Jump to content

LulzSec: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
No edit summary
Dayyan (talk | contribs)
27 edits
→‎Later corporate attacks: - may need to be moved to another section.
Line 33: Line 33:
On June 15, LulzSec took down the main server of S2 Games' [[Heroes of Newerth]]. This came by request on the phone. They updated
On June 15, LulzSec took down the main server of S2 Games' [[Heroes of Newerth]]. This came by request on the phone. They updated
their twitter profile to this: Heroes of Newerth master login server is down. They need some treatment. Also, DotA is better.<ref>{{cite web|last=LulzSec|title=Tweet 81036958826102784|url=http://twitter.com/#!/LulzSec/status/81036958826102784|publisher=Twitter|accessdate=15 June 2011}}</ref>
their twitter profile to this: Heroes of Newerth master login server is down. They need some treatment. Also, DotA is better.<ref>{{cite web|last=LulzSec|title=Tweet 81036958826102784|url=http://twitter.com/#!/LulzSec/status/81036958826102784|publisher=Twitter|accessdate=15 June 2011}}</ref>

On June 16, LulzSec posted a random assortment of 62,000 emails and passwords to [[MediaFire]]. LulzSec states they released this in return for supporters flooding the [[4chan]] [[4chan#.2Fb.2F|/b/]] board.<ref>{{cite web|last=LulzSec|title=Tweet 81327464156119040|url=http://twitter.com/#!/LulzSec/status/81327464156119040|publisher=Twitter|accessdate=16 June 2011}}</ref>


==Government attacks==
==Government attacks==

Revision as of 13:12, 16 June 2011

Lulz Security Logo
Lulz Security Logo

Lulz Security (or simply LulzSec) is a computer hacker group that claims to be responsible for several high profile attacks, including the compromise of over 1,000,000 user accounts from Sony in 2011 of which only 37,500 were actually affected according to Sony. The group also claimed responsibilty of taking the CIA website offline. It has gained attention due to its high profile targets and the lighthearted messages it has posted in the aftermath of its attacks.

Overview

LulzSec draws its name from the neologism "Lulz," (from LOLs) which often signifies laughter at the victim of a prank, and "Sec," short for "Security". The Wall Street Journal has characterized its attacks as closer to internet pranks rather than serious cyber-warfare. It has gained attention in part due to its brazen claims of responsibility and lighthearted taunting of corporations that have been hacked. It frequently refers to Internet memes when defacing websites. The group first emerged in May 2011, and has successfully attacked the websites of several major corporations.[1] It specializes in finding websites with poor security, and then stealing and posting information from them online. It has used well-known straightforward methods, such as SQL injection, to attack its target websites.[2] Several media sources have described their tactics as grey hat hacking.[2][3][4]

The group has used the motto "Laughing at your security since 2011!" and its website, created in June 2011, plays the theme from The Love Boat.[1] It announces its exploits via Twitter and its own website, oftentimes accompanied with lighthearted ASCII art of boats. Its website also includes a Bitcoin donation to help fund its activities.[5] Although the number of members and exact motivation of the group are unknown,[2] Ian Paul of PC World has written that, "As its name suggests, LulzSec claims to be interested in mocking and embarrassing companies by exposing security flaws rather than stealing data for criminal purposes."[6] The group has also been critical of white hat hackers, claiming that many of them have been corrupted by their employers.[1]

Some in the security community have lauded them for raising awareness of the widespread lack of effective security against hackers.[7] They have also been credited with inspiring LulzRaft, a group which has been implicated in several high-profile website hacks in Canada.[8]

The group's first recorded attack was against Fox.com's website. It claimed responsibility for leaking information, including passwords, altering several employees' LinkedIn profiles, and leaking a database of X Factor contestants containing contact information of 73,000 contestants.[9][10] The group has begun taking suggestions for sites to hit with denial-of-service attacks.[11] The group has also been redirecting their telephone number to different customer support lines, including the line for World of Warcraft, magnets.com, and the FBI Detroit office. The group claims this sends 5 to 20 calls per second to these sources, overwhelming their support officers.[12]

