Anonymous, In it for the LuLz...

After all the damage anonymous caused HBGary you'd think they'd be done punishing them, but not just yet. HBGary was scheduled to speak at the RSA convention that took place February 14-18 in San Fransico. They arrived and set up their booth and left for the night to prepare their talks for the next day. They were going to unviel a new product called Razor, it was a computer / software combo that would be able to identify and analyze malware of all types, even code never seen before (so they claim). However, when they returned the next day to their booth they saw that Anonymous had been there.

Source: Ars Technica

They were disturbed by this physical act and felt stalked and not just embarrassed but threatened physically. Vice President of Services for HBGary Jim Butterworth told Ars "They decided to follow us to a public place where we were to do business and make a public mockery of our company. Our position was that we respected RSA and our fellow vendors too much to allow this spectacle to occur." They left this message behind:

Picture by ZDNet

Follow-up New Cyber Warfare

Source: http://arstechnica.com

I wrote recently linking to an article on Ars Technica about HBGary selling exploits to the government. It is a long article and I have been slowly working through it to give a summary of what it brings to light. I have a few every interesting things that have been going on.

These aren't really surprising, to me at least, but I find them very enlightening. HBGary worked along side other companies to put together demos to sell zero-day exploit tools to the government. Two government agencies specifically mentioned in the Ars article are the Air Force and SOCOM. HBGary claims to have many zero-day exploits and even to have sold many of them to others. Here is a list:

HBGary vs Anonymous

HBGary is a computer security company that does penetration testing, intrusion detection and worm detection, quarantine, and analysis. They present themselves as experts in the computer security field, but recently they were successfully compromised by basic well known techniques.

Aaron Barr was conducting what he called "just research" on information gathering through social media. He would use Facebook, Twitter, Lindedin, and other social networks to gather data about his target and their family and friends. He claims he could find his target's real name as well as where they were from just from publicly available information on social media sites.

He decided that he wanted to go after what he saw as "the leaders" of Anonymous. This did not turn out well for Mr. Barr. He claimed to have found the real names of these so called leaders of Anonymous and was in talks with the FBI to gain a contract between them and HBGary Federal, that's right Aaron Barr was the CEO of HBGary Federal. HBGary Federal is a branch of HBGary that was to handle all federal contracts, but was falling short of it's goal and running out of money. This made Barr anxious to close a deal by any means neccessary.

Anonymous Releases Stuxnet Source Code

Fox News reports that an unencrypted version of the Stuxnet worm source code has been released online by the group known as Anonymous. This version was being studied by HBGary Federal and was discovered when Anonymous hacked into their network earlier this month.

For those who don't know the Stuxnet worm was the first computer worm to specifically target SCADA (Supervisory Control and Data Acquisition) systems and also the first known worm to install a rootkit on a PLC (Programmable Logic Controller). It is largely regarded as the most sophisticated piece of computer malware to date. Experts worry that this source code could be studied by attackers to create similar sophisticated attacks.




For a more in-depth look at what Stuxnet is I suggest reading over the Wikipedia entry or watch this youtube video by Semantec demonstrating what Stuxnet does to a PLC.

The decompiled source code can be found here, and for more news and updates on the source code follow @stuxnetsource.

I link to the source because I believe knowledge is for everyone and the more people that can study these types of malware the better off we all are because the more wide spread the knowledge the less powerful it becomes.