The Register® — Biting the hand that feeds IT

Feeds

Stratfor email hackers were tricked into using Feds' server

Spotlight on source of WikiLeaks' files

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

WikiLeaks – and Julian Assange – could get caught up in the investigation into the LulzSec takedown saga because it published the internal emails of Stratfor, the private global intelligence firm that was attacked by Anonymous hackers, it has emerged.

A warrant authorising the arrest of the prime suspect in the Stratfor raid revealed that an FBI supergrass persuaded hackers to use a server controlled by the feds to store the emails.

Whistle-blowing site WikiLeaks began publishing emails from the intelligence biz last month to show "how a private intelligence agency works, and how they target individuals for their corporate and government clients".

The site refuses to explain how it came by the "Global Intelligence Files" but the dates covered by the emails - from July 2004 to late December 2011 - are consistent with the hacktivists' ransacking of Stratfor back in December as part of a high-profile and much publicised cyber-assault.

Hackers made off with email spools and credit card information from Stratfor's insecure systems.

Responding to WikiLeaks' release, the so-called GIFiles, George Friedman, founder and chief exec of Stratfor, suggested some of the emails might be forgeries while admitting others could be accurate. He alleged that the Anonymous attack was the source of the information:

As most of you know, in December thieves hacked into Stratfor data systems and stole a large number of company emails, as well as private information of Stratfor subscribers and friends. Today WikiLeaks is publishing the emails that were stolen in December. This is a deplorable, unfortunate - and illegal - breach of privacy.

Some of the emails may be forged or altered to include inaccuracies. Some may be authentic. We will not validate either, nor will we explain the thinking that went into them. Having had our property stolen, we will not be victimized twice by submitting to questions about them.

Jeremy Hammond, 27, of Chicago, Illinois, was arrested and charged with access device fraud and hacking offences on Monday night. Hammond, alleged to go by the name of Anarchaos, is suspected of being involved in December's Anonymous hack on Stratfor. His arrest came after Hector Xavier Monsegur, 28, accused of being LulzSec kingpin Sabu, was outed as an FBI informant since the time of his arrest in New York last June.

Monsegur was instrumental in leading federal investigators to Hammond, a 34-page criminal complaint prepared to authorise a raid on his house reveals.

The 27-year-old trusted Monsegur and, it is alleged, let slip that he had been collared for protesting at the Republican National Convention in New York City in 2004 and an offhand remark that his pals had been arrested at a climate change protest called Midwest Rising earlier this year.

These schoolboy mistakes and others like them allowed disparate online handles to be linked to one identity for investigators to target.

A week-long surveillance operation was then initiated on 28 February that included monitoring of his movements and a tap on his wireless internet connection to log websites Hammond visited. It turned out Hammond frequently went online using the Tor anonymisation service. Meanwhile Monsegur continued to help investigators by noting when Anarchaos went on and offline and correlating it with Hammond's movements.

Hammond was already on a long list of potential suspects because of his 2005 conviction for hacking into a “politically conservative website and stealing its computer database, including credit card information". He never made the mistake of revealing his real IP address when he logged into a chat server, the error that reportedly undid Monsegur, but he let slip enough information for the feds to latch onto his alleged identity as an Anonymous hacktivist anyway.

Cloud based data management

Anonymous Coward

Re: sounds like entrapment to me

It would only be entrapment if they suggested and facilitated the initial hack, just saying "you can put your data here" wouldn't be entrapment.

7
0
Anonymous Coward

It turned out Hammond frequently went online using the Tor anonymisation service

So what? So do I.

I'd like to guess he also connected to Google as well - just as relevant...i.e not.

TOR is not illegal. Or are you saying anybody who uses TOR must be up to no good (just like the governments want everyone to think). "He uses TOR you know...he must be a pedo or hacker or something bad....after all, nothing to hide and all that", "See her in the burkah....hides her face she does...must be a terrorist, after all..why else would you do that"..

Use of TOR should be promoted as much as possible - something that is not helped by shitty innuendo about its use in articles like this.

6
1
Anonymous Coward

Know thy enemy and know thyself

Going after a bunch of ex-spooks was guaranteed to prompt response from their still-officially-active chums. No surprise at all that someone's been cuffed already... he'll be singing like a canary if he wants to see any non-Cuban daylight over the next half century or so.

Idealism is a wonderful thing, but frankly the kind of people who can send you to Guantanamo aren't going to give a monkey's nuts about your rights... if you don't understand that, don't try going up against them. They may not always be fast, but they really don't forget, they really don't forgive, and their retribution is far more real-world...

4
0

More from The Register

 breaking news
Number of cops abusing Police National Computer access on the rise
Only a telegram from the Queen can get you off it
 breaking news
NSA whistleblower to tech firms, Obama: 'Grow a pair!'
Ed Snowden: Email tracking grabs 'IPs, raw data, content, headers, attachments, everything'
NSA: We COULD track you by your phone ... if we WANTED to
Honestly, too much work, can't be bothered
Google flings another £1m at online child sex abuse vid CRACKDOWN
See, see, we're trying, ad giant tells Daily Mail UK.gov
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
SCO vs. IBM battle resumes over ownership of Unix
Zombie lawsuit back and wants to suck the brains out of Linux
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights