Jump to content

The Jester (hacktivist)

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Bender the Bot (talk | contribs) at 10:38, 3 August 2020 (→Hacking history: HTTP → HTTPS for CNN Money, replaced: =http://money.cnn.com/ → =https://money.cnn.com/). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

The Jester
th3j35t3r
NationalityAmerican
OccupationGrey hat hacktivist
Known forHacking anti-American, jihadist, and homophobic websites
Websitecounter.social/blog

The Jester (also known by the leetspeak handle th3j35t3r[1]) is an unidentified computer vigilante[2] who describes himself as a grey hat[3] hacktivist.[4] He claims to be responsible for attacks[4] on WikiLeaks,[5] 4chan,[citation needed] Iranian President Mahmoud Ahmadinejad,[5] and Islamist websites.[6] He claims to be acting out of American patriotism.[7] The Jester uses a denial-of-service (DoS) tool known as "XerXeS", that he claims to have developed.[5]

History

Identity and communication

The Jester first appeared on Twitter, where he announced his attack on the Taliban website alemarah.info on January 1, 2010. On June 26, 2010, he established his WordPress blog "Jester's Court".[8] The Jester also communicates via his I2P IRC channel #jester and cautions these are the only three authentic methods of communication from him: "As per usual, because of the large amount of imposters trying to pass themselves off as me I will only speak in THREE places, here via this blog, my twitter and the i2p IRC network outlined above where my nick (th3j35t3r) is registered to myself. If you see a ‘jester’ anywhere else it's not me."[9] In November of 2017 Jester set up an instance of the Mastodon social networking server, named Counter Social, where he continues to use the alias @th3j35t3r.

Military service

The Jester had stated that he was a former soldier and had served in Afghanistan and elsewhere.[5][6] A former defense operative claimed that The Jester was a former military contractor involved in US Special Operations Command projects.[7] On April 10, 2012, The Jester gave a live chat interview to a class of Computer Science students at the University of Southern Maine where he confirmed his military service and stated he served four "operational tours".[10]

XerXeS and other tools

The Jester claims to have originally developed his DoS script as a means to test and harden servers.[11] After learning from an article that Jihadists were using the Internet to recruit and coordinate terror cells, The Jester resolved to disrupt online communications between Jihadists.[12] He weaponized his script and created a front-end known as "XerXeS"[13] in order to solve the script's usability problems.[11]

Hacking history

On January 1, 2010, The Jester began a campaign against Jihadist websites. His first target was alemarah.info, which was the Taliban's website at the time.[14][15][16]

The Jester posted several tweets claiming to be responsible for the downtime WikiLeaks was experiencing.[citation needed] He justified his alleged attacks by claiming that WikiLeaks was "attempting to endanger the lives of our [US] troops, 'other assets' & foreign relations."[5] In retaliation to The Jester's reported efforts, hacktivists including a group named Anonymous in support of WikiLeaks were reported as temporarily disrupting the website of MasterCard as well as attacking websites of Amazon and PayPal.[17]

On November 29, 2010, someone claiming to be The Jester stated that he had been raided by the U.S. and attempted to solicit money for legal fees. The Jester purported that the person was an impostor, though writers at InfoSecIsland believe the hoax was created by The Jester himself.[18][19]

On December 28, 2010, a DoS attack targeted 4chan.org. On that same day, The Jester tweeted "4chan.org — that looks like a TANGO DOWN (not) maybe you guys pissed off the wrong person trying to (wrongly) ID me?" This tweet is believed to be a reference to claims by 4chan users that The Jester was a man from Montana.[20]

On February 21, 2011, The Jester began a DoS attack on several sites belonging to the Westboro Baptist Church for celebrating the death of homosexual U.S. servicemen.[21]

In March 2011, The Jester employed a different style of attack by using an XSS vulnerability to make it appear as if fabricated articles were inserted online Libyan newspapers The Malta Independent Online and the Tripoli Post. On March 28, 2011, he tweeted links to the forged articles. The articles were not visible in search, or to viewers of those websites and viewable only via the inserted links. These tweets drew the attention of Anthony M. Freed, who examined the articles and discovered they were anomalies not contained in the newspapers' respective archives.[22] Further inspection by Freed revealed The Jester left a watermark of his signature Harlequin avatar on the articles he created, which can only be seen by tilting the computer monitor back at an angle. The fabricated articles reported degradation in troop morale among fighters loyal to Muammar Gaddafi and incidents of his soldiers abandoning their posts. Freed concluded The Jester's objective was a "psyops campaign aimed at breaking the spirit of the troops loyal to Libyan strongman Muammar Gaddafi."[22] The Jester confirmed this in a subsequent interview later the same year.[23]

In June 2011 The Jester vowed to find and expose members of LulzSec.[24] He attempted to obtain and publish personally identifiable information of key members within group, whom he described as "childish".[25] On June 24, 2011, he claimed to have revealed the identity of LulzSec leader Sabu as Xavier Kaotico, an information technology consultant possibly from New York City.[26] In July of the same year he falsely accused Hugo Carvalho, a Portuguese IT professional, of also being Sabu, leaving The Jester's outing claims to be considered suspect.[27] However, in a post on his blog in November 2011, The Jester retracted his prior identifications for "Sabu", issued an apology and correctly identified "Sabu" as Hector Xavier Monsegur, 28, of New York.[28] Sabu's identity was confirmed on March 6, 2012, when Monsegur was arrested by the FBI and it was revealed that he had been acting as an FBI informant in the interim.[29][30]

In October 2011, at the Hackers Halted USA conference, The Jester gave a surprise live presentation and fielded questions through an online chat with presenter Jeff Bardin.[23] His identity was authenticated via his Twitter account. Jester answered questions about XerXeS and other tools in development and discussed his motivations for attacking militant jihadi recruiting websites. On August 26, 2012, Bardin hosted a similar presentation at Utica College for the college's Cybersecurity Master's program.[31]

Late November 2011, th3j35t3r claimed to take down multiple jihadist sites permanently, with his newest tool known as 'Saladin'.[32][33][34] Saladin is claimed to be similar to other 'Apache Killer' tools used by hackers. Critics have claimed Saladin does not exist, and that he is relying on domain expiration.[35]

On May 14, 2012, The Jester's Twitter account (@th3j35t3r) appeared to have been deleted, along with all posts on his WordPress blog.[36] However, the Twitter account and WordPress blog were merely temporarily deactivated and were subsequently restored May 16, 2012.[37]

On July 2, 2013, the Jester took responsibility for a series of DoS cyberattacks against the Ecuadorean stock exchange and the country's tourism website, and promised to attack any other governments considering granting asylum to NSA leaker Edward Snowden. In a June blog post, he wrote that Snowden "is not a goddam hero, here to save Americans from 'the government' because of privacy infringements and breaches of the 4th amendment, he is a traitor and has jeopardized all our lives." In tweets, the Jester also alluded to a plan to seize control of the fire alarms at the Ecuadorean embassy in London, which would force WikiLeaks founder Julian Assange to set foot on UK soil and face potential extradition to Sweden to face sexual assault charges.[38]

On October 21, 2016, the Jester took responsibility for "defacing" the official website of the Russian Ministry of Foreign Affairs.[39] The "hack" was later shown to be fake, actually being a POST based XSS on the website, not a deface or hack.[40]

SANS report: "The Jester: A Lesson in Asymmetric Warfare"

In December 2011, T. J. O'Connor, a research analyst in the Information Technology and Operations Center (ITOC),[41] produced a comprehensive report for the SANS Institute detailing the history of The Jester's hacking campaigns titled "The Jester Dynamic: A Lesson in Asymmetric Unmanaged Cyber Warfare".[42] The paper examines the history, motives and impact of two years worth of The Jester's hacking, and provides a detailed analysis of the timeline of his attacks, a speculative analysis of the tools he may use, and review of his use of social media and public relations through his blog.[42]

QR code attack

On March 5, 2012, The Jester changed his Twitter account @th3j35t3r avatar from his signature Jester icon to a QR code without comment or explanation.[43] Scanning a QR code redirects a browser to a website.[44] Scanning The Jester's icon led to a URL where he had an image of his signature Jester icon and an embedded, hidden code that allegedly exploited a vulnerability that affects Safari, Chrome and Android browsers.[43] "When anyone scanned the original QR code using an iPhone or Android device, their device would silently make a TCP shell connection back to my remote server," The Jester wrote. "Like a phone call, if you like."[43][45] This was however exposed to be fake[46] and the exploit was stolen from a 2-year-old CVE advisory.[47]

