp unless you are part of it, just like HN.

Although they don't have leaders, at least in their IRC, there are moderators, that, at least during the leaks, when there were over 3 thousand people in a single IRC channel, would lock the channel, summarize arguments, add questions and unlock it, while they were selecting targets. But usually that only happened when there were that many people and too many trolls spamming the chat.

They are people, from all ages that act by their shared values.

stcredzero18• 15 years ago

This idea is repeated so often, I suspect that there's a group of people somewhere that wants that particular message to be repeated and believed. If I were manipulating a group like Anonymous from behind the scenes, that's exactly what I'd want the net at large to think.

On the other hands, if Anonymous were really as decentralized as implied in this meme, I should think everyone would want the media to think there was a shadowy conspiracy inolved -- if nothing then just for the LULZ.

My best guess is that the truth is somewhere in the middle. Anonymous is somewhat decentralized, but there is also a core group (are core groups) that started a self-perpetuating process toward some end. This core group is a little worried that things are a little out of hand, so they are now covering their tracks using the same social-media manipulation techniques used to start Anonymous itself.

wipt• 15 years ago

Why is it so hard for some people to grasp that Anonymous are just what they claim to be - everyone and yet no one person? There is no roster, no voting, but they are still organized.

Maybe one could call it a mob mentality?

bdclimber142• 15 years ago

It's hard because corporate leaders have an incredibly difficult time organizing their own companies to achieve comparable feats to what Anonymous can do overnight.

Helianthus163• 15 years ago

if they feel like it.

fleitz5• 15 years ago

You can actually use military techniques to analyze why this is. Anonymous operates inside the enemy ODA (Observe Decide Act) loop.

The ODA loop for a typical corporation is at least 5 people. Eg. from when someone observes something (anon is ddosing us) to when that information reaches someone who can act on it (the CEO) anonymous has already completed it's complete loop which is (post on IRC, have people read it and suggest action) the ODA loop for anonymous is on the order of 5 minutes, the ODA loop for a corporate CEO is probably more like 5 hours to 5 days.

Therefore anonymous will always be about 25 steps ahead of a corporate target. The primary advantage that comes from this is that anonymous appears to act 'randomly' which causes further stress on the enemy ODA loop and forces them to continually react which leaves the proactive party in control of the competitive landscape (battlefield)

If you study military genius you'll find that the most effective commanders were the ones that pushed command furthest down to the org chart.

We know that decentralized control is much more efficient than centralized control. Communism didn't lose because its a failed ideology or because its godless, it failed because it's command and control systems allocate resources poorly. They allocate resources poorly because of information asymmetry and the length of the ODA loop.

The important thing to take from this for software development is that your time from when you decide to implement a feature to when you deploy to production or get a product to market (AppStore,BestBuy,etc) is your ODA loop.

Also, for software watch what happens to your favorite webserver under intense load when you replace it's queue (FIFO) with a stack (LIFO). The LIFO drastically shortens the median response time.

bdclimber142• 15 years ago

I think someone needs to read "The Starfish and the Spider"

jdp23• 15 years ago

The log where the CEO of the parent company joins the IRC chat room is great reading. http://pastebin.com/x69Akp5L -- search for "HI it's me"

pessimizer2• 15 years ago

[04:15] <@blergh> Penny: What i am saying is that someone residing on your network attacked one of my boxes

[...]

[04:16] <+Penny> OK how do I know who is on my comcast network?

[04:16] <+heyguise> lol

[04:16] <+heyguise> omg that is precious

dekz2• 15 years ago

Interesting replies

[04:37] <+Penny> Hey I"m not sure how this whole Torrent thing works, I'm sure I"ll find out but I can tell you that if you want freedom of press and

[04:37] <+Penny> documents, there is a better way than doing it this way. What you did was illegal and it will hurt you guys as wel

...

[04:41] <+Penny> Can you take PHil out?

...

[04:42] <+Penny> Perhaps I'll invest in you guys, but invest in me, please do not leak any of the emails from HBGary

...

[04:48] <+Penny> OK, so if we fire Aaron, you won't release?

...

[04:54] <+Penny> This isn't about Greg's email this is about Bradley. When you work for the military and you take an oath, shouldn't that count?

[04:55] <+Penny> It's not negotiation, I'm asking a question I want answered. You want me to donate to bradley's fund

[04:56] <+Penny> OK BUT what if it puts people in harms' way? What if it cause bad ramifications for US citizens?

...

