Feeds

LulzSec's Sabu hacked foreign gov sites while under FBI control – NYT

'Bank records to login information' dumped on feds' server, it's claimed

Secure remote control for conventional and virtual desktops

Ex-LulzSec chief Sabu orchestrated attacks on government computers in Iran, Syria, Pakistan and Brazil while under the control of the FBI, according to a New York Times investigation.

After he was apprehended and turned to became an FBI informant, Hector Xavier "Sabu" Monsegur encouraged fellow Anonymous hackers to hit foreign websites using a zero-day vulnerability in server-side software.

Data stolen during the hacking spree was then uploaded to a server that was secretly monitored by the Feds, it's claimed.

The allegations are based on copies of court documents as well as interviews with individuals linked to the network assaults by the New York Times.

Monsegur was arrested in September 2011, and since then he has been working with the Feds as an informant against his online brothers-in-arms. This only became public knowledge in March 2012. During the eight months in between, Sabu was coordinating a hacking spree by the LulzSec cyber-gang and elements of the wider Anonymous movement, all while pushing a list of targets on behalf of his US government handlers, it is claimed.

The NYT said it has evidence that Uncle Sam, through Sabu, used Anonymous activists to probe foreign government websites for vulnerabilities.

Chat logs between hacktivist Jeremy Hammond and Sabu show that the FBI mole supplied Hammond with addresses of foreign websites to target, it's alleged. A flaw in web-hosting software Plesk was one of the main routes used to obtain unauthorized access to vulnerable systems, the newspaper claimed.

Hammond, together with a Brazilian hacker using the nickname Havittaja, broke into the insecure sites, although Sabu merely encouraged them rather than participating in the hacks, it's reported. Once the sites were hacked, sensitive information was extracted and uploaded to servers designated by Monsegur that had been tapped by the Feds, we're told.

"Exploiting a vulnerability in a popular web hosting software, the informant directed at least one hacker to extract vast amounts of data - from bank records to login information - from the government servers of a number of countries and upload it to a server monitored by the FBI," the NYT reports.

Hammond is serving a 10-year sentence after pleading guilty last month to a high-profile hack against private intelligence outfit Stratfor and for attacks inside the United States. The hacktivist admits to taking part in attacks outside the US, but the terms of his plea-bargaining deal prevent him from going into details.

Monsegur's repeatedly delayed sentencing [PDF] is due to take place on 8 May. He has admitted 12 criminal charges that include multiple counts of conspiracy to engage in computer hacking. ®

Internet Security Threat Report 2014

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.