U.K. police charge hacker linked to LulzSec
19-year-old's server logs may lead police to others in hacking gang, says security expert
Computerworld - Authorities in the U.K. today charged a 19-year-old with using a botnet he controlled to take down the website of a national police unit.
The charges filed against Ryan Cleary followed his arrest Monday by the Metropolitan Police Central e-Crime Unit.
One security expert said Cleary's arrest, and the seizure of his computers, may lead authorities to members of LulzSec, the group that claimed responsibility earlier this week for taking down the website of the U.K.'s Serious Organised Crime Agency (SOCA).
SOCA is responsible for, among other things, major computer crime investigations in the U.K.
Cleary, of Wickford, England, has been linked to both LulzSec and Anonymous, hacker crews that have used distributed denial-of-service (DDoS) attacks to knock government and business sites offline.
Today, Cleary was accused of building a botnet that has been used to launch several DDoS attacks since October, including the one on the SOCA site on Monday.
"On or before the 20th of June 2011, you did conspire with other person or persons unknown to conduct unauthorised modification of computers by constructing and distributing a computer program to form a network of computers (a Botnet) modified and configured to conduct Distributed Denial of Service attacks," read the charge list.
Police also charged Cleary with aiming DDoS attacks at the International Federation of the Phonographic Industry (IFPI) site last November and the British Phonographic Industry (BPI) website last October.
On Tuesday, LulzSec downplayed Cleary's arrest, saying that he was "at best, mildly associated with us."
"Ryan Cleary is not part of LulzSec," the group said on Twitter yesterday. "We house one of our many legitimate chat rooms on his IRC server, but that's it."
The group made other efforts to distance itself from Cleary. "Seems the glorious leader of LulzSec got arrested, it's all over now... wait... we're all still here! Which poor bastard did they take down?" said LulzSec on Twitter earlier Tuesday.
LulzSec has claimed responsibility for hacking several prominent websites, including a number of Sony sites. It also claims that it defaced the site operated by the U.S. Public Broadcasting Service (PBS) and attempted to access systems belonging to the U.S. Senate and the CIA.
If LulzSec is telling the truth -- that Clearly was hosting an IRC (Internet relay chat) channel used by the group -- police investigators may be able to unveil the real identities of its members.
"Assuming [Cleary] is part of the group, and that's not certain, law enforcement might have access to enough information from the IRC logs to better point to the location of different members who accessed the chat room," said Amichai Shulman, co-founder and CTO of Imperva, an IT security vendor.
Shulman also leads Imperva's research lab and its hacker intelligence group. "I've had some experience in this kind of investigation, and if you have enough data for a long enough period of time, you may be able to narrow down the [IP addresses] of other members, or correlate with other data to locate them," said Shulman.
That may be possible even if LulzSec's members used anonymizing techniques, such as routing their traffic through Tor or other proxies, to hide their identity, something Shulman said he assumed the group did.
Another way that U.K. police may be able to finger LulzSec is through standard police work, added Shulman. "If they think he's part of the group, it's possible members know the real identity of others, and they could use normal investigative measures to get that out of him," Shulman said.
But while it's speculation at this point whether the IRC logs can provide leads for police, Shulman was cautiously optimistic that LulzSec would be tracked down.
"If we look back 20 years at hacking incidents, we find that the high-profile attacks or those that involve serious losses to governments or commercial companies have ended up with law enforcement finding the perpetrators... eventually," said Shulman.
"When you create this kind of visibility in the media and attack serious industries, like the gaming industries, there will be lots of pressure on law enforcement," he added. "My guess is that if law enforcement puts in the resources, they will catch these people."
Cleary is scheduled to appear in a London court Thursday morning.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is firstname.lastname@example.org.
- Arrests made after international cyber-ring targets StubHub
- International police operation disrupts Shylock banking Trojan
- Spamhaus pushes for arrests of alleged DDoS participants
- Accused Russian point-of-sale hacker arrested, will face U.S. charges
- No-IP regains control of some domains wrested by Microsoft
- Microsoft legal action cramping other hacking campaigns, Kaspersky says
- Microsoft admits technical error in IP takeover, but No-IP still down
- QuickPoll: Why hasn't Windows XP come under attack from hackers?
- Cybercrime losses top $400 billion worldwide
- U.S., foreign agents disrupt Gamover Zeus botnet
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Cybercrime and Hacking White Papers | Webcasts