Some people learn lessons the hard way.
February 7, 2011 11:40 AM Subscribe

Aaron Barr, of security company HBGary, claimed in the Financial Times to have infiltrated Anonymous and to be collecting information on members of the group. Predictably, Anonymous responded by hacking HBGary's website and replacing its front page, as well as by stealing Barr's research documents on Anonymous (and social networking accounts) and releasing them to the public, along with thousands of internal HBGary emails.
posted by Pope Guilty (199 comments total) 40 users marked this as a favorite

I learned a long time ago not to prod a rattlesnake.
posted by Astro Zombie at 11:42 AM on February 7, 2011 [18 favorites]

I think every high school kid has successfully infiltrated Anonymous at one point or another--last I checked, the bar for entry to 4chan is set really really low.
posted by reformedjerk at 11:45 AM on February 7, 2011 [36 favorites]

They may be unprincipled cyber-vigilantes, but I do like their style.
posted by Joe Beese at 11:45 AM on February 7, 2011 [80 favorites]

Anonymous responded by hacking HBGary's website and replacing its front page, as well as by stealing Barr's research documents on Anonymous

Was the flaming poop bag store closed?

Look, be hackerish dicks all you want but please don't leave cutesy logos and lines like "we are legion." I've been threatened at gunpoint; hackers aren't intimidating. They're annoying. Look, here's some proving it.
posted by XQUZYPHYR at 11:45 AM on February 7, 2011 [3 favorites]

The "Timeline" on page 2 goes back to... what, July 12, 2010? This is my scared face.
posted by muddgirl at 11:47 AM on February 7, 2011

If Barr didn't see this coming, then he is, literally, an idiot.
posted by Sticherbeast at 11:48 AM on February 7, 2011 [26 favorites]

I am elated at this emergence of this strange new entity, and eagerly await future developments. What an interesting time to be alive.
posted by Meatbomb at 11:48 AM on February 7, 2011 [11 favorites]

OK, finished now. By "Infiltrate Anonymous", it seems like HBGary meant "followed some folks on Twitter and friended them on Facebook." Whatta white hat!
posted by muddgirl at 11:48 AM on February 7, 2011 [14 favorites]

Infiltrated by posting "ITT moar dox, will bump with tits"
posted by Ad hominem at 11:48 AM on February 7, 2011 [1 favorite]

Damn, why would someone want to mess with those guys like that? They'll overwhelm you with numbers if nothing else...
posted by Mister_A at 11:49 AM on February 7, 2011

Referring to yourself as a Computer Security Expert is really just asking for trouble. Just ask the Anti-Kidnapping Expert.
posted by 2bucksplus at 11:50 AM on February 7, 2011 [15 favorites]

Which raises the point that Anon probably are infiltrated with FBI at the very least. Many of them during working hours.
posted by DU at 11:50 AM on February 7, 2011 [3 favorites]

XQUZYPHYR: i see your point, but they didnt just take the homepage, they deleted backups, posted the complete mysqldump of the sites, torrented every internal email, and posted the CEO's home addr and SSN on his twitter. thats a pretty brutal takedown of a company.
posted by Mach5 at 11:50 AM on February 7, 2011 [18 favorites]

Which raises the point that Anon probably are infiltrated with FBI at the very least.

What?
posted by reductiondesign at 11:51 AM on February 7, 2011

HBGary cofounder and security researcher Greg Hoglund confirmed on Sunday evening that the latest attacks were sophisticated compared to the group's past shenanigans. "They broke into one of HBGary’s servers that was used for tech support, and they got e-mails through compromising an insecure Web server at HBGary Federal," Hoglund told KrebsonSecurity. "They used that to get the credentials for Aaron, who happened to be an administrator on our e-mail system, which is how they got into everything else. So it’s a case where the hackers break in on a non-important system, which is very common in hacking situations, and leveraged lateral movement to get onto systems of interest over time." Source. That's gotta be good for business.
posted by fixedgear at 11:51 AM on February 7, 2011 [5 favorites]

His twitter avatar is changing pretty regularly right now.
posted by jquinby at 11:52 AM on February 7, 2011

"This is a triumph. I making a note here HUGE SUCCESS"
posted by storybored at 11:53 AM on February 7, 2011 [11 favorites]

fixedgear: "HBGary cofounder and security researcher Greg Hoglund confirmed on Sunday evening that the latest attacks were sophisticated compared to the group's past shenanigans."

The pastie.org detailing an email exchange seems to be a simple social hack.
posted by boo_radley at 11:53 AM on February 7, 2011 [17 favorites]

"So it’s a case where the hackers break in on a non-important system, which is very common in hacking situations, and leveraged lateral movement to get onto systems of interest over time.""

It's almost like that's an incredibly common method of defeating security and any competent admin at a computer security company would have secured the unimportant systems.
posted by Pope Guilty at 11:54 AM on February 7, 2011 [49 favorites]

I know I should find this disturbing, but I always laugh at hubris. Why in the hell would you poke at that hornet's nest? There is nothing to gain and everything to lose.
posted by maxwelton at 11:54 AM on February 7, 2011 [11 favorites]

Didn't he play "Hi, I'm Doctor Evil" in that Cessna-timetraveling MST3k episode?
posted by DU at 11:55 AM on February 7, 2011 [2 favorites]

From twitter.com/aaronbarr:

I'll give Aaron his twitter back when he posts shoe on head.

I love the internet. I love love love the internet.
posted by 2bucksplus at 11:56 AM on February 7, 2011 [74 favorites]

ha ha, I love these guys. I just do. In an age of Nottinghams, the world needs Robin Hood.
posted by vorfeed at 11:56 AM on February 7, 2011 [6 favorites]

Changed his Twitter Bio to include: RAGING HOMOGAY

Wow - that's awesome. Who am I supposed to be cheering for again?
posted by helmutdog at 11:58 AM on February 7, 2011 [6 favorites]

Didn't he play "Hi, I'm Bob Evil" in that Cessna-timetraveling MST3k episode?

It's J.K. Robertson! CEO of GenCorp!
posted by Servo5678 at 11:58 AM on February 7, 2011 [3 favorites]

The pastie.org detailing an email exchange seems to be a simple social hack.

That's actually pretty awesome.
posted by penduluum at 11:58 AM on February 7, 2011 [3 favorites]

For now Barr is working on damage control to his reputation as well as trying to make sense of what’s happened. “I just feel a bit exhausted by the whole thing,” he says. His biggest problem is the thousands of personal emails that have been released into cyberspace. Forbes. Somehow I doubt that is his biggest problem.
posted by fixedgear at 11:59 AM on February 7, 2011 [2 favorites]

The pastie exchange, if legitimate, is absolutely glorious.

Human Beings: Your weakest link in the security fence since ever.
posted by cavalier at 12:01 PM on February 7, 2011 [7 favorites]

Who am I supposed to be cheering for again?

Maybe the consumers who will now know to avoid an incompetent service provider.
posted by Joe Beese at 12:02 PM on February 7, 2011

> Which raises the point that Anon probably are infiltrated with FBI at the very least. Many of them during working hours.

No doubt the NSA is monitoring the top 10000+ message boards, including this one, with snazzy computers with complicated algorithms.

Or were you just saying that there are some Feds out there that surf anime and pr0n when they should be doing background checks or something?
posted by Burhanistan at 12:02 PM on February 7, 2011 [1 favorite]

penduluum: "That's actually pretty awesome."

greg@hbgary.com: jussi, I need to get into the server. jussi@gmail.com: Opening a port and here's a new password, boss. greg@hbgary.com: what IP address should I use? jussi@gmail.com: The normal one. You know for public acce~ greg@hbgary.com: DAMMIT CHLOE THERE'S NO TIME!

