LulzSec: Why we do what we do

by ssclafani • 15 years ago

329 178 15 years ago

saulrh5• 15 years ago

Might want to change the title to something like "LulzSec actually had a point after all." They do, too, an even better one than I expected. Not only are they making a point about how terrible security is ("Do you think every hacker announces everything they've hacked?"), but they've also called out the internet on its generally abysmal attention span. I wouldn't be surprised if they'd had this written on day zero.

patrickod• 15 years ago

Part of me feels that the publicity side of their argument is a little overblown. Many people do publicly disclose exploits, it's just that LulzSec has made a huge deal in the media about each one. Another part of me is happy to see them call people out on their abysmal security practices. Sony would not have upgraded/redone their security practices had there not been attacks. The only thing worse than poor security is having a false assurance that it's good.

hollerith• 15 years ago

That's not the most important thing I took away from the submitted link.

To me, the important thing is that LulzSec says that it derives pleasure from causing harm to people -- like the people who used to add poison to bottles of Tylenol, package the Tylenol back up again and place it back on the supermarket shelf. Although they could be saying that to cover up their real agenda, most writers (and especially most writers who have the tech skills needed to do what LulzSec has done) could not fake an admission of this sort as well as this text would have to have been faked.

Since it is natural human behavior to rationalize an antisocial motivation with a more socially-acceptable cover story, you would expect LulzSec to say things like, "We are doing this to bring public attention to how terrible security is." But if it is a rationalization, and it sure seems that way to me, surely it would be a mistake to focus on it and not the true motivations.

>they've also called out the internet on its generally abysmal attention span.

What an surprizing interpretation! I interpreted the parts about boredom as a continuation of the author's honestly disclosing his own motivations, not anything about internet users in general.

thomasz• 15 years ago

Lets not overblow things. They don't kill random people, they carry out pranks which can cause emotional and maybe financial distress, that's all.

achompas2• 15 years ago

Not only are they making a point about how terrible security is ("Do you think every hacker announces everything they've hacked?"), but they've also called out the internet on its generally abysmal attention span. I wouldn't be surprised if they'd had this written on day zero.

Neither of these are novel concepts: we've heard about abysmal internet security (FireSheep) and low attention spans (Nicholas Carr[0, 1] and Jonah Lehrer[2]) repeatedly over the last couple of years.

This release may seem profound to you, but LulzSec proposes no solutions to the problems they're creating. They're too nihilistic to put on white hats, and they deserve none of your praise as a result.

[0] http://www.theatlantic.com/magazine/archive/2008/07/is-googl...

[1] http://www.amazon.com/Shallows-What-Internet-Doing-Brains/dp...

[2] http://scienceblogs.com/cortex/2010/04/attention_and_intelli...

saulrh5• 15 years ago

The difference is that LulzSec managed to get their word on every tech blog in the world. They also managed to get their basic message - nothing is safe, and here's proof - onto nearly every single major news site in existence, and they made their message immediately and personally important to millions of people. That's why I'm praising them. They don't need to propose a solution; that's already been done. They don't need to have a new message; extant messages are good enough. What they bring to the party is visibility.

madmaze• 15 years ago

I think we have found the LulzSec hacker manifesto.

shareme• 15 years ago

They seem somewhat clueless..

If the NSA can partner with ISPs to scan internet traffic for phishing, viruses, etc ...the obvious next step is Lulzsec mentions or member mentions...in IRC, email, etc..

There is no such thing as hiding when attacking the internet, sooner or later you become the bitch

BasDirks2• 15 years ago

what makes you think Lulzsec mention the name "Lulzsec" a lot more often than the average HN reader?

getsat3• 15 years ago

It's good for the NSA that there's no way to securely communicate over an insecure medium. It's also convenient that all Internet infrastructure exists inside the USA.

__rkaup__• 15 years ago

You are being ironic. It actually is possible to communicate securely over an insecure medium, and not all the internet's infrastructure is in the USA. Am I right?

kenjackson2• 15 years ago

Given the NSA's charter, I wouldn't be surprised if most of their data interception mechanism are focused on non-US internet traffic.

glassx2• 15 years ago

Call me crazy, but I'd rather have LulzSec stealing passwords on crappy secured services than a NSA agent scanning my whole life. That would be the single worst outcome.

misuse-permit• 15 years ago

Really? Because the NSA could be doing it right now and you wouldn't have a clue. If someone steals your password though, chances are you'll notice.

migrantgeek2• 15 years ago

I agree with showing how poorly secured websites are and how easily our information is distributed even when we think it's private.