<Penny's husband Greg now comes on>

[05:51] <+greg> do you guys realize that attacking a U.S. company and stealing private data is something you have never done before?

Helianthus163• 15 years ago

He thought that Anonymous was affiliated ("strongly linked") with Wikileaks, as if there was some secret backdoor agreement between them. Nutcase. There doesn't _need_ to be any agreement or promise between Anonymous and other parties.

SwellJoe9• 15 years ago

I can't believe this guy has a job in a security company doing work for the federal government. I'm getting a strong vibe that he's schizophrenic. I've known an unmedicated schizophrenic, and this is the way they talked and acted. Self-aggrandizing, convinced they have comprehended great secrets based on little to no data (schizophrenics often believe that have "other ways of knowing" or extremely heightened intuition), and a belief that once they tell the whole story of the truths that have been revealed to them the world will take notice and be amazed.

The coder in this story is an hero (OK, just a reasonably nice guy, not afraid to tell the moronic "analyst" to go to hell), and obviously prevented a lot of damage by actively working against Barr's insane plans.

I feel the tiniest bit sorry for Leavy and the rootkit guy, as they clearly weren't encouraging this stuff, but really, they knew this guy was a whack-a-mole and they kept him on anyway, I guess because his crazy ego managed to close sales. It's really hard to take pity on someone that knows there's a crazy guy using company resources to go on a personal jihad against random kids on the Internet, and doesn't do anything to stop it.

The level of invasion of privacy this guy was taking part in, against children, is pretty much inexcusable. He's not law-enforcement, and should not be allowed to act as though he has a warrant for rifling through the personal lives of dozens or hundreds of children. All 50 states have laws that cover cyberstalking, cyberharassment, and cyberbullying; in a just world, this nutjob would end up in prison. Whether these kids have done anything wrong or not is irrelevant. Barr is a private citizen, and adult, and he ought to leave law enforcement activities to the police or FBI.

Edit: I should point out that I don't think anyone should be arrested for browsing facebook or twitter or whatever. I was a bit rambling in this comment, and the entirety of my thought processes are not exactly made clear by the text. The stuff that I think is probably illegal is the stuff he was doing outside of his actual research: Dropping hints and threats in mainstream media and in IRC about the data he was gathering, using his fake persona to stir up a shitstorm by leaking that a security company was gathering data on the people he was talking to, etc. I had to google cyberstalking to even know if there were laws about this stuff (and there are, and in all fifty states). While I don't know if those laws are reasonable or not, I'm pretty sure he crossed the line into breaking some of them, particularly in the case of his underage targets.

jefe78• 15 years ago

I think your last paragraph nails it. He apparently called out a bunch of innocent people. Imagine the damage that could do?

And agreed, the coder was a saint among men!

SwellJoe9• 15 years ago

Regardless of whether the ones he called out are innocent (though I suspect most are, since his methods are the work of a madman), he trawled through hundreds of profiles, twitter feeds, IRC conversations, and basically cyberstalked the hell out of every friend of every person he thought might be a "leader" of Anonymous; many of them underage, and the vast majority completely oblivious about Anonymous. He even created a fake persona, who was a kid just like his targets. This is the stuff pedophiles and con-men do to get closer to their victims. I'm not suggesting the guy is a pedophile (but "con-man" might be a good word to describe him); I'm just saying that I can't believe any adult (if not Barr himself, who I don't think is quite sane, then one of the many people at his company who had some idea of what he was doing) would look at all these activities and not think, "Whoah! This is crazy and probably illegal. We need to reel this guy in, or get him out of this company before he causes us real trouble."

cookiecaper8• 15 years ago

IANAL but it doesn't sound like he did anything criminal to me. He's obviously misguided and silly, thinking he can draw statistical relevance from assumptions based on his personal reading of Facebook profiles, but there is nothing illegal about reading information that someone posts on the internet.

Cyberstalking, to the best of my non-lawyer knowledge, involves real, disruptive harassment, not just a guy who saw you were friends with some other guy and drew some wild conclusions from that.

Barr never dropped the names so any post-facto prosecution for cyberstalking that would have been primarily based on his use of electronic methods to "identify" Anonymous leaders is unlikely.

I don't think there's anything wrong with doing your own detective work, and you certainly don't need a warrant to follow Facebook or Twitter pages. Private investigators do this kind of stuff in the "real world" all the time (granted, they have licenses).

