The FBI has taken into custody a 27-year-old man, claiming that he hacked the accounts of Facebook users coaxing hundreds of women to strip on their webcams, while watching on Skype.
The man identified by the FBI as Karen (“Gary”) Kazaryan of Glendale, CA, was arrested yesterday on federal computer hacking charges.
According to a US Department of Justice press release, Kazaryan is claimed to have broken into victims’ Facebook and email accounts, changing their passwords, and searching for naked and half-naked photographs. He also gathered personally-identifiable information from the users, including passwords, personal details, names of friends, etc.
The report details also that Karen threatened the users who did not comply to his demands of stripping, that he would post nude photos of them on their own Facebook pages. It is also reported that approximately 3,000 photos were seized from the man’s computer. The FBI believes 350 women were lead in to “sextortion”.
The FBI is urging all women who believe they might be a victim to contact the Los Angeles Field Office at +1-(310) 477-6565.
The New York Times reported about the damages of the attacks on Saudi Aramco, a Saudi Arabian oil firm. The article stated the following, blaming Iran for the attacks on Saudi Aramco along with supporting evidence:
That morning, at 11:08, a person with privileged access to the Saudi state-owned oil company’s computers, unleashed a computer virus to initiate what is regarded as among the most destructive acts of computer sabotage on a company to date. The virus erased data on three-quarters of Aramco’s corporate PCs — documents, spreadsheets, e-mails, files — replacing all of it with an image of a burning American flag.
United States intelligence officials say the attack’s real perpetrator was Iran, although they offered no specific evidence to support that claim. But the secretary of defense, Leon E. Panetta, in a recent speech warning of the dangers of computer attacks, cited the Aramco sabotage as “a significant escalation of the cyber threat.” In the Aramco case, hackers who called themselves the “Cutting Sword of Justice” and claimed to be activists upset about Saudi policies in the Middle East took responsibility.
Intelligence officials are still investigating the nature of the RasGas hack also, because it is related to this attack, which involved a malware called Shamoon.
The investigations of Saudi Aramco and RasGas, Qatar’s top natural gas firm, are coming together. Most of the cyberattacks this year have been aimed at erasing data on energy companies’ computers. More updates to come.
- How hackers attacked Saudi oil company’s computers (seattletimes.com)
- US Increasingly Convinced Iran Behind Attack On Saudi Aramco (techweekeurope.co.uk)
- Shamoon Virus that Attacked Saudi Aramco is the Most Dangerous to Date (oilprice.com)
When talking with several other IT professionals, they happened to know who Anonymous was. Based on hacking, activism, and other protesting events particularly online, Anonymous has become very well known around the IT world. But, the questions today have to do with how all of us (in the IT and business world) can learn from these motives by Anonymous.
Here are some automatic principles that can be learned that applies to all of us in the IT world:
- Anonymous will not ever cease function, because it is an awesome principle. It requires the hacker to be anonymous, and to not admit identity. Tons of people worldwide do not display their picture with their name online. Ask a “private” person to put their full name online, and they will cower in fear. That is why Anonymous can get away with their motives that are done in secret.
- The target to bring down Anonymous, is to get them to stop their hacking, and to stop the activism in the streets. It’s not getting anywhere. The collective thinks that we need a perfect world, but sadly, it won’t happen!
- Membership in Anonymous is a “free-for-all”. Which means that even if your code name gets banned, you can come back as a different code name/IP address and continue contribution on hacking, projects (software), etc.
- There is probably not a grand-master or leader, just people keeping the same old mission going year after year. It all began with a few voices on 4chan years ago, and keeps on going (8 years now?).
- Time is of the essence. These people spend countless hours hacking. That means you have to work countless hours fighting back and on prevention.
What Businesses can learn
- Anyone entering your organization with anonymous identity ideas, or asks to be anonymous (by preference), has probably bad motives.
- It’s about time to implement better password security policies.
- It’s also time to implement better database encryption.
- Ensure good reputation across the entire spectrum of business…why? It attracts awesome workers, makes income rise, and makes the overall feeling of running the company a great type of feeling.
