Favorite Hackers and Hacking Groups
Hello guys👋👋 ,Prajit here from the BUG XS Team , recently I joined Cyber Sapiens United LLP as Cybersecurity and Red Team Intern, in this I am regularly given some interesting tasks, so one by one I would post here my completed task so everyone could learn about them. So let’s start with the first task.
Part-1: Top 5 Favorite Hackers
- Kevin Mitnick: Kevin Mitnick is one of the famous hackers who was able to completely turn his life from being a most wanted illegal hacker to being a famous and successful ethical hacker.
● To understand this story, let’s start from the beginning. Residing in Los Angeles, at the early age of 12, Mitnick started to love bypassing different security features, and his main tools were “dumpster diving” & “social engineering”. First he found a loophole in Bus Punch Card Systems with which he was able to travel for free in any bus in Los Angeles. He convinced the bus driver to tell him where he could find the ticket punch for the “so-called” school project. He started looking for tickets in the dumpster and got many unused punch cards and now was able to drive many buses for free in Los Angeles.
● Kevin Mitnick is also known as a “Father of Social Engineering” as he was able to bring down many big companies & organizations only on the basis of that. So when did he discover this trick of social engineering? Growing up Mitnick developed a deep interest for computer science, radio and also some fun little pranks. One of his favorite was that he was able to hack into a Mc Donald’s drive through by simply replacing the worker’s voice with his own on the order window and saying something like “You are the 100th customer, so you get your order for free”.
● At the age of 16, Kevin was a part of fellow hackers who dared him to hack “The Arc” owned by digital equipment corporations(DEC). After getting the name and phone number of The Arc System administrator, he gave them a call and used social engineering to convince the project manager to give the credentials, and within a minute he had complete access to the Arc System. Kevin was charged with 160,000 USD for this.
● Some of his famous hacks were, making his own copy of pacific bell manuals in 1981. Gaining access to computers in university of southern California in 1982. Copying software from Santa Cruz operation system in 1987. A second round at DEC in 1988. When there was an arrest warrant for him out there he went on the run around for 2.5 years, and was labeled as a fugitive and most wanted by the FBI.
● The FBI with help of a skilled security researcher, as complex as Mitnick, “Tsutomo Shimomura”, tracked down and caught Mitnick in California. In 1999, as a part of deal, he pled guilty to four counts of wire fraud, two counts of computer fraud and one count of illegally intercepting communication. From this he spent 5 years in federal prison, ending on January 21st, 2000 and his supervised release ended on January 21st, 2003
● After all this, Mitnick worked very hard and today he runs a successful security company called, “Mitnick Security”. He along with his global ghost team, test for weaknesses in companies security by trying to hack them, ironically using all the skills he learnt as a black hat hacker. He has written 3 books defining what we know today as “Social Engineering”. Mitnick and his team have a 100% success rate.
2. Gary McKinnon : Gary McKinnon is one of the famous hackers for doing the biggest hack on the United States. Well most of these kinds of hacks’ purposes are mainly money, fame or political power, Gary’s purpose was completely different from these.
● Gary is a Scottish systems administrator and hacker born on 10th February, 1996. Gary was so fed up with the government withholding information regarding UFOs, extraterrestrials, and free energy that he decided to hack NASA and the Pentagon which led to the “biggest military computer hack of all time,” although McKinnon himself states that he was merely looking for evidence of free energy suppression and a cover-up of UFO activity and other technologies potentially useful to the public.
● Gary hacked & infiltrated 97 computers of NASA & US military by installing a virus and deleting a few files. He did all this by sitting in her girlfriend’s aunt’s house in London, under the hacker name “Solo”. He also left a message on their system saying “Your Security Is Crap” mocking US Cyber Defense.
● After this crime apparently there would be 70 years of prison, but he did not face this sentence. Since he lived under British jurisdiction and committed a crime over US so it required the Britishto hand him over to them, but when McKinnon’s story became public, he had a large support group that opposed his extradition and began collecting money for legal costs for him. Finally on 16 October, 2012, after a series of legal proceedings in Britain, Home Secretary Theresa May blocked extradition to the United States.
● So even after doing all this, at the end what information did Gary acquire? Well most of the information was promised not to disclose, we still can get information on there from some of his statements.
● Among the sensational information, McKinnon found in the Pentagon files was information about “extraterrestrial officers”, “contacts between fleets” and a secret program called the Solar Warden. Apparently, the US military had a secret battalion in space that was used by the United States Naval Network and Space Operations Command (NNSOC). About 300 military personnel were involved in this program. Finally this confusion was cleared by Gary in his statement “I also found a list of officers in the” Officers who do not work on Earth “section. This does not mean that this is a list of aliens, but it is the fact that they do not work on our planet. They served a fleet that did not consist of ships of the US Navy, but from spaceships far from our planet.”
● So this was the case of Gary McKinnon, where you can literally state “curiosity killed the cat”.
3. Adrian Lamo : Adrian Lamo is one of the most famous borderline ethical hacker. He was also known as the “Homeless Hacker” for his reportedly transient lifestyle. He did hack different companies, but instead of getting monetary gains by using them as leverage, he used to “professionally humiliate” them, making them rethink how secure they are.
● Adrian Lamo was an American threat analyst & hacker born in February 20,1981. From hacking his way into the most prestigious companies while living out of a backpack to being called a “snitch” from the hacker community, Adrian was a highly controversial figure in the hacking world.
● In December, 2001 Lamo was praised by WorldCom for helping them find flaws in their system. In February,2002 Adrian successfully hacked The New York Times, added his name to an internal database of expert sources, angered by which The New York Times filed a complaint, and a warrant for Lamo’s arrest was issued in August 2003 following a 15-month investigation by federal prosecutors in New York. On September 9, he surrendered to the US Marshals in California. He re-surrendered to the FBI in New York City on September 11, and pleaded guilty to one felony count of computer crimes against Microsoft, LexisNexis, and The New York Times on January 8, 2004.
● Adrian was sentenced to two years’ probation, with six months in home detention, and ordered to pay a fine of $65,000 in restitution and also was convicted of compromising security at The New York Times, Microsoft, Yahoo!, and WorldCom.
● Well from the above scenarios we get to know one thing even if it is for “Professional Humiliation” or for money or fame, both are considered the same when it comes to out-of-bound hacking and the same legal charges are pressed whatsoever. So his story does give us a sweet reminder of the need to stay within the boundaries of ethical hacking. As a bug hunter, nowadays I have experienced many companies take bug reports, fix them and never respond or reward as they mention in their policy, so many turn to black hat by finding ways to compromise the company and make them pay for what they did. But at the end the law would be on their side and you would end up paying legal charges. So it is better to steer clear and stay safe, but I do hope that some laws also come in place to charge companies like this.
● Eitherway, coming back to Adrian, I remember his one interview, in which he said that the passwords of even big big million dollar companies are simple dictionary passwords like animal name, place name ,verbs, etc. Even after investing millions of dollars in the security of their company, if they can’t even keep their company safe , then they really need to reconsider what is more dangerous, an outsider threat or their own foolishness. Well after his many exploits by finding simple dictionary passwords to compromise big companies, many companies changed their password to a pretty strong unique ones, but still to the date there are many companies who work on simple passwords like admin:admin, my only hope is that they learn to reconsider this, at least not by a hard way.
● Lamo died on March 14, 2018, at the age of 37.
4. Albert Gonzalez : Albert Gonzales also known as the hacker who double crossed US Government is one of the famous to the core black hat hacker, engrossed in doing illegal activities. While all other names in my list consist of people who turned a good leaf and got fame and money through it after being caught and serving their time, Albert isn’t one of them.
● Albert Gonzalez is an American computer hacker and computer criminal born in 1981. Albert’s love for computers increased when he was in his highschool years, where he was leader of a group of computer nerds, who used to spend most of their time hacking. He was at that time already considered as Alpha in this community and was respected for his knowledge of computers, During highschool at the age 14 he hacked NASA, which resulted in a visit by FBI agent to his house. His starting exploits were buying clothes and cds online with stolen credit card numbers. But aside from this he also managed to hack into Indian Government Service and as a result of this he was told to stay away from computers for six months by the authorities.
