UK's GCHQ reportedly infiltrated and attacked hacktivist groups

A PowerPoint presentation that GCHQ prepared for a 2012 conference organised by the U.S. National Security Agency reveals that one of the agency’s units, called the Joint Threat Research Intelligence Group (JTRIG), collected information on “hacktivists” – politically motivated hackers – and shared it with law enforcement agencies. The unit also used denial-of-service techniques to disrupt the hacktivists’ communication channels.

The slides were among the documents leaked by former NSA contractor Edward Snowden and were published Wednesday by NBC News. JTRIG used human intelligence techniques to gather information about members of Anonymous and LulzSec, two related groups of hacktivists that attacked the websites of various companies, organisations and governments, NBC News reported.

The leaked slides provide two examples of JTRIG intelligence gathering that targeted two hackers using the online handles GZero and p0ke.

In one IRC (Internet Relay Chat) log included in a slide, an undercover JTRIG agent responds to a request from a hacker looking to buy access to a website with 10,000 or more unique daily visitors. The discussion suggests the hacker intended to install an exploit on the site to infect the computers of visitors with botnet malware so they could be used to support Operation Payback, a large-scale DDoS (distributed denial-of-service) campaign launched by Anonymous in 2010 against pro-copyright organisations and a variety of companies including PayPal, MoneyBookers, Visa, Mastercard and Amazon.

In another chat log, the agent is contacted by a user named GZero who says the first hacker works with him and who also expresses interest in buying traffic for use with an exploit pack.

JTRIG’s reporting on GZero led to his identification and arrest, one of the slides says. Edward Pearson, a 23 year old from York, England, was identified by law enforcement as GZero. He was sentenced in 2012 to two years in prison for using Trojan programs like Zeus and SpyEye to steal credit card details and PayPal credentials.

Another chat log in the GCHQ slides shows a user named p0ke telling another one, named Topiary, that he hacked into a government database and extracted the names, email addresses and phone numbers of 700 U.S. Federal Bureau of Investigation employees. In a later private chat with a JTRIG agent p0ke says that he compromised usda.gov, the website of the U.S. Department of Agriculture.

P0ke was identified by JTRIG, but was never arrested for hacking into government databases, NBC News reported. However, an 18-year-old teenager from Scotland named Jake Davis was identified as Topiary and was arrested in 2011. He later pleaded guilty to computer related crimes and was sentenced to 24 months in a youth detention centre.

The GCHQ slides also mention an operation code-named Rolling Thunder that disrupted an Anonymous IRC server by using denial-of-service techniques. One chat between Anonymous supporters included in the slides suggest the server was hit by a SYN flood – a type of denial-of-service attack involving a flood of SYN requests – which resulted in downtime of over 30 hours.

JTRIG agents also sent messages that read “DDOS and hacking is illegal, please cease and desist” to Anonymous supporters via Facebook, Twitter, email, Skype and other instant messaging applications, NBC News reported, citing a slide that is not among those published. The outcome of this type of activity, which GCHQ calls “information operations,” was that 80 percent of those messaged did not show up in Anonymous’ IRC channel one month later.

 

Originally published on IDG News Service (Romania Bureau). Click here to read the original story. Reprinted with permission from IDG.net. Story copyright 2024 International Data Group. All rights reserved.