U.K. police charge hacker linked to LulzSec
19-year-old's server logs may lead police to others in hacking gang, says security expert
Computerworld - Authorities in the U.K. today charged a 19-year-old with using a botnet he controlled to take down the website of a national police unit.
The charges filed against Ryan Cleary followed his arrest Monday by the Metropolitan Police Central e-Crime Unit.
One security expert said Cleary's arrest, and the seizure of his computers, may lead authorities to members of LulzSec, the group that claimed responsibility earlier this week for taking down the website of the U.K.'s Serious Organised Crime Agency (SOCA).
SOCA is responsible for, among other things, major computer crime investigations in the U.K.
Cleary, of Wickford, England, has been linked to both LulzSec and Anonymous, hacker crews that have used distributed denial-of-service (DDoS) attacks to knock government and business sites offline.
Today, Cleary was accused of building a botnet that has been used to launch several DDoS attacks since October, including the one on the SOCA site on Monday.
"On or before the 20th of June 2011, you did conspire with other person or persons unknown to conduct unauthorised modification of computers by constructing and distributing a computer program to form a network of computers (a Botnet) modified and configured to conduct Distributed Denial of Service attacks," read the charge list.
Police also charged Cleary with aiming DDoS attacks at the International Federation of the Phonographic Industry (IFPI) site last November and the British Phonographic Industry (BPI) website last October.
On Tuesday, LulzSec downplayed Cleary's arrest, saying that he was "at best, mildly associated with us."
"Ryan Cleary is not part of LulzSec," the group said on Twitter yesterday. "We house one of our many legitimate chat rooms on his IRC server, but that's it."
The group made other efforts to distance itself from Cleary. "Seems the glorious leader of LulzSec got arrested, it's all over now... wait... we're all still here! Which poor bastard did they take down?" said LulzSec on Twitter earlier Tuesday.
LulzSec has claimed responsibility for hacking several prominent websites, including a number of Sony sites. It also claims that it defaced the site operated by the U.S. Public Broadcasting Service (PBS) and attempted to access systems belonging to the U.S. Senate and the CIA.
If LulzSec is telling the truth -- that Clearly was hosting an IRC (Internet relay chat) channel used by the group -- police investigators may be able to unveil the real identities of its members.
"Assuming [Cleary] is part of the group, and that's not certain, law enforcement might have access to enough information from the IRC logs to better point to the location of different members who accessed the chat room," said Amichai Shulman, co-founder and CTO of Imperva, an IT security vendor.
Shulman also leads Imperva's research lab and its hacker intelligence group. "I've had some experience in this kind of investigation, and if you have enough data for a long enough period of time, you may be able to narrow down the [IP addresses] of other members, or correlate with other data to locate them," said Shulman.
That may be possible even if LulzSec's members used anonymizing techniques, such as routing their traffic through Tor or other proxies, to hide their identity, something Shulman said he assumed the group did.
Another way that U.K. police may be able to finger LulzSec is through standard police work, added Shulman. "If they think he's part of the group, it's possible members know the real identity of others, and they could use normal investigative measures to get that out of him," Shulman said.
But while it's speculation at this point whether the IRC logs can provide leads for police, Shulman was cautiously optimistic that LulzSec would be tracked down.
"If we look back 20 years at hacking incidents, we find that the high-profile attacks or those that involve serious losses to governments or commercial companies have ended up with law enforcement finding the perpetrators... eventually," said Shulman.
"When you create this kind of visibility in the media and attack serious industries, like the gaming industries, there will be lots of pressure on law enforcement," he added. "My guess is that if law enforcement puts in the resources, they will catch these people."
Cleary is scheduled to appear in a London court Thursday morning.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is email@example.com.
- Nine charged with distributing Zeus malware
- The new security perimeter: Human Sensors
- Cyberattacks could paralyze U.S., former defense chief warns
- Security Manager's Journal: Thousands of dollars in phone calls? Management hates that.
- Everything You Know About Enterprise Security Is Wrong
- UK man charged with hacking Federal Reserve
- McAfee Offers Global Response to Nationalized Malware
- Tech Industry Praises Cybersecurity Framework From White House
- Ransomware like Cryptolocker uses Bitcoin, other virtual currencies for payment
- Trial for alleged Silk Road creator Ross Ulbricht set for November
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Path Selection Infographic Path Selection Infographic
- Hyperconvergence Infographic A wide range of observers agree that data centers are now entering an era of "hyperconvergence" that will raise network traffic levels faster...
- Preparing Your Infrastructure for the Hyperconvergence Era From cloud computing and virtualization to mobility and unified communications, an array of innovative technologies is transforming today's data centers.
- How WAN Optimization Helps Enterprises Reduce Costs If you wanted to break down innovation into a tidy equation, it might go something like this: Technology + Connectivity = Productivity. Productivity...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Cybercrime and Hacking White Papers | Webcasts