Anonymous hacks BART after wireless shutdown; protests planned for Monday

Anonymous has delivered on earlier threats to hack BART after the San Francisco Bay Area transit entity "pulled a Mubarak." Wireless data service was killed in some stations last week, after BART supervisors got word that protesters were planning demonstrations within the train system. Those demonstrations were to protest the recent killing of a homeless man by a BART officer, and the 2009 fatal shooting by another BART officer of an unarmed passenger.

Today's Anonymous hack included the release of names, passwords, and other personal data stored for users of the marketing site MyBart.org. And this is the database leak. I post the link because some Boing Boing readers are no doubt regular users of the system, and may wish to know if their information was compromised. BART infosec critics are asking why such data was stored in plain text on public-facing servers in the first place.

Californiaavoid.org, a DUI site, was also defaced (screengrab above).

Anonymous has announced plans for a new protest Monday at 5pm at the San Francisco Civic Center station, as well as continued online attacks. This Twitter account seems to be one of the more reliable sources for plans. Meanwhile, BART has called in the feds.

Coverage I've been reading around the web: CNET, SF Gate, SF Examiner, CNN, Oaklandlocal.com, TheNextWeb, BayCitizen.org. The San Francisco ABC News affiliate has an interview with someone identified as an Anonymous member.

In comment threads for previous Boing Boing posts about BART's troubles (and by "troubles," I mean BART officers shooting and killing two passengers), some readers asked whether the entity was private or governmental. It's a dot-gov, a special governmental agency created by the State of California.

Boing Boing editor/partner and tech culture journalist Xeni Jardin hosts and produces Boing Boing's in-flight TV channel on Virgin America airlines (#10 on the dial), and writes about living with breast cancer. Diagnosed in 2011. @xeni on Twitter. email: xeni@boingboing.net.

More at Boing Boing

Eurovision 2013: An American in London

The technology that links taxonomy and Star Trek

Xof

Well, I’m convinced. There’s nothing like massive release of personal information of uninvolved people to demonstrate the correctness of a cause.

P.S. To: BART info sec people: What the fsck?
- nopits
  
  Better than blowing the place up! Don’t ya think? Everyone is involved in this one. They jam the cell service and someone needing help cannot call for it. This will also be a big issue on the internet when Obama gets his “hot button” to turn it off. They have no right to do that. We pay for service-not them!!!
mat catastrophe

Well, someone wrote something the other day that they should be more “serious”.

This. Is. Serious. Business.
- That_Anonymous_Coward
  
  Needs a cat pic or it wasn’t serious.
http://kalabhairava.org/ Corry O’Neill

There will not doubt be a continued and heated debate about whether Anonymous is a force for good or for evil. To me, this is a matter of supreme indifference. Anonymous is inevitable.
- jcostantino
  
  Anonymous is a force of itself, I don’t think it is inherently Good or Evil. It is, as they say, for the lulz.
  - http://www.facebook.com/pahokin.mahwheenir Pahokin Mahwheenir
    
    I can’t help but think that doing something “for the lulz” is in itself, a darker shade of grey.
    
    Doing something in protest is one thing, doing it because it’s amusing is completely different.
CastanhasDoPara

Oh great. Surely the way to win hearts and minds and seek redress for blacking out stations is by stealing customer info and posting it publicly. What exactly is this suppose to accomplish and how is this any better than what BART did? It’s actually worse in my opinion. A getting-to-be-less-rare-miss for anon.

Also, BART IT security team, you screwed up too.

edit: Opps, sorry Xof seems I unintentionally copied you. Guess I owe you a coke or something.
- http://www.facebook.com/michael.valera.s Michael Valera
  
  “What exactly is this suppose to accomplish and how is this any better
  than what BART did? It’s actually worse in my opinion. A
  getting-to-be-less-rare-miss for anon”
  
  You mean that officers killing 2 unarmed people is nothing compared to leaking unencrypted data?
  - nick15
    
    Or that blanket banning ALL (ie innocent) users from network service is no where near as bad as leaking unencrypted data of a relatively small group of people who actually committed an offense against innocent people (BART)?
  - CastanhasDoPara
    
    You need to work on your critical thinking skills here.
    