Initial targets

In May 2011, members of Lulz Security hacked into the Public Broadcasting System (PBS) website. They stole user data and posted a fake story on the site which claimed that Tupac Shakur was still alive and living in New Zealand. In the aftermath of the attack, CNN referred to the responsible group as the "Lulz Boat".[13]

Lulz Security claimed that some of its hacks, including its attack on PBS, were motivated by a desire to defend WikiLeaks and Bradley Manning.[14] A Fox News report on the group quoted one commentator, Brandon Pike, who claimed that Lulz Security is affiliated with the hacktivist group Anonymous. Lulz Security claimed that Pike had actually hired it to hack PBS. Pike denied the accusation and claims it was leveled against him because he said Lulz Security was a splinter of Anonymous.[15]

In June 2011, members of the group claimed responsibility for an attack against Sony and took data that included "names, passwords, e-mail addresses, home addresses and dates of birth for thousands of people."[16] The group claimed that it used a SQL injection attack,[17] and was motivated by Sony's legal action against George Hotz for jailbreaking into the PlayStation 3. The group claims it will launch an attack that will be the "beginning of the end" for Sony.[18] Some of the compromised user information has since been used in scams.[19] The group claimed to have compromised over 1,000,000 accounts, though Sony claims the real number was around 37,500.[20]

Later corporate attacks

Lulz Security attempted to hack into Nintendo, but both the group and Nintendo itself report that no particularly valuable information was found by the hackers.[21] LulzSec claims that it did not mean to harm Nintendo, declaring: "We're not targeting Nintendo. We like the N64 too much — we sincerely hope Nintendo plugs the gap."[22]

On June 8 2011, LulzSec hacked into the website of Black & Berg Cybersecurity Consulting, a small network security company, and changed the image displayed on their front page to one containing the LulzSec logo. They did so after the company had issued a "Cybersecurity For The 21st Century, Hacking Challenge", in which they challenged hackers to hack the site and alter the homepage graphic. The intrusion came after Joe Black, an owner of the company posted the message "Black & Berg Cybersecurity Consulting appreciate all the hard work that you're putting in. Your Hacking = Clients for us. Thx" to the LulzSec Twitter account. Though Black & Berg offered a prize of $10,000 and a position with the company for the successful hack, members of LulzSec declined the offer.[23] Instead, the website contained the reply "DONE, THAT WAS EASY. KEEP THE MONEY, WE DO IT FOR THE LULZ".[24]

On June 11, reports emerged that LulzSec reportedly hacked into and stole user information from the pornography website www.pron.com. They obtained around 26,000 e-mail addresses and passwords. Among the information stolen are records of six users who subscribed from .gov and .mil e-mail addresses as well as administrator information from 55 other adult-oriented websites. Following the breach, Facebook locked the accounts of all users who had used the published e-mail addresses, and also blocked new Facebook accounts opened using the leaked e-mail addresses. They feared that users of the site would get hacked after LulzSec encouraged people to try and see if these people used identical user name and password combinations on Facebook as well.[25]

LulzSec hacked into the Bethesda Game Studios network and posted information taken from the network onto the Internet, though they refrained from publishing 200,000 compromised accounts.[26] LulzSec posted the following message to Twitter regarding the attack, "Bethesda, we broke into your site over two months ago. We've had all of your Brink users for weeks, Please fix your junk, thanks!" [27]

On June 14, LulzSec took down four websites by request of fans as part of their "Titanic Take-down Tuesday". These websites were Minecraft, League of Legends, The Escapist, and IT security company FinFisher.[28] They also attacked the login servers of the massively multiplayer online game EVE Online, which also disabled the game's front-facing website, and the League of Legends login servers. Most of the takedowns were performed with denial-of-service attacks.[29]

On June 15, LulzSec took down the main server of S2 Games' Heroes of Newerth. This came by request on the phone. They updated their twitter profile to this: Heroes of Newerth master login server is down. They need some treatment. Also, DotA is better.[30]

On June 16, LulzSec posted a random assortment of 62,000 emails and passwords to MediaFire. LulzSec states they released this in return for supporters flooding the 4chan /b/ board.[31]