I feel for jussi (whomever that might be) and the laughter I feel is p much "There but for the grace of god go I".
posted by boo_radley at 12:02 PM on February 7, 2011 [16 favorites]

Surely the cyberpolice are backtracing this.
posted by mullingitover at 12:02 PM on February 7, 2011 [10 favorites]

CEO of GenCorp!

it's pronounced GhhhheeeeeeeenCgorphf.
posted by The Whelk at 12:03 PM on February 7, 2011 [3 favorites]

Surely the cyberpolice are backtracing this.

Consequences... will never be the same.

Sorry, someone had to.
posted by reductiondesign at 12:04 PM on February 7, 2011 [6 favorites]

In an age of Nottinghams, the world needs Robin Hood

....what?

Who is what now? Is Barr a horrible person who robs people and molests children or something? The most egregious act the "Sherriff" appears to have done here is bragged that he knew who Robin Hood might be; who then responded by burning all of London to the ground.

I really don't understand what "justice" is being performed in the form of a bunch of hacker assholes proving they're really good hackers and even better assholes. Yes, the legend of Robin Hood and his merry band of guys who scribbled racial epithets over the Sheriff of Nottingham's face.
posted by XQUZYPHYR at 12:04 PM on February 7, 2011 [7 favorites]

"...infiltrated Anonymous".

As has been pointed out, that's not an accomplishment. I'll point out that Anonymous isn't really even a group, it's a conceptual movement.

And calling yourself a security expert/owning a security company, being hacked by Anonymous...well that's just sad.
posted by Xoebe at 12:05 PM on February 7, 2011 [2 favorites]

So I'm trying to analogize this. It looks like a guy who lives in mob territory publicly outed himself as a snitch, then sent an open letter to the local media with his contact information and address included.

Well, at least he's physically unharmed...
posted by Phyltre at 12:05 PM on February 7, 2011 [2 favorites]

Who the hell gives out a root password via email? Corp policy should be to, at the very least, telephone for one.
posted by wcfields at 12:05 PM on February 7, 2011 [6 favorites]

Can somebody please turn down the nerdsauce and explain the pastie exchange to me?
posted by phaedon at 12:05 PM on February 7, 2011 [3 favorites]

Bernie Shifman:Media Savvy & Legal Might :: Aaron Barr:Security Investigations & Risk Assessment
posted by adipocere at 12:06 PM on February 7, 2011

Can somebody please turn down the nerdsauce and explain the pastie exchange to me?

Looks like they emailed the admin of their server from the boss' stolen email account asking the dude to reset the password, and he did.
posted by maxwelton at 12:07 PM on February 7, 2011 [4 favorites]

"There but for the grace of god go I".

Totally. I am beginning to consider my habit of florid language and correct(ish) spelling/caps/punctuation/grammar even in short business emails to be a kind of security feature. Dammit, if you want somebody to just send you my passwords, you are at least going to have to be able to reproduce my individual communication idiom!
posted by penduluum at 12:07 PM on February 7, 2011 [4 favorites]

Okay Anons, we're giving Aaron back his account in T-Minus 60 minutes. If he doesn't admit defeat in his first Tweet, we're taking it back.
posted by The Mouthchew at 12:07 PM on February 7, 2011

Who the hell gives out a root password via email? Corp policy should be to, at the very least, telephone for one.

And I guarantee that you will be fired from your job when the CEO, bedecked in suit and meeting with people, emails you asking to change it and you refuse. If my experience with CEOs is anything to go by.
posted by maxwelton at 12:09 PM on February 7, 2011 [23 favorites]

Now I know never to hire HBGary for anything remotely related to security. Of course, had it not been for this hack, I wouldn't ever have heard of them to begin with.
posted by tommasz at 12:10 PM on February 7, 2011 [1 favorite]

Sometimes, if you are planning on kicking over a hill of fire-ants, the best plan is to not let them know you're coming.

Also, don't me made out of the things that fire-ants like to destroy. That helps too.
posted by quin at 12:10 PM on February 7, 2011 [9 favorites]

phaedon: "Can somebody please turn down the nerdsauce and explain the pastie exchange to me"

someone got access to greg@hbgary.com by some mechanism (unknown).
the compromised account emails jussi@gmail.com and asks for a direct connection to a server.

Now! At this point, basic security protocols require jussi to verify that greg@hbgary.com is really greg@hbgary.com -- either the "tell me pseudo-secure identifiers" or "I will call you because your request is coming in from a backchannel and is weird as fuck" or "I am verifying this request with a B-line because it is weird as fuck".

Think of every unreliable narrator/ spy movie film ever: "If you're really greg, what's the name of your cat? What poster do we have in the break room?"

Rather than doing that, jussi basically permits greg@hbgary to sign on to a server using a custom built security hole.
posted by boo_radley at 12:11 PM on February 7, 2011 [7 favorites]

I'd like them more if their fan-boys stopped claiming they won the Tunisian and Egyptian revolutions. This seems like a good day's work, mind.
posted by Abiezer at 12:11 PM on February 7, 2011 [2 favorites]

Why does the CEO even need the root password in the first place?
posted by Pyry at 12:14 PM on February 7, 2011 [2 favorites]

To sudo tell someone to make him a sandwich!
posted by proj at 12:16 PM on February 7, 2011 [43 favorites]

I learned a long time ago not to prod a rattlesnake.

Prodding a rattlesnake is no big deal, you can keep your eye on one rattlesnake. They are only so long and if you pick the right length stick you can poke all day, just annoying the rattlesnake to the point it spends its time trying to get away from the guy with the stick hoping the DNR comes by and cites the guy with a stick for harassing the wildlife.

This is more like kicking a fire ant hill, where the fire ants are also airborne, can use sharpie markers and like eating clothes such that:

You end up naked because you can't watch ALL the ants with your naked posterior in the air with rude words written on said aerial posterior.
posted by rough ashlar at 12:17 PM on February 7, 2011 [14 favorites]

To sudo tell someone to make him a sandwich!

Properly set up sudo doesn't require the root password!

</joke pedantry>
posted by kmz at 12:17 PM on February 7, 2011 [4 favorites]

phaedon - imagine calling up your local bank, pretending to be the CEO and asking them to leave the keys to the vault under a flower pot by the front door. And then they do. Hard to imagine these people can even use email, much less pretend to be security experts.

Imagine your phone ringing, and the in-building caller ID shows that it's the CEO's extension. the CEO orders you to do something, and you say just a sec, then call the CEO's extension and tell him that it's done. Only, instead of the CEO's phone extension, it's his email -- from a security standpoint, very different things, but from an employee's viewpoint they're very much the same when you want to avoid pissing off the CEO.

If the Pastie.org thing is real, my favorite part is this: the hacker's email is devoid of caps and punctuation and grammar, and my first thought is: that is the hackierist email I've ever seen, it should set off alarms. The tech support guy, however, responds just as un-capitalized, un-punctuated, and un-grammarly as the hacker, and is doing it from a gmail account. It reminds me of a story whose punchline is, if you need something done from a guy who answers his phone, "YAH, DIS IS GARY, VAT IS IT?" you do not answer "Hello, Gary, When you have a chance please bring me the thing", you respond, "YAH, GARY, DID IS DAVE, YOU GOTTA GIMME DAT TING NOW."
posted by AzraelBrown at 12:17 PM on February 7, 2011 [21 favorites]

Or were you just saying that there are some Feds out there that surf anime and pr0n when they should be doing background checks or something?

I'm pretty much certain that Anonymous is infiltrated with FBI agents in much the same way MetaFilter is infiltrated with librarians.
posted by Faint of Butt at 12:19 PM on February 7, 2011 [28 favorites]

Why does the CEO even need the root password in the first place?

Telling the CEO "you don't need the root password" will be almost as successful as telling them that you are going to need a phone call or you're not going to change it.

