The legal attack against Anonymous and LulzSec
The March 6, 2012 arrest of six Anonymous/LulzSec members included a public release of the sworn affidavits and indictments. These are posted below. The following is a synopsis of the facts obtained from those released documents and is an excellent example of how the FBI conducts criminal computer investigations (and how they utilize informants).
Claims against Hector Xavier Monsegur (aka Sabu)
The arrest of Hector Xavier Monsegur was the most significant as many surmised that Monsegur turned informant to assist the FBI in the investigation against the other hackers. The documents filed against Monsegur claim that Hector Xavier Monsegur (known as â€œSabuâ€ in Anonymous circles) acted as the rooter and assisted the groups in gaining unauthorized access to the systems by identifying vulnerabilities and providing infrastructure support (servers and routers) which could be used to launch the attacks. Whether the â€œinfrastructure supportâ€ mentioned in the documents was unauthorized use of his companyâ€™s hardware, the purchase of hardware using stolen credit cards, or simply acting as a LIOC client/agent or Tor exit node is not specified. Oddly, the indictment specifically mentions that the group supported Wikileaks and its founder, Julian Assange, a stab at Wikileaks that seems much out of place.
Specific attacks that Sabu allegedly participated in included the December 2010 DDOS attacks against Visa, MasterCard, and PayPal, the early 2011 attacks against the governments of Tunisia, Algeria, Yemeni, and Zimbabwe, and attacks against HBGary Federal, Fox Broadcasting Company, ACS Law, PBS, Nintendo, and Sony PlayStation Network.
One interesting accusation included a 2010 hack of an automobile parts company (no specific company name given in the document) whereby Sabu â€œfraudulently causedâ€ the shipment of four automobile engines to his New York, New York home. This one falls outside the lines of the other supposed attacks and if true, could have been the undoing of Sabu given how easy it would have been to tie the shipment, and therefore the system intrusion, directly to Monsegur himself.
The document also claims that credit card numbers and bank account numbers were obtained by Sabu and used to purchase items and pay bills. The kicker â€“ the document reveals their objective of forcing Monsegur to forfeit his own property to pay for these items.
Nowhere in the case against Monsegur does it mention that he may have turned state evidence against his fellow hackers. But, there are many clues that Sabu was pressured into turning including a Summer arrest and an obvious change in behavior (some fellow hackers noted that in retrospect, it seemed as if Sabu was covertly hinting that the other members should not trust him).
Claims against Ryan Ackroyd (United Kingdom), Jake Davis (United Kingdom), Darren Martyn (Ireland), and Donncha Oâ€™Cearrbhail (Ireland)
The indictment claims against Ryan Ackroyd, Jake Davis, Darren Martyn, and Donncha Oâ€™Cearrbhail hint that all were members of Anonymous and/or the Internet Feds hacking groups. The document claims that they carried out a campaign of â€œonline destruction, intimidation, and criminalityâ€. Specific attacks mentioned parallel the claims against Monsegur and include the hacks against HBGary and Fox Broadcasting Company. The supposed cyber attacks involved deleting data, stealing confidential information, decrypting confidential information (or â€œde-encryptingâ€ as the Feds put it) including passwords, publicly disclosing the stolen information by dumping the data on public websites, hijacking email and Twitter accounts, defacing websites, doxing personal information (publishing private, personal details about a person), installing backdoors on the penetrated systems, intimidating the victim, and subjecting the victim to harassment. The document pointedly mentions their association with â€œSabuâ€ (aka Hector Xavier Monsegur), and other hackers identified as â€œTflowâ€, and â€œAvunitâ€.
The documents notes the specific roles of each defendant claiming that Ryan Ackroyd identified and penetrated systems while Jake Davis acted as the â€œspokesmanâ€ for the group. The hack on Fox Networks notes that personal information, including names, birth dates, telephone numbers, email addresses, and home addresses, of 70,000 X-Factor contestants was stolen.
