U.K. spy agency attacked hacktivist groups
Leaked documents suggest the agency used denial-of-service tactics and assisted law enforcement in identifying Anonymous members
IDG News Service - British intelligence agency Government Communications Headquarters (GCHQ) has reportedly infiltrated hacktivist groups and used denial-of-service and other techniques to disrupt their online activities.
A PowerPoint presentation that GCHQ prepared for a 2012 conference organized by the U.S. National Security Agency reveals that one of the agency's units, called the Joint Threat Research Intelligence Group (JTRIG), collected information on "hacktivists" -- politically motivated hackers -- and shared it with law enforcement agencies. The unit also used denial-of-service techniques to disrupt the hacktivists' communication channels.
The slides were among the documents leaked by former NSA contractor Edward Snowden and were published Wednesday by NBC News. JTRIG used human intelligence techniques to gather information about members of Anonymous and LulzSec, two related groups of hacktivists that attacked the websites of various companies, organizations and governments, NBC News reported.
The leaked slides provide two examples of JTRIG intelligence gathering that targeted two hackers using the online handles GZero and p0ke.
In one IRC (Internet Relay Chat) log included in a slide, an undercover JTRIG agent responds to a request from a hacker looking to buy access to a website with 10,000 or more unique daily visitors. The discussion suggests the hacker intended to install an exploit on the site to infect the computers of visitors with botnet malware so they could be used to support Operation Payback, a large-scale DDoS (distributed denial-of-service) campaign launched by Anonymous in 2010 against pro-copyright organizations and a variety of companies including PayPal, MoneyBookers, Visa, Mastercard and Amazon.
In another chat log, the agent is contacted by a user named GZero who says the first hacker works with him and who also expresses interest in buying traffic for use with an exploit pack.
JTRIG's reporting on GZero led to his identification and arrest, one of the slides says. Edward Pearson, a 23 year old from York, England, was identified by law enforcement as GZero. He was sentenced in 2012 to two years in prison for using Trojan programs like Zeus and SpyEye to steal credit card details and PayPal credentials.
Another chat log in the GCHQ slides shows a user named p0ke telling another one, named Topiary, that he hacked into a government database and extracted the names, email addresses and phone numbers of 700 U.S. Federal Bureau of Investigation employees. In a later private chat with a JTRIG agent p0ke says that he compromised usda.gov, the website of the U.S. Department of Agriculture.
P0ke was identified by JTRIG, but was never arrested for hacking into government databases, NBC News reported. However, an 18-year-old teenager from Scotland named Jake Davis was identified as Topiary and was arrested in 2011. He later pled guilty to computer related crimes and was sentenced to 24 months in a youth detention center.
The GCHQ slides also mention an operation code-named Rolling Thunder that disrupted an Anonymous IRC server by using denial-of-service techniques. One chat between Anonymous supporters included in the slides suggest the server was hit by a SYN flood -- a type of denial-of-service attack involving a flood of SYN requests -- which resulted in downtime of over 30 hours.
JTRIG agents also sent messages that read "DDOS and hacking is illegal, please cease and desist" to Anonymous supporters via Facebook, Twitter, email, Skype and other instant messaging applications, NBC News reported, citing a slide that is not among those published. The outcome of this type of activity, which GCHQ calls "information operations," was that 80% of those messaged did not show up in Anonymous' IRC channel one month later.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Cybercrime and Hacking White Papers | Webcasts