The less jokey answer in this specific case is that: in the eyes of the security guy, Greg already knew the root password, he just wanted confirmation on which one was currently valid. So that probably seemed like a pretty safe thing to tell him. Giving him a direct connection to the server is what made that dangerous, and if the security guy thought "well, he already knows the password, it's probably really Greg", then opening that hole probably didn't seem like that big of a step.
posted by penduluum at 12:20 PM on February 7, 2011 [2 favorites]

If the Pastie.org thing is real, my favorite part is this: the hacker's email is devoid of caps and punctuation and grammar, and my first thought is: that is the hackierist email I've ever seen, it should set off alarms.

I work tech support and routinely see emails just like that one from people of all levels of the organization, regardless of education or position or whatever. That is simply how a lot of people type.
posted by Pope Guilty at 12:21 PM on February 7, 2011 [9 favorites]

Why does the CEO even need the root password in the first place?

Guys, comeon. He's not just the CEO he is a security expert!
posted by Ad hominem at 12:22 PM on February 7, 2011 [3 favorites]

This has inspired me to start professionally billing myself as a celibacy, poverty, and ignominy expert.
posted by zylocomotion at 12:23 PM on February 7, 2011 [53 favorites]

> If the Pastie.org thing is real, my favorite part is this: the hacker's email is devoid of caps and punctuation and grammar, and my first thought is: that is the hackierist email I've ever seen, it should set off alarms.

The owner of the IT firm I work for now has created wonderful autocorrect haiku's out of his typos, he just fucking types what he is thinking, skips a few words, and hits send.

Usually his emails are better drafted before he sends them to customers, but honestly, the guy is smart, he's in charge, and if we got a well written email from him asking for a password vs one written in his obviously thumbed and autocorrected to hell manner, the well written one would be suspect more than the one looking like markoved I Ching output.
posted by mrzarquon at 12:24 PM on February 7, 2011 [10 favorites]

zylcomotion, we're not going to hack you rich and sexy.
posted by boo_radley at 12:24 PM on February 7, 2011 [4 favorites]

Honestly the funniest part of all this is that Anonymous' response to "I HAVE DOX THAT I WILL SELL TO THE FEDS!" is to simply release them to the public.
posted by Pope Guilty at 12:27 PM on February 7, 2011 [56 favorites]

Active CEOs and other bigwigs write emails on their Blackberries or iPhones nowadays. My boss's boss's boss is now required to send all his emails to his assistant, who re-writes and formats them for clarity. Otherwise they pretty much look like what's in the pastie exchange.
posted by muddgirl at 12:29 PM on February 7, 2011 [1 favorite]

Metafilter: We're not going to hack you rich and sexy.
posted by zylocomotion at 12:35 PM on February 7, 2011 [5 favorites]

I worked for a guy who always wrote his message in the subject line. If I'd ever gotten an email from him with text in the body, it would have made me suspicious. He did once send an [all group] email asking for the login and password for the company's website backend, and before I could shoot back an email saying hey, don't send this over email, someone sent him a login and password. He was notoriously paranoid about corporate espionage. Sigh.
posted by rtha at 12:35 PM on February 7, 2011 [3 favorites]

It's important to point out: If your company is staffed by fucking morons, you have no security.

They asked for login information via e-mail and were supplied with it. Hardy any hacking required.
posted by odinsdream at 12:39 PM on February 7, 2011 [2 favorites]

Prodding a rattlesnake is no big deal, you can keep your eye on one rattlesnake.

One Friday night, back in high school, a couple of guys I knew found a rattlesnake in a parking lot and started messing around with it.

It bit one of them. So they spent another ten minutes trying to capture the snake, getting bit a couple more times each, because they wanted to have the snake with them when they went to the ER, so the docs could identify the species correctly when picking out an anti-venom.
posted by nomisxid at 12:43 PM on February 7, 2011 [23 favorites]

someone got access to greg@hbgary.com by some mechanism (unknown).

It does appear that they sent it from a compromised account, but I'd like to point out that unless your recipient cares to read e-mail headers (which, since this guy supplied a root password via e-mail, my guess is they wouldn't even know where to begin with e-mail headers), you can very easily forge the "From" address in any e-mail you send. They could have just as easily sent this from a library, with a reply-to pointed to a fake gmail account.
posted by odinsdream at 12:46 PM on February 7, 2011 [3 favorites]

LESSON: Use encryption. Or at least PGP signatures.
posted by mkb at 12:48 PM on February 7, 2011

If your company is staffed by fucking morons, you have no security. If you are a security company and you don't have a procedural manual in place so that even a moron can't fuck up, you aren't really a security company. Security isn't about software, hardware, or tech as much as it is about procedures, documentation, write-ups, and constant testing for failure at all levels especially human. Because even smart people make mistakes, and you better be prepared for it. If they don't have a policy manual about password reset procedures and firewall holes then why do they have systems that can be accessed without hardware tokens in addition to passwords?

There is some famous apocryphal story about the CEO of Siemens being stopped by a security guard who asked for his ID.
Do you know who I am?
Yes sir, but it's the procedure, and I'm sticking to it
Supposedly the CEO sent down an email commending the guy. It's a trite story, but there's something to having policies that allow for no unplanned exceptions. Of course, there's a downside to proper security too.
posted by BrotherCaine at 12:57 PM on February 7, 2011 [15 favorites]

How does someone like HBGary actually get clients to pay for their services. Is it because he looks good in a suit? Because he plays golf with the right people? I really wish I knew how to break into consulting like this, and I'm not joking.

As discussed in a recent thread, how does AOL continue to make a profit off people who think they still need to keep paying AOL for dial-up accounts in order to access their email, even though they have broadband through another provider? The world is full of people who don't understand computers, who are scared of hackers and viruses and things, and who are quite willing to give money to "security experts" like this - after all, they have a "Web Sight" on the Internets, they must be legitimate...
posted by Jimbob at 12:58 PM on February 7, 2011

This has inspired me to start professionally billing myself as a celibacy, poverty, and ignominy expert.

Don't mess with Ignominious.
posted by Devils Rancher at 12:59 PM on February 7, 2011 [11 favorites]

Why does the CEO even need the root password in the first place?

Same reason God needs a starship, apparently.
posted by Naberius at 1:01 PM on February 7, 2011 [23 favorites]

Everytime something like this comes up, I get depressed. How does someone like HBGary actually get clients to pay for their services. Is it because he looks good in a suit? Because he plays golf with the right people? I really wish I knew how to break into consulting like this, and I'm not joking.

Connections connections connections. When you start working you find somebody who does what you're doing and convince him to give you a job — and if Somebody's big enough, then you're in legitimate business. The thing is, Somebody often doesn't care much who he hires or doesn't know enough to know who's a good hire, so you don't need to be particularly gifted at what you do, you just need to sell yourself.

Doesn't matter what you're doing, this is how it works. Writers know publishers, actors know directors and casting agents, designers know giddy entrepreneurs, restaurants know hungry people. It's a matter of knowing people who want what you've got; rarely do those people care as much about quality as they do about convenience.

(I kind of like working like that, because it makes you feel like a part of the collective community that hires you. But for things like security where quality really matters, it's probably not wise.)
posted by Rory Marinich at 1:01 PM on February 7, 2011 [1 favorite]

I find Anonymous fascinating. I'd love to read a serious piece of journalism about them. Has there been any single definitive piece about them anywhere?
posted by Bookhouse at 1:02 PM on February 7, 2011 [2 favorites]

This is like claiming you've infiltrated Santa Claus's workshop only to come home and find elf-piss EVERYWHERE.

Should the nasty elves have pissed on everything, ruining this poor man who did nothing but charge people money for things like knowing Santa Clause?