Logs of IRC discussions are playing a critical role too â€“ especially logs of conversations that were purposefully initiated and led by the FBI and/or FBI informant(s). Screen names and subtle personal information the hackers revealed in the chats were used to tie the screennames to the real person (although the feds specifically point out the obvious â€“ that they used proxy servers to cloak their IP addresses). Davis, the â€œspokesmanâ€, told Avunit on IRC channel #hq, â€œIâ€™m happy to talk to press on IRC/Skype, have done so for months. Have talked to maybe 150 journalists.â€ This one statement alone was likely considered justification for tagging Davis as the â€œspokesmanâ€ for the groups.
It is also interesting to note that Ryan Ackroyd and Jake Davis had been charged previously for alleged participation in a hacking spree during the Spring of 2011. The claims mentioned above lead to further charges against the two.
The Sealed Complaint against Jeremy Hammond
Jeremy Hammond of Chicago was already a noted activist and hacker who had previous brushes with the law. Hammond is also known to have given a Defcon speech on electronic civil disobedience and has even been profiled by Chicago Magazine. His reputation precedes him.
The case against Jeremy Hammond, aka Anarchaos, sup_g, burn, yohoho, POW, tylerknowsthis, crediblethreat) comes from a deposition of Milan Patel (an eight-year FBI Special Agent veteran) where he notes that in December 2011, Hammond sent stolen credit card information to â€œa computer located in the Southern District of New York (supposedly the computer of Hector Xavier Monsegur). The credit card information was stolen from the comprised network of Strategic Forecasting Inc., an Austin, Texas based company (known as Stratfor). The deposition claims that one â€œco-conspiratorâ€ received a chat message from Hammond stating that he had broken into the network of Strategic Forecasting and that the stolen data had been uploaded to a server in the â€œsouthern district of New Yorkâ€ to a second â€œco-conspiratorâ€.
The affidavit notes that the credit card information stolen from Strategic Forecasting was used to purchase at least $700,000 worth of goods. On December 29, 2011, a document titled â€œantisec teaser 12/29 (legit)â€ was posted on pastebin. It said:
Itâ€™s time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. But thatâ€™s not all: weâ€™re also dumping ~860,000 usernames, email addresses, and md5 hashed passwords for everyone whoâ€™s ever registered on Stratforâ€™s site. We call upon all allied battleships, all armies from darkness, to use and abuse these password lists and credit card information to wreak unholy havoc upon the systems and personal email accounts of these rich and powerful oppressors.
The deposition reveals little specifics since it is intended only to prove probable cause. It does mention specific technologies though which gleans some insight into how Anonymous operated and hid their identities. Technological terms such as ip address and MAC address hint that log files and pentraps were used to gather evidence in the cases. IRC and Jabber are described hinting that chat logs were used. The affidavit goes into a lengthy description of TOR (the Onion Router) which implies that the TOR network was used by Anonymous and LulzSec in an attempt to hide their true IP addresses (it also describes files â€œfound on a .onion serverâ€).
In addition to the technical details listed, simple personal details that the hackers revealed were strung together to narrow down the list of suspects. The affidavit notes that in one chat log, the defendant stated, â€œsome comrades of mine were arrested in st louis a few weeks agoâ€¦ for midwest rising tar sands workâ€ (a protest held in St. Louis, Missouri on August 15, 2011). Arrest reports were pulled and the list of arrestees included Hammond’s twin brother and another good friend of Hammondâ€™s. In another chat log, sup_g states that he was arrested in 2004 during the Republican National Convent in New York City. A list of people arrested during the convention included â€œJeremy Hammondâ€. These details (and many more examples that were provide din the affidavit), combined with the fact that Hammond had previously been arrested for computer intrusion, led the FBI to set up surveillance on him and on March 1, 2012, to install a pen trap to collect addressing and signal information from his home. The pen trap further revealed that Hammond was sending a significant amount of data through the TOR network and combined with the personal surveillance, was used to tie Hammond to specific screen names (they could tell that certain chat sessions conducted under certain screen names ended each time Hammond left his home).
The amended complaint against Donncha Oâ€™Cearrbhail
Aliases used by Oâ€™Cearrbhail included palladium, polonium, and anonsacco. The affidavit claims that in early 2012, the personal GMail accounts of two National Police Service (Ireland) officers was compromised by a hacker. Via this hacked email account, messages were obtained by the hackers that gave the telephone number and passcode of a scheduled police conference call discussing the Anonymous investigation. Anonsacco, via a private chatrom, chatted with the informant about the information he had obtained.
