Read the rest
The Spectator has just run my review of Gabriella Coleman's Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous , an anthropological recounting of the glories and disasters of Anonymous.
Read the rest
A new Snowden leak, reported by NBC, documents the UK spy agency GCHQ's attacks on Anonymous, which included Denial-of-Service attacks, which are strictly forbidden under UK law. As the Slashdot story notes, "Regular citizens would face 10 years in prison and enormous fines for committing a DoS / DDoS attack. The same applies if they encouraged or assisted in one. But if you work in the government, it seems like you're an exception to the rule."
Onion Pi - Convert a Raspberry Pi into a Anonymizing Tor Proxy, for easy anonymous internet browsing
About this nifty "Onion Pi" HOWTO just published at Adafruit, Phil Torrone says, "Limor and I cooked up this project for folks. We are donating a portion of any sales for the pack we sell that helps do this to the EFF and Tor."
Browse anonymously anywhere you go with the Onion Pi Tor proxy. This is fun weekend project that uses a Raspberry Pi, a USB WiFi adapter and Ethernet cable to create a small, low-power and portable privacy Pi. Using it is easy-as-pie. First, plug the Ethernet cable into any Internet provider in your home, work, hotel or conference/event. Next, power up the Pi with the micro USB cable to your laptop or to the wall adapter. The Pi will boot up and create a new secure wireless access point called Onion Pi. Connecting to that access point will automatically route any web browsing from your computer through the anonymizing Tor network.
Some people using the Anonymous banner have declared religious war on the Westboro Baptist Church, the real-life "God hates fags" trolls who have announced their intention to picket the funerals of the children shot in Sandy Hook. In addition to publishing a list of purported home addresses and phone numbers of alleged Westboro members, the Anons have released a videos that sets out chapter-and-verse citations of Biblical injunctions that Westboro is said to have violated, and promises to punish all of them.
In response to the WBC's plans early today, Anonymous tweeted, "It's so nice of #WBC to provide the internet with a list of their twitter handles..." Roughly one hour later, they revealed their plans for the WBC: "#WBC GodHatesFags Site Admin gets #DOX'd via: Anonymous." DOX, of course, refers to the work Anonymous did to find and publish a list of WBC members complete with e-mails, phone numbers, and even home addresses—all for the adoring public to access.
In addition to the DOXing, Anonymous has repeatedly promoted a whitehouse.org petition to have the WBC recognized legally as a hate-group. The petition was created on Friday and it has already doubled the required 25,000 signatures.
Quinn Norton reports in depth on Wired with a careful, important account of where Anonymous's actions come from -- how coordinated activity (political, lulzy, legal and illegal) can emerge from noise, randomness, bombast and joking. This is the best description of how decision-making works in decentralized movements, and has important implications for the future of activism, governance, politics, crime and security:
But it’s a mistake to identify Anonymous entirely with these arrestees, some of whom were blackhats and others who were guilty of just using the LOIC. The hacks draw their power from the support of the wider collective, not the other way around. The majority of Anonymous operations are conceived and planned in a chaotic and open fashion. At any given time, a few thousand people are congregating on the Anonymous IRC channels, figuring out for themselves what it means to be an anon. And together they embody whatever Anonymous is going to be that day.
Most of the time, in most of the channels, there’s little more than conversation; sometimes a whole channel will consist of lurkers, with no one contributing a thing. But when some offense to the net is detected, anons will converge on one or more of these “chans,” with hundreds or thousands arriving within hours—many of them new to Anonymous and yet all primed and eager to respond. What looks in one moment like a sad, empty chat room can quickly become the staging ground for a major multipronged assault.
Consider OpBART, which flared up in August 2011 and dealt with an unlikely issue for Anonymous: the messy offline world of race relations and police violence. Ever since 2009, when a Bay Area Rapid Transit police officer shot and killed an unarmed black man named Oscar Grant, protests against abuse of authority by transit police had grown. On August 11, anti-BART activists were planning a rally at several of San Francisco’s underground transit stops to protest another shooting by a BART officer, this one of a homeless man named Charles Hill. It was an unremarkable story by the standards of the national media, but the response from BART to the planned protest did catch the interest of the local press: To thwart protesters from coordinating via mobile devices, BART cut cell service at its downtown stations.