Yes. Cause if he had really known Santa Clause, he would have known that a-pissing was coming....
posted by umberto at 1:02 PM on February 7, 2011 [8 favorites]

Santa Clause

Thanks a lot for reminding me of that Tim Allen abomination. *shudder*
posted by kmz at 1:04 PM on February 7, 2011

Granted, my understand of Anonymous is weak, but as near as I can tell, they're not an organized entity. Infiltrating Anonymous is akin to infiltrating a village in Latvia and claiming you've infiltrated all of Earth.
posted by Joey Michaels at 1:05 PM on February 7, 2011 [3 favorites]

Why does the CEO even need the root password in the first place?

Most likely the company is small enough that he's also a worker. At a "security" company, that means he's also a sysadmin.

It should be noted that the whole of "computer security" as an industry is pretty much bullshit.
posted by atbash at 1:05 PM on February 7, 2011 [1 favorite]

procedures, documentation, write-ups,

That would not have saved them here, though, because of the power imbalance in a conversation with a CEO.

What would have saved them would have been to have minimally competent staff that do things like, oh, I don't know, require public-key authentication instead of passwords? That would obviate the need for the CEO to ask for a root password as it's simply not an option. You either have the right key with you on your secure laptop, or you don't. There is no "logging in from the hotel conference room" scenario by design.

Anyway, security is about more than policies and procedures. It's about having staff smart enough to notice these kinds of social engineering attacks.
posted by odinsdream at 1:06 PM on February 7, 2011 [2 favorites]

They asked for login information via e-mail and were supplied with it. Hardy any hacking required.

As penduluum mentioned above, at that point they apparently already had the root password ("88j4bb3rw0cky88") and were only verifying that it was correct (they replied saying that it was "w0cky", which I assume was shorthand for the full password). If you believe what Anon has posted on the Twitter, this was after around two days of monitoring "all HBGary communications". So the ruse around getting SSH access to root the server shown in that email was just a small part of the overall attack. But really these kinds of social exploits have always been a huge part of hacking, at least if by hacking you mean gaining unauthorized access to computer systems. Especially when there's a specific target rather than a general system vulnerability (like an exploit in IE or whatever).
posted by burnmp3s at 1:07 PM on February 7, 2011 [3 favorites]

Should the nasty elves have pissed on everything, ruining this poor man who did nothing but charge people money for things like knowing Santa Clause?

You've seen Rare Exports too? I tell ya, those Finns have a very odd sense of humor.
posted by scalefree at 1:08 PM on February 7, 2011 [1 favorite]

Also, is their business site actually back on the net? Their homepage is indistinguishable from a spam link-farm. Is that seriously their real corporate page?
posted by odinsdream at 1:08 PM on February 7, 2011 [2 favorites]

Thanks for the explanations all. This is so gangster, I love it.
posted by phaedon at 1:12 PM on February 7, 2011 [1 favorite]

Their business site is not back up. That's a Network Solutions "under construction" page:

This Page Is Under Construction - Coming Soon!
Why am I seeing this 'Under Construction' page?

posted by hades at 1:13 PM on February 7, 2011 [1 favorite]

Who is what now? Is Barr a horrible person who robs people and molests children or something? The most egregious act the "Sherriff" appears to have done here is bragged that he knew who Robin Hood might be; who then responded by burning all of London to the ground.

I really don't understand what "justice" is being performed in the form of a bunch of hacker assholes proving they're really good hackers and even better assholes. Yes, the legend of Robin Hood and his merry band of guys who scribbled racial epithets over the Sheriff of Nottingham's face.

Have you ever read the old Robin Hood stories or ballads, from back before they got whitewashed? Robin was, actually, sort of a dick. Exactly the kind of dick who loved to bring any and all representatives of The Man down a few pegs, "justice" or not. He'd have shamed the hell out of anyone who dared to pretend to be one of the Merry Men, much less threatened to expose him.
posted by vorfeed at 1:14 PM on February 7, 2011 [4 favorites]

Telling the CEO "you don't need the root password" will be almost as successful as telling them that you are going to need a phone call or you're not going to change it.

Something I pretty much word for word told a General once. He wasn't happy at the time. I was praised to all hell afterward.

If you're respectful and make verification as easy as possible, I think you'd be just fine in 99.99% of cases, with 99.99% of bosses.
posted by John Kenneth Fisher at 1:15 PM on February 7, 2011

omething I pretty much word for word told a General once. He wasn't happy at the time. I was praised to all hell afterward.

If you're respectful and make verification as easy as possible, I think you'd be just fine in 99.99% of cases, with 99.99% of bosses.

You ain't worked with my bosses.
posted by emjaybee at 1:17 PM on February 7, 2011 [3 favorites]

Account control is now switching to the real Aaron Barr; Mr. Barr, you should know that we're still watching. Place nice or we won't. #ciao
posted by L'Estrange Fruit at 1:18 PM on February 7, 2011

emjaybee: "omething I pretty much word for word told a General once. He wasn't happy at the time. I was praised to all hell afterward.

If you're respectful and make verification as easy as possible, I think you'd be just fine in 99.99% of cases, with 99.99% of bosses.

You ain't worked with my bosses."

Though, it may be a moot point, it would be best to have HR have this verification procedure written in as Corp policy that can not be over ruled.
posted by wcfields at 1:18 PM on February 7, 2011

I find Anonymous fascinating. I'd love to read a serious piece of journalism about them. Has there been any single definitive piece about them anywhere?

There are pieces here and there, focusing on different aspects of their trolling; I rather like this piece by Matt Schwartz, from 2008.
posted by Greg Nog at 1:25 PM on February 7, 2011 [4 favorites]

L'Estrange Fruit, where did you see that tweet? Because it's not on his feed now.
posted by jbickers at 1:28 PM on February 7, 2011

jbickers, refresh? It's there for me.
posted by jaduncan at 1:29 PM on February 7, 2011

Weird. Still not showing up for me.
posted by jbickers at 1:33 PM on February 7, 2011

I can see it?
posted by WinnipegDragon at 1:36 PM on February 7, 2011

I find it amusing that this should be posted on the very day I spent about half an hour completing my company's mandatory "security awareness training" (which only included one half-wrong thing and one Catch-22). Once all of our employees complete this training, I feel certain that nothing like this could possibly happen to us!
posted by nickmark at 1:37 PM on February 7, 2011 [1 favorite]

Once all of our employees complete this training...

"Step 1: Try not to threaten to release the identities of various important members of Anonymous."
posted by jaduncan at 1:40 PM on February 7, 2011 [10 favorites]

... they deleted backups, posted the complete mysqldump of the sites ...

Damn it, anonymous! Make up your minds.
posted by sebastienbailard at 1:45 PM on February 7, 2011 [7 favorites]

Weird. Still not showing up for me.

Me neither.
posted by phaedon at 1:48 PM on February 7, 2011

emjaybee: "You ain't worked with my bosses."

Conversely, your bosses ain't worked with me.
posted by boo_radley at 1:51 PM on February 7, 2011

Weird. Still not showing up for me.

Me neither.

Showing up for me in Chrome, but not in Firefox.

Have no idea if this is in any way interesting. But there ya go.
posted by jbickers at 1:51 PM on February 7, 2011

Does this remind anyone else of the beginning(ish) of Hackers?
posted by sperose at 1:54 PM on February 7, 2011

I'm seeing it in Firefox.
posted by rtha at 1:58 PM on February 7, 2011

> Does this remind anyone else of the beginning(ish) of Hackers?

Needs more beeping keyboards and cracking of firewalls with some kludgy keystrokes.
posted by Burhanistan at 2:00 PM on February 7, 2011 [1 favorite]

Does this remind anyone else of the beginning(ish) of Hackers?

Doesn't Hackers begin with a camera panning across a courtroom as somebody reads a list of computer crimes, until it settles at the defense's desk, then pans down to reveal the cranky and insolent face of a 10-year old boy?

That absolutely is Anonymous.
posted by AzraelBrown at 2:02 PM on February 7, 2011 [7 favorites]

fixedgear: "HBGary cofounder and security researcher Greg Hoglund confirmed on Sunday evening that the latest attacks were sophisticated compared to the group's past shenanigans."

