The feds' guide to bringing down a hacker from the inside

infoworld.com

Earlier this month, Jeremy Hammond was sentenced to 10 years in prison for his role in the hack of security consultancy Stratfor Global Intelligence. Hammond is the biggest fish to be snared after the FBI managed to turn former top Anon Sabu into a confidential informant. His conviction is a dagger in the side of the struggling hacktivist movement.

Quinn Norton has a fascinating post on Medium called "How Antisec died." It offers an almost-inside view of how the feds targeted and took down the most active members of Anonymous and its kin.

Norton has reported extensively on the activities of the Anons. More than any reporter I am aware of, she managed to get inside that very secretive, very suspicious org and talk to them, even if she never knew more about them personally than the handles they liked to use in IRC conversations.

What she reveals about how Hammond was taken down, though, isn't simply a tale of some arrested adolescent who let his hacking talents run amok. Too many details just don't smell right.

The sting

When Hammond was sentenced, he gave an extended and impressively articulate statement about his role in the hack, his motivations for doing it, and how he got set up by Sabu (aka Hector Xavier Monsegur), a key member of the Anons turned FBI informant. He wrote:

I had never even heard of Stratfor until Sabu brought it to my attention. Sabu was encouraging people to invade systems, and helping to strategize and facilitate attacks. He even provided me with vulnerabilities of targets passed on by other hackers, so it came as a great surprise when I learned that Sabu had been working with the FBI the entire time.

On December 4, 2011, Sabu was approached by another hacker who had already broken into Stratfor's credit card database. Sabu, under the watchful eye of his government handlers, then brought the hack to Antisec by inviting this hacker to our private chatroom, where he supplied download links to the full credit card database as well as the initial vulnerability access point to Stratfor's systems.

On Dec. 6, the feds contacted Stratfor, informed the company it was being hacked, and asked it to do nothing to stop it. For three weeks, Hammond had his way with the systems -- downloading millions of emails and thousands of customer credit card numbers, which were later used to generate bogus donations to various charities, and trashing the company servers -- all while the FBI watched.

Foreign intrigue

But the Stratfor vulnerabilities weren't the only ones Sabu shared with Hammond. At the FBI's behest he provided Hammond with a laundry list of vulnerable targets for the hacker to crack, then uploaded all the information Hammond collected onto servers controlled by the FBI.

The names of the targets provided to Hammond were redacted in the statement released by the court. But somebody posted the unredacted list on Pastebin. It's an eye-opener:

These intrusions took place in January/February of 2012 and affected over 2000 domains, including numerous foreign government websites in Brazil, Turkey, Syria, Puerto Rico, Colombia, Nigeria, Iran, Slovenia, Greece, Pakistan, and others. A few of the compromised websites that I recollect include the official website of the Governor of Puerto Rico, the Internal Affairs Division of the Military Police of Brazil, the Official Website of the Crown Prince of Kuwait, the Tax Department of Turkey, the Iranian Academic Center for Education and Cultural Research, the Polish Embassy in the UK, and the Ministry of Electricity of Iraq.

Hammond's proof, he says, can be found in the chat logs maintained by the FBI, as well as other documents -- all of them under a "protective order" that prohibits them from being made public.

In her Medium post, Norton wrote:

I believe this list, personally, though I can't prove it. I remember the Brazil, Syria, and Colombia hacks, and some of the talk of Iraq and Puerto Rico. Some of the docs were even screenshot and included in the Lulzxmas video. Some of the Brazilian defacements gave thanks to Antisec and Sabu in particular. Some documents from these hacks appeared online on the now-defunct Anonymous leaks site, par-anoia.net.

For the record, I talked to someone with some 20 years of experience living in the shadows where the security world and federal government intersect. He is skeptical that the feds went to the trouble of targeting Hammond -- using Stratfor like a goat tied out to a stake to lure a lion -- when there are so many bigger bad guys to bag.