- Ensure the host server has excellent firewall technology and antivirus. It should not allow even the tiniest of malware threats onto a client server.
What Developers can learn
- “There may be developers smarter than me in Anonymous, so I need to step up my coding skills and get better encryption.”
- Encrypting files and databases has never been more important than now. Don’t think it cannot happen to you. That’s what Philips thought, or even AMD thought. You’d think AMD would have proper protection for their WordPress databasing since they know how to engineer root-level microprocessing chips. What gives?
- If the network is running one or two servers to operate a website, then it DOES need antivirus/firewall software. Don’t think just because your skills in database administration or server management are very good that malware can’t trump your server…you’re wrong. Some of the best administrators/managers have trouble with their server keeping free from malware.
- If you must get an unknown application from the web, or download it from an “anonymous source”, then run it in a sandbox or virtual machine. Execution of malware could be the end of the life for a server…don’t be tricked…stay protected.
- Just because your programming skills are awesome doesn’t mean anything. There are a lot of others that think their programming skills are awesome, however, the first time you let your guard down or get prideful – expect trouble.
What IT Security can learn
- Hackers can get in to nearly anything. Keep up on top standards in IT security. Being one step ahead of the hackers is a good thing.
- Keep the defense-in-depth method in mind. If you can get it to work, it will help for miles and miles (or kilometers and kilometers).
- Don’t expect security to be a piece of cake anymore. It’s now the top challenge in IT, and people are being recruited all across the IT stage to work in security. There just isn’t enough warriors on the scene. It’s time to step it up a notch in all aspects of your work. Don’t procrastinate and don’t be pessimistic. Be optimistic about all outcomes of your work, and see the improvement before your eyes!
- As stated above for businesses: password security is extremely important! Push password security big time. It’s the only chance at keep information secure in personal, business, and enterprise aspects.
- Push internet security software like there’s no tomorrow. Because for some people’s computers, personal or business, there will be no tomorrow. Not just for computers now, but also for devices such as smart phones, tablets, and PDAs.
There may be no more way to stop Anonymous, but at least we can be 5-10 steps ahead of them. If we do that, we’re showing them they have no future. It will also make it more challenging for hackers, and improve the best of technologies all across the IT spectrum. See for yourself, and try these principles on your specific spectrum. You won’t be sorry!
Get Kaspersky Antivirus for Server now to safeguard your Windows Server!
Please consider a donation to help our project, if we have helped you or your business save money.
Sabu, mole hacker of Anonymous small groups Antisec and LulzSec, now has a wait time on his sentence, because of his cooperation with the FBI. The cooperation is done to help the FBI track down hackers involved with Anonymous, and attempt to put an end to the nonsense.
Since the FBI arrested Sabu, or his real name Hector Xavier Monsegur, last June, he’s been working undercover for them. After providing information leading to arrests of several Antisec and LulzSec members, the charges/sentencing is being waited for Sabu.
The reactions from fellow LulzSec/Anonymous members has been utter denial of his original involvement with the group, and how Sabu even got the idea that spilling the details would help the groups’ plans: “Activism and hacking, also known as Hacktivism. It involves protest against the government, corporations, news media, etc. using street protest and online blackhat hacking. Usually the hacking done by these members has been more blackhat style, in which they are doing it for the purpose of damage and to also gain money. Makes Anonymous seem more illegitimate if you look at it like that.
Although unstated what the plea deal was, Sabu is entitled to a maximum charge (after pleading guilty in March) to 124 years in prison. The charges involved 12 federal offenses, including conspiracy to commit computer hacking, and conspiracy to commit bank fraud, among other charges. Some of the things mentioned by Sabu led to other charges for hackers that were also arrested from Anonymous.
Since LulzSec’s & Antisec’s fallout, small hacking groups have appeared and then disappeared, including SpexSec and r00tbeersec. Since Sabu’s leave, Anonymous has never been the same. Who would care? Their unethical behavior must be stopped. The only way to get it to stop is to continue to hold strong to our values and beliefs. The world system cannot be perfect, and they seem to have this idea it can be. The economic difficulties all around the world complicate every year. There is no end to struggle, it’s part of life.