    I did not say that anon leaking personal info was worse than the shootings, I said that the leaking was worse than the black-out.
    
    So my point and question still stand, what in the hell did this accomplish? Not only that but you’re okay with innocent people’s data being made public as a form of protest against police brutality. That’s like saying, hey you shot my friend so I’m going to put all these random people over here, that had nothing to do with my friend getting shot, in peril. Yeah, that sounds fair, ethical and right to me… idiots!
- http://twitter.com/CorporateFawkes Dylan Giles
  
  Killing people is less worse than hacking BART’s system? The protests are about 2 murders by BART officers. BART is blacking out stations in response to the threat of protests.
  - CastanhasDoPara
    
    If you don’t know why harming many random innocent people in lieu of going after those that deserve punishment ( such as BART itself, and it’s rogue cops) then I really don’t know what to tell you. I’m not even sure why I am talking to you. See, when you harm innocent people (say by releasing private information about them) and call it justice you are either foolish, ignorant, or a jerk or all of the above. This was not an act of protest, nor an act of justice, it was the act of a tyrant. And in this case anon are not protestors or freedom-fighters or heroes of the net they are blindly raging bullies.
    
    All that said, what BART and it’s cops did was so wrong in so many ways that it boggles the mind. And THEY should be punished. However, whipping their customers is not a valid punishment and it’s a very scummy thing to do.
http://www.facebook.com/daniel.mora Daniel Mora

God bless Anon. <3
masamunecyrus

Anonymous is blowback for years of increasing opppression by Western “free, democratic” governments of the world. Ringleaders though it may have, the kid who was arrested in the UK was right.

“You can’t arrest an idea.”

Anonymous will continue so long as tech-savvy citizens are feeling that their freedom is being oppressed and anyone that fails to see that completely fails to comprehend the disenchantment that young people feel towards authority today.
Xof

Anonymous is blowback for years of increasing opppression by Western “free, democratic” governments of the world.

And, so, they’ve TP’d a house, and scattered the school records on the front yard. Messy and requires cleanup by other people, and absolutely irrelevant to the problem they claim to be campaigning against.
- Bersl
  
  The result being that people pay attention to them. If people pay attention to them, people have a better chance of paying attention to what is being involved. Even if only a fraction of those who didn’t know about Anon before now look into the subject, and even if only a fraction of that fraction even remotely come to a relevant conclusion, it’s better than leaving the topic to stagnate in the hands of those for whom these problems are old news.
- nick15
  
  You’re assuming a “clean up by other people” of Anonymous’ actions is some kind of back-breaking task that takes days to accomplish, akin to the “TD’d … an scattered … school records on the front years” clean up required in real life.
  
  The difference between Anonymous and domestic/international terrorists is that you can’t undo real life you can online. And Anonymous knows it.
  - Xof
    
    You’ve never had to patch up a security breach on a server, I can tell.
    
    And you know something about releasing a file to the Internet? You can’t undo it.
- http://www.facebook.com/pahokin.mahwheenir Pahokin Mahwheenir
  
  HERE HERE!!
  
  This is a Juvie “kicking sand in someone’s face” kind of attack. Messing with the site in protest is, like Xof said, the IT version of TPing the Principal’s house.
  
  Stealing the Records proves the lack of security used… but sharing ALL of the details of what they mined from the site is Morally irresponsible. And coming from a group that’s using Morallity as the justification for their actions… it kind of makes them seem more like cyber vandals and less like cyber revolutionaries. Kind of reminds me of a “killing in the name of God” sort of mentallity.
  
  You can’t do evil in the name of good, it doesn’t work that way. Not to mention it’s horribly Cliche.
benher

I agree with the notion that Anonymous was inevitable. Expressing distain or admiration for them is largely irrelevant.

