Cybersecurity firm HBGary hacked by anonymous

[Demosthenes11]

I use cash for: toll, parking at school, a few hole in the wall restaurants that are awesome that dont support CC, and a few other misc things.

I hate cash but i can't go without...

[Max™]

http://arstechnica.com/tech-policy/n...-wikileaks.ars

http://www.p2pnet.net/story/48930

Dear HBGary (a recently disgraced “security” company),
Warm regards from Anonymous once again. It was our belief that you’d been taught a valuable lesson since our last message to you, but it appears that this is not the case.
After we humiliated you thoroughly by making your private documents public, defacing your website, taking over various online accounts of your executives, socially engineering your “trusted” server admins, unveiling embarrassing personal mishaps of Aaron Barr and essentially ruining any future plans your company might have, we had assumed that you’d at least, for once, use your combined brain cells to realize what you should and shouldn’t do.
So what did you do? You threatened us. Greg Hoglund, COO of HBGary, thought it wise to push forth that legal action is being taken to bring down Anonymous. Let’s not forget that the first time you tried to do something like this, we did not overlook it, and we are not overlooking it now. We were willing to stop attacking you, we were even willing to leave you be entirely – but now you have provoked us, and there will be no mercy.
You even have the nerve to suggest we’re falsifying information, which you arrogantly posted in a statement on your company website. The same company website that Anonymous ravaged.
HBGary, Inc and HBGary Federal, a separate but related company, have been the victims of an intentional criminal cyberattack. We are taking this crime seriously and are working with federal, state, and local law enforcement authorities and redirecting internal resources to investigate and respond appropriately. To the extent that any client information may have been affected by this event, we will provide the affected clients with complete and accurate information as soon as it becomes available.
Meanwhile, please be aware that any information currently in the public domain is not reliable because the perpetrators of this offense, or people working closely with them, have intentionally falsified certain data. HBGary, Inc and HBGary Federal are committed to a comprehensive, accurate, and swift response to this crime.
Anonymous has falsified nothing; we leaked your inboxes in full with no edits. In fact, most of your emails contain S/MIME digital signatures, proving that they’re real. This information is now free to the public, and you honestly think you can wriggle your way out of it by accusing Anonymous of tampering with your data?
We feel it’s time we took the game to the next level. We have now released all 71,802 HBGary emails so they are fully available to every citizen who is interested. This includes the previously unreleased 27,606 mails from Greg Hoglund’s spool. We also included a fulltext search for your convenience.
But do not get us wrong, this is not all about revenge. Your leaked communications reveal that your companies were entangled in highly dubious and most likely illegal activities, including a smear campaign against WikiLeaks, its supportive journalists, and adversaries of the U.S. Chamber of Commerce and Bank of America. Evidence even suggests that this was done with full knowledge of the U.S. Department of Justice.
While the whole truth has yet to be uncovered, Anonymous feels that it is its duty to let the world know what you, related companies, and government agencies are up to behind closed doors. We will not stand idly by while firms like HBGary work in secrecy to undermine rights of citizens or institutions like WikiLeaks.
Admittedly, HBGary, while we do what we feel is necessary and just, we do not deny that we enjoyed breaking your neck in the process. You tried to play our game. You lost.
We are Anonymous.
We are legion.
We do not forgive.
We do not forget.
Expect us – always.
—
Web version: http://anonleaks.ru

Giggity!

[SephYuyX]

Fuck sake, where is the media at all ready.
This should be on headlines everywhere.

[Jefe]

The media and public are too busy wondering about that reporter who apparently had a heart attack on air during the Grammys.

[Feedmenow]

This is only somewhat related, but I found this comment on one of the Anonymous hacking stories on Ars Technica.

The easiest methodology I know of (and what I personally use to maintain unique passwords for all my sites) is a program like 1Password + DropBox. My password for Ars is a 50 character unique letter/number/symbol strong for instance. Most sites won't let you go that long, but my banking passwords are 32 chars.

DropBox keeps 1Password synced, and there are iApp versions too, so I'm basically set on all my machines and mobile devices. Nothing is foolproof of course, but it's a lot more secure than the examples given in this story at least.

Is this even reasonably smart? Sounds like a savvy person writing some trojan or someshit just needs to implement something to keylog/redirect all that info to obtain all your passwords for goddamn everything.

[Caiyuo]

Keylogging likely wouldn't work since 1Password would autofill, but it sounds like access to his Dropbox would grant you logins to everything else he uses, but I assume that, too, is no less than a billion characters long. Might be the only one he writes down in his wallet, though, might be easier to literally rob him instead of this subversive internet shit.

[Niiro]

In this age of technological saturation no one takes the time to rob people face to face anymore.

It's sad, really.

[Cantih]

I think Max's p2p site link has some.

[Stumblingdrunk]

E-Mails Hacked By 'Anonymous' Raise Concerns
Wednesday, February 16 2011 10:37 PM

A pro-WikiLeaks activist group hacked an Internet security company's servers, stole private e-mails and dumped them on the Web. The e-mails offer a glimpse at a world of corporate dirty tricks in the Internet age.

http://www.wnyc.org/shows/atc/about/

there is a link to download the audio from the piece if ya scroll down

[Demosthenes11]

the best article about this entire thing (most fascinating at least):
http://arstechnica.com/tech-policy/n...gary-hack.ars/

It's the walkthrough of what they did

[Drex]

it's funny, because that stuff is like lesson 5 of how to hack a website on those tutorial pages floating around, where lessons 1 and 2 are "look at the source code". really sad how easy they made it. have to laugh at the password being leetspeak though. nerds!

[SephYuyX]

It's just something unavoidable. As the article summed up, basic and upkept protection would have been enough to keep them out, for the most mart. However security can be a real beast. While they definitely have only theirselves to blame for not keeping up with the latest patches and not checking for vunerabilities, getting people to use secure passwords is near impossible if left to their own devices.

It's just a perfect example of a company being so full of themselves that they overlook the basics. You would think a security firm would have the best security, you would think a financial firm would have the best financial practices, you would think a carpenter would have the best house. For the most part these dont hold true, but for HBGary to not even enforce basic password policies via the server is pretty bad, and for someone to use the same password across multipule platforms is even worse.

[miokomioko]

http://3.bp.blogspot.com/_OfOrI9LzPX...8_sneakers.jpg

...OR NOT.

[bungiefan]

http://arstechnica.com/tech-policy/n...government.ars

That company was also writing rootkits for corporations and government agencies.

[Celeras]

To be honest, now it kind of seems like its just being made up lol.

[Athas]

Colbert was probably the last place I expected to see this story.

[Chun Liroy]

However, it was definitely the funniest.
"Anonymous is like a hornet's nest and [guy's name] said 'I wanna stick my penis in there'"

[Silenka]

Bah looks like there are no videos of that up yet. Wanted to see it

[Ksandra]

holy crap my hubby got good eyes. at one point on colbert's face it flashed a fawkes mask on him. LOL

inb4 feds start claiming colbert is anon's leader

[Ksandra]

For those that missed it: