Feeds

LulzSec's Sabu hacked foreign gov sites while under FBI control – NYT

'Bank records to login information' dumped on feds' server, it's claimed

The Power of One Infographic

Ex-LulzSec chief Sabu orchestrated attacks on government computers in Iran, Syria, Pakistan and Brazil while under the control of the FBI, according to a New York Times investigation.

After he was apprehended and turned to became an FBI informant, Hector Xavier "Sabu" Monsegur encouraged fellow Anonymous hackers to hit foreign websites using a zero-day vulnerability in server-side software.

Data stolen during the hacking spree was then uploaded to a server that was secretly monitored by the Feds, it's claimed.

The allegations are based on copies of court documents as well as interviews with individuals linked to the network assaults by the New York Times.

Monsegur was arrested in September 2011, and since then he has been working with the Feds as an informant against his online brothers-in-arms. This only became public knowledge in March 2012. During the eight months in between, Sabu was coordinating a hacking spree by the LulzSec cyber-gang and elements of the wider Anonymous movement, all while pushing a list of targets on behalf of his US government handlers, it is claimed.

The NYT said it has evidence that Uncle Sam, through Sabu, used Anonymous activists to probe foreign government websites for vulnerabilities.

Chat logs between hacktivist Jeremy Hammond and Sabu show that the FBI mole supplied Hammond with addresses of foreign websites to target, it's alleged. A flaw in web-hosting software Plesk was one of the main routes used to obtain unauthorized access to vulnerable systems, the newspaper claimed.

Hammond, together with a Brazilian hacker using the nickname Havittaja, broke into the insecure sites, although Sabu merely encouraged them rather than participating in the hacks, it's reported. Once the sites were hacked, sensitive information was extracted and uploaded to servers designated by Monsegur that had been tapped by the Feds, we're told.

"Exploiting a vulnerability in a popular web hosting software, the informant directed at least one hacker to extract vast amounts of data - from bank records to login information - from the government servers of a number of countries and upload it to a server monitored by the FBI," the NYT reports.

Hammond is serving a 10-year sentence after pleading guilty last month to a high-profile hack against private intelligence outfit Stratfor and for attacks inside the United States. The hacktivist admits to taking part in attacks outside the US, but the terms of his plea-bargaining deal prevent him from going into details.

Monsegur's repeatedly delayed sentencing [PDF] is due to take place on 8 May. He has admitted 12 criminal charges that include multiple counts of conspiracy to engage in computer hacking. ®

HP ProLiant Gen8: Integrated lifecycle automation

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.