● As he grew up, he also couldn’t escape the allure of money, and realised he could earn much more money by his talents rather than doing the petty theft and frauds like he used to do in high school. So he joined a group of hackers called “ShadowCrew”, while all other big hacking groups were also said to be doing good to this world by their skills, this particular group was nasty and full of people involved in doing any kind of crime. They were involved in computer crimes, identity theft, stolen credit cards and much more. They even have a website through which no user can be tracked and there were different forums to contact any type of criminals and talk with them on their site. You can say, ShadowCrew website is the base of the “dark web” we know today.
● In 2003, he was caught for making fortunate ATM withdrawals in New York, during investigation the secret service came to know that he was a part of ShadowCrew , which they were trying to catch for a while. So as a part of a deal, Albert agreed to work with the secret service and justice department to take them down. Albert convinced the members of ShadowCrew to communicate through a VPN, which was already wiretapped by the secret service which helped the secret service to monitor the crew. It took over 18 months, but the secret service was able to catch more than 20 people in the group. After this operation, Albert continued to work for the secret service as an informant and was paid 75,000$ per year.
● Now you might think that the story of Albert Gonzales ends here, but no, from here it will get only more interesting. Even though Albert now worked for the secret service earning good money, he was still conducting criminal activities and the secret service wasn’t even aware of that. It was during this time only that he committed his biggest hack by hacking into TJX companies in which 45.6 million credit & debit cards were stolen over an 18 month period, he also hacked Office Max, Boston Market, Barnes Noble, sport’s authority. The Secret Service didn’t even know the civic guy they were chasing for these crimes was right under their nose. Well while researching for his story and reading this, it did remind me of an anime I saw some years back called Death Note. It was pretty interesting and a bit similar to this case in the aspect of “working right under the nose” , but I never guessed something would also have happened in real life.
● But, as all things come to an end, so did this. In May 2008, Albert was caught hacking into Dave & Busters corporate network from a point of sale location at a restaurant in Islandia, New York. The incident occurred in September 2007. About 5,000 card numbers were stolen. Fraudulent transactions totaling $600,000 were reported on 675 of the cards.
● Authorities became suspicious after the conspirators kept returning to the restaurant to reintroduce their hack, because it would not restart after the company computers shut down. Finally Albert was arrested in room 1508 at the National Hotel in Miami Beach, Florida. In various related raids, authorities seized $1.6 million in cash (including $1.1 million buried in plastic bags in a three-foot drum in his parents’ backyard), his laptops and a compact Glock pistol. Officials said that, at the time of his arrest, Gonzalez lived in a nondescript house in Miami. He was taken to the Metropolitan Detention Center in Brooklyn, where he was indicted in the Heartland attacks. Due to the severity of his crime, finally he was sentenced to 20 years in prison and scheduled to be released on 4th December, 2025.
5. Astra : Astra is one of the hackers who has been able to stay as anonymous as possible about his whereabouts, his deeds nowadays and a true mystery.
● Astra has been famous for his biggest hack in which he gained access to a French aviation company Dassault Group computers, stealing weapons technology data for more than five years. Astra sold information about jet fighters and military aircrafts to countries and on the dark web to 250 different people. during the period spanning the hacks. Astra’s infiltration of Dassault computers apparently cost the company more than $360 million.
● An interesting thing is that Astra is never identified, but is described by authorities as a 58-year old Greek mathematician. He was caught in January 2008 and was sentenced to six years in jail. Some say that this might be a cover up, some say he might be working with the European government now to catch other hackers, but in the end no one really knows about reality, which made him an interesting hacker to be added into this list.
➔ My Favourite : So from all of the hackers I have listed, I found “Gary McKinnon” to be my favourite hacker of them all. As growing up I was immensely interested in Space, aliens, universe, etc, well still am. I also have been curious after seeing many different conspiracy theories about the work on Area 51 , UFO cover ups, etc. This hacker also had same curiosity as me, but what made him different from all is that many hackers do black hat hacking for the sake of money, fame and even some for the curiosity of computers working, but Gary is the first guy who hacked a government just for the curiosity of space and hidden technology and documents of Area 51 and alien visitors. As far as I know this might be the most unique reason why someone has hacked a government institution on such a big scale. It does require great skills and guts to hack a government institution by simply sitting casually on a normal modem router.