My latest Guardian column is "Disorganised but effective: how technology lowers transaction costs," a piece about a new kind of group that has been enabled by the Internet -- a group with no formal structure that can still get stuff done, like Occupy and Anonymous.
The things that one person can do define what is "human". The things that transcend the limits of an individual – building a skyscraper, governing a nation, laying a telecommunications network, writing an operating system – are the realm of the super-human.
The most profound social revolutions in human history have arisen whenever a technology comes along that lowers transaction costs. Technologies that makes it cheaper to work together lower the tax on super-human powers.
Language (which allowed for explicit communication), writing (which allowed for record-keeping), literacy (which allowed for communication at a distance and through time) and all the way up to assembly lines, telegraphs, telephones, cryptography (which lowers transaction costs by reducing the amount of energy you have to expend to keep attackers out of your coordination efforts), computers, networks, mobile phones and beyond.
Decreasing transaction costs means that the powerful can do more. If you've already organised a state or criminal enterprise or church with you at the top, it means that you've figured out how to harvest and distribute resources effectively enough to maintain your institutional stability.
A good-tempered rebuke from The Pirate Bay to the Anons who staged a raid on Virgin Media in protest of the ISP's participation in blocking The Pirate Bay for its customers:
Seems like some random Anonymous groups have run a DDOS campaign against Virgin media and some other sites. We'd like to be clear about our view on this:
We do NOT encourage these actions. We believe in the open and free internets, where anyone can express their views. Even if we strongly disagree with them and even if they hate us.
So don't fight them using their ugly methods. DDOS and blocks are both forms of censorship.
If you want to help; start a tracker, arrange a manifestation, join or start a pirate party, teach your friends the art of bittorrent, set up a proxy, write your political representatives, develop a new p2p protocol, print some pro piracy posters and decorate your town with, support our promo bay artists or just be a nice person and give your mom a call to tell her you love her.
Further to the ignoble saga of Anonymosus-OS, an Ubuntu variant targeted as people who want to participate in Anonymous actions: Sean Gallagher has done the legwork to compare the checksums of the packages included in the OS with their canonical versions and has found a long list of files that have been modified. Some of these ("usr/share/gnome/help/tomboy/eu/figures/tomboy-pinup.png: FAILED") are vanishingly unlikely to be malware, while others ("usr/share/ubiquity/apt-setup") are more alarming.
None of this is conclusive proof of malware in the OS, but it is further reason not to trust it -- if you're going to produce this kind of project and modify the packages so that they don't check, you really should document the alterations you've made.
all.md5 > /dev/shm/check.txt
md5sum: WARNING: 143 of 95805 computed checksums did NOT match
anonymous@anonymous:/$ grep -v ': OK$' /dev/shm/check.txt
The bad checksums in Anonymous-OS (Thanks, Sean!)
On Ars Technica, Sean Gallagher delves into the Anonymosus-OS, an Ubuntu Linux derivative I wrote about yesterday that billed itself as an OS for Anonymous, with a number of security/hacking tools pre-installed. Sean's conclusions is that, contrary to rumor, there's not any malware visible in the package, but there's plenty of dubious "security" tools like the Low Orbit Ion Cannon: "I don't know how much more booby-trapped a tool can get than pointing authorities right back at your IP address as LOIC does without being modified."
As far as I can tell, Sean hasn't compared the package checksums for Anonymosus-OS, which would be an important and easy (though tedious) step for anyone who was worried about the OS hiding malware to take.
Update: Sean's done the checksum comparison and found 143 files that don't match up with the published versions.
Some of the tools are of questionable value, and the attack tools might well be booby-trapped in some way. But I don't know how much more booby-trapped a tool can get than pointing authorities right back at your IP address as LOIC does without being modified.
Most of the stuff in the "Anonymous" menu here is widely available as open source or as Web-based tools—in fact, a number of the tools are just links to websites, such as the MD5 hash cracker MD5Crack Web. But it's clear there are a number of tools here that are in daily use by AnonOps and others, including the encryption tool they've taken to using for passing target information back and forth.
Quinn Norton has an excellent piece over at Wired:Threat Level on the reactions within "Anonymous" to the news that LulzSec frontman "Sabu" (photo above) was collaborating with the FBI. Kim Zetter's take on the arrests and secret plea deals is here.
The Guardian has more on the big hacking news which Fox News broke yesterday (as noted in a post by Rob). "Sabu," the trash-talking, self-appointed leader of LulzSec, has been working for the FBI for the last six months. The FBI says he helped the US and various European governments identify and arrest five alleged LulzSec members charged with participating in defacement, DDOSing, and "doxing" against high-profile government and corporate targets. Sabu (above) is, in now identified as Hector Xavier Monsegur, a 28-year-old unemployed Puerto Rican guy living in New York, and a father of two. He was charged with 12 criminal counts of conspiracy to engage in "computer hacking and other crimes" last year, pled guilty in August, 2011, then "snitched" on his LulzSec friends.
Here's the FBI news release, which notably omits the names of any prosecutors (perhaps for fear of Anonymous attack).
Snip from Guardian story:
His online "hacker" activity continued until very recently, with a tweet sent by him in the last 24 hours saying: "The feds at this moment are scouring our lives without warrants. Without judges approval. This needs to change. Asap."
In a US court document, the FBI's informant – there described as CW – "acting under the direction of the FBI" helped facilitate the publication of what was thought to be an embarrassing leak of conference call between the FBI and the UK's Serious and Organised Crime Agency in February. Officers from both sides of the Atlantic were heard discussing the progress of various hacking investigations in the call.
A second document shows that Monsegur – styled this time as CW-1 – provided an FBI-owned computer to facilitate the release of 5m emails taken from US security consultancy Stratfor and which are now being published by WikiLeaks. That suggests the FBI may have had an inside track on discussions between Julian Assange of WikiLeaks, and Anonymous, another hacking group, about the leaking of thousands of confidential emails and documents.
The indictments mark the most significant strike by law enforcement officials against the amateur hacker groups that have sprung out of Anonymous. These groups, which include LulzSec, have cost businesses millions of pounds and exposed the credit card details and passwords of nearly 1 million people.
Fox News' Jana Winter reports that LulzSec's Sabu was caught and turned by the authorities last June and has been working with them since. Other members of the group were arrested today as a result, she writes; details will be unsealed today in district court. The name given, Hector Xavier Monsegur, would confirm earlier outings and doxings from the same period. Last June saw the group publicly suspend operations, if you'll recall, and suffer its earliest arrests.
Spanish police also accused one of four suspects picked up in the cities of Madrid and Malaga of releasing personal data about police officers and bodyguards protecting Spain's royal family and the prime minister.
Other arrests were in Argentina, Chile and Colombia, and 250 items of computer equipment and mobile phones were seized across 15 cities, Interpol said. Colombia's Ministry of Defence and presidential websites as well as Chile's Endesa electricity company were among the targets of the hackers, it said.
In this YouTube video, someone in Anonymous garb has threatens a massive, embarrassing document dump for Vic Toews, the Canadian MP and Public Safety Minister whose domestic spying bill will require ISPs to log information on Canadians' Internet use and to turn that to police and appointed inspectors over without a warrant (and which immunizes ISPs from liability should they voluntarily turn over even more information, like the contents of email). The Anon demands that Toews retract his legislation.
Toews is a "family values" candidate who has consistently stood on a ticket that opposed gay marriage and espoused other supposedly conservative ideals, and he was publicly embarrassed when an anonymous Twitter user going by @Vikileaks30 tweeted choice quotes from the affidavits in Toews's messy divorce (which was precipitated by an affair with a much younger woman, whom Toews impregnated, and led to what his ex-wife described as an abandonment of his previous family). If there were further embarrassments of this nature in Toews's closet, it might alienate the voters who elected him on the basis of his "sanctity of the family" platform.