Hahaha. Of course he's going to say that.

"This is hacking unlike the world has ever seen, to get through our incredible security!"
posted by graventy at 2:06 PM on February 7, 2011 [7 favorites]

Needs more beeping keyboards and cracking of firewalls with some kludgy keystrokes.

Yeah, and more 20 year-old Angelina Jolie.
posted by Civil_Disobedient at 2:07 PM on February 7, 2011

You ain't worked with my bosses
And how.
written in as Corp policy that can not be over ruled
... Until the CEO sez so. (FTFY)

Corp idjits always think they're exempt from these kind of rules, as they are 'inconvenient', and if they can be bothered to remember who the hell you are, will make issue for you later.
posted by LD Feral at 2:08 PM on February 7, 2011

It's not that hard nor inconvenient to say, "Thanks for your email Mr. CEO. I will call you with the new password since email is not secure, and we will make sure you can get in." The suit is usually pleased since it seems like more personal service, and it has the benefit of being more secure.
posted by benzenedream at 2:10 PM on February 7, 2011 [8 favorites]

emjaybee: "You ain't worked with my bosses."

Conversely, your bosses ain't worked with me.
posted by boo_radley at 1:51 PM on February 7

You possess the amazing superpower of being Impossible to Fire?

I once saw a manager get their head torn off for letting his employees bring him a tiny birthday cake without getting prior approval from a higher-up. Said higher-up was insane, but said higher-up was still in charge. You never said no to that person, ever, for any reason if you wanted to keep working there.
posted by emjaybee at 2:13 PM on February 7, 2011 [1 favorite]

It's not that hard nor inconvenient to say, "Thanks for your email Mr. CEO. I will call you with the new password since email is not secure, and we will make sure you can get in."

But wait hold on. Is it fair to say the hacker was mimicking Greg's email style? Perhaps the phrase "and is our root password still 88j4bb3rw0cky88 or did we change to
88Scr3am3r88 ?" was researched, and planted to create the impression that that was the real Greg writing?
posted by phaedon at 2:15 PM on February 7, 2011

Ugh. Why can't anonymous fight for healthcare reform or something? Make themselves useful.
posted by catwash at 2:20 PM on February 7, 2011 [7 favorites]

But wait hold on. Is it fair to say the hacker was mimicking Greg's email style

Probably, which makes this guy look even more like the kind of tool who would send whole passwords via plaintext email.
posted by benzenedream at 2:21 PM on February 7, 2011

Can we all agree that Anonymous is pretty much the modern equivalent of the Eye of Sauron and you should probably avoid getting it's attention if at all possible.
posted by The Violet Cypher at 2:22 PM on February 7, 2011 [10 favorites]

at that point they apparently already had the root password ("88j4bb3rw0cky88") and were only verifying that it was correct (they replied saying that it was "w0cky",

88? Jabberwocky?

Just sayin'.
posted by Jimbob at 2:22 PM on February 7, 2011 [6 favorites]

if you wanted to keep working there

That being the key phrase.

(I know: there are times when you can't leave a job. But if you've got any confidence that you can find another one, that right there is a situation when you should get the hell out of there.)
posted by ocherdraco at 2:22 PM on February 7, 2011 [4 favorites]

Looks like the tweet has been deleted, and at least one prankster still has access.

(also I suck cocks and am a sweaty ballsack of caterpillars) oh shit not supposed to be in his account still, sorry Aaron *hops off*
posted by L'Estrange Fruit at 2:23 PM on February 7, 2011 [1 favorite]

Ugh. Why can't anonymous fight for healthcare reform or something? Make themselves useful.

Not your personal army.
posted by mosk at 2:23 PM on February 7, 2011 [8 favorites]

Ugh. Why can't anonymous fight for healthcare reform or something? Make themselves useful.

Not your personal army.

Erm, actually they kinda are. As everyone keeps trying to fucking explain to the media and "security experts", there is no bald guy in a castle stroking a cat telling Anonymous what to do. Start a #HealthCareOps IRC channel somewhere, post some endearing GIFs to 4chan, and hope enough people want to stir up some shit.
posted by Jimbob at 2:26 PM on February 7, 2011 [4 favorites]

I find Anonymous fascinating. I'd love to read a serious piece of journalism about them. Has there been any single definitive piece about them anywhere?

This Economist blog post, written during the peak of the Wikileaks fightback: The 24-hour Athenian democracy is pretty good, as the journalist actually gets to see how they were operating and seems to 'get it'.

Anonymous are a prototype human hive mind, the first of their kind (I guess?). In that they actually aim to behave as a hive mind, rather than a more traditional anarchist group or collective or suchlike. Which makes them fascinating, but also very lowest common denominator.
posted by memebake at 2:26 PM on February 7, 2011 [7 favorites]

I find it helpful to think of Anonymous as the modern equivalent of the trickster.
posted by mosk at 2:52 PM on February 7, 2011 [2 favorites]

emjaybee: "You possess the amazing superpower of being Impossible to Fire? "

I have told my C-line directly (1) to use his words and (2) that my profession isn't justifying bad decisions after the fact. So possibly, yes.
posted by boo_radley at 2:55 PM on February 7, 2011 [3 favorites]

Why isn't Anonymous working on healthcare?

Anonymous is a subtractive force, drawn by puffery, fueled by wrath, producing tears and maddened titters. It is the gibbering mouther of social networking and if it is unable to quite structure itself to reach so high as to create a healthcare plan upon which all Americans will agree and a cure for cancer to boot, well, the world is full of low-hanging fruit. It is easier to destroy than to create, certainly, but it is also harder to point and say "That, that there, that is the right thing to do" versus "heh, that guy is an asshat. Let's make him cry." All stick, no carrot. You cannot shape intricate, delicate policy with a (Low Orbit Ion) cannon.

Even something with the collective decision-making capabilities of a flatworm can recognize an irritant and either flee or smite with a pseudopod. This guy seriously underestimated his defensive capabilities in comparison to the offensive capabilities of, well, any number of people who might feel threatened or just annoyed that someone was trying to make a name for himself off of their reputation. That he would be swatted was inevitable; that he touted himself as a security expert while maintaining the kinds of precautions that were a Bad Idea back in 1988 just makes him delicious going down.
posted by adipocere at 3:01 PM on February 7, 2011 [15 favorites]

You never said no to that person, ever, for any reason if you wanted to keep working there.

That's all I need to hear to know I would not, in fact, want to keep working there.
posted by localroger at 3:05 PM on February 7, 2011 [4 favorites]

You know, I was rolling my eyes a bit at the plot of the novel Directive 51, but then Anonymous went and made it look more plausible.
posted by BrotherCaine at 3:07 PM on February 7, 2011

emjaybee - while a small company CEO might demand and get remote access from an underling via e-mail, if that company is a computer security company, it means they fail at their business. Completely and utterly. You might get some plants if you throw seeds on the ground, but that doesn't make you a farmer. And if you open the door to the henhouse because the fox steals the CEO's hat and puts it on, you need to be in a different business.

Security companies must use digital certificates to sign their e-mails. They must not open holes in their firewall - that's what VPNs are for. They must not use pop culture references as their password with some numbers and simple substitution for the key to their kingdom. These are simple solved issues.

While this CEO might have actually fired someone had the e-mails been real, that's just an indication of what a bad company it is (or hopefully was).
posted by Candleman at 3:15 PM on February 7, 2011 [5 favorites]

Anonymous is a subtractive force, drawn by puffery, fueled by wrath, producing tears and maddened titters.

I read that as "maddened kittens" and somehow it just totally made my day.
posted by L'Estrange Fruit at 3:28 PM on February 7, 2011 [8 favorites]

I'm curious: In a truly secure environment, should anyone even have a gmail or other third-party email account for transacting corporate business? I mean, I guess google is trustworthy, but it's just one more layer of potential compromise, isn't it?
posted by maxwelton at 3:29 PM on February 7, 2011 [1 favorite]

This is all to say, fear-based, top-down, or yes-sir leadership is bad leadership and bad security. Good leaders encourage managing up and are secure enough in their abilities to allow questioning.
posted by Skwirl at 3:31 PM on February 7, 2011 [2 favorites]

maxwelton: "I'm curious: In a truly secure environment, should anyone even have a gmail or other third-party email account for transacting corporate business? I mean, I guess google is trustworthy, but it's just one more layer of potential compromise, isn't it?"

Jesus no. A system I don't control is a system I don't trust.
posted by boo_radley at 3:44 PM on February 7, 2011 [2 favorites]

This is all to say, fear-based, top-down, or yes-sir leadership is bad leadership and bad security. Good leaders encourage managing up and are secure enough in their abilities to allow questioning.

I respectfully disagree.

Sincerely,
George W. Bush
posted by Mister Fabulous at 3:55 PM on February 7, 2011 [3 favorites]

Neo-Raffles tells the press guy
"well, its like this shee."

Torrent News- more then a bit
its a byte.
posted by clavdivs at 4:09 PM on February 7, 2011

Actually, I think for a small company using gmail might be safer and cheaper than trying to do it yourself.

As for all these comments about "the boss would fire you" - sorry, the statement "I'm on an insecure line here, please call me at this number" trumps everything. I've used that line many times with bosses from nice to crazy and no one ever said boo. Frankly, bosses often prefer the phone anyway.
posted by lupus_yonderboy at 4:10 PM on February 7, 2011 [2 favorites]

it is back to typewriters and fax machines DAMN!
posted by clavdivs at 4:11 PM on February 7, 2011

lupus_yonderboy: "Actually, I think for a small company using gmail might be safer and cheaper than trying to do it yourself."

Well, yes, for a small company, sure. That's not where I work, and it doesn't really describe the environment of HBGary. Funnily enough, I've met some general consultants who tried to get people interested in cloud hosting, and startups are the most resistant to it -- they don't want anyone messing with their stuff in any way. Kinda took me by surprise.
posted by boo_radley at 4:13 PM on February 7, 2011

I just got one question:

Who the hell is Gary and why is he HB?
posted by ymgve at 4:36 PM on February 7, 2011

Who the hell is Gary and why is he HB?

Actually, that's two questions.
posted by localroger at 4:38 PM on February 7, 2011 [2 favorites]

"I'm a locksmith, and I'm a locksmith."
posted by Burhanistan at 4:50 PM on February 7, 2011 [11 favorites]

internet marry me burhanistan?
posted by boo_radley at 4:57 PM on February 7, 2011

Sure, but put an encryption on it first.
posted by Burhanistan at 5:00 PM on February 7, 2011 [1 favorite]

> "I'm a locksmith, and I'm a locksmith."

Thanks, because of that I found this youtube channel of all the policesquad episodes.
posted by mrzarquon at 5:46 PM on February 7, 2011 [6 favorites]

Properly set up sudo doesn't require the root password!

</joke pedantry>

Oh, you're one of those sudointellectuals.
posted by George_Spiggott at 6:54 PM on February 7, 2011 [35 favorites]

And I guarantee that you will be fired from your job when the CEO, bedecked in suit and meeting with people, emails you asking to change it and you refuse. If my experience with CEOs is anything to go by.

Not my experience. At all. You tell him you can't do it, he asks the CIO why you can't do it, who asks the CSO why you can't do it, and the CSO says, "I told his boss to tell him not to do it like that, and he'd be fired if he did it. Spooky hacker shit, you don't wanna know. I'll make sure Top People do it for you, and do it for you right now, the right way."

Then the CEO jokes about it with you sheepishly the next time you're in his office to swap out his monitor for a bigger one.

This is especially true in financial institutions and large, established infosec companies, where they take separation of powers, the chain of command and following documented process very, very, very seriously.
posted by Slap*Happy at 6:57 PM on February 7, 2011 [5 favorites]

This is especially true in financial institutions and large, established infosec companies, where they take separation of powers, the chain of command and following documented process very, very, very seriously.

Unlike companies who have time to waste "infiltrating" Anonymous.

Sorry, but this takes me back. Remember this shit?

Hats off to the kids that graffiti the suits. I hate it when they turn on their own, but when they make people like this look silly? Hats off.
posted by valkane at 7:25 PM on February 7, 2011

Anonymous is a real life Zerg rush. Better make sure you got tech tree right before you mess with them.
posted by digitalprimate at 7:46 PM on February 7, 2011 [3 favorites]

George_Spiggott: Oh, you're one of those sudointellectuals.

You know, you could go your entire life without punning better than that. I'd favorite it twice if I could. :)
posted by Malor at 8:07 PM on February 7, 2011 [4 favorites]

...This is more like kicking a fire ant hill, where the fire ants are also airborne, can use sharpie markers and like eating clothes such that ...

rough ashlar, if anonymous borrows your sharpie, you don't want it back. Trust me on this.
posted by sebastienbailard at 8:23 PM on February 7, 2011 [3 favorites]

Said higher-up was insane, but said higher-up was still in charge. You never said no to that person, ever, for any reason if you wanted to keep working there.

There are much worse things than being fired by an asshole. Continuing to work for an asshole is one of them.
It's scary to lose your job, but the vast majority of the time you're happy that you did, later.
posted by msalt at 8:24 PM on February 7, 2011 [2 favorites]

I find Anonymous fascinating. I'd love to read a serious piece of journalism about them. Has there been any single definitive piece about them anywhere?

The Wikileaks episode of the radio show Too Much Information with Benjamen Walker (my favorite radio show in the country right now) featured an interview with Gabriella Coleman, a scholar who studies online behavior and has studied Anonymous particularly. Her own site is suspiciously down, but here's some videos of her studies on Anon vs. Scientology, and here's an article with an overview of her research called The Anthropology of Hackers.

Why can't anonymous fight for healthcare reform or something? Make themselves useful.

It's not exactly healthcare reform, but in that interview Coleman mentions an Anon project that seems to be doing something more than the mere whimsical destruction most often attributed to them, called Operation Leakspin. It seems to be an effort to crowdsource the analysis of the enormous number of documents released in Cablegate, by encouraging local groups to comb through and find the documents most related to them, review those documents, and post their analysis & results.
posted by slappy_pinchbottom at 8:36 PM on February 7, 2011 [5 favorites]

somebody mention locks?
posted by clavdivs at 8:50 PM on February 7, 2011

oh, so this why TXXX did what they did when what happened happened.
posted by clavdivs at 8:52 PM on February 7, 2011

I doubt if we can imagine all the new backdoors in Mr. Barr's neighborhood.
posted by spock at 8:58 PM on February 7, 2011 [1 favorite]

No, seriously.

That is a really good question; how competent are the FBI/NSA with regards to dealing with "these kinds of things."? (cybermob/... uh, shit. There're loads of kids who're more savvy than people who get paid hundred-of-thousands OF DOLLARs to ... do what these people have been doing).

Current journalistic credibility is shit in these matters, and press releases are worse than toilet paper/bumwipe.

Is there a "report card," that's credible, on how government law enforcement are dealing these things?
posted by porpoise at 10:54 PM on February 7, 2011 [1 favorite]

Why do you think that 4/chan b/chan and Anon exist? Are allowed to exist?
How difficult would it be to for the NSA , the FBI - whomever - to cut off all communication channels ?

Why does 4/chan exist?

Because it is useful
Ask yourself useful to whom might it be useful? Who could use such an army of technologically savvy Mechanical Turks collecting vast amounts of information - for free?

Anonymous helps disrupt Tunisian and Egyptian websites and a too old and increasingly useless Autocrat is removed from power. The dominoes fall across the Islamic world and hardly a shot is fired. Who would find this useful?