Besides, I have a hard time believing that the rest of the net would shed any tears for the tyrants who are their victims.
- Daniel Forster
  
  How is an anti-drunk-driving campaign tyranny?
  - Xof
    
    A BART station agent was mean to me once, so, burn baby burn! #firstworldproblem
    - nick15
      
      If a “first world problem” is a rent-a-cop killing an uninvolved person with powers not granted to them by the people, then the history of humanity has been dealing with this “first world problem” for centuries…
      - Xof
        
        Well, BART cops aren’t rent-a-cops (they’re real police) and the person shot can’t really be said to be “uninvolved,” and the comment wasn’t about that anyway, but otherwise, you’re spot on.
        
        I see no reason to give the BART police the benefit of the doubt in this shooting; they have a pretty spotty record. But Anonymous is just be juvenile here. I mean, an anti-drunk-driving site? What in has that got to to do with anything.
grimc

That’ll show mass transit users and people against drunk driving. Hope they learned their lesson. Good job, Anon.
http://www.facebook.com/people/Trent-Baker/100000123865597 Trent Baker

Really this was a lazy response, a wprthwile response would be to make a CC device that could bypass the blocks so no one can stop the signal.
PapayaSF

Wow, what perfect examples of how brain-dead “protest” can be. BART cops killed two people, so let’s interrupt the commutes of thousands of transit riders. That’ll show… who, exactly? And what will it show them? Will it somehow enlighten lots of people who are supposedly in favor of cops shooting people that not everybody agrees? Will BART management think: “Gosh, these protests make us question our long-standing policy in favor of shooting of BART patrons”?

And vandalizing an anti-drunk-driving website to protest… a BART station antenna switch-off? Brilliant! Could the connection be any more tenuous?
Or is Anonymous just a group of jerks with hammers who think every problem looks like a nail, and who likes to use self-righteous b.s. to justify what amounts to useless tantrums and pointless (if not counterproductive) vandalism?
- That_Anonymous_Coward
  
  “so let’s interrupt the commutes of thousands of transit riders”
  
  Having not seen the filed protest plan for the event, I wonder how much truth that statement contains.
  The protest could merely have been people standing with signs and pamphlets to hand out, it could have been a reenactment of Thriller, it could have been people blowing bubbles (only gets you arrested in Canada and then you sue people on YouTube for mocking you), it could have been a double dutch competition (ok that might get in people’s way).
  
  The only time I’ve seen anyone claiming they were out to screw up the trains was from the people running the service, and given their track record at the moment… I disbelieve them.
  - AntiSlice
    
    I assume they were thinking of the last set of BART protests when that statement was made. Powell, Civic Center and 16th St stations were all shut down during the evening commute. I’d say that affected thousands of transit riders – both the ones using BART and the ones on Muni being suddenly overwhelmed when BART shut down.
    
    http://www.fogcityjournal.com/wordpress/2931/bart-protest-delays-evening-commute/
    - That_Anonymous_Coward
      
      Well the last guy to try to blow up a plane tried to use his underwear so everyone drop trou. Looking at what happened last time rarely is helpful when you fail to adapt.
      
      While screwing over that many people is not a good idea, I doubt that was the intent of each person who attended. I saw several people holding signs and photos talking with other people in what seemed to be rational ways. (still photos hard to tell)
      And then you had some asshats going overboard.
      Having your “police” response standing there in the best jackbooted finery MIGHT be not a smart move.
      
      A smart response might have been to reach out to the organizers and say flatly – You have a right to protest, your right to protest ends when it effects other people. Stopping the trains will not be tolerated, we invite you to come hand out flyers, inform the public of your side. As horrible as this incident is to you, pissing off the commuters will not make them take your side. If you disrupt the trains, we will arrest you.
      
      And then you go on with your day. You arrange for a paddy wagon to be available, you arrange for extra security to be available but not out as a visual scare tactic. When the few who are there to just be outrageous get out of hand, you arrest them and press the appropriate charges. The people there to protest get their message out, some commuters get informed, the asshats get arrested and life goes on.
      
      Trying to overcome the view some people, rightly or wrongly, of you being jackbooted thugs is never helped by turning off communication forms. Falling into the we are the authority and you will respect us rarely ends well.
      
