Original URL: https://www.theregister.com/2012/03/08/strafor_anon_arrest_analysis/

Stratfor email hackers were tricked into using Feds' server

Spotlight on source of WikiLeaks' files

By John Leyden

Posted in Legal, 8th March 2012 13:36 GMT

WikiLeaks – and Julian Assange – could get caught up in the investigation into the LulzSec takedown saga because it published the internal emails of Stratfor, the private global intelligence firm that was attacked by Anonymous hackers, it has emerged.

A warrant authorising the arrest of the prime suspect in the Stratfor raid revealed that an FBI supergrass persuaded hackers to use a server controlled by the feds to store the emails.

Whistle-blowing site WikiLeaks began publishing emails from the intelligence biz last month to show "how a private intelligence agency works, and how they target individuals for their corporate and government clients".

The site refuses to explain how it came by the "Global Intelligence Files" but the dates covered by the emails - from July 2004 to late December 2011 - are consistent with the hacktivists' ransacking of Stratfor back in December as part of a high-profile and much publicised cyber-assault.

Hackers made off with email spools and credit card information from Stratfor's insecure systems.

Responding to WikiLeaks' release, the so-called GIFiles, George Friedman, founder and chief exec of Stratfor, suggested some of the emails might be forgeries while admitting others could be accurate. He alleged that the Anonymous attack was the source of the information:

As most of you know, in December thieves hacked into Stratfor data systems and stole a large number of company emails, as well as private information of Stratfor subscribers and friends. Today WikiLeaks is publishing the emails that were stolen in December. This is a deplorable, unfortunate - and illegal - breach of privacy.

Some of the emails may be forged or altered to include inaccuracies. Some may be authentic. We will not validate either, nor will we explain the thinking that went into them. Having had our property stolen, we will not be victimized twice by submitting to questions about them.

Jeremy Hammond, 27, of Chicago, Illinois, was arrested and charged with access device fraud and hacking offences on Monday night. Hammond, alleged to go by the name of Anarchaos, is suspected of being involved in December's Anonymous hack on Stratfor. His arrest came after Hector Xavier Monsegur, 28, accused of being LulzSec kingpin Sabu, was outed as an FBI informant since the time of his arrest in New York last June.

Monsegur was instrumental in leading federal investigators to Hammond, a 34-page criminal complaint prepared to authorise a raid on his house reveals.

The 27-year-old trusted Monsegur and, it is alleged, let slip that he had been collared for protesting at the Republican National Convention in New York City in 2004 and an offhand remark that his pals had been arrested at a climate change protest called Midwest Rising earlier this year.

These schoolboy mistakes and others like them allowed disparate online handles to be linked to one identity for investigators to target.

A week-long surveillance operation was then initiated on 28 February that included monitoring of his movements and a tap on his wireless internet connection to log websites Hammond visited. It turned out Hammond frequently went online using the Tor anonymisation service. Meanwhile Monsegur continued to help investigators by noting when Anarchaos went on and offline and correlating it with Hammond's movements.

Hammond was already on a long list of potential suspects because of his 2005 conviction for hacking into a “politically conservative website and stealing its computer database, including credit card information". He never made the mistake of revealing his real IP address when he logged into a chat server, the error that reportedly undid Monsegur, but he let slip enough information for the feds to latch onto his alleged identity as an Anonymous hacktivist anyway.

The days before the Stratfor hack

It's unclear whether or not Monsegur and his FBI handlers knew about the Stratfor hack beforehand, but they were intimately involved in discussions about what to do with the stolen email and credit card data extracted during the hack soon afterwards. This discussion happened over Christmas - at the time the first tranche of leaked emails and credit card details were published and while the Anonymous strategy on what to do was still in flux.

Court documents reveal that Monsegur offered an FBI-supplied server as a repository for data extracted from Stratfor and that this offer was accepted. Hammond allegedly used multiple servers to store the leaked data. Chat transcript in the warrant reveals several discussions about using stolen credit card data to lease web servers to run as .onion domains from which Strafor emails could safely be reviewed. Eight unidentified co-conspirators in the Stratfor hack are listed in these various chat extracts included in Hammond's warrant.

Hacktivists clearly wanted the Strafor email haul to receive the widest possible audience, including providing an opportunity for journalists and others to review them. But chats in the warrant omit any talk of plans to turn over the information to WikiLeaks (an organisation members of Anonymous have gone into online battle to defend) which is designed to manage and publicise material like Stratfor's internal memos.

The extent of communication between WikiLeaks and Anonymous regarding the Stratfor leak remains unclear. Stratfor's own assertion that "some of the emails may be forged or altered to include inaccuracies", meanwhile, certainly seems much more plausible, especially if Monsegur (under the control of his FBI minders) had any say in deciding what was released.

It's not too extravagant to think that a bigger game might be in play.

The US department of Justice is rumoured to have convened a grand jury investigation into WikiLeaks, supposedly investigating the possibility that Assange might be charged under the 1917 Espionage Act.

Lawyers acting for Assange have argued that his extradition from Blighty to Sweden for questioning over alleged sexual assaults will open the door to a US extradition on possible espionage charges related to the leak of confidential US military reports from Iraq and US diplomatic cables. US army private Bradley Manning, a former Iraq-based intelligence analyst, faces court martial as the alleged source of the classified US documents.

If US authorities could obtain evidence to tie Julian Assange to some conspiracy involving the hacking attacks against Stratfor then this could pave the way for separate criminal charges against WikiLeak's founder.

News of Hammond's arrest over the Stratfor hack and Monsegur's betrayal of his former hacktivist chums was jokingly greeted by WikiLeaks. "So, Stratfor emails dumped to @wikileaks under the supervision of the FBI? Clearly constitutionalists who believe in the 1st amendment," Wikileaks said in a Twitter update.

Security consultants at HP argue against an overreaction against this week's bust.

Josh Corman, director of security intelligence at Akamai, notes that one set of high-profile arrests does not spell the end of Anonymous: "Anonymous is more Starfish than Spider. Decentralized organisations are very different than rigid hierarchical ones," he said on Twitter.

Corman has put together a series of informative blogs on Anonymous here.

Rik Ferguson, a security consultant at Trend Micro, concurs: "Anonymous isn't Sabu and Sabu certainly wasn't anonymous." ®