An editorial piece by Jaded Security on the June 2011 LulzSec / AntiSec announcement and what its ideological framing meant for the threat landscape.
LulzSec has been watched with the same morbid fascination as everyone else in this industry. There is something deeply entertaining about watching multi-billion dollar companies get embarrassed by a group that named itself after internet laughter.
Today they crossed a line. Or maybe they crossed it a while ago and we were all too busy laughing to notice.
LulzSec has officially declared war on governments worldwide. Their statement — released, naturally, on Pastebin — calls on people to “steal and leak any classified government information.” They are calling it Operation Anti-Security. AntiSec.
What this actually means
Here is what nobody in the breathless media coverage is saying: this is not new. The AntiSec movement goes back to the early 2000s. What is new is that a group with actual demonstrated capability is reviving it with a massive audience watching.
LulzSec has proven they can break into Sony, PBS, the US Senate, InfraGard, and a dozen other targets. They have the skills. Now they have an ideology to attach those skills to. That is a fundamentally different threat than “we did it for the lulz.”
The industry response has been pathetic
Security vendors are tripping over themselves to use this as a marketing opportunity. “Our product would have prevented the Sony breach.” No it would not have. Stop lying. The full scope of what happened is not even known yet.
The talking heads on cable news are calling them “sophisticated hackers.” Most of what LulzSec has done is SQL injection against poorly configured web applications. That is not sophisticated. That is Tuesday. The embarrassing part is not that they can do it — the embarrassing part is that these organisations left the door wide open.
Where this goes
Nobody has a crystal ball. But the patterns are visible. When hacktivism gets this much attention, three things happen:
- Copycats emerge. Lots of them. Most will be incompetent. Some will not be.
- Law enforcement gets political pressure to make arrests. They will make examples of someone.
- The actual security problems that enabled all of this will go unfixed, because fixing them is expensive and boring, and nobody gets budget approval for boring.
The industry will be having the same conversation in five years, just with different group names.