➔ References:
https://www.youtube.com/watch?v=Qe73tRTksf0
https://www.youtube.com/watch?v=zUKcg6Kwsvk
https://www.planet-today.com/2021/04/gary-mckinnon-man-who-hacked-nasa-and.html
https://en.wikipedia.org/wiki/Gary_McKinnon
https://freakydodo.medium.com/andrian-lamo-homeless-hacker-scriptkiddie-stories-ba64e7cae586
https://en.wikipedia.org/wiki/Adrian_Lamo
https://www.youtube.com/watch?v=sGTYyltYi80
https://en.wikipedia.org/wiki/Albert_Gonzalez#Arrest
Part-2: Top 3 Favourite Hacker Groups
- Anonymous : Of course, if we are talking about famous hacker groups and Anonymous isn’t mentioned, that isn’t possible. This is one of the most famous and widely supported hacker group.
● Anonymous is a “decentralized” international activist/hacktivist collective and movement widely known for its various cyberattacks against several governments, government institutions and government agencies. Anonymous members also known as anons can be distinguished in public by the wearing of “Guy Fawkes masks” in the style portrayed in the graphic novel and film “V for Vendetta”, which was about a guy wearing this mask fighting facist white government supremacy. Some anons also opt to mask their voices through voice changers or text-to-speech programs.
● Anonymous is believed to have started in 2003 on the imageboard website “4chan” representing the concept of many online and offline community users simultaneously existing as an anarchic, digitized global brain or hive mind.They became famous for their hack on the Church of Scientology in 2008. They unleashed a chain of cyberattacks on the Church of Scientology when they sought to delete a controversial video of famous film star Tom Cruise speaking about his religious beliefs.
● Some of the famous hacks by Anonymous are, the Sony Network outage in April, 2011, when Sony decided to take George Hotz to court for creating software that allowed PlayStation owners to run homemade software on their consoles. Over 77 million registered PlayStation Network accounts were hacked, which was considered as the largest data security breaches in history.
● “Operation Payback” in December, 2010, in which Anonymous declared war on Visa, Mastercard, and Paypal for refusing business with WikiLeaks. The anonymous hacker shut down their system server and froze the website account. Afterward, the biggest companies like- Visa and Mastercard sites were also taken down by anonymous.
● “Bank of America E-mail Drop in March, 2011. Anonymous leaked emails of bank employees on bankofamericasucks.com. In an effort to expose the Bank of America’s alleged corrupt and unfair mortgage practices.
● Well this is one of the influential group, who works as a vigilante to make the world more secure for people.
2. The Level Seven Crew : The “Level Seven Crew”, also known as Level Seven, Level 7 or L7, was a hacking group during the mid to late 1990s and was noted in Attritions Top 20 most active groups of all time by claiming responsibility for over 60 unauthorized penetrations of computer systems in 1999 alone.
● Thought to have been derived from Dante Alighieri’s poem, “The Inferno”. The group called themselves Level Seven after the seventh level of hell, the violent.THE YEMENI GHOST. Their method of cyberattacks mainly consisted of web defacement and the quote used in defacement was “il livello sette posidare la vostra famiglia”, which loosely translated from Italian says, “Level Seven owns your family”. The group was also associated with other high-profile hacking groups such as Global Hell and Hacking For Girliez.
● Level Seven typifies a group of hackers who exploit or attack computers and networks for more than just the thrill and challenge, and for reasons other than money. During their era, they were activists, and they used their computer skills to make political statements and protest actions by government and industry. Thus, they bridged the realms of hacking and activism, operating in a domain that is now called “hacktivism”.
● This group claimed responsibility for over 60 unauthorized penetrations of computer systems in 2020 alone, including The First American National Bank, The Federal Geographic Data Committee, NASA and Sheraton Hotels. However, the group is most widely known for the September 7, 1999 defacement of (The US Embassy in China’s Website), in regards to the 1998 U.S. embassy bombings.
● Level Seven is also credited with being the first group to hack a .ma domain and server located in Morocco. The server was owned by the Faculté des Sciences Semlalia, Marrakech.
3. Syrian Electronic Army : Unlike all other hacking groups discussed in this list, who work on their free will or for fun, this is a group which is mostly known for their affiliation with a government body and work on their command.