"All this legislation does is give your corrupted government more power to control its citizens," a synthesized voice says in one of the videos still posted to the site Monday.
"We know all about you, Mr. Toews, and during Operation White North we will release what we have unless you scrap this bill," it states.
The RCMP has been called in to investigate apparent death threats against Toews as controversy swirls around the legislation. Police said Monday they haven't yet decided whether a full investigation will be launched.
Alan Moore, writer of V for Vendetta and enigmatic wizard of comicology, describes the relationship between the Guy Fawkes mask and Anonymous, anti-ACTA protests, and the Occupy movement. Beginning with the Moore-ish phrase, "Without wishing to overstate my case, everything in the observable universe definitely has its origins in Northamptonshire, and the adoption of the V for Vendetta mask as a multipurpose icon by the emerging global protest movements is no exception," Moore goes on to semi-seriously condemn the ugly reality of post-capitalist winner-take-all economics and explain why V for Vendetta has found such fertile soil in this decade.
It also seems that our character's charismatic grin has provided a ready-made identity for these highly motivated protesters, one embodying resonances of anarchy, romance, and theatre that are clearly well-suited to contemporary activism, from Madrid's Indignados to the Occupy Wall Street movement. Neglect
Our present financial ethos no longer even resembles conventional capitalism, which at least implies a brutal Darwinian free-for-all, however one-sided and unfair. Instead, we have a situation where the banks seem to be an untouchable monarchy beyond the reach of governmental restraint, much like the profligate court of Charles I.
Then, a depraved neglect of the poor and the "squeezed middle" led inexorably to an unanticipated reaction in the horrific form of Oliver Cromwell and the English Civil War which, as it happens, was bloodily concluded in Northamptonshire.
Today's response to similar oppressions seems to be one that is intelligent, constantly evolving and considerably more humane, and yet our character's borrowed Catholic revolutionary visage and his incongruously Puritan apparel are perhaps a reminder that unjust institutions may always be haunted by volatile 17th century spectres, even if today's uprisings are fuelled more by social networks than by gunpowder.
Viewpoint: V for Vendetta and the rise of Anonymous (Thanks, Gawain Lavers!)
Here's some handy, infringealicious clip art for the discriminating Anon who wants to make a statement without paying a royalty: a Guy Fawkes mask, suitable for urban art, dress-up, and silkscreening.
Guy Fawkes Mask clip art (Thanks, @crisnoble!)
A group of Anons are about to dump a torrent 2.6GB of email containing "detailed records, transcripts, testimony, trial evidence, and legal defense donation records" about the Haditha massacre, in which 24 unarmed Iraqi men, women and children were killed by the USMC.
The announcement states that Anonymous stole 2.6 gigabytes of e-mail belonging to Puckett Faraj, a law firm that represents Staff Sgt. Frank Wuterich, who is accused of leading the group of Marines in Haditha. The Web site of Puckett Faraj is not currently loading, and Gawker is reporting that the site was hacked.
A spokeswoman for Puckett Faraj confirmed that the Web site was down but said that she could not confirm or deny whether the site had been hacked.
MegaUpload raided, founder arrested; Anonymous launches mass DDoS against entertainment companies and US law enforcement
New Zealand police, responding from a request from the US government, raided MegaUpload today, arresting founder and CEO Kim ”Dotcom” Schmitz and three "associates." The service, which allowed users to upload files that were too big to email, claimed 150 million users. The entertainment industry alleged that the service was primarily intended to facilitate copyright infringement, since people could use it to illegally share music and movies, but the company claimed that while some users might infringe copyright with MegaUpload, others simply used it to share files that belonged to them. For example, I use a comparable service, YouSendIt, to exchange large MP3 files of my podcast with John Taylor Williams, the sound engineer who masters them. At other times, companies that wanted me to review their movies and music have uploaded them to a file locker and supplied me with the link and password to get them.
In response, a large denial-of-service attack ("OpMegaupload") has been launched against the US Department of Justice, the FBI, Universal Music and other entertainment and law-enforcement sites, by activists operating under the Anonymous banner.