I agree that Barr is incompetent and/or a tinge off his rocker, but the idea that only law enforcement should be able to search publicly accessible data is silly. If I find the page of a guy I haven't seen in five years, should it be illegal if I spend some time reading his publications? What if I just want to find someone that I've heard a story about so I can ask them more information? Should that be illegal? Remember, the people publishing these things publish them by their own choice with the understanding that they are making the information publicly accessible.

Dropping a bunch of names and recklessly implicating individuals in a criminal investigation is at least a civil offense, but there's no crime in drawing wild conclusions about people while cruising Facebook -- at least as long as you use the conclusions judiciously.

SwellJoe9• 15 years ago

Yes, I should have been more clear.

I believe what is illegal is that he was threatening these people, by dropping hints in IRC and national media. He used his fake persona to notify the people he had identified as "leaders" that a security company was researching them and had leadership information, etc.

I don't think it should be illegal to browse facebook, twitter, etc. But, the social engineering aspect of things and the kind of shitstorm he was cooking up was definitely evil and irresponsible. I believe some of the stuff he did does constitute bullying or harassment, and many of his targets are underage.

Regardless of the legality, which was just an afterthought in my post, honestly (I had to even search to see if cyberstalking and such had any legal meaning, and it turns out it does), I find what he was doing disturbing as hell.

msravi• 15 years ago

HBGary's proposed plan of attack against Wikileaks

http://www.thetechherald.com/article.php/201106/6798/Data-in...

steveklabnik3• 15 years ago

Here's the actual document, rather than a summary: http://wikileaks.ch/IMG/pdf/WikiLeaks_Response_v6.pdf

notahacker• 15 years ago

I'm not sure that schizophrenia is any better an explanation than straightforward arrogance. Assuming that the leaks of his work are reasonably accurate I'd be concerned if the government actually started using his research to arrest people though.

I'm not sure that Barrs interest in finding patterns in publicly available information in order to sell his intelligence is any different to advertising analysts doing the same thing. The attempt to socially engineer Anonymous via IRC is a bit more extreme, but I haven't seen any evidence that he intended harrassing them; the problem would have occurred if and when law enforcement bodies started harassing innocent people based on his dodgy intelligence. If you start making any investigative work or social network analysis carried out by private citizens online illegal on the basis of stalking laws then you risk censuring a lot of people actually doing good work.

cookiecaper8• 15 years ago

True, and Barr's idea is not actually far off; Facebook and other social networking sites are intelligence goldmines, linking people to aliases, groups, networks, and a lot of other things. Think of how hard it may be for a fugitive to retreat to a trusted safehouse when he's published a list of everyone he's ever met on Facebook via the Friends list, and/or named the handful of people he hasn't friended in a status or note.

The CIA has shown interest in Facebook's database for a long time, because, besides the normal detective work a normal detective can do if he reads through a Facebook page, if you get a handful of real mathematicians working with that dataset, they can certainly rig something up that would at least return really interesting results.

techiferous• 15 years ago

"Self-aggrandizing, convinced they have comprehended great secrets based on little to no data (schizophrenics often believe that have 'other ways of knowing' or extremely heightened intuition), and a belief that once they tell the whole story of the truths that have been revealed to them the world will take notice and be amazed."

Are you describing a schizophrenic or a newbie entrepreneur? ;)

SwellJoe9• 15 years ago

Point conceded. Maybe this guy is merely recklessly arrogant and has drunk the Koolaid of entrepreneurship, and is not actually insane.

steveklabnik3• 15 years ago

> The coder in this story is an hero

Oh man, I'm not sure if this is funnier if you meant it, or not...

> in a just world, this nutjob would end up in prison.

Yup. I'm interested to see what happens in the weeks ahead. I really doubt that anything bad (other than getting his SSN posted to Twitter...) will actually happen to him, though.

SwellJoe9• 15 years ago

Subtlety is a art.

noahc3• 15 years ago

I am not a lawyer, but I'd like to address your legal points.

Just as I don't need a warrant to view a publicly available website, he shouldn't either. What you are proposing is that it should be illegal to view public pages in a certain order or time. What is the difference of me viewing 100 of my new crushes friends pages over 2 days vs 2 years? There isn't, but the first is rifling, the second is innocent curiosity.

I don't believe he was cyberbullying anyone. However, to address cyberstalking and cyberharasamnet we first have to consider what a reasonable person would have felt had those actions been taken against us. Before the release of the data, and while this was going on, those on the list were unaware of what was occurring. Just as a reasonable person isn't threatened until they become aware of the stalking, threats, etc in real life. Being unaware of what he was doing would mean that no constitute cyberstalking, cyberharassment or cyberbullying took place.

Barr is a private citizen accessing public information and drawing crazy conclusions. There's nothing illegal about that nor should there be.

ilamont• 15 years ago

Wouldn't communicating an "untrue statement of fact" that certain people are leaders of an allegedly law-breaking group to government officials or other people constitute defamation (assuming that their reputations were harmed as a result)?

SwellJoe9• 15 years ago

I agree with you up to a point.

And here's that point:

"Before the release of the data, and while this was going on, those on the list were unaware of what was occurring. Just as a reasonable person isn't threatened until they become aware of the stalking, threats, etc in real life."

People did become aware of it before the release, which is why the exploits of his servers happened, and why Anonymous got butthurt and went on a crusade.

He was dropping hints and threats in IRC, national media, and in email, that he was doing this stuff. He also "leaked" via his fake persona some of the kinds of information he was gathering to his victims so in order to drum up more publicity and to scare them into action. And, it now turns out, he planned to do a lot more than that.

I don't have a problem with him idly browsing facebook or twitter, though I have to question the mental stability of someone that spends all their time voluntarily reading and logging the incoherent ramblings of teenagers all day and trying to build a conspiracy out of it.

The legal issue is that he was threatening people with exposure, via major media outlets. When seeing this stuff, anyone who ever happened to drop in on the IRC channels had to think, "Crap. When is the FBI gonna show up to question me because I made a joke about Egypt on IRC?" You and I both know the government are wholly incompetent at dealing with issues on the Internet, and they try to make up for that incompetence by being extremely heavy-handed in execution of their misguided policies. I'd be scared as hell if I thought someone, apparently trusted by the government, was going to "reveal" my involvement in some wacky Internet conspiracy to the FBI.

kdahfklaf• 15 years ago

'an hero' does not mean what you think it does.

colanderman• 15 years ago

I'm astounded at both the CEO's (Aaron's) lack of basic grammar skills, and predeliction for "script kiddie" talk. How do you get to be CEO of anything when you communicate (even informally) at the level of an 8th grader?

(edit: I meant Aaron; Penny was decently well spoken)

leon_2• 15 years ago

1. drink brain away 2. become "social media" expert 3. lie to get funding 4. ??? 5. ceo

1337p3373• 15 years ago

I think you've just described at least two startups I've worked for.

memetichazard• 15 years ago

I assumed that all those garbled messages were from typing on an iPhone. One particular error reeked of autocorrect. If you've seen the things people post on Damnyouautocorrect...

Still no excuse for not writing professionally and at least checking up on what you just typed.

freedrull• 15 years ago

Is this article supposed to make sense?

eam• 15 years ago

A message from HBGary Federal: http://www.hbgary.com/

X-Istence• 15 years ago

https://twitter.com/#!/anonymousirc/status/35578771021111296

Apparently the S/MIME signatures match just fine ... it is possible they got ahold of their private keys as well to sign messages, but that would be more difficult than hacking the central servers as private keys are stored locally on the clients machine.

cookiecaper8• 15 years ago

Not necessarily. You can copy private keys to different machines just as easily as you can copy anything else. Since it's important not to lose private keys, it's plausible that lazy and/or ignorant persons would copy them to central servers for easy retrieval. It's much more hassle to burn to a CD and put them in a safe deposit box at the bank, after all.

prpon• 15 years ago

A great read. It's amazing how Aaron Barr completely believed his hunches even when his programmer said that the data doesn't backup his analysis. He is a business man trying to get paid big bucks from FBI for his hunches.

r00fus• 15 years ago

Sadly, were he rewarded with a continuing money stream, he would likely justify the innocent names as "collateral damage" as the money would have been a mark of success.

Aaron Barr fancies himself a modern-day witch-hunter, and it's good he was hoisted on his own petard.

khafra2• 15 years ago

Gives one pause to think about the attractiveness of the career "witch-hunter" when the witches actually do have magic powers.

buckwild• 15 years ago

good story.

hardik988• 15 years ago

Wow, this was almost like a cyber crime thriller! Anyone for writing a book on Anonymous ?

mahmud• 15 years ago

Anon should write it together, using Etherpad.

Perceval• 15 years ago

That will turn out poorly: http://static.funnyjunk.com/pictures/therobot02.jpg

leon_2• 15 years ago

> so I can give all those freespeech nutjobs something

That says everything about Mr. Barr that needs to be said.

maweaver• 15 years ago

Well you could complete the quote for fairness: "I just called people advocating freespeech, nutjobs - I threw up in my mouth a little."

chc4• 15 years ago

Barr could have edited it out if he didn't really believe it. A fleeting moment of awareness that you support fascism isn't really all that important in the grand scheme of things.

johnmack• 15 years ago

Someone, please, bring eggs and throw them at Aaron Barr during BSides security Feb 14-15! Literally: bring eggs. Please, I'll by you a beer

corin_• 15 years ago

Where's Sorkin when you need him to write a screenplay?

stcredzero18• 15 years ago

Reclining somewhere warm while drinking his FU money?

rokhayakebe• 15 years ago

I am reading through the entire article, pausing every other paragraph to tell myself "This would make a kick ass movie"

scotty79• 15 years ago

You just need to program as good as I talk bullshit. I think I've heard something along those lines in my professional expeirience.

shareme2• 15 years ago

1 First lesson: All data on Internet until verified is suspect.

JonnieCache• 15 years ago

This guy is clearly a dangerous moron. This kinda makes me feel better for being so cold about this whole affair in the other thread.

The terrifying thing is that there are still people in government who believe sentences like "specific techniques that can be used to target, collect, and exploit targets with laser focus and with 100 percent success" through social media.

I mean, who claims one hundred percent success at anything?

EDIT: Also, that coder hopefully shouldn't be buying any drinks for a while.

rst• 15 years ago

The same people who believe that DRM can effectively prevent copying, if the people selling it say that it can. Which is to say, the ones who think of technology as wizardry, and evaluate wizards by looking for social proof. (They can't really evaluate what the guy's selling, but they sure can tell if he's the kind of person that would get respect at a cocktail party.)

stcredzero18• 15 years ago

My read: The piece is based on Anonymous propaganda. Anonymous itself is actually an amorphous propaganda outfit. The primary purpose of their actions is to produce media. Anonymous achieves these ends in part by taking on opponents with good story value, but no consequential power. They also engage in actions against significant players, like credit card companies, but these actions are most effective in creating media while only resulting in momentary financial damage. Anon is a media entity, not a financial one.

1337p3373• 15 years ago

Some of them are. The Guy Fawkes masks are sort of a good way of describing them: a bunch of completely unrelated people assuming the same identity for a time. Likewise, the "Anonymous" you hear of is usually the "Anonymous" that pulls this sort of stunt and then publicizes it. There are a number of people hanging out on /b/ doing nothing but humorous (depending on your sense of humor) image manipulation, also calling themselves Anonymous, and people trolling LiveJournal doing the same. They've all got a different character, but if they all use the same name, it makes them difficult to attach attributes to.

They get to be anonymous by all assuming the same name, "Anonymous"; it's tricky to talk about them as a unified group because it's a group of groups, all with the same name. "This Anonymous" versus "that Anonymous" is hard to talk about. (It's a disclosed exploit in language.)

stcredzero18• 15 years ago

They get to be anonymous by all assuming the same name, "Anonymous"

People have been doing something like that for thousands of years. That's never meant that everything done under that name was wholly aimless and spontaneous.

michaelty• 15 years ago

"The coder said he didn't support all they did, but that Anonymous had its moments. Besides, "I enjoy the LULZ.""

Who among us hasn't?

dalore• 15 years ago

Reading the story, time and time again his programmer warned him about anonymous, and said he shouldn't be messing with them.

Then what do you know, he gets attacked by anonymous. Do you think maybe his programmer is in anonymous? :)

tezmc• 15 years ago

You don't have to have anything to do with Anonymous to have some idea of what they're capable of when they're poked with a stick.

chc4• 15 years ago

Not really any good evidence to support that conclusion unless you're using Barr's statistical methodology. That coder's responses to Barr aren't that far off from what I'd say in his position. It's not surprising that a programmer would be familiar with Internet geek subculture, and predicting that Anonymous will turn LOIC on a direct challenger is not much of a leap.

rapicastillo2• 15 years ago

On a related note, what he was trying to do reminded me of a Kaggle.com winner on social networks, deanonymizing social networks: http://www.cs.utexas.edu/~shmat/shmat_oak09.pdf . The latter, of course, is better than gut feel.

Also, his coder is fun. :D Taco!!!

_b8r07• 15 years ago

I've resisted discussing this but I think it's late enough after the event to chime in.

First off, disclaimer: We sell HBGary's products in the UK, I know Greg and Penny personally, as well as Jussi (who runs rootkit.com but as far as I'm aware does not work for HBGary). I'm not claiming to speak for anyone or company, just for myself on a purely personal level.