      They still could have done this and it still could have turned into just as horrible as it was last time, but honestly when your commute time is more important than freedom of speech there might need to be a look at the priorities. You can inform people without screwing with their lives, it is a matter of finding the balance.
  - PapayaSF
    
    The fact that the protest is planned for a downtown station at 5:00 pm on a weekday is proof that it’s meant to be disruptive. Those stations are already crowded at rush hour with people who need to travel; adding more people to the platforms who just want to hand out pamphlets or blow bubbles or anything other than traveling is inherently disruptive, and the organizers know this.
- http://twitter.com/nonpeter Peter Zanon
  
  I agree. Only two people were killed. People should just shut up and accept that cops kill people. Sometimes violence is necessary to make the trains run on time.
  
  [/sarcasm]
  
  Seriously, PapayaSF, what is a “better” thing to do? How about you going along and doing that? Or would you rather have a few undesirables killed as long as the trains run on time?
  I’m rather dismayed that delaying a commute is shocking to people, but murder isn’t. These commuters all purchased tickets (or clipper cards or whatever). They’re paying for a service that kills people. Maybe arriving to that morning’s meeting an hour late would do them good, if it gives them that time to think about what they pay others to do in order to get to work on time.
  - PapayaSF
    
    Who says murder is acceptable? The guy who did the first killing went to prison for it, and the second (at least so far) doesn’t look like “murder” to me, because if someone throws a knife at a guy and then gets shot, it’s self defense.
    
    But in any case it’s ridiculous to punish BART patrons for this. Who the heck are you or anyone to decide that you have the right to delay someone’s travel by an hour in order to “get them to think” about anything? For all you know someone at that station could be racing to a hospital to see a dying relative, or be involved in something else quite time-sensitive. Do I really have to explain that this sort of action does not generate sympathy for a cause?
    
    And it’s especially ridiculous to consider them patrons of “a service that kills people.” Sheesh.
    - http://twitter.com/nonpeter Peter Zanon
      
      Who says murder is acceptable? The guy who did the first killing went to prison for it, and the second (at least so far) doesn’t look like “murder” to me, because if someone throws a knife at a guy and then gets shot, it’s self defense.
      
      The reason I implied that people think murder is acceptable because it sounds like some people are accepting it, and really trying hard to justify it, so they can go on with their lives and not feel bad griping about being late for work. For one thing, it’s hard to construe ANY situation where lethal force is self-defense, and from what is known about the situation, and a little common sense, this certainly isn’t one of those. Gunned to death? Really? When they out numbered him and had tasers? Sorry, that doesn’t sound like “self defense” to me. If you have other options, and you choose killing, then its murder.
      
      And it’s especially ridiculous to consider them patrons of “a service that kills people.” Sheesh.
      
      Why is it ridiculous? They pay for a service. The service uses those funds (among others) to pay armed employees. These employees have an recently high track record of murder during their job, under the pretense of keeping the station “secure” and providing that service which customers pay for. Please note that I use BART too, so I’m as guilty as anyone else. It doesn’t sit well with me. I’m happy that it doesn’t sit well with other people either: hence the protests.
      
      (I was going to tackle other points, but this is long enough :P )
http://www.mrericsir.com MrEricSir

MyBart is a service that’s barely related to Bart in the first place. It’s a website about local events where you can win free tickets and such.
HenryPootel

It boggles the mind that a site would store unencrypted passwords. It also goes to show that you might as well just set your password to “password” if jackwagon developers are going to just leave your password in the open.
That_Anonymous_Coward

Oh the humanity…

“Allison also noted that BART’s website infrastructure is not at all
connected to the computer systems that run the trains themselves, and
that the web attacks would not result in any service delays.”

Did he have to ask first? I think I am disturbed that you needed to clarify this point, most people do not assume that the Best Buy website lets you control your local store. Or that your local electric companies website lets you control the system…. but now I gotta wonder about how you do stuff in CA.

“He said that BART allows for protests in the station, but outside the
fare gates. “We firmly believe in free speech, that’s why we have an
expressive activities program that allows for activities outside the
fare gates, where it’s safe,” Allison said.”