If the powers that be have been proven (and they have) to have thoroughly infiltrated virtually every major independent protest organization of the last 60 years - do you seriously believe that Anonymous and 4/Chan are somehow immune.

Shit happens. Collateral damage happens. But when the need arises ...
posted by Poet_Lariat at 11:45 PM on February 7, 2011 [1 favorite]

Is there a "report card," that's credible, on how government law enforcement are dealing these things?

I have had some dealings with Australian cyber crime guys. There is a small number of very, very good geeks working for them, a larger number of good law enforcement officers who have the level of experienced IT user skills, and everybody else in law enforcement is technically clueless.
So when the Brits arrested some Anon kids it looked to me like somebody very high up had directed them to do it, because it would have required the police geeks to stop fighting real crime to spend the time going after them.
posted by bystander at 11:46 PM on February 7, 2011

Forgive me if I'm wrong, but what is there to infilitrate in the first place? It seems the media try to paint a picture of some guys actually sitting together somewhere, declaring themselves to be card-carrying members of Anonymous, with clearly defined leaders and name badges.

I was under the impression that's it's more like an amorphous blob of people loosely connected through whatever '2.0' media, probably with an average age of less than 20.
posted by Harry at 1:35 AM on February 8, 2011 [1 favorite]

Thanks a lot for reminding me of that Tim Allen abomination. *shudder*

Somebody else who hated Galaxy Quest! I was going to comment on the GQ thread, but I was afraid I'd be buried up to my neck at low tide.
posted by obiwanwasabi at 3:33 AM on February 8, 2011 [1 favorite]

Shit happens. Collateral damage happens. But when the need arises ...

Tony? Is that you?
posted by obiwanwasabi at 3:34 AM on February 8, 2011

Harry, that's exactly what it is, but Anonymous likes to project an image of themselves as a shadowy underground network of hackers on steroids. Looking good is a huge deal when you're doing any kind of business, and they want to look like 20-year-old Angelina Jolie in the movie Hackers.
posted by LogicalDash at 4:39 AM on February 8, 2011 [1 favorite]

That's right.

Anonymous wants to be the little girl.
posted by LogicalDash at 4:40 AM on February 8, 2011 [3 favorites]

Look, the important bits of Anonymous - not the dicking around with Twitter accounts and webpages after they've been hacked, but the actual "computer crimes" themselves - are perpetrated by relatively small group of people. Anonymous wants to be perceived as a "hive mind Joker", but like any organization there is a hierarchy.

Incidentally, my favorite part of any Anonymous post is when some 4chan dude comes along and spouts off a bit of anonypasta in an authoritative tone, so thanks Poet_Lariat!
posted by muddgirl at 5:55 AM on February 8, 2011 [4 favorites]

Poet_Lariat: Your faith in the competence of government is quaint.
posted by odinsdream at 6:22 AM on February 8, 2011 [1 favorite]

The fact that only a relatively small group of people within Anonymous have the technical skills to pull off more complex hacks doesn't mean that they also have authority within the organization. They have the same standing within the organization as anyone else.

I have some experience with anarchy-minded organizations, and we love love LOVE to believe this. We really do - but in the end it's never true. Any combination of charm, talent, or extra free time wins out in the end.

Anonymous' greatest "hack" has been convincing a bunch of people that they matter. That they are "no one's personal army"... except when they are.
posted by muddgirl at 7:04 AM on February 8, 2011 [1 favorite]

like the devil?
posted by clavdivs at 10:06 AM on February 8, 2011

Thanks a lot for reminding me of that Tim Allen abomination. *shudder*
---
Somebody else who hated Galaxy Quest! I was going to comment on the GQ thread, but I was afraid I'd be buried up to my neck at low tide.

Santa Clause was a shit sandwich. Galaxy Quest is golden, and you are a betrayer of The One True Film.

Clan - get the shovels.
posted by FatherDagon at 10:28 AM on February 8, 2011 [1 favorite]

odinsdream: "Poet_Lariat: Your faith in the competence of government is quaint."

"All right, but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, and public health, what have the Romans ever done for us?"
posted by mullingitover at 11:21 AM on February 8, 2011 [2 favorites]

No-one here seems to get it. Anonymous is not a group with structure and leaders, there are no profit and loss accounts and no mission statement. Anonymous is a temporary loose affiliation of like-minded individuals who decide to take action against something they find reprehensible. The fact that you might consider current and previous actions ineffective or immature or whatever is irrelevant because under the right circumstances, YOU are Anonymous.
posted by NeonSurge at 11:37 AM on February 8, 2011 [3 favorites]

No-one here seems to get it.

We get it, we really do.

Anonymous is a temporary loose affiliation of like-minded individuals who decide to take action against something they find reprehensible.

So it is a group. With (albeit fluctuating) structure, and (albeit fluctuating) decision makers who identify targets, develop strategies, and disseminate information from more private to less private communication channels. Just because there's no organization chart doesn't mean there is not an informal heirarchy.

Jeez, it's like some people thing Anonymous invented the idea of an anarchist movement.
posted by muddgirl at 11:44 AM on February 8, 2011 [4 favorites]

Man, I know it's cool to hate on these guys, but damn I love them. They're a modern-day monkey-wrench gang.
posted by nevercalm at 2:02 PM on February 8, 2011 [1 favorite]

I actually admire Anonymous in many ways, but I dislike their pseudo-philosophical "We are legion... we cannot be held jointly or severally responsible for any of our actions" BS.
posted by muddgirl at 2:11 PM on February 8, 2011

Clan - get the shovels.

/b/ - avenge me!
posted by obiwanwasabi at 2:17 PM on February 8, 2011

I appreciate some of what Anonymous has done; no matter my unsettled opinion of Julian Assange, I consider the ideal of Wikileaks a public good, and deeply resented how quickly the levers of business moved in concert with those of government in the wake of the diplomatic cable leak to isolate the site.

This, of course, was less noble, but I did still appreciate it on another level, as a takedown on so many different levels of an individual of apparently extreme hubris.
posted by The Confessor at 5:39 PM on February 8, 2011

Oh my. Data intelligence firms proposed a systematic attack against WikiLeaks.
posted by mullingitover at 10:20 AM on February 9, 2011 [6 favorites]

Jeez, it's like some people thing Anonymous invented the idea of an anarchist movement.

Actual historical anarchist movements were actually pretty well-organized, public organizations. Please don't shit on people who died to make your life better.
posted by Pope Guilty at 11:31 AM on February 9, 2011 [2 favorites]

No shitting intended. I don't quite get your point beyond the fact that you think that being compared with Anonymous is the worst thing ever?
posted by muddgirl at 11:34 AM on February 9, 2011

Honestly the funniest part of all this is that Anonymous' response to "I HAVE DOX THAT I WILL SELL TO THE FEDS!" is to simply release them to the public.

That's my favorite part too. After reading that, I can't believe he tried to sell that to the feds. There's barely any actionable info in it, and the portions written by the researcher are full of typos.
posted by thsmchnekllsfascists at 11:48 AM on February 9, 2011 [1 favorite]

There's barely any actionable info in it, and the portions written by the researcher are full of typos.

I can't really fault him for recognizing a market for shit data and trying to capitalize on it.
posted by odinsdream at 11:55 AM on February 9, 2011

muddgirl: So it is a group. With (albeit fluctuating) structure, and (albeit fluctuating) decision makers who identify targets, develop strategies, and disseminate information from more private to less private communication channels. Just because there's no organization chart doesn't mean there is not an informal heirarchy.

I havent seen any evidence of them operating like that. I think its more like someone posts an idea on 4chan or IRC, and if enough people think its a good idea then the swarm swarms and a few of the bees land blows. As in, all of their communication is public, if you know where to look. In theory this makes them open to 'hijack', as anyone could try to sway the group, or use their name and put out some 'press releases'. I presume the former risk is avoided because they only achieve 'critical mass' when there's a wide consensus. The latter risk is presumably avoided because individuals don't want to fuck with Anonymous, or claim to be their spokerperson when they aren't. (they were very quick to disown that 'spokesperson' who talked to Radio 4 during the wikileaks battle).