What I don't agree with is their use of DDoS attacks against sites like cia.gov.

DDoS attacks are pointless. All they point out is how a site has limited resources for dealing with so many concurrent connections.

Sites should deploy onto an infrastructure they feel is adequate to deal with the expected load plus some additional room for growth and spikes.

I'm sure the cia.gov doesn't get hit very hard on a normal day so they didn't go crazy on infrastructure which is understandable. A DDoS proves nothing and prevents people from accessing data.

If you're going to hack, please wear a white or grey hat.

cryptoz• 15 years ago

When Anonymous attacked Visa and Mastercard via DDoS (in retaliation to them cutting off Wikileaks donations), Anonymous did actually succeed in stopping the online verification systems for both companies (SecureCode, or something, and Verified by Visa). In that case, the DDoS attacks did more than just take the site down; they financially hurt their target, which was probably the aim to begin with.

I'm not justifying the attacks and I agree that they are the wrong way to go about this business, but it would be naive to suggest that the DDoS attacks are a minor inconvenience.

ojilles2• 15 years ago

DDoS's have a monetary impact, yes. However, what the parent is saying is that all infrastructure has limits in terms of bandwidth, etc. The point is that it's not the same class of "attack" vs. finding an exploit. The latter is more in line with the "strive for more secure sites". The former, not so much.

nextparadigms2• 15 years ago

It also led to Paypal allowing Wikileaks to retrieve the money they already had before they suspended their account.

corin_• 15 years ago

But clearly that's not what they want to do, they're not claiming that their intentions were moral or ethical, just that their having fun happens to have some arguably positive impact at times.

mentat5• 15 years ago

There is a need to develop systems that aren't subject to DDOS (at least the current generation). It used to be very easy to DOS anyone's network stack (think SYN flooding). If people hadn't shown that it was an issue by doing it, the Internet would still be running on stacks that were trivial to undermine many different ways. Saying that something is easy to do and has a tremendous impact is an engineering problem statement. Demonstrating it shows that it's also a business problem. This is how things get fixed, when people get tired of being instantly knocked of the Internet by .4% of the LulzSec DDOS capacity. The Internet still has some basic problems, ignoring them won't make it go away.

Shenglong• 15 years ago

DDOS attacks are terribly hard to stem. I remember Softlayer having a Cisco Guard they claimed helped against DDoS attacks, but it seems to cut off and block a good amount of legitimate traffic as well.

someone132• 15 years ago

See, is there a practical way to "fix" the problem behind a DDOS? More specific attacks (slowloris, SYN flood, ping of death, smurf, and a laundry list of other stuff) can be fixed by simply introducing changes to the infrastructure that makes such things possible.

But a DDOS attack is, at heart, nothing more than a brute-force attack - flooding a single website / IP with so much traffic that it can't respond. No matter how much fancy technology you add, if you have a 100Mbps link, and someone's sending 1Gbps of data at you, you're out of luck.

And, yes, I realize that there are companies that specialize in protecting against DDOS attacks - generally, they move content to a CDN and use some intelligent filtering to drop packets (i.e. people that request multiple times in succession, etc.). But this still is reliant on the fact that their connections are large enough that they can actually process all this data.

If a large country decided to use all it's available Internet bandwidth to DDOS, there's not much anyone can do about it.

In short: DDOS attacks will likely always be around - they might require higher bandwidth (country-scale or thereabouts), but it's not "fixable".

gasull• 15 years ago

> There is a need to develop systems that aren't subject to DDOS

Some protocols are immune to DDOS: like BitTorrent and Freenet. HTTP wasn't designed to deal with DDOS.

AshleysBrain• 15 years ago

I think the point of their DDoS attack on cia.gov was in response to the US's statements that cyberwarfare would be responded to with actual warfare. They're just poking the beehive to see what it will do.

bdhe• 15 years ago

DDoS attacks are pointless. All they point out is how a site has limited resources for dealing with so many concurrent connections.

This point was raised a few months back in relation to PayPal and Visa getting DDoSed because of Wikileaks: DDoS attacks could be the new digital age version of a protest, a disruption of normal activities to draw attention to a particular cause (whether or not that cause is worthy is secondary). In that sense, DDoS attacks are very relevant.

scythe4• 15 years ago

>People who can make things work better within this rectangle have power over others; the whitehats who charge $10,000 for something we could teach you how to do over the course of a weekend, providing you aren't mentally disabled.

This is a common complaint among blackhats: they see whitehats as being in the game for the money and taking advantage of the unenlightened as much as they [the blackhats] themselves do.

I don't really know what to make of it.

huckfinnaafb• 15 years ago

Blackhats can cost organizations way more than whitehats would charge in operating costs, personal identity theft, and reputation.

Whitehats are only taking advantage of the unenlightened as much as a mechanic is taking advantage of someone who doesn't know anything about cars - they provide experience and expertise and offer a service for a high price - at least, a higher price than if the client knew how to fix it themselves.

webXL2• 15 years ago

I love it when the economically illiterate attack others for "price gouging" as if the third party doesn't have a choice in the matter or they aren't "unenlightened" enough to properly appraise the value of what they are buying.

How do I know that my jeweler isn't gouging me on my fiancee's 2 caret diamond ring? Because I know that there's a fixed quantity of available diamonds, and almost everyone would buy them at a given price. And if I need to verify that, I can go to the jeweler down the street. Everyone would buy security consulting at a given price, but that quantity is even more limited than 2 caret diamonds.

Why is my house worth a third less than what it was 3 years ago? Because there's at least a third fewer potential buyers than there was when I bought it. I wasn't "price gouged" or fooled in either instance.

Whitehats specialize in security and it frees up our time to specialize and produce excess value for others. It's not a conspiracy. If Steve Jobs and LeBron James aren't tricking people into giving them money, neither are whitehats. It's the free market and, believe it or not, it produces wealth.

Wilduck• 15 years ago

Sure, but what blackhats often claim is that even if a company pays whitehats large sums of money, it is often fairly easy for the blackhats to do just as much damage as they could before.

alexophile• 15 years ago

That false comparison has always bothered me. Preying on the weak for fun instead of profit doesn't make you right, it makes you sound like a sociopath.

seats• 15 years ago

Preying on the weak for fun

Preying on the weak for profit

They both kind of have a sociopath sound to them

nihilocrat• 15 years ago

I think everything else said in the post proves they are sociopaths. They don't seem to place value in "peons", "lulz lizards", or really any kind of human beings.

dodo53• 15 years ago

It's a bit of a silly way to respond though - they could either be whitehats themselves and charge a more reasonable amount; or charge the same amount and donate whatever they think is reasonable to education campaigns or whatever.

JoshCole2• 15 years ago

My guess is rationalization. They are lieing to themselves to justify their actions. I've read that even serial-killers think they are doing good. I don't see why blackhats would be much different.

jrwoodruff• 15 years ago

What corporation would ever trust a 'free' security consultant?

MatthewPhillips2• 15 years ago

Just a question: if all they were doing was manipulating URLs (and I know they've moved beyond that) would they be doing anything illegal?

tomp2• 15 years ago

Yes. If I leave the door to my house unlocked, it doesn't mean that it is ok for you to come in without my permission.

MatthewPhillips2• 15 years ago

Can I look in the windows?

Deestan2• 15 years ago

Morally, it's also not just how you break in, but what you do afterwards. I.e. if you prevent more harm than you do.

If you enter the unlocked door and write "HI YOU FORGOT TO LOCK YOUR DOOR" with lipstick on the bathroom window, you're alerting the owner to a bad security practice by giving them a good scare. It is A Good Thing, because you likely prevented them losing their stuff.

If you enter the unlocked door and start smashing and stealing stuff, you are technically still alerting the owner to a bad security pracice, but it is now A Bad Thing. By "being" the worst case, you only guaranteed something that was only likely to happen.

edw2• 15 years ago

Raise your hand if you're hesitant to write what's on your mind for fear of receiving some special attention from Anonymous, LulzSec, and friends.

BasDirks2• 15 years ago

Your question is more inviting than anybody speaking their mind. The one thing I thought when I read their statement was that it reminded me of A Clockwork Orange.

edw2• 15 years ago

Yes, the parents in A Clockwork Orange! Or pretty much everyone in the "It's a Good Life" episode of Twilight Zone:

http://en.wikipedia.org/wiki/Its_a_Good_Life_(The_Twilight_Z...

That episode also made it into the Twilight Zone movie directed by John Landis.

See you next Wednesday!

diminoten4• 15 years ago

Please don't fear them, their power comes from feeling righteous in what they do. No one's figured out how to manipulate them that easily.

At least not yet, anyway.

mentat5• 15 years ago

The impact of their attacks has more been a strong motivation to "get my house in order". I'd been using LastPass for some time but decided that I should get the YubiKey for two factor auth. I also started becoming quite a bit more vocal at work about the sorts of things it might be a good idea to take a closer look at. This is a wake up call for what's already happening. They just decided to do it and tell the public instead of sitting, waiting, and letting people continue to feel safe. If there's danger and it's at your doorstep, it's good to feel not safe.

nextparadigms2• 15 years ago

Wasn't LastPass hacked earlier this year?

marchdown• 15 years ago

Isn't YubiKey a fail-closed mechanism? Are you okay with trading a little extra protection from voyers with the possibility of losing access to the portion of your personal data that you deemed important enough to encrypt and vital enough still keep around as opposed to wiping it clean?

jjcm• 15 years ago

I wouldn't be to worried about it, and here's why:

For Anonymous, they're driven by strong moral convictions in their attacks these days (e.g. look at this puppy killer, let's fuck him up). The wayward person on the internet is of no interest to them. I've had my info posted on 4chan in full - address, phone number, email, facebook, screen names for other things, etc, with no lasting effects. Got spammed a bit, had some strange things arrive in the mail, but nothing malicious. They'll only be mean if they think you deserve it.

LulzSec is out there with a different purpose - they want publicity. The ddos attack they just ran wasn't to strategically take out services, it was to gain publicity by temporarily taking out unimportant but socially obvious targets. The CIA website was the public facing one, the only purpose it served was to be a PR job for the CIA. Smearing their PR site gets people looking. Smearing some random guy on the internet does not.

Basically, you're not important enough to warrant attention, nor am I, and nor are most people.

diminoten4• 15 years ago

This smells to me like a hastily conjured rationalization for a series of attention-seeking acts wrought by a small group of disenfranchised industry workers who have something to say, but they're just not articulate enough to voice it so they blow shit up instead.

saulrh5• 15 years ago

They can voice it perfectly well. The problem is that they can't be heard in the mass media without some large event to draw attention. The last month has been their big event, and now they have the attention they needed. They had a good plan and it was executed perfectly.

[Edit: by "good plan" I mean that their plan had a good chance of success, not that it was beneficial. That part is still up for debate.]

diminoten4• 15 years ago

No, they cannot voice it perfectly well, if they have to resort to stealing user information to get their message across.

Their plan was not good, insofar as it caused pain for a great many people. What they did was not okay, and should not be lauded as a positive thing for the Internet at large.

The problem is that their antics are even being considered as anything other than the terroristic (in the real sense of the word, not the post 9/11 hyped up nonmeaning it tends to carry today) acts that they are.

If someone broke into a hospital and flung all of the patient records out onto the street, we wouldn't be having this discussion; they'd absolutely be considered criminals. So what if the glass they broke to get into the hospital wasn't shatter-proof? Sure, the hospital security would be improved, but there are a great many ways to go about fixing the problem without compromising the privacy if hundreds of thousands of people.

hugh32• 15 years ago

a small group of disenfranchised industry workers

Do you really think they're industry workers? I'd peg most of them as high school kids. Probably with the occasional creepy thirty-something thrown in for good measure.

gabaix• 15 years ago

exactly. high schools have a strong envy for anarchy - trying stuff for fun. I think most readers here went through that phase and forgot about it. Flirting with the borders is fun. We were not realizing the consequence of our acts.

mhitza• 15 years ago

For a moment I'd taught I was the only one to notice. If we would ignore them, they would just fade away.

ilikepi• 15 years ago

If by "we", you mean everyone on the planet, including the blackhats who benefit indirectly by utilizing the results of LulzSec's exploits, then...maybe.

This is not realistic, however.

jjm• 15 years ago

How do we enforce that these companies (such as banks) utilize proper security protocol (within reason of course)?

Some would say, "With your wallet!". But what happens when it's your wallet that gets stolen (electronically)?

What do you think?

TeMPOraL2• 15 years ago

Unfortunately, I've never seen "vote with your wallet" concept work[1], neither in the Internet, nor in real life. When a company misbehaves, there's usually a big group of their customers which doesn't know about it, and another (maybe little smaller) group, that doesn't care at all (or enough[2]). It's an interesting issue I have no idea how to fix...