No ya don’t. People wanted to protest shit you did and you said NO. Then you shut down cell service on the CHANCE they might do something.

How much longer are we willing to accept “Free Speech Zones”? The country was founded with the idea of free speech, not free speech everywhere except where the media might see.

Oh and morons, start looking for a scapegoat or 7.
Passwords stored in plain text… maybe you missed the first 5 times Sony got hacked but really?

Maybe the demon sysadmin from CA had the right idea and all of the “top thinkers” working for you are the problem.
Xof

Shutting down the cell repeaters was a dick move. It accomplished nothing (by the time people got to the dead zone, they were already where the protest was planned to happen) except give BART yet another PR nightmare to deal with. Nice job breaking it, hero.

And then Anonymous comes along with another dick move, promptly moving the debate from “BART cops shot an unarmed man and then BART did a dick move by shutting down the cell repeaters” to “punks are spraying personal information across the internet.” Thanks, that’s a great contribution to the conversation, Anonymous.

(I’ll also point out that Anonymous didn’t get involved until BART shut down the cell repeaters. I guess the whole BART-cops-shooting-an-unarmed-man thing isn’t Anonymous-worthy.)
http://twitter.com/shelbythomas Shelby Thomas

Why do activists insist on wearing a mask which references a very, very stupid movie?
- http://pulse.yahoo.com/_MLAKC2J76NFB64XLSLUKEHF4J4 Daniel
  
  1. Because it was comix about 25 years before it was a movie
  2. Because it’s thematically appropriate
  3. Because some people have better taste in movies than you do
- Pend-O-Matic
  
  If that’s an actual question- to incite fear. guy fawkes (not his intention, but reaction to him) caused many to fear just how easy it was their government could be destroyed(by proxy themselves via their country), the government- that they could be killed. That is how it should be. A government literally can hold the life of their people. Because so many governments (as well as the one in that “very stupid movie”) discount the lives of their people, because they no longer fear/care for their people. The mask is to reinstate the fear necessary for good governance. in theory greedy people only respond to fear, and those now who run for office need to be rich to run winning campaigns.
  
  “Why do you wear the stupid man suit?”
Rah El

Okay, let me see if i get this right; I as a customer put my trust into some company to ensure the safety of my personal stuff, like data. Then the company does something to piss off some third party, which retaliates at the company by searching for flaws in their security system, finds one or more, and so is able to steal my valuable stuff. And then people start telling me i should despise those who used those flaws to get my data, not those who I trusted in and who failed at protecting my stuff.Does that also mean that if my bank leaves open a back door leading right into the vault, and some crooks steal the golden watch I inherited from my parents, I should hug the bank and say “Un-be-lievable there are people doing this, let’s hope they catch them soon. Come with me, I think we both need a beer now – and don’t worry, we’ll both sue those crooks once police gets them”?
http://pulse.yahoo.com/_LYYCAPNRGQMWWXNRUZVWI226MM abayareabum

These BART clowns need their guns permanently taken away! Then I’d feel a lot safer!
Guest

If this doesn’t convince you that Anonymous are douchebags, I don’t know what will.
- Rah El
  
  This just convinces me once more that most companies don’t take security serious enough. I, for one, prefer Anonymous publicly leaking that data over some real crooks just stealing it and passing it on, while the company either doesn’t even notice, or does not notice but won’t talk about it, or will only talk about it after the stolen data has been abused.
http://evilbobdayjob.blogspot.com/ Deidzoeb

Typical Anonymous reaction. “Ho hum, another person shot in the back by a cop. Blah blah, what else is happening the in the news? Wait, they cut cell service to protesters??? Aw hell no. This cannot stand!”
technogeekagain

C’mon, folks. You know better than to feed trolls. If the media wasn’t publicizing Anonymous’s exploits — and crediting the cretins — they’d have much less incentive to continue.
toyg

Anonymous is the internet equivalent of early anarchic movements: an emergent force for social justice, minimally organized and still exposing an incoherent and uncomplicated view of the world, often led by “renegade” members of the upper class.

