Hackers attack sites considered Wikileaks foes
By John F. Burns and Ravi Somaiya
New York Times
Posted: 12/08/2010 07:34:40 PM PST
Updated: 12/08/2010 09:42:30 PM PST
LONDON -- In a campaign that had some declaring the start of a "cyberwar," hundreds of Internet activists mounted retaliatory attacks Wednesday on the websites of multinational companies and other organizations they deemed hostile to the WikiLeaks anti-secrecy organization and its jailed founder, Julian Assange.
Within 12 hours of a British judge's decision Tuesday to deny Assange bail in a Swedish extradition case, attacks on the websites of WikiLeaks' "enemies," as defined by the organization's impassioned supporters, caused several corporate websites to become unavailable or slow down markedly.
Targets of the attacks included MasterCard.com, which had stopped processing donations for WikiLeaks; Amazon.com, which revoked the use of its computer servers; and the online payment service PayPal, which cut off its services.
Visa.com was also affected by the attacks, as was the website of the Swedish prosecutor's office and the lawyer representing the two women whose allegations of sexual misconduct are the basis of Sweden's extradition bid.
A website tied to former Republican vice presidential candidate Sarah Palin also came under cyberattack, she said. In a posting on the social networking site Facebook last week, Palin called Assange "an anti-American operative with blood on his hands."
The cyberattacks in Assange's defense appear to have been coordinated by Anonymous, a loosely affiliated group of activist computer hackers who have singled out other groups before, including the Church of Scientology and Gene Simmons of the rock band Kiss, who spoke out against file sharing. Last weekend, members of Anonymous vowed in two online manifestoes to take revenge on any organization that lined up against WikiLeaks in an effort called "Operation Payback."
Anonymous claimed responsibility for the MasterCard attack in Web messages and, according to one activist associated with the group, continued to conduct multiple and repeated waves of attacks on MasterCard and other companies during the day.
The activist, Gregg Housh, who disavows any personal role in illegal online activity, said in a telephone interview that 1,500 Anonymous supporters had been in online forums and chat rooms organizing mass and repeated "denial of service" attacks on some of the companies. His account was confirmed by Jose Nazario, a senior security researcher at Arbor Networks, a Chelmsford, Mass., firm that tracks malicious activity on computer networks.
The lone ranger
Anonymous has an enemy in the hacking community, however: a self-proclaimed "hacktivist for good" who calls himself the Jester. He has claimed responsibility for taking down WikiLeaks' website several times since it started posting confidential State Department cables Nov. 28. The Jester, who describes himself as a patriotic hacker with a military background, claims other like-minded hackers have approached him to help.
Anonymous brings hackers into secure chat rooms at encrypted websites where potential targets are identified and hackers are encouraged to attack. Speaking by phone Wednesday, Housh said one of the Anonymous chat rooms, anonops.net, was under "massive" attack. "It's probably this guy, the Jester," he said.
The Jester came to the attention of cyber security experts this year when he disabled several websites run by Islamic extremists. He told computer forensics expert Richard Stiennon in an e-mail in January that he had served in a "rather famous unit" in Afghanistan. The Jester probably served with a non-American NATO force, Stiennon said, and that experience shaped his decision to go after militant websites, and now WikiLeaks.
The Jester uses a disruption method that cyber experts had not seen before. The Jester wrote a program called XerXeS that clogs up a website like WikiLeaks.org, instructing it to launch continual requests for information, so the website is too busy to load.
The Anonymous group, like most hackers, shuts down websites by launching what are known as distributed denial of service attacks. Usually, these attacks are launched from a network of thousands of unsuspecting computers connected to the Internet.
Skilled hackers install tiny programs called botnets onto hundreds of thousands of computers that can be activated on command, turning a chain of home desktops and company servers around the world into what hackers call a "zombie army." Those computers, temporarily under the control of the hacker, can direct millions of messages to a single website, overwhelming even the world's biggest servers.
Almost all the corporate websites that were attacked appeared to be operating normally later Wednesday. But the sense of an Internet war was reinforced late Wednesday, when Operation Payback itself appeared to run into problems, as many of its sites went down. It was unclear who was behind the counterattack.
TL;DR
/b/rofist!