[1] - if you know any examples, I'd be glad to hear them.

[2] - "Maybe this company is bad, but hell, the competition is 10 minutes further walking from me...", etc.

pingswept• 15 years ago

In real life: http://en.wikipedia.org/wiki/Disinvestment_from_South_Africa

Djehngo• 15 years ago

Initially I thought the disclosure argument they made was weak (we hack stuff because when we announce it similar companies will be more careful) because unless they cause enough trouble to make security an immediate priority for a given non-targeted company, then it's unlikely that they will overcome that company's inertia.

However I realised that I have become significantly more careful with password reuse now because there are no companies I absolutely trust to keep my information from leaking out.

dgabriel• 15 years ago

Adorable. They're bullies and proud of it. It's one thing to call out security exploits, and quite another to take great joy in causing others pain.

getsat3• 15 years ago

> to take great joy in causing others pain

This happens far more often than people realise.

ZeSmith• 15 years ago

Still does not make it okay.

noglorp2• 15 years ago

They're mostly taking publicity, the joy is mostly for show.

Wickk• 15 years ago

This just reeks of arrogance

noonespecial• 15 years ago

Why we do what we do: We're 15, unsupervised, and behaving badly.

Do they really need a manifesto?

snorkel• 15 years ago

This missive strongly reeks of teen spirit. Guess we'll find out when the FBI perp walks them in front of the cameras.

puredemo• 15 years ago

No one that young would have the capacity to understand some of the contextual references required to write this piece. If you pay attention to the way LulzSec writes and words things, they aren't at all immature in their thinking or worldview. Ceasing to give a fuck about perceived trivialities is something that comes with age and seeing how the world really works. The confidence they have came with age as well. Neither is not a sign of youth whatsoever.

I'd guess mid-thirties for these guys, at least for whomever is putting out their twitter updates. This is someone who is basically immune to white-knighting and is a truly hard-core realist. It takes quite a while for someone reasonably intelligent to become that cynical, and then a while longer for them to act on it.

Anyway, I'm a fan of these guys. While I wouldn't do what they are doing myself, I certainly understand the mindset. I'm not quite sure I understand the arguments against what they're doing. The knee-jerk reactions of wanting to call them wrong frequently seem more immature to me than their recent campaigns. The real world is messy, and LulzSec's work is a valid reflection of that.

As far as the comparisons to sociopathic thinking, that's just ignorant. Sociopaths generally don't care about anyone but themselves and that's obviously not the case here. A sociopath would never release any of this data, and would simply use it for their own advantage, regardless of who was harmed.

LulzSec is gleaning entertainment here from the unwashed masses to be sure, but they aren't out there enslaving people with debt, indoctrinating them with religion, shooting them for protesting, putting them in cages for drug offenses, etc. All of which is completely legal, and in my opinion, far more sociopathic than releasing some bit personal data or playing a few practical jokes on people.

savramescu• 15 years ago

I don't think they're 15, they're to articulate for that age. But I don't think they above 30 either.

bh422223• 15 years ago

And I just realized what it is about LuLzSec that's bothered me. I couldn't quite put my finger on it, but now I realize deep down they are nihilists.

That's a damn shame.

What seemed most admirable about Anonymous is that as much as they were also in it for lulz and pure chaos, underneath there seemed to be a kind of idealism. Idealism is seductive, nihilism is off-putting.

chriserin2• 15 years ago

Or maybe that Anonymous idealism was a fraud and lulz, as peers, could see the hypocrisy much clearer, as everybody in their community likely do what they do because of the thrills and ignoring the pain caused. Lulz admitting it is likely taking the high road? or is that too tortured as twist.

bh422223• 15 years ago

Perhaps anon was also pure lulz with absolutely nothing else behind it. But I vaguely recall their writing to be strongly pro freedom. And their most prominent vandalisms seemed to be an attempt to make a point about basic rights and freedoms.

When LuLzSec state that they don't care, and don't even care if they get arrested, that's definitely nihilistic and kind of sad.

Certainly they too in their juvenile ways were close to making a good point. A point about shocking incompetence when handling and storing sensitive customer data. A point about unethical behavior in government. And I believe them when they say they have stuff that they've chosen not to release. So they are not in fact true sociopaths or true nihilists. I guess that makes it even sadder when they say they don't care about anything but lulz.

saraid216• 15 years ago

invokes Ayn Rand!

cmurdock• 15 years ago

These men are nihilists, nothing to be afraid of.

noglorp2• 15 years ago

Note LulzSec claims to 'not be Anon' (lol).

It seemed like there was idealism lurking because there was!

bh422223• 15 years ago

Good point!

chmike• 15 years ago

This seems so fishy. Perfect timing considering the last 24 months events. I think it was unavoidable and we'll have to face it and get ready for the consequences.

adamdecaf• 15 years ago

> "suggests...our actions are causing clowns with pens to write new rules for you. But what if we just hadn't released anything? What if we were silent? That would mean we would be secretly inside FBI affiliates right now, inside PBS, inside Sony... watching... abusing..."

Isn't that happening right now and by the people with pens?

hnsmurf2• 15 years ago

This is classic psychopathic behavior. Instead of torturing people physically to see them squirm they're doing it digitally, but the same lack of empathy is there.

_emice• 15 years ago

From what I've been reading the attacks were not sophisticated, mainly using SQL injection. Many here on HN understand that kind of threat but it seems lots of companies and important services don't. Is it possible that the attention shone on these simple/trivial hacks will cause those less security conscious admins to get rid of that low hanging fruit?

If so, it should help reduce the impact of a broad, simultaneous attack across many sites from much more dangerous foes. I am not saying it is right, but it may be more effective than the legislation our congress comes up with to protect us, with fewer nasty side effects.

trotsky2• 15 years ago

OK, so for the remaining 3 people out there who were pathologically not paying attention, computer hacking is easy. The state of computer security is poor. Lulzsec deserves a medal and a chest to pin it on for breaking this news to all of the people who don't have a facebook account, have never been on irc, didn't see the movie wargames, don't know anyone who plays world of warcraft, has never read the new york times, has never heard of china and has never heard anyone utter the word "stuxnet".

For the rest of us, it's pretty tedious.

There's another situation that fits the general parameters of what they describe. Almost no one is protected against it. Being a gunshot victim.

At least in the US, pretty much anyone can get their hands on a handgun either legally or illegally. Almost anyone can use one with a bare minimum of instruction. And almost no one is protected - if you pick a name out of a hat of all america, pretty much any possible outcome will be dead easy to track down, stalk, find the right opportunity and shoot dead. And a vanishingly small numbers of shooters make an announcement about the whole incident on the Internet.

But, all that said, if you go around shooting people for no real reason and bragging about it you're assuredly a psycopathic asshole.

daeken2• 15 years ago

Being a victim of a random person with a gun with no particular affinity for shooting you isn't easily avoidable; being a victim of a random person with Burp Proxy and a couple hours of work is. That's the key difference here. Security is hard, but we have great processes to make things secure and keep them secure against all but the most dedicated attackers.

Mind you, these processes aren't perfect. Things fall through the cracks, and effectively nothing will keep out a significantly determined attacker, but that doesn't mean you shouldn't follow well-established security methodologies. In the vast majority of cases, they hold up well.

Edit: I want to note that, in all likelihood, no amount of secure development and review would've kept people out of Sony -- there were just too many people that wanted to attack them, and too large an attack surface. It could've diminished the number of successful attacks, and it could have reduced the amount of data stolen, but in all likelihood attackers would've still made it in to some extent. However, things like the Brink attack might have been stopped entirely, since they didn't seem to be terribly determined to get in.

sunchild• 15 years ago

Honestly, I'm more worried about companies like Citi allowing users to change the uid param in the URL to access someone else's account data than I am about kids in it for the lulz.

trotsky2• 15 years ago

We must have a different definition of easily avoidable. The truth is that organizations that spend a much larger than average portion of their energy and resources on computer security can and do still fall the victim to intrusions on a regular basis. Outfits that follow generally accepted best practices get successfully spearphished on a weekly or monthly basis. Startups are encouraged by the industry to throw up websites in weeks, yet the tools they're given largely do very little to prevent them from shooting themselves in the foot on a regular basis.

Lulzsec isn't even calling their shots. They're casting around for security issues widely without rhyme or reason. You're supposed to lock your front door, but if you go through a neighborhood and try everyone's front doors you'll always find one that's left open. Now imagine your neighborhood is the world. It's literally impossible that you'll ever run out of victims.

