LulzSec

Chapter 1: What Is LulzSec?

LulzSec is a group of Web hackers who made themselves famous for their barrage of attacks and their sarcastic taunting of victims during the summer of 2011. Members of LulzSec, short for Lulz Security, committed many well-publicized online attacks in the span of several weeks. The successful attacks included publicizing hundreds of thousands of passwords and user names from customers of supposedly secure Web sites.

LulzSec's history is a short, busy one. The group's first known attack occurred in May 2011. By July 2011, 50 days after its first publicized hack, Lulz Security released a statement saying it would be disbanding. In between, LulzSec was in the news almost daily.

Lulz Security's members certainly were not the first hackers to take down a Web site or steal data. However, the group received quite a bit of publicity for its attacks because of the contemptuous messages left behind on the Web sites after the attacks.

The group also grew in fame for its brash nature in announcing the attacks through Twitter. By carrying out cyber-attacks on high-traffic Web sites, LulzSec grabbed additional headlines.

Lulz Security's mascot is a snooty millionaire who wears a monocle while holding a glass of wine. The black and white line drawing appeared on LulzSec's Twitter page and its Web page. The group often inserted the mascot into photos of various locations, which it then posted on sites that it hacked.

You can see the mascot at: www.en.wikipedia.org/wiki/File:Lulz_Security.svg

Considering its list of online attacks, it's no surprise that the Arizona Dept. of Public Safety listed Lulz Security as a cyber-terrorist group. The FBI and British law enforcement officials doggedly pursued LulzSec members. Various arrests have been linked to LulzSec associates, but it's unknown whether any of the arrests so far actually involve core Lulz Security group members.

LulzSec also seemed to attack the very community from which it originated. Notorious forum board 4chan and the 4chan community may have played a role in helping connect those in the LulzSec group. (www.4chan.org/) The group's name - lulz - comes from a phrase commonly used at 4chan.

Despite these ties, LulzSec later specifically attacked 4chan users, turning their computers into zombies and crashing gaming sites 4chan users frequent. Lulz Security's short history included many instances where group members fought with former allies and teamed up with former enemies.

Denial of service (DoS) attacks were among the most popular that LulzSec performed in the summer of 2011. In an act of boldness in mid-June, Lulz Security actually set up a telephone number that allowed people to make suggestions for sites it should hack with a DoS attack. The number had a 614 area code, making it appear to originate from Ohio. Someone called Pierre Dubois, who had a fake French accent, greeted callers, asking them to leave a message.

LulzSec claimed to make eight DoS attacks against targets suggested by callers: www.pcmag.com/article2/0,2817,2386959,00.asp.

Such brashness caused victims of the attack to seethe. Such brashness caused those watching from the outside to "LOL" at the group's antics … which was the group's goal all along.

Denial of service attacks involve overloading a Web site hosting server with more requests than it can handle. Usually, a hacker uses a group of computers he has secretly overtaken, turning them into “zombie computers” to create the flood of requests. To legitimate site visitors, the Web site suffering from a DoS attack will not load or will appear to load very slowly. Sometimes these attacks are called DDoS (distributed DoS).

To take over these computers, a hacker will upload a small piece of software to the host computer. The hacker then can take remote control of these computers at any time. Many times, a hacker will trick the victim into downloading the remote control software, usually through a fake Web site or through fake photo or video links.

You can learn more about DoS attacks here: nakedsecurity.sophos.com/2011/06/15/cia-website-down-hackers-lulzsec/.

An anti-virus program or firewall should prevent such software from working. Therefore, hackers will seek out computers with high-speed Internet connections and with weak anti-virus protection. High-speed Internet connections are desirable for a DoS attack because of the always-on connection.

After hackers put together a large number of these computers they can control remotely, the hackers are ready to make a DoS attack. This network of controlled computers is called a botnet. These fake requests from the botnet prevent many legitimate visitors from gaining access for the duration of the DoS attack.

LulzSec made specific use of 4chan user computers in carrying out its DoS attacks. According to a Lulz Security Twitter post, they especially enjoy hijacking the computers of 4chan users, specifically those on the /b/ (Random) board, turning the machines into a zombie computer botnet.

“The best part about making 50% of all /b/tards our bots is that they leave their daddy's laptops on 24/7, more bandwidth for us,” the Twitter post said. LulzSec members and 4chan members often use a term — /b/tards — to refer to those using the 4chan /b/ board.

Learn more about the term /b/tards at: www.urbandictionary.com/define.php?term=%2Fb%2Ftard.

On occasion, LulzSec did make political statements with its attacks. However, the primary political-themed attacks occurred as part of Operation Anti-Security (AntiSec), where LulzSec teamed up with hacker group Anonymous. Operation AntiSec ran from June 20-25, and it involved attacking government targets.