Domestic Web work

Still, the questions these accounts raise provide enough material for another three Jason Bourne movies. For example:

  • Hacking foreign government sites, exposing backdoors, pawing through millions of emails -- who does that sound like to you? Any three-letter agency that's been in the news lately?
  • Did the feds hand a talented hacker its wish list for places it wanted to break into but didn't have the skilz? What happened after Hammond opened all those backdoors? Were these foreign entities ever notified about the vulnerabilities?
  • How did that Stratfor vulnerability come into Sabu's possession? According to Norton's account, " the vuln had come from outside the group, and that person was out of touch not long after turning it over." That's not suspicious or anything.
  • Was it perhaps a friendly member of No Such Agency who provided it to the feds, in exchange for that list of foreign backdoors?
  • Why did the top fed running the Hammond sting retire three days after the hacker's arrest and become president of Crowdstrike, a security firm whose MO is to hack the hackers? Did Shawn Henry take the list of backdoors to his new job?
  • If you handed a convicted bank robber a list of bank vault combinations, then sat back and watched him go on crime spree for three weeks, wouldn't you be at least just a bit culpable yourself?
  • Finally, why are the chat logs and other the evidence cited by Hammond being kept from the public? If the feds truly acted like the forthright upholders of truth and justice they claim to be, wouldn't they clear them of such scurrilous suspicions?

Is Hammond guilty of breaking the law? Absolutely, though I'm sure he'd frame it as civil disobedience or political protest. But it also seems pretty clear he was lured into these particular crimes by the feds. If that's not entrapment, then I don't know what is.

More important, though, the crimes he committed pale in comparison to the allegedly legal and patently illegal activities undertaken by certain three-letter agencies. Where are the jury trials for those?

Free Jeremy Hammond Website

Write to Jeremy!

Jeremy Hammond #18729-424

MDC Brooklyn

Post Office Box 329002

Brooklyn, New York 11232

Category: 

Comments

I think the problem with these guys is that they see the digital computing system as totally distinct from the broader social and even broader still natural environmental system. Computers and computer systems are built in a modularized way so that the parts are interchangeable. I can, for example, add an extra memory module or remove an uneeded kernel module, add remove software and hardware as becomes necessary. This type of thinking is somewhat faulty when you consider that the addition of an extra piece of hardware or software only has ramifications for those functions that that hardware or software if supposed to provide. Yet it is well documented that data in memory or memory registers in the CPU can be accessed by processes totally unrelated to those that put it there.

How does this relate to social and environmental systems?
Obvious. There is no absolute mutual exclusion between an agent of the state, an agent of a corporation and even an agent of finance capital, a free agent and revolutionary praxis. In fact, a correct analysis would require exactly the opposite, total integration. The media likes to put the hackers on one side (the bad guys) and the law and informants on the other (good guys) and we like to do exactly the opposite, but the reality is much more complicated. I do not intend to rustle up dirt on Hammond because I admire what he did and respect that too much, but the narrative being bandied about of his total ignorance to the darker side of political online hacktivism is more unflattering and disempowering than he might want. To simply present him as a patsy for the feds denies him a certain bit of credibility and the narrative loses a major aspect of the bravery he is demonstrating.

But then you have to wonder what Hammond thought of Sabu and if he knew he had been arrested by the feds in 2011. It reminds me of a weed dealer I used to know who it was well known he had been raided a few years back. So, everyone who bought weed from him knew information was getting out, it was not exactly a black box. And the question wasn't simply who was getting the information but more so, what they intended to do with it.

My advise for hacktivists and activists alike (as well as heads, even in legal places such as Colorado and Cali) is to first and foremost ask what they intend to do with you. If you are a piece of a puzzle in a large system like this, if you are being treated as a module in a larger mechanism, then ask yourself, how do they conceive of your function in this larger mechanism. This empowers you in knowing what they have in mind for you and if it is undesirable, you may be able to change things. Don't just follow their script and their intentions, there's a lot of wiggle room and clandestine methods to exchange info and solidarity.

And always know the risks because you may just want to play it safe and not take those risks that land you in deep deep doo doo.

Yup. Know people for years before you take risks with them, giving you ample time to observe their behaviour and scale the level of risk accordingly.

please don't generalize

Hey, it's the please-don't-generalize-troll. Always so polite, it's refreshing.

There is mutual exclusion between hacktivists and the other grouds, and it is not based on media propaganda, but prison walls.

Why most cops don't go to jail over murder explains it all. The State will not persecute itself.

Please substianciate on those foreign processes infiltrating the CPU unnoticed.

And although it's always crucial to set records straight with any activist when feeling you're possibly being instrumentalized, I doubt it's an effective tactic against undercovers.... perhaps to repel them, at best.

Substantiate what? I'm still dealing with neuropsychologists about far more pertinent matters, like being able to write and read at all. Please, don't insult.

SSH, Tor, AES, PGP, GPG... all of these tools have been the official tools promoted by hacktivists for years. All of these tools are OBVIOUSLY cracked open, and they've probably been for years. Hacker's biggest mistake I think are their reliance on the enemy's "gifts". In the case of AES and Tor, it's been openly created by the NSA.

Now what's important to think about, is how we're going to deal with the NSA's 4 year SigInt plan, without repeating the same stupid gullibility....

(can't link. Look on Cryptome.org, November 23, for the pdf)

The NSA still recommends that government agencies used AES, clearing AES-256 for "Top Secret" when a 35 random character passphrase is used. The NSA, like us, has to assume it's enemies could be as capable of finding it as they are-or that they might get snitched again. That means any backdoor in AES itself would force the NSA to withdraw the recommendation that AES-256 be used for "Top Secret," the kind of secrets that can change the course of a war, bring down an "allied" government, or cause other governments to become hostile. If they backdoor AES and another Snowden blows the whistle, all that stored AES traffic other governments become open books.

OK, if the NSA can't put their backdoor in the encryption itself, what can they do? Let's use bicycle locks as an example. Suppose I get control of Onguard and Kryptonite, and find the local Nazis are ordering their locks online for some really nice bikes. If I get Kryptionite and Onguard locks made weaker, any thief that finds this out even by accident gets my bike too. On the other hand, if I get these companies to give all the Nazis keys picked from a list of ten out of thousands, I can now put each key on my keyring, find a Nazi's bike, and try them one through ten until I am riding away. If they will directly tell me which key each Nazi is using, better yet. Meanwhile the locks themselves are as strong as ever, and with my own keys NOT on that list of ten, even if the Nazis intercept the list or pull the ten keys out of my mailbox, they still don't get my bike unless they can smash the lock.

In other words, AES is not the problem until NSA tells the government itself to stop using it (then we know it's cracked for real). Until then, the NSA goes around, not through AES by limiting keys, being handed the keys, or just plain reading shit either before it is encrypted or after it is decrypted.

The NSA (its command) are ABOVE Top Secret. That's the point. Top security clearances are not like a binary (of have and have not), but rather a hierarchy of levels and sub-levels, the result of a complicated system of compartmentalization. So the fact that AES is used by the lower levels of government (even the Congress and the Senate) doesn't mean it cannot be cracked open with a single click. It just allows for damn strong security from outside threats.

Assuming that this whole chain of command -as any other- is a Russian puppet, with probably the Central Security Service or even the NSA at its core (I'm one to believe that Keith Alexander is truly "the Man", who else in the goddamn military has the latitude to retrofit his control room like the USS Enterprise or wear a custom-designed uniform? think about that), it's only a matter of disciplinary necessity to be able to hack through the encryption of all the lower levels.

I'm pretty sure that the Cyber Command has its own intricate encryption measures, because for security reasons, this would keep infiltrators from gaining any access to any sensitive top-level infos. We're not just talking about flying saucers here, but VITAL information related to Defense. Hence why you needed a Snowden to leak some infos out. Coz nobody else would have been able to access it from anywhere outside of the inner circle.