After looking into this, what happened is that HBGary invested in 15% of HBGary Federal, a company set up to do work HBGary didn't want to do. Now presumably (from TFA) they were looking at selling this off.

I don't know Aaron, but it sounds to me like he's a bit of a character at least (I'll leave it to others to resort to namecalling) and completely misunderstood what Anonymous are and how they work - FWIW we investigated Anonymous' years ago for some clients who'd been DDOSed and concluded that the simple solution is (to paraphrase Greg's irc comment) not to poke the wasps nest.

Penny, Greg and HBGary in general are in a bit of a tough situation now because of Aaron's actions and appear to have no ability to impose anything on HBGary Federal. This should serve as a warning to others that if you're going to use the name elsewhere, you better have a way of enforcing unforseen issues that may arise.

The sad thing about all of this is that Penny and Greg are really great guys, and HBGary is a good company with some insanely great technology. I'm sure they'll pull through, but I imagine there will be collateral damage for them resulting from this for some time to come.

moe2• 15 years ago

HBGary is a good company with some insanely great technology

Insane would be to trust security-related products or advice from a company that can't even secure its own mailserver.

_b8r07• 15 years ago

We don't know if the security of the mailserver was at stake here. A web app was compromised through SQL injection, then lateral movement was used to get to the mailserver (which may or may not have been on the same box).

The rootkit.com mail server has nothing to do with HBGary AFAIK.

To put it in perspective, HBGary's (not HBGary Federal) technology is a thing called Digital DNA that cuts down the amount of time it takes to analyse memory fragments. That's their focus.

I could understand your reference if they were a company that wrote mail server software and were compromised through their mail server, but your point is a bit of an apple to oranges comparison.

The thing is, people get owned all the time. Even security companies. Heck, we get targeted attacks on us fairly routinely, and when something comes in we have (I think, and unlike most we have actually been able to test it's effectiveness) reasonably good methods for detecting bad stuff coming in and going out, but I'd never say that one day our emails won't end up spread across the Internet, and I wouldn't be so bold as to suggest that someone that has had systems compromised didn't do a proper job just because they were compromised.

The attacker only needs one way in. The defender has to protect against everything. That's not a level playing field.

nhangen2• 15 years ago

I've yet to see anyone address the behavior of anonymous, and it appears as though it's been justified by most because this dude was an asshole - but why not point a finger at them both?

cookiecaper8• 15 years ago

Well, there's no story to really address there. Barr was dangerously ignorant and naive. He had a complete misconception of how these things were organized and how they worked while claiming to know all of the identities of "the leaders" by correlating Twitter posts with what someone in IRC was talking about.

If you get on the news and say, "Hello Criminal Group. We have a bunch of information on your leaders that will get them arrested, we are meeting with the FBI next week", it is only reasonable to expect some attempted retaliation. I think that no one is surprised that the targeted group compromised HBGary's servers -- there are, after all, much worse things that could happen -- except maybe the HBGary people themselves, who, as we see here, were already in way over their heads.

No one addresses the behavior of Anonymous because it is completely and totally the expected reaction. The shocking thing about the story is Barr's personality and behavior, not the idea that someone will retaliate if you threaten to decapitate their organization.

nhangen2• 15 years ago

So that makes attacking a company's website OK?

If I did something illegal every time someone pissed me off, I'd be a lifer.

peterpaul• 15 years ago

I <3 anon

mcantor• 15 years ago

FTA, from one of Barr's e-mails: "... accept during hightened points of activity..."

Did this drive anyone else bonkers? I think "accept" or "hightened" alone wouldn't have bugged me. But for some reason the juxtaposition of the two in this sentence made me nerdrage.

marshray• 15 years ago

"except" -> "accept" could be explained by autocorrect or speech recognition but "hightened" suggests the use of neither.

justinj• 15 years ago

Guess he got what he wanted - there's no such thing as bad publicity.

shareme2• 15 years ago

Anyone see the wikileaks connection?

Some DOD contractors were attempting to hire them to put out miss-information to discredit wikileaks..

Which might explain the original Anonymous insvestigation

lwat• 15 years ago

Actually it was Bank of America that hired Palantir and HBGary Federal to help them defend against the upcoming BoA Wikileaks release.

micah63• 15 years ago

I never really felt safe on the Internet, but wow

How one man tracked down Anonymous—and paid a heavy price

Related Stories