The Powers that Be didn’t fear Bakunin (who they could easily criminalize), but they ended up fearing Marx. In the same way, they don’t fear Anonymous, but rather what will inevitably follow. Expect stronger and stronger calls to turn off the internet at the smallest breach of the peace.
- grimc
  
  Anonymous isn’t a movement. It’s a group of people who find being offensive entertaining that occasionally take a break from posting racist jokes and grotesquerie to hunt down cat abusers, harass preteen girls and perform acts of attention whoring in the name of ‘justice’.
  - toyg
    
    Do you seriously think original anarchic movements didn’t feature a large share of common criminals and bad/cruel people ? You’d be naive. Most determined “action” groups contain a significant number of insane and violent people.
    
    Yes, Anonymous is a mixed bag, nobody disputes that; it’s always been the case in the blackhat underworld. No, I don’t idolize them or think they’re the solution to any problem. However, I can grasp the historical significance of their appearance, especially in the mainstream media narrative, and you’d be naive to underestimate the political consequences and likely outcomes of their actions.
- Pend-O-Matic
  
  While I do agree the big picture is they want to sublimate the net, i think the smaller powers really just are ignorant (most people are) and that these sub flavors of anon are mostly using brute force. BB could and has caused DoS [accidentally] (correct me if I’m wrong). Also I have to agree that if the upper class (in part) has gone rouge then it’s an indicator of things to come. That really should be how people view this. If something is big enough- it’s at the very least an indicator- that indicator is what requires our attention not necessarily the thing itself.
http://twitter.com/dubthach jesse l mabus

because the stupid movie references an important comic book whose model is a historical attempt by the dis-empowered to wrest power back from their oppressors. read a book once in a while or check out the wiki before making a stupid comment.
- Antinous / Moderator
  
  because the stupid movie references an important comic book whose model is a historical attempt by the dis-empowered to wrest power back from their oppressors. read a book once in a while or check out the wiki before making a stupid comment.
  
  No. It references a right-wing nut who tried to return Great Britain to enforced Catholicism. He was the Mel Gibson of his day. Please see your own comment re reading.
  - TimothyWells
    
    Penny for (information on) the guy.
    - Daniel Forster
      
      Antinous refers to Guy Fawkes: http://en.wikipedia.org/wiki/Guy_fawkes
      
      He’s so loved in England that there’s an annual holiday of burning him in effigy. That’s where the tradition of Guy Fawkes masks came from.
Paool

No love for anon. They need to stick with defacing random sites no one cares about and not getting involved in political or protest related issues. They taint the side they support with their would be vigilantism and give the side THEY support an air of bad press.

TL:DR?
They do more harm than good for what they support.
bonjourmiette

I don’t know the Guy Fawkes is a little ironic (which I also think its origin in the Comic was meant to be.) Reminds me a little of all the people who read/saw Fight Club and only got the Tyler Durden philosophy, never the underlying message of the book.

In one sense I appreciate some of the insecure data outing that Anon and Lulzsec have done because it’s irresponsible of corporations to ask for our trust and personal data and then put it behind the cheapest solution when they know damn well they’ll still turn us down as a bad risk based on compromised identities that they are at fault for in the first place. However what’s the real difference between a criminal stealing our info and putting it out for their use or the use of others and Anonymous doing it to prove some point about our misplaced trust in corps?

I think what bugs me most about these guys is that I know that there is a ton of brilliance and talent in their ranks and it just feels like they could be doing so much more to use those skills to promote change, but instead of exploiting networks to provide cell access, or hacking cctv networks to watch the watchmen, we get NPR articles on how Tupac lives in NZ (when it’s funny) or unrelated people’s personal info thrown up on the web (when it’s a dick move.)
Teller

I understand the hack is part of the diy/tech vibe at BB. But lulz, anon et al get so much early press here, it’s beginning to feel like press-agentry. You guys fronting or just plugged-in supergood?
- Antinous / Moderator
  
  Duh. We’re sucking up so they don’t hit us.
  - Teller
    
    So far so good!
- Pend-O-Matic
  
  you should see reddit-they’re super plugged in… mmhmn