Also I forgot... Beyond claims of national security matter, it makes it a highly-profitable business too!

http://cryptome.org/2013/11/nsa-power-profit-pay.htm (download carefully)

over the years and I've seen mountains of them. Even with their shortcomings things like PGP and other encryption and Tor still work. So we shouldn't give up on them.
For further security I wild also suggest thinking more cleverly in not what we use but how use web tools there are lots of ways to send safe data that are electronic versions of the ol mail drop trick for example.
Don't be limited because the same email you use for everything might be compromised.

no they don't

Just takes three words for full genius, eh?

Not. Perhaps you actually got nothing intelligent to write.

suck it liberal

Well that was my point... that these things may allow better security, but there's better than that. Like i2p instead of Tor, or Tor with no javascript, cookies and exit nodes from hostile countries/servers (mainly those hardcore NATO member countries), DIY analog encryption methods, meet in ways or places that render cell phone/bug surveillance impossible or unlikely, use a discreet coded language for sensitive stuff, and stay away from fucking FB/Google accounts for ANYTHING...

I'm still apphrehensive of PGP and even GPG. They will never be as safe as unplugged encryption measures.

Most of the NSA's focus on countering encryption has been aimed at ssl and other encryption over networks. The cyphertext at least is available, and such a system can be compromised at either end or anywhere in the middle. Over a network, you can trust encrypted files you encrypt locally with noncommercial, open source encryption, then sent over the network to a recipient with a machine as secure as yours. An encrypted loopback-mounted DM-crypt container is probably safest of all, and unlike PGP/GPG can handle any kind of media, even big, fat video files. Remember also that a good encrypted file the FBI or Secret Service can't crack probably isn't going to the NSA at all for an attempt at cracking,as the NSA is "court-shy" about sources and methods. Instead they are more likely to see if the recipient did something stupid after decryption like saving the plaintext to disk. A Windows machine, BTW, should be presumed in all cases incapable of safely handling decrypted content of this kind.

By comparison, cracking disk encryption of data at rest is far more difficult as the compromise must be in one particular machine and takes a real expert to do it without physical access. Guess what? That encrypted DM-crypt container you just emailed is one of these in a sense!

Usually Secret Service, not the NSA, is tasked with attempting to break encryption on machines cops get in raids, but activist machines have to wait in line with Mafia machines and that sort of thing. They will get a a lot more Truecrypt and Bitlocker than DM-crypt, but a few years ago the Washington Post published the SS's perferred method of that time: A dictionary attack with the target's writing prepended to the dictionary. This works on any machine encrypted with a one-word password that can be found in the dictionary, any word from the target's writing QUICKLY, possibly any phrase from the target's known body of written work. If the passphrase is anything else, this fails totally.

Commercial stuff the FBI is often able to get past by themselves. Example: The ATA security set commands allow setting a disk password that blocks even reading the disk. One guy in a criminal case thought he was safe, but the disk maker gave the FBI as well as the NSA a backdoor password and he was convicted. In open source software defenses there is no place to hide a back door or an extra key. Microsoft Bitlocker, for instance is sold by a company that also sells tools to law enforcement to defeat it. The cold boot tools, etc may only be cover for a keylogger. A similar hole in Linux's native DM-Crypt would be found very quickly by people who go over that code with a fine-toothed comb, every time it changes.

I KNOW encryption works, the pigs never got into the computer they stole from me in 2008! Don't believe stories spread by those that want you to communicate in the open so they can monitor you with ease, saying no encryption can ever work. Also don't trust claims that shit that can get someone killed or jailed for decades can be trusted to ANY electronic device, just in case. If you have to use electronics at THAT level, remember that you can smash, burn, and replace a cheap netbook after use for less than the cost of one billable hour of a lawyer's time. Encryption is a layer in your defenses, not your only defense.

the internet is a dark alley.
there is no safe place.
stop being fucking cowards.

Cowards?

Only cowards are those who've put Jeremy in jail.

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
To prevent automated spam submissions leave this field empty.
z
%
M
7
N
k
9
Enter the code without spaces.
Subscribe to Comments for "The feds&#039; guide to bringing down a hacker from the inside"