Hi mate. Could I ask you for help? I need to intercept a conference call wich would be a very good leak. I have acquired info abou the time, phone number, and pin number for the conference call. I just donâ€™t have a good VOIP setup for actually calling in to record it. If you could help me, I am happy to leak the call to you solely. I guarantee it will be of interest!
The conference call recording was later posted online and tied to one of the screen names.
The anonsacco screen name was then cleverly tied to other aliaes (primarily via personal details revealed during the conversation), including palladium, which linked Oâ€™Cearrbhail with other hacks. Oâ€™Cearrbhail was arrested for another computer intrusion and released. His later conversations regarding the first arrest were also used to tie him to other screen names and hacking activity. It also appears as if Oâ€™Cearrbhailâ€™s IP address was easily tied to some of the breakins. In addition, his cloaked IRC login ID was tied to several screen names.
As far as I can tell, the names of the accomplices are not listed but there are hints in the documents that one or two co-conspirators assisted the FBI in the investigation. Later news leaked that a 124 year sentence was threatened if the informant did not cooperate with the FBI (a sentence which struck many as out of proportion to the alleged crimes).
One particular statement in the affidavit notes that the informant, with encouragement from the FBI, provided an upload bin on a server in the southern district of New York. This is the only notable fact and could hint that the unnamed co-conspirator was Hector Xavier Monsegur. But nowhere is Monsegur specifically labeled an informant. The affidavit does note that one of the members of LulzSec was arrested (during the Summer of 2011) and agreed to cooperate in return for receiving a reduced sentence. The affidavit also points out that this person was located in New York, New York while he was working for the FBI and that this person has already plead guilty to various charges. In retrospect, many Anonymous members noted a marked change in Monsegurâ€™s behavior (oh how a â€œsafe wordâ€ used in the chats could have saved the day).
The affidavit describes how the FBI used the informant to further trap other Anonymous members. For instance, the FBI directed the snitch to provide storage space for the attackers. During the Stratfor hack, the informant provided Hammond and the others a computer server in New York, New York which they could use to store data. This was used to gather additional evidence against the other Anonymous members.
In addition, the snitch recorded chat logs that were used to derive the attackers various aliases and tie them to other crimes. Hereâ€™s a sample of a logged conversation:
sup_g: I was thinking we order some servers with them stolen credit card numbers. Lots of servers with big hard drives and make four of five mirror .onions with them. A few will go down right away, a few might not.
informant: can you get an offshore server with one of those verified credit cards? Iâ€™ll try it too.
sup_g: since web/onion is really the most practical way to browse the mails and clearspace. Torrent is damn impractical, no one will download. We might want to offer it anyway but even so, focus on web viewing.
And in this exchange, notice how the informant refers to the hacker by different aliases to ensure he responds in kind to each one.
informant: yo you
sup_g: hey homeboii
sup_g: Itâ€™s all real good = )
informant: took a na
sup_g: hooking it up with custom script to parse them things as we speak.
informant: howâ€™s the news looking?
sup_g: I been going hard all night.
informant: I heard weâ€™re all over the newspapers. You mother fuckers are going to get me raided.
sup_g: we put out 30k cards, the it.stratfor.com dump, and another statement. Dude, itâ€™s bigâ€¦
informant: if I get raided anarchaos your job is to cause havok in my honor.
sup_g: it shall be so
The Anonymous and LulzSec (Lulz Security) indictment documents are available for download on scribd. See embedded versions below.
Indictment against Hector Xavier Monsegur filed in the United States District Court Southern District of New York:
Indictments filed in the United States District Court Southern District of New York against Ryan Ackroyd, Jake Davis, Darrent Martyn, and Donncha O’Cearrbhail.
Sealed complaint against Jeremy Hammond.
Amended complaint against Donncha O’Cearrbhail.
Hector Xavier Monsegur Waiver of indictment in return for cooperating with the government