Government attacks

LulzSec claims to have hacked InfraGard, a company affiliated with the FBI that does work on botnet detection,[1] in June 2011. The group leaked some of Infragard's e-mails and a database of users.[32] The group defaced the website posting the following message, "LET IT FLOW YOU STUPID FBI BATTLESHIPS," accompanied with a video. LulzSec has posted the following message regarding the attack:

"It has come to our unfortunate attention that NATO and our good friend Barrack Osama-Llama 24th-century Obama [sic] have recently upped the stakes with regard to hacking. They now treat hacking as an act of war. So, we just hacked an FBI affiliated website (Infragard, specifically the Atlanta chapter) and leaked its user base. We also took complete control over the site and defaced it [...]."[33]

On June 9, LulzSec sent an email to the administrators of the British National Health Service, informing them of a security vulnerability discovered in NHS systems. LulzSec stated that they did not intend to exploit this vulnerability, saying in the email that "We mean you no harm and only want to help you fix your tech issues."[34]

On June 13, LulzSec released the e-mails and passwords of a number of users of senate.gov, the website of the United States Senate.[35] The information released also included the root directory of parts of the website. LulzSec stated, "This is a small, just-for-kicks release of some internal data from Senate.gov — is this an act of war, gentlemen? Problem?" referencing a recent statement by the Pentagon that some cyberattacks could be considered an act of war. No highly sensitive information appears in the release.[36]

On June 15, LulzSec launched an attack on cia.gov, the public website of the United States Central Intelligence Agency, taking the website offline.