Mostly, though, LulzSec members just seemed to be having fun. LulzSec often taunted its victims as part of the attack. Through its Twitter site, LulzSec posted: “[We] release personal data so that equally evil people can entertain us with what they do with it. … You find it funny to watch havoc unfold, and we find it funny to cause it.”

The group never accepted blame for any misuse of such information, as shown here: http://arstechnica.com/tech-policy/news/2011/06/lulz-sony-hackers-deny

In the end, LulzSec released quite a bit of sensitive information and passwords collected during its attacks. Lulz Security's members claimed the fault rested with those entities with poor security that the group could exploit … while laughing the entire time.

Chapter 2: LulzSec's Motivations

Determining what motivated LulzSec to unleash its series of hacks in the summer of 2011 was a difficult process. Debate still continues on just how serious LulzSec's attacks were.

Part of the group's name is a play on an Internet acronym. The term Lulz is a phonetic spelling of the Internet term LOLs, which is short for laughing out loud. (en.wikipedia.org/wiki/LOL)

Multiple posts stating LOL might be made on an Internet message board or on Facebook. Most of the time, LOLs are used when an Internet prank is particularly successful. Because many of the LulzSec attacks had a humorous or prank-like slant, they might have generated many LOLs from the group's members and fans, hence the name.

The term Sec is short for security. Computing, network, and Internet security personnel often shorten security to sec in everyday conversations. However, the group does not always use sec. In fact, the group's Web site – www.lulzsecurity.com – spells out security in its entirety.

When you combine the two terms, you end up with LulzSec. The term could be read as laughing out loud at security. The group created a motto – Laughing at your security since 2011! – that continues this theme.

You can read more about the group's motto, and a famous attack against PBS, at: www.stuff.co.nz/entertainment/music/5079309/Hackers-claim-Tupac-alive-in-NZ.

By including the idea of laughing at victims in its name, some people labeled Lulz Security's members as pranksters. The group, at times, did not appear to be serious hackers bent on causing destruction and significant financial losses. Security personnel pointed at the group's unsophisticated methods of attack as another sign that its members were little more than pranksters posing as serious hackers.

The group's behavior at times seemed to strengthen this argument. Lulz Security has never listed one specific motivation for the attacks. In its various statements, LulzSec used humor, political statements, revenge against other hackers, calling attention to lax security, and support for WikiLeaks director Julian Assange as explanations for its motivation behind its attacks.

To learn more about Julian Assange, visit here: www.guardian.co.uk/media/julian-assange.

Lulz Security usually claimed credits for its attacks using Twitter, which isn't the most serious form of communication. Using Twitter added to the general feeling that the group was pulling pranks.

Visitors to the LulzSec Web site were greeted with the theme from the 1980s television show, The Love Boat. The group's Twitter site (twitter.com/#!/LulzSec) is called The Lulz Boat and states: “Lulz Security (LulzSec), the world's leaders in high-quality entertainment at your expense –”

The group's Web site encouraged visitors to make a donation to the group, which doesn't exactly portray a well-funded, serious, secret organization. The donation system seemed to work, though, as LulzSec often sent Twitter posts with funding updates.

The group announced through Twitter that it received a single $7,200 donation in early June. Lulz Security had nearly 400,000 Twitter followers at one time. (twitter.com/#!/LulzSec/followers)

By taking credit for its attacks with flair and humor, LulzSec seemed to encourage the idea that it was just playing pranks. This situation caused some people to not take the group's threats seriously. Although the group did nothing to downplay its humorous nature, it also claimed it had the ability to perform more serious attacks, if it so desired.

Even though Lulz Security is branded by law enforcement as a group that committed cyber-terrorism, some in the computer security industry don't agree. Some applauded LulzSec's ability to find and publicize holes in security protocols. The LulzSec attacks placed public attention onto the holes, forcing them to be fixed immediately.

You can learn more about how some security professionals felt about LulzSec at: www.dailymail.co.uk/sciencetech/article-2006118/Ryan-Cleary-charged-cyber-attack-CIA-LulzSec-takes-revenge.html.

Other security professionals appreciated the attention shone on the problem, but they would've preferred LulzSec's members used a different method of publicizing the security holes.

A month after its first attack, LulzSec released a document that discussed the motivation behind its attacks. This manifesto discussed how the members of the group enjoyed hacking because of the mayhem that resulted. Attacks occurred for fun, the manifesto said.

You can see the LulzSec manifesto at: www.pastebin.com/HZtH523f.

According to the manifesto, LulzSec claimed it was doing businesses a favor by revealing security flaws. If businesses didn't know about the flaws, hackers looking to do serious harm could exploit them instead. By revealing the group's methods of attack and results from the attacks, according to LulzSec's manifesto, the public could learn about vulnerable Web sites.