Hence, as I argued above, I think they are best thought of as a hive mind, and not as an anarchist collective or suchlike.
posted by memebake at 12:11 PM on February 9, 2011 [2 favorites]

No shitting intended. I don't quite get your point beyond the fact that you think that being compared with Anonymous is the worst thing ever?

Anonymous is not an anarchist organization and is not organized in the way that anarchist organizations historically were.
posted by Pope Guilty at 1:09 PM on February 9, 2011 [1 favorite]

mullingitover: Oh my. Data intelligence firms proposed a systematic attack against WikiLeaks.

Wow, thats well worth reading.

Quick summary: An email chain recovered from the HBGary hack that this thread is about, reveals that law firm Hunton and Williams asked HBGary, Palantir Technologies and Berico Technologies put together a presentation on how to deal with Wikileaks, for a presentation they were giving to Bank of America. The timing is close to Assange mentioning that he had info on a major bank (Nov 29th to early December), so it was probably a reaction to that.

Among other things, the presentation has a slide about putting pressure on Glen Greenwald to stop him from supporting Wikileaks "These are established professionals that have a liberal bent, but ultimately if pushed most of them will choose professional preservation over cause"
posted by memebake at 2:35 PM on February 9, 2011 [4 favorites]

Man, mullingitover's link is too juicy to be ignored, especially the bit about "submitting fake documents to WikiLeaks and then calling out the error."
posted by Sticherbeast at 2:49 PM on February 9, 2011 [1 favorite]

Man, mullingitover's link is too juicy to be ignored, especially the bit about "submitting fake documents to WikiLeaks and then calling out the error."

Yeah. Wikileaks now mentions it on their front page and have a PDF version of the presentation. The page near the end describing HBGary's expertise is pretty funny: "World renowned vulnerability research and exploit development"
posted by memebake at 3:42 PM on February 9, 2011 [2 favorites]

I think the most interesting part about the Power Point presentation is how the data intelligence firms are conspiring to break Federal computer crime laws. The second most interesting part is how utterly wrong they are in their analysis. Companies pay for this shit?
posted by ryoshu at 6:37 PM on February 9, 2011 [3 favorites]

Comprehensive review on arstechnica.
posted by fixedgear at 4:51 AM on February 10, 2011 [7 favorites]

Wow, fixedgear's arstechnica article is a must-read. Aaron Barr is a real douchebag. With everyone from his programmer to his PR person to his own company president trying to rein him in and cover for him he just charges ahead, oblivious not just to the possibility of retribution but also to his programmer's warnings that the real life names he had "uncovered" might very well be innocent people. MFer deserves everything that happened to him, but too bad for all the people who work with him.
posted by localroger at 6:11 AM on February 10, 2011

Ha, I saw HBGary mentioned over on TPM regarding wikileaks and had an oh huh moment. No mention of of the recent Anonymous hijinks over there yet that I saw.
posted by cortex at 8:00 AM on February 10, 2011

Ugh, what a douche. I'm reading the Arstechnica article right now. Even his staff was telling him that this was a terrible idea.
posted by thsmchnekllsfascists at 8:23 AM on February 10, 2011

I thought what I'd do was, I'd pretend I was one of those deaf-mutes.
posted by ryoshu at 8:44 AM on February 10, 2011 [1 favorite]

Seriously, read the goddamn Arstechnica article. It's amazing.
posted by Pope Guilty at 8:53 AM on February 10, 2011

"As 1337 as these guys are suppsed to be they don't get it. I have pwned them! :)"

This person makes more money then you ever will.
posted by The Whelk at 9:00 AM on February 10, 2011 [2 favorites]

This person makes more money then you ever will.

Not after I sell my 20 page Power Point presentation about the Marcab Confederacy to the FBI.
posted by ryoshu at 9:05 AM on February 10, 2011 [2 favorites]

Penny, the CEO of HBGary, showed up on an Anon IRC channel to discuss the matter.

Long, very long, spanning several hours but I found it interesting. Her argument boiled down to "I'm with HBGary, the Powerpoint was by HBGary Federal, we only sometimes shove business their way that we don't want to do and only own 15% of that company, please don't publish my emails!"

Her attempts at damage control were frequently countered with quotes from internal emails showing at the very least encouragement by her to Aaron Barr to continue the "investigation," and later she even offered money in return for not having the emails published — after being told the torrents were already running and seeded.

Oh, and somebody on her corporate network was attacking a server run by an Anon. I'm hoping the FBI will prosecute that, to be honest.

tl;dr: HBGary Federal seems like a blight on society, yet another proof that connections count for way more than actual technical acumen when it comes to sucking on the government's teat; offering up the lives of innocent people as a sacrifice to appease the bureaucracy. Its management blatantly lies in attempting to cover up its intentions and actual work product and relationships.

Aaron Barr (nickname CogAnon) got epic trolled [txt] when he was asked on an Anon-related IRC channel whether he wanted to participate in an attack on a certain Washington security company.
posted by LanTao at 10:36 AM on February 10, 2011 [6 favorites]

See also the newer thread: Who's been discredited again? - which focuses on the leaked powerpoint.
posted by memebake at 1:07 PM on February 10, 2011

Anonymous doth protest too much, methinks. From the second page of that (excellent) ars technica article, here's an Anon talking to the HBGary president:

Penny please note that the names in that file belong to innocent random people on facebook. none of which are related to us at all

Huh? Did they look in their Anonymous-issued member directory and check every released name from Barr's list? Or did they just do it offline during the big meeting that everybody attends at the Anonymous clubhouse? (My point being that Anonymous being anonymous, its members do not know who one another are, so they couldn't gauge the accuracy of his results with any more certainty that anyone else.)

It's clear that Barr's analysis was crap, even his own people thought so, but that's not to say that the sort of analysis he was pursuing in general wouldn't work. (It doesn't seem particularly new, however.)
posted by whir at 2:05 PM on February 10, 2011 [1 favorite]

Well whir anon posted the list Barr was planning to sell, so if their names were on it it that would be kind of ballsy (but then again, this is anon...). I wouldn't think it would be too hard to get a head's up if anyone had been bullseyed without the individual revealing who the bullseye was. And they did admit he managed to snag a girlfriend.

Which is really, if you think about it, very bad. This is the point the coder was trying to make; even best case you're going to have false positives, and since you're trying to make your rep on this everyone is going to know who to sue if you finger someone who's innocent. Considering the crap that would be likely to ensue after such fingering I would suspect the settlements could be significant if that happened.

Bottom line was Barr was more interested in making his splash than in worrying about that. He didn't care about the innocent victims and he didn't care about the exposure of his company. Dude should be insta-fired.
posted by localroger at 3:44 PM on February 10, 2011 [1 favorite]

If this was the Catholic church he would just be transferred to another parish.

I cannot see how he can retain his job AND have his firm have any credibility whatsoever. And Penny doesn't come across as too bright, either.
posted by maxwelton at 7:22 PM on February 10, 2011

Huh? Did they look in their Anonymous-issued member directory and check every released name from Barr's list?

The people may not have been entirely random, but I read somewhere in the irclog that one of them was an Anon's girlfriend, swept up because he'd used her PC occasionally. It was very bad analysis all around.
posted by scalefree at 10:14 PM on February 10, 2011

« Older Brian Jacques, author of many children's books abo... | Nas & Damian Marley (Dista... Newer »

This thread has been archived and is closed to new comments

Some people learn lessons the hard way. February 7, 2011 11:40 AM Subscribe

Some people learn lessons the hard way.
February 7, 2011 11:40 AM Subscribe