References

  1. ^ a b c d Morse, Andrew; Sherr, Ian (6 June 2011). "For Some Hackers, The Goal Is Just To Play A Prank". The Wall Street Journal. p. B1. Retrieved 6 June 2011.
  2. ^ a b c "Q&A: Lulz Security". BBC. 6 June 2011. Retrieved 6 June 2011.
  3. ^ Mitchell, Dan (9 June 2011). "Yet another hack, yet another delay in reporting it". CNN Money. Retrieved 11 June 2011.
  4. ^ Raywood, Dan (10 June 2011). "Security expert publicly backs 'grey hats' such as LulzSec, saying that public disclosure will help businesses". SC Magazine. Retrieved 11 June 2011.
  5. ^ Olson, Parmy (6 June 2011). "LulzSec Hackers Post Sony Dev. Source Code, Get $7K Donation". Forbes. Retrieved 7 June 2011.
  6. ^ Paul, Ian. "Lulz Boat Hacks Sony's Harbor: FAQ." PC World. June 3, 2011. Retrieved on June 6, 2011.
  7. ^ Ragan, Steve (8 June 2011). "One month later – LulzSec continues their personal brand of comedy". The Tech Herald. Retrieved 9 June 2011.
  8. ^ Beltrame, Julian (8 June 2011). "Hacker without a cause scores with Harper 'breakfast incident' hoax". The Canadian Press. Retrieved 10 June 2011.
  9. ^ "Who is LulzSec, Hacker of PBS? Are they hacking Sony again?". International Business Times. Retrieved 3 June 2011.
  10. ^ Poulsen, Kevin. "Sony Hit Yet Again; Consumer Passwords Exposed". Wired. Retrieved 3 June 2011.
  11. ^ Boscker, Bianca (15 June 2011). "LulzSec Hacker Group Now Taking Requests". The Huffington Post. New York City. AOL. Archived from the original on 15 June 2011. Retrieved 15 June 2011.
  12. ^ Albanesius, Chloe (15 June 2011). "LulzSec Call-In Line Taking Hacking Requests". PC Magazine. Archived from the original on 15 June 2011. Retrieved 15 June 2011.
  13. ^ CNN Wire Staff. "Hackers pirate PBS website, post fake story about Tupac still alive". CNN. Retrieved 3 June 2011. {{cite web}}: |last= has generic name (help)
  14. ^ Olson, Parmy. "Interview With PBS Hackers: We Did It For 'Lulz And Justice'". Forbes. Retrieved 3 June 2011.
  15. ^ Kaplan, Jeremy (2 June 2011). "Group Claims It Was 'Paid to Hack PBS,' Then Leaks a Million Sony User IDs". Fox News. Retrieved 3 June 2011.
  16. ^ Pepitone, Julianne (2 June 2011). "Group claims fresh hack of 1 million Sony accounts Money". CNN. Retrieved 3 June 2011.
  17. ^ Ogg, Erica. "Hackers steal more customer info from Sony servers". CNET. Retrieved 3 June 2011.
  18. ^ Reisinger, Don. "Tupac hackers to Sony: 'Beginning of the end'". CNET. Retrieved 3 June 2011.
  19. ^ Ars Staff. "Lulz? Sony hackers deny responsibility for misuse of leaked data". Ars Technica. Retrieved 3 June 2011.
  20. ^ Olivarez-Giles, Nathan (9 June 2011). "Sony Pictures says LulzSec hacked 37,500 user accounts, not 1 million". Los Angeles Times. Los Angeles. Tribune Company. Archived from the original on 12 June 2011. Retrieved 12 June 2011.
  21. ^ "LulzSec Hacks Nintendo: No User Information Released". PCMag. 5 June 2011. Retrieved 5 June 2011.
  22. ^ "Nintendo Is Hit by Hackers, but Breach Is Deemed Minor". New York Times. 5 June 2011. Retrieved 5 June 2011.
  23. ^ "LulzSec wins hacking competition, refuses $10k award". International Business Times. New York City. 8 June 2011. Retrieved 8 June 2011.
  24. ^ "Black & Berg Cybersecurity Consulting, LLC". Black & Berg Cybersecurity Consulting. Archived from the original on 8 June 2011. Retrieved 8 June 2011.
  25. ^ Thomas, Keir (11 June 2011). "Porn Site Users Beware: Hacker Group LulzSec May Have Posted Your Email Address". PC World. IDG. Archived from the original on 11 June 2011. Retrieved 11 June 2011.
  26. ^ Albanesius, Chloe. "LulzSec Targets Bethesda Softworks, Porn Site". PC magizine. Retrieved 13 June 2011.
  27. ^ Ben, Kuchera. "LulzSec hackers demand hats, threaten release of Brink user data". Ars Technica. Retrieved 13 June 2011.
  28. ^ Bright, Peter (14 June 2011). "Titanic Takeover Tuesday: LulzSec's busy day of hacking escapades". Ars Technica. Condé Nast Publications. Archived from the original on 14 June 2011. Retrieved 14 June 2011.
  29. ^ Peckham, Matt (14 June 2011). "LulzSec Knocks 'Minecraft,' 'EVE Online,' 'League Of Legends' and 'The Escapist' Offline Read more: http://techland.time.com/2011/06/14/lulzsec-knocks-minecraft-eve-online-league-of-legends-and-the-escapist-offline/#ixzz1PI1veH4u". Time. New York City. Time Inc. Archived from the original on 14 June 2011. Retrieved 14 June 2011. {{cite news}}: External link in |title= (help)
  30. ^ LulzSec. "Tweet 81036958826102784". Twitter. Retrieved 15 June 2011.
  31. ^ LulzSec. "Tweet 81327464156119040". Twitter. Retrieved 16 June 2011.
  32. ^ "LulzSec claims to have hacked FBI-affiliated website". LA Times. Retrieved 4 June 2011.
  33. ^ Read, Max. "LulzSec Hackers Go After FBI Affiliates". Gawker. Retrieved 4 June 2011.
  34. ^ "Hackers warn NHS over security". BBC. Retrieved 9 June 2011.
  35. ^ Ogg, Erica (13 June 2011). "LulzSec targets videogame maker ZeniMax Media". CNET.com. CBS Interactive. Archived from the original on 13 June 2011. Retrieved 13 June 2011.
  36. ^ Morse, Andrew (13 June 2011). "LulzSec Hacker Group Claims Attack On US Senate Website". The Wall Street Journal. News Corporation. Archived from the original on 13 June 2011. Retrieved 13 June 2011.
Retrieved from "https://en.wikipedia.org/w/index.php?title=LulzSec&oldid=434583528"