Whether it's wishful thinking or a sign the net is tightening around LulzSec, the talk in computer security circles is that the hacking group's headline-filled glory days may be numbered. The reportedly tight-knit group of anonymous, renegade hackers has drawn far too much attention to itself and angered too many people with the ability and now the motivation to track them down, say rival hackers and security experts.
At this point, whoever discovers and exposes the identities of what's believed to be as few as six to eight individuals who comprise LulzSec would have cyber-scalps perhaps as valued in their own way as the real one belonging to the recently dispatched Osama bin Laden.
The Straw that Broke the Camel's Back?
Though its two-month-long reign of cyber-shenanigans had already made the group a huge target, LulzSec's latest exploit has assuredly fueled the efforts of law enforcement and self-proclaimed LulzSec hunters like lone wolf hacker "th3j35t3r" (the Jester, translated from "leetspeak") to catch them.
The hacking group on Thursday published more than 700 documents containing confidential information stolen from the Arizona Department of Public Safety (DPS). The 440MB data dump, which contains emails, bulletins, images and other files that have been pored over by Boing Boing, "could jeopardize the safety of many DPS officers and employees," according to a statement from Arizona police.
In a sense, previous LulzSec endeavors, like the group's posting of a fake story on the PBS.org website, temporary take-downs of sites belonging to the CIA and U.S. Senate, and even its breaches of the Sony Playstation Network, seem almost benign in comparison to exposing the identities and methods of police who contend with dangerous border gangs in Arizona.
Back in Bed with Anonymous
LulzSec's customary press release describing the operation it called "Chinga La Migra," or "f*** the border patrol" in Spanish, was far more restrained in its language than is typical from LulzSec. The statement was also more overtly political in explaining that the group's opposition to Arizona's controversial SB1070 anti-illegal immigrant law was the reason the DPS was targeted.
That's because, as the group later explained, the statement wasn't penned by LulzSec's regular mouthpiece. That master of snarky braggadocio is reportedly a LulzSec member known as "Topiary," as identified in the Guardian's must-read analysis of LulzSec chat logs that are believed to have been leaked by ex-LulzSec associate "m_nerva."
The targeting and hacking of the DPS appears to have also been the work of separate, associated hackers. LulzSec recently stated that in an effort to target police and government entities, it was teaming up with the more established—as odd as that qualifier sounds—AnonOps faction of the "leaderless," strange-bedfellow collective of online griefers and free Internet activists known as Anonymous.
That alliance may give LulzSec more disruptive resources at its disposal, but it could also prove costly. Alleged affiliates of Anonymous have had a habit of getting arrested in recent days.
Somebody shut these guys up! Keep reading to find out how the thrill of boasting about its exploits could sink the LulzBoat.
Choose Your Friends Wisely
Ryan Cleary, a 19-year-old Briton and LulzSec associate who may have orchestrated a schism in AnonOps a few months ago, was arrested by British police this week and charged with various computer crimes. Earlier in June, Spanish authorities arrested three alleged members of Anonymous in connection with their investigation into the Sony PSN hacks.
It would be somewhat ironic if LulzSec, which has taken pains to disassociate itself with Anonymous in the past, found itself exposed to authorities just as it had made common cause with the larger, more anarchic collective.
And as the Guardian chat log analysis shows, LulzSec members are well aware of the risks they are taking, and their consequences. In those chat logs, "Sabu," the apparent iron-fisted, publicity-shy leader of the group, repeatedly instructs subordinate members to cover their tracks and is furious when they make unauthorized public appearances in online forums like Reddit. "Topiary" in particular seems like someone whose distinctive, witty writing style might be identifiable in venues where LulzSec doesn't control access to IP address data that could potentially be used to track down commenters.
Indeed, it is LulzSec members' seemingly unquenchable appetite for public recognition that many observers believe will be their downfall.
Loose Lips Sink Ships
"[Y]ou have relied on technology to keep you safe while flagrantly whipping out your collective pee pee's and waving them at forces who are much better equipped, trained, and funded to hunt you down and make you go bye bye," writes Infosec Island's Scot Terban in an open letter to LulzSec posted Thursday. "Some might see that as daring ... Others see it as just plain stupid."
Terban is especially critical of LulzSec's association with Cleary, as "loose" as LulzSec claims it was. Cleary ran an IRC server for LulzSec, the group has admitted.
"It seems from all of the press and from the kid's history, that he was unstable to start," writes Terban. "This is the guy you want to trust with any data, no matter how small, on who LulzSec is and how they operate?"
Charles Arthur and Josh Halliday say much the same in the Guardian, pointing out the dilemma faced by LulzSec: "The trouble with hacking for glory—as LulzSec, a.k.a. Lulz Security are doing—is that you want everyone to know what you've done, but you don't want anyone to know who you actually are."
Further, LulzSec hasn't done itself any favors by provoking the ire of "th3j35t3r" and other rival hackers like "On3iroi," the "Web Ninjas," and "TeaMp0isoN," according to Arthur and Halliday.
LulzSec now faces "twin threats from rival gangs and from law enforcement. The latter move more slowly, but are more dangerous; the former are quicker and can draw in the latter," they write. That combination of adversaries makes it likely that LulzSec members will soon find their homes surrounded by the "party vans" full of police that LulzSec often refers to mockingly on Twitter, Turban believes.
Of course, LulzSec hasn't been stopped yet. And for as long as its members remain unidentified and free to chase down their beloved "lulz" at the expense of others, you can bet they'll keep laughing at the idea of party vans, arrests, and the notion of their world crashing down around them.
At least in public.