See also

References

  1. ^ Keizer, Gregg (2010-11-30). "WikiLeaks moves to Amazon servers after DOS attacks". Computerworld New Zealand. Retrieved 2010-12-29.
  2. ^ "Hacktivist Tactics Raise Ethical Questions". Infosecisland.com. 2010-01-27. Retrieved 2011-08-30.
  3. ^ th3j35t3r (2010-07-03). "[Interview] The Jester". ethicalhack3r (Interview). Interviewed by ethicalhack3r. Retrieved 2010-12-29.{{cite interview}}: CS1 maint: numeric names: authors list (link)
  4. ^ a b th3j35t3r. "About Jester". Retrieved 2010-12-29.{{cite web}}: CS1 maint: numeric names: authors list (link)
  5. ^ a b c d e Anthony M., Freed (November 29, 2010). "The Jester Hits WikiLeaks Site With XerXeS DoS Attack". Infosec Island.
  6. ^ a b Rosenbach, Marcel; Stark, Holger (2010-12-07). "Julian Assange Becomes US's Public Enemy No. 1". Der Spiegel. Retrieved 2011-12-02.
  7. ^ a b Vance, Ashlee (2010-12-03). "WikiLeaks Struggles to Stay Online After Attacks". The New York Times. Retrieved 2010-12-29.
  8. ^ th3j35t3r. "Maybe I might setup a blog here??". Retrieved 2012-06-07.{{cite web}}: CS1 maint: numeric names: authors list (link)
  9. ^ th3j35t3r. "IRC Channel". Retrieved 2012-06-07.{{cite web}}: CS1 maint: numeric names: authors list (link)
  10. ^ "Transcript: Patriot Hacker th3j35t3r Addresses USM Students". Infosec Island. 2011-04-11. Retrieved 2012-05-28.
  11. ^ a b Freed, Anthony M. (2010-02-10). "Jester Unveils XerXeS Automated DoS Attack". Infosec Island. Retrieved 2011-01-03.
  12. ^ Freed, Anthony M. (2010-02-04). "More Talks with Anti-Jihadi Hacker The Jester". Infosec Island. Retrieved 2011-01-03.
  13. ^ Bailey, Laurelai (2010-07-08). "XerXeS source code". SecLists.Org Security Mailing List. Retrieved 2011-07-08.
  14. ^ th3j35t3r (2010-06-30). "Hacker macht Jagd auf Online-Dschihadisten". Die Welt (Interview). Interviewed by Florian Flade. Retrieved 2010-12-29.{{cite interview}}: CS1 maint: numeric names: authors list (link)
  15. ^ th3j35t3r (2010-06-30). "Unredacted Original Interview with Newspaper 'Die Welt'". th3j35t3r.wordpress.com (Interview). Interviewed by Florian Flade. Retrieved 2010-12-29.{{cite interview}}: CS1 maint: numeric names: authors list (link)
  16. ^ "Afghan Taliban deny meeting U.N. envoy". Reuters. 2010-01-30. Retrieved 2011-01-03.
  17. ^ David Leigh, Luke Harding WikiLeaks cyber attacks: a tango with the Jester The Guardian, 2 February 2011
  18. ^ "Did WikiLeaks Hacker The Jester Pull Police Raid Hoax?". Infosecisland.com. 2010-12-02. Retrieved 2011-08-30.
  19. ^ Sullivan, Bob (2010-12-07). "Red Tape - WikiLeaks hacker a villain or a hero?". Redtape.msnbc.msn.com. Archived from the original on 2011-05-02. Retrieved 2011-08-30.
  20. ^ Prefect (2010-12-10). "Anonymous Turns Operation Payback Toward "The Jester"". Praetorian Prefect. Retrieved 2011-01-02.
  21. ^ (2011-03-24) "Hacktivist Maintains Attack on Westboro Baptist Church" Retrieved 28 March 2011
  22. ^ a b Freed, Anthony (2011-03-30). "Patriot Hacker The Jester's Libyan Psyops Campaign". Infosec Island. Retrieved 2011-12-01.
  23. ^ a b "Hacktivist "The Jester" Draws Crowd at Hacker Halted". Infosec Island. 2011-10-31. Retrieved 2011-11-23.
  24. ^ Poeter, Damon (24 June 2011). "Will LulzSec's Hit on Arizona Cops be its Last Hurrah?". PC Magazine. Ziff Davis. Archived from the original on 25 June 2011. Retrieved 25 June 2011.
  25. ^ Halliday, Josh (24 June 2011). "LulzSec: the members and the enemies". The Guardian. London. Guardian Media Group. Archived from the original on 25 June 2011. Retrieved 25 June 2011.
  26. ^ Chapman, Stephen (24 June 2011). "LulzSec's leader, Sabu, revealed?". ZDNet. CBS Interactive. Archived from the original on 25 June 2011. Retrieved 25 June 2011.
  27. ^ "The Quest to Unmask the Ringleader of Anonymous - Technology". The Atlantic Wire. 2011-07-14. Retrieved 2011-08-30.
  28. ^ Wagenseil, Paul (8 March 2012). "Despite Being Anonymous, Hacktivist Sabu Wasn't Hard to Find". Security News Daily. Retrieved 13 March 2012.
  29. ^ "5 'Anonymous' hackers busted after one becomes FBI informant". Newsday. AP. March 6, 2012.
  30. ^ Goldman, David (March 6, 2012). "Anonymous in disarray after major crackdown snares leaders". CNN.
  31. ^ "th3j35t3r: BIG shout-out to Mr H.Cooper". Twitter. Retrieved 2012-09-01.
  32. ^ ʇuıɐs ʞɔopuooq™ (November 27, 2011). "jihadunspun.com - TANGO DOWN - PERMANENTLY (yes forever)". Twitter.
  33. ^ ʇuıɐs ʞɔopuooq™ (November 27, 2011). "muslimdefenseforce.islamicink.com - TANGO DOWN - PERMANENTLY". Twitter.
  34. ^ ʇuıɐs ʞɔopuooq™ (November 27, 2011). "falojaa.net - TANGO DOWN - PERMANENTLY". Twitter.
  35. ^ "th3j35t3r's Saladin Tool Exposed". Twitter. Retrieved 2013-07-02.
  36. ^ ""Patriotic hacktivist" The Jester unmasked—or maybe it's a big troll". Ars Technica. May 15, 2012.
  37. ^ th3j35t3r. "Not totally sure what just happened, but damn it's getting out of hand now". Retrieved 2012-05-28.{{cite web}}: CS1 maint: numeric names: authors list (link)
  38. ^ Snowden and Assange Targeted by Mysterious Hacker "The Jester", Mother Jones, 2 July 2013
  39. ^ "In Soviet Russia, we get out-propagandered by a guy in a jingly hat". Jesterscourt.cc. October 23, 2016. Retrieved October 24, 2016.
  40. ^ https://arstechnica.com/information-technology/2016/10/how-the-jester-fooled-russians-and-fox-news-with-one-simple-trick/
  41. ^ "Department of Electrical Engineering and Computer Science - Home". Eecs.usma.edu. Retrieved 2012-07-09.
  42. ^ a b O'Connor, T. J. (December 30, 2011). "The Jester Dynamic: A Lesson in Asymmetric Unmanaged Cyber Warfare" (PDF). SANS Institute.
  43. ^ a b c Wagenseil, Paul (March 13, 2012). "Anti-Anonymous hacker threatens to expose them". MSNBC.
  44. ^ "What Is A QR Code And Why Do You Need One?". Search Engine Land. October 15, 2009.
  45. ^ Wagenseil, Paul (March 12, 2012). "Pro-American Hacker's Attack Threatens to Expose Anonymous". Security News Daily.
  46. ^ "th3j35t3r and QR Exploits Exposed Part 2". Wordpress. March 13, 2012.
  47. ^ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1807
Retrieved from "https://en.wikipedia.org/w/index.php?title=The_Jester_(hacktivist)&oldid=970955845"