MegaUpload has been waging an online campaign against Universal Music and US law enforcement and trade representatives, first releasing a video featuring famous artists singing an anthem in praise of MegaUpload, then suing Universal Music over false copyright claims that had the video removed from YouTube.
Quinn Norton has completed her triumphant history of Anonymous's actions in 2011 for Wired and this installment is amazing, containing real insight into how the world sees Anon, how Anon sees itself, and how those two mix. I was really taken with the following section, which reminds me a lot of Clay Shirky's idea that the pre-Internet world was one of "select, then publish" but that now we live in the world of "publish, then select":
The Freedom Ops are useful in explaining how Anonymous ops work. At any time on IRC there were ops for any number of countries, not just Middle Eastern ones. There were channels for Britain, Italy, Ireland, the USA, Venezuela, Brazil, and many more, as well as Syria, Bahrain, Yemen, Libya, and most of the rest of the Middle East. Most of the ops had few participants, so those who were there linked to a press release or video about problems in that country with a bold call to action, but, for long stretches, nothing would happen.
That was OK; that is how Anonymous proposes ideas to itself. This reverses the order that the media was used to. In most of the world, the bold proclamation comes after the decision to act. In Anonymous, hyperbolic manifestos and calls to apocalyptic action show you want to talk about an issue. For many people reporting on Anonymous, it often looked like Anonymous was all bluster and no action.
But that’s the wrong way to look at it. For the lulzy hive mind, bluster can be the point itself. Other times, quieter, less dramatic actions would spring up and fill the channel, only for it to go quiet again when anons had moved on to another action. For the Freedom Ops, lying fallow was no shame, and dormant ops often sparked up in response to news events from the relevant region.
Quinn notes that this installment is "longer than the first two parts [part 1, part 2] put together, and only covers 2011-- a doozy of a year! ...I think 2012 may be an even crazier year with the hive mind."
(Photo: Quinn Norton)
Quinn Norton continues her excellent history of Anonymous for Wired, this time visiting the shift in the movement from pure transgression to political activism, and the way that this played out among Anons themselves:
Anonymous fundamentally produces two things: spectacle and infrastructure hacking. They create scenes the media often can’t resist, but they also tend to be ones that the media isn’t very good at understanding. The rest of the time they create or destroy online infrastructure, much of which never directly gets noticed. Op Payback & Assange combined the two, but were mainly spectacle. None of the attacks disrupted the function of the targeted entities for long, if at all, but that was missed by much of the media, who instead confused people into believing that they wouldn’t be able to use their Visa or MasterCards to buy gas or groceries, thanks to Anonymous.
Intelligence and security research group Stratfor was hacked Saturday, and a a list of clients, personal information and credit card numbers purloined from its servers.
Having exposed the group's customers, the hackers apparently used the card numbers to make donations to the Red Cross and other charities.
The New York Times' Nicole Perlroth writes that the attack was also likely intended to embarrass Stratfor. She ends with a curious quote from Jerry Irvine, a member of the Department of Homeland Security's cybersecurity task force:
“The scary thing is that no matter what you do, every system has some level of vulnerability,” says Jerry Irvine, a member of the National Cyber Security Task Force. “The more you do from an advanced technical standpoint, the more common things go unnoticed. Getting into a system is really not that difficult.”
Sure, if it's a web server, exposed to the public by design.
But Stratfor didn't just expose a website to the public. It also, apparently, put all this other stuff online, in the clear, for the taking.
It's true that websites are like storefronts, and that it's more or less impossible to stop determined people from blocking or defacing them now and again.
Here, however, it looks like Stratfor left private files in the window display, waiting to be grabbed by the first guy to put a brick through the glass.
Now, I'm not a member of the national IT security planning task force. But I'm pretty sure that putting unencrypted lists of credit card numbers and client details on public-exposed servers isn't quite explained by "no matter what you do, every system has some level of vulnerability."
UPDATE: One Anon claims that the hack was not the work of Anonymous. However, the usual caveats apply: no structure, no official channels, no formal leaders or spokespersons.