Guardian: Chat logs reveal FBI informant’s role in hacking of Sun newspaper

Source: http://www.theguardian.com/us-news/2014/oct/14/fbi-informants-role-hacking-sun-newspaper-lulzsec-chat-logs

Chat logs reveal FBI informant’s role in hacking of Sun newspaper

US agency faces questions after records show Lulzsec leader, who was informant at time, helped attack that closed UK sites

•  

• The Guardian, Tuesday 14 October 2014 10.00 BST

Computer hacker Hector Xavier Monsegur, better known by his screen name ‘Sabu,’ walks out of Manhattan’s Federal Court after his sentencing in New York Photograph: Getty Images

The FBI is facing questions over its role in a 2011 hacking attack on Rupert Murdoch’s Sun newspaper in the UK after the publication of chat logs showed that a man acting as an agency informant played a substantial role in the operation.
In July 2011, a group of hackers known as Lulzsec – an offshoot of Anonymous – posted a fake story about the death of Murdoch, penetrated several News International (now News UK) corporate sites, and claimed to have obtained gigabytes of material from the company’s servers.

The Sun website after it was targeted by computer hackers, visitors to the website were redirected to a hoax story about Rupert Murdoch’s suicide. Photograph: PA

The attack was so successful that the publisher took down the websites of the Sun and the Times while technicians worked out the scale of the hack.
Unsealed documents obtained by Motherboard, the technology channel operated by Vice, and seen by the Guardian, show Hector Xavier Monsegur – known widely online as “Sabu” and frequently referred to as the leader of Lulzsec – played an active role in the operation.
The chat records show Monsegur encouraging others to break further into News International systems, claiming to have sources at the Sun, and even apparently helping to break staff’s passwords and to source files for stealing.
Monsegur was, however, at that time operating under the direction of the FBI, who had arrested him weeks earlier and cut a deal that kept him free if he helped to track down and secure the convictions of others in the group.
The close involvement of an FBI asset working under extraordinarily close supervision in a hacking attack on a media outlet ultimately owned by a US-listed company is set to raise further questions about the agency’s approach to tackling online crime.
Monsegur, who faced a maximum of 124 years in prison, was released earlier this year in exchange for his “extraordinary” cooperation with the FBI. Monsegur, who is currently on a 12-month supervised release programme, is believed to have cooperated with authorities because of his role as sole carer for two young relatives. He has had no contact with the media since his release.
The chat logs, which are more than 380 pages long, show the Lulzsec group working together over several days to hack into the Sun, talking in the relaxed (and often misspelled) manner of online conversations.
The chat, in a private channel aptly named “#sunnydays”, jumped between talking through reasons to attack the newspaper, what to do when in, and technical advice on how to operate the hacks.
“what up gentlemen,” said Sabu, opening the channel’s conversation, “lets do this.”
Some members of the group had already secured limited access to servers owned by the Sun. Sabu immediately encouraged them to go further, and obtain email records.
“good work on owning sun honestly speaking this is going to be good shit,” he wrote. “I want their mailspools … fuck the rest”
Sabu goaded the others on, telling them the Sun was planning to fabricate a story saying Lulzsec had tried and failed to hack the newspaper – a claim likely to enrage the group – and saying there were likely to be internal communications to confirm his claim.
At the time, others in the channel were focusing on merely embarrassing the Sun by running a false news story – which they did – or replacing home pages with pictures of internet memes, such as Nyan cat.
After some login details were shared, Sabu claimed to be looking around in the server, cautioning the others to “do this carefully”, and helping them try to “root” – gain total access to – another server.
Later, another hacker obtained encrypted login details of multiple News International staff, but was unable to decrypt them and thus obtain the usernames and passwords. Sabu offered to assist at this point, and later provided the password details.
The logs also show Sabu on multiple occasions offering detailed technical help to find additional records on different servers, breaking in to new servers, or obtaining more files – which could easily have included those belonging to journalists at either the Sun or Times.
At various stages in the course of the conversation, Sabu claimed to have obtained mail records from HSBC bank, and details on the Qatari royal family.
The logs even show Sabu celebrating with the other hackers – whose names are redacted – when CNN read out messages released by the group when the websites were taken down to handle the hack. “THE GUY JUST SAID WE HAVE JOY WE HAVE FUN WE HAVE MESSED UP MURDOCHS SUN,” he posted.
Less than 10 days after the attack on the Sun, several members of Lulzsec were arrested, and later convicted, for activities in the group. They included British citizens Jake Davis (known online as “Topiary”) and then-16-year-old schoolboy Mustafa Al-Bassam (“Tflow”).
The Sun, which is challenging the UK government over police accessing the phone records of one of its reporters, declined to comment on the apparent FBI involvement in attacks on its servers.
The FBI had not responded to a request for comment by the time of publication.