The truth is that computer security isn't shit because all the noobs out there that don't have a CSO, don't hire matasano, don't have sufficient change review policies, don't have a 24x7 ops team with live instrumentaion and don't have DDOS protection are id1ots. Sure, any one of them can be pointed and laughed at and said they're losers. But taken in aggregate, it's not all their 30,000,000 individual failures, it's a failure of the computer industry that has long pushed speed and ease over safety and continues to sweep the current security environment under the rug. And also a failure of our own security industry for selling ineffective, labor intensive solutions and pricing most of the rest beyond the reach of most potential customers.

And I dare say that Lulzsec isn't going to have much of an impact on any of that.

gcb2• 15 years ago

I've been kept out of Sony and all this by never consuming from them.

this is the epitome of capitalism. your comment was spot on until the edit.

last sony thing I paid was a cassette walkman. then after betamax, minidisc, memory stick, etc, etc, etc... you have to be a sucker to support them. sad but true.

anyway, by not consuming from a company with low market ethic, I also avoided a company with bad network security ethic. they would be hacked? could be. but if nintendo is hacked, I can at least just change my password not my name and credit card.

for similar reasons I also avoid apple, j&j, and a few others.

dexen3• 15 years ago

The gunshot analogy fails hard. LulzSec pre-empted at least half of it, by stressing how harm occurs quietly all the time. Data gets stolen or destroyed and we just don't know it.

Unlike gunshot wound, where a person lands in a hospital, or morgue, or goes missing, data can be, and indeed is, copied quietly. Of gunshots, people are informed most of the time; of security breaches, barely ever. Cops investigate most gunshots, but do they know of most security breaches?

The big hope is the press will at last start paying attention to (in)security of our data. Thus the headline-grabbing tactics.

The other half is that corporations don't shoot people, people shoot people. And to the wit, people don't store 200.000 bank accounts on a web server, corporations do. You can -- and should -- hold corporations to a somewhat higher standard when it comes to affording decent protection for customers. It's no coincidence LulzSec weren't after granny-loves-her-cat blogs, but after commercial services.

rgbrgb• 15 years ago

Corporations most definitely shoot people... http://en.wikipedia.org/wiki/Military

dazmax• 15 years ago

Except they didn't say that they are doing this to bring attention to security issues. They are doing it because they can, and because it brings them some entertainment – that's the point the gunshot analogy was addressing.

They only bring up all the silent malicious hacking that happens as an argument that we shouldn't care so much about what they're doing.

natural2192• 15 years ago

None of this addresses the DDoS attacks. I agree with you in regards to the SQL injections / URL parameters, but your post fails hard to defend Lulzsec's DDoSing of anybody.

drivingmenuts• 15 years ago

Well, maybe people will start shooting hackers. I volunteer Lulz to be first against the wall.

laughinghan• 15 years ago

To rephrase what dazmax said: They're under no delusions they're not evil. They're saying, "there are a lot of evil people around, and yeah, we're one of them, but who cares? There are a lot of evil people around, and in terms of damage, we're probably doing far less than anyone else and happen to be doing some good by bringing attention to how weak these security systems are. You're spending so much effort chasing us and condemning else; not that we don't deserve it, but you should be spending at least as much, in fact, far more on the people doing far more damage and not announcing it and not doing any good at all."

They're right too. I'm not saying what they're doing is good, or even necessary like some vigilante stories portray, but they're right that we should be devoting just as much attention and effort denouncing and trying to catch the doubtless countless people, who like they, tried some simple attacks and discovered that most security systems are almost trivial to breach, and are taking real advantage of it, not just putting it on the internet and watching the lulz unfold.

127• 15 years ago

I don't see that analogy working very well. It's not about shooting single people. It's about banks building their vaults using cardboard and paper, instead of concrete and steel. It's just not that smart.

hnsmurf2• 15 years ago

As I mentioned below it does very much show psychopathic tendencies. These people clearly have no empathy for those they are harming. This includes far more than just the Sony executives that everyone hates (despite not knowing).

Online security is poor for the same reason airport security is. Good security would take enough time and money to make the whole thing economically unviable.

redthrowaway• 15 years ago

>Online security is poor for the same reason airport security is. Good security would take enough time and money to make the whole thing economically unviable.

Airport security in the US is poor because the policies are a series of politically convenient patches applied to a broken system. In Israel, where the threat of terrorism is far greater, their airport security is both much more effective and much less invasive. Why? Because it was designed to work, from the ground up. They don't hire legions of idiots at minimum wage or close to it to do their security. They hire ex-military and ex-mossad people to surveil travellers. They have highly-trained people who know how to spot potential terrorists, and multiple layers of security (usually just someone saying hi and engaging in light chatter) that catch the vast majority of problem people before they get anywhere close to an airplane.

The US system is expensive, invasive, and ineffective. That doesn't mean airport security in general is doomed to fail, it means the US is incompetent at it.

afterburner• 15 years ago

If my data was stolen, I'd be annoyed, not dead. And the law, and enforcement priorities, reflect that.

scilro• 15 years ago

They need to bring in someone who can write without seeming like a 12 year old who grew up on 4chan.

yters4• 15 years ago

Hey, if people really want a secure internet I believe the government would be more than willing to lock it down for us.

That's all that's going to happen as kids like Assange and Lulzsec keep up with their criminal shenanigans. Governments are going to say, "Enough is enough!" and lock it down like in China.

oliveoil• 15 years ago

This thing must be fake. I thought they were doing it for the lulz.

doyoulikeworms• 15 years ago

Their campaign is about reaching out, eliciting a response, and then reveling in the emotional connection they've created with another anonymous soul across this tangled mass of copper and silicon.

In other words, for the lulz.

tobylane• 15 years ago

"This is the lulz lizard era"

Yes it is. What the fuck is it? Nightowl would be more believable, and true.

Bertil• 15 years ago

Why is this text the first one from Anonymous et al. that doesn't move me, at all? They sound odd, using a “we” to include all ‘digital natives’ while I never heard anyone under 25 use “we” before; they mention (two girlfriend's) faces on MSN, but I never heard of a webcam on MSN; I never heard of anyone actually enjoying a show call it “we want our shot of entertainment”.

crux• 15 years ago

When are the internet tough guys of the world going to tighten up their prose? This third-rate Patrick Bateman routine is so fucking old at this point. There is no easier way to mark yourself as a barely socialized child barely capable of any critical thought than to try out that ridiculous, outdated, unconvincing pose at being this cynical, wise, best-informed übermensch above all morals. It's not a good look.

SSHisForWienies• 15 years ago

Any wall can be broken, but it doesnt mean that anyone who breaks a wall is a hero. What wonders me more why did China infiltrate the group ?

bwaaa• 15 years ago

LulzSec seems to be just a group of teenagers that have actually nothing special to say. As they want to be like the grown-ups, they try to add a message behind their acts, but there is no message, no morality. If they were real hackers and not only prepubescent teens, they would not justify their action by any manifest, they would just act, no matter what people say or think. Their vocabulary is also proper teen vocabulary : "bitches" "mentally disabled" "evil bastards" "we nom nom nom, we move onto something else that's yummier" "unimpressed zombie""Watching someone's Facebook picture turn into a penis and seeing their sister's shocked response is priceless" "Receiving angry emails from the man you just sent 10 dildos to because he can't secure his Amazon password is priceless.". They don't know how to write, their sentences are full of repetitiveness, the vocabulary is poor.

LulzSec is just a group of teenagers (or someone alone). And they are really really funny. (This is not a compliment..)

floppydisk• 15 years ago

When it comes to security, you run into IT departments being the red headed step children of the corporation and NIMBY (not in my backyard). It's a lot easier and cheaper to stick your head in the sand and pretend nothing is happening or you have some mitigating factor that discourages people from going after you be it size (miniscule for instance), participating in a niche market, etc. It's a lot easier and cheaper to do an ostrich than actually spend the money on decent security.

nsomaru• 15 years ago

The last line got me a giggle

foysavas• 15 years ago

Who else has a hunch they don't yet have access to Brink accounts, but instead have access to log files that would reveal password when users now change them?

majmun• 15 years ago

this kids should be punished by pulling their ear. or beating them with branch. they're too young for prison

quark92• 15 years ago

whatever is their excuse to hack companies it is illegal , it is a crime and should be punished . if they want to pay attention for security, then they can establish organization and give away free courses about security and privacy in legal way instead of breaking laws and stealing people information . black hat methods would never be agreed to improve security and privacy ..

sigzero• 15 years ago

We don't care. Just stop please.

LulzSec: Why we do what we do

Related Stories