● The Syrian Electronic Army is a group of computer hackers which first surfaced online in 2011 to support the government of Syrian President Bashar al-Assad. In the 1990s Syrian President Bashar al-Assad headed the Syrian Computer Society, which is connected to the SEA, according to research by University of Toronto and University of Cambridge, UK. In February 2011, after years of Internet censorship, Syrian censors lifted a ban on Facebook and YouTube. In April 2011, only days after anti-regime protests escalated in Syria, Syrian Electronic Army emerged on Facebook. On May 5, 2011 the Syrian Computer Society registered SEA’s website (syrian-es.com). Because Syria’s domain registration authority registered the hacker site, some security experts have written that the group was “supervised by the Syrian state”.
● Their methods of cyberattacks are mainly using spamming, website defacement, malware, phishing, and denial-of-service attacks, through which they have attacked terrorist organizations, political opposition groups, western news outlets, human rights groups and websites that are seemingly neutral to the Syrian conflict. It has also hacked government websites in the Middle East and Europe, as well as US defense contractors. As of 2011 the SEA has been “the first Arab country to have a public Internet Army hosted on its national networks to openly launch cyber attacks on its enemies”. But no one truly knows the true nature of Syrian Electronic Army with the Syrian’s government.
● Their famous attacks were, spamming popular Facebook pages with pro-regime comments: The Facebook pages of President Barack Obama and former French President Nicolas Sarkozy have been targeted by such spam campaigns. They once posted White House has been bombed and that President Barack Obama was injured. This post resulted in a noticeable impact on the DOW Jones and S&P 500 index which had a loss of around 136.5 billion dollars.
● They did website defacement and electronic surveillance against Syrian rebels and other opposition: The SEA has carried out surveillance to discover the identities and location of Syrian rebels, using malwares like blackworm tool, phishing, and denial of service attacks.
● They also did defacement attacks against Western websites that it contends spread news hostile to the Syrian government: These have included news websites such as BBC News, the Associated Press, National Public Radio, CBC News, Al Jazeera, Financial Times, The Daily Telegraph, The Washington Post, Syrian satellite broadcaster Orient TV, and Dubai-based al-Arabia TV, as well as rights organizations such as Human Rights Watch. SEA targets include VoIP apps, such as Viber and Tango.
➔ My Favourite Hacker Group : My favourite group is “Anonymous”, well why not, they are one of the influential good doing black hat hackers who work for maintaining peace and oppose oppression by the government. They have been said to have given a helping hand in many protests and mainly living in a world like this, where even the higher up officials of an institution are corrupt, only vigilantes like Anonymous can keep them in check. And the fact that they have still not got caught by the government and stay true on their word for a hack is truly impressive. They also played a huge role in the recent protest of George Flyod, who was a balck man and was killed by a white police officer, which resulted in racial tensions and protest, not only in the US but also all over the world.
➔ References: https://en.wikipedia.org/wiki/Anonymous_(hacker_group)
https://www.deepweb-sites.com/10-best-hacks-by-anonymous/
https://en.google-info.org/2519015/1/level-seven-hacking-group.hml
https://en.wikipedia.org/wiki/Syrian_Electronic_Army
Part-3: Top 5 Favourite Cyber Attacks
1. World Health Organization :
● On April 19, some 25,000 email addresses and passwords were leaked online belonging to several groups working to fight the coronavirus pandemic, including the WHO, NIH, the US Centers for Disease Control and Prevention (CDC), and the Gates Foundation. Among the cybersecurity incidents so far in 2020, stealing data from important organizations who are fighting the COVID-19 pandemic is particularly shocking.
● The leaked credentials did not put WHO systems at risk because the data was not recent. However, the attack did impact an older extranet system, used by current and retired staff as well as partners.
● WHO is working with the private sector to establish more robust internal systems and to strengthen security measures and is educating staff on cybersecurity risks.
2. Mobikwik Data Breach :
● Mobikwik is one of the famous digital payment platforms, which on March 26, 2021 faced one of the largest data breaches in its history. An independent cyber security researcher Rajshekhar Rajaharia informed News18 about a massive data dump on the dark web.
● The researcher, who had previously alleged a direct data breach from one of Mobikwik’s servers to have revealed personal and sensitive data of almost 11 crore users earlier in March, shared proof of the Mobikwik data breach that was, and still is, live in a database on the dark web. Hackers who have seemingly exploited the Mobikwik data breach was reportedly selling it for 1.5 BTC (approx. Rs 63.7 lakh) — which is not a lot of money for a data trove of such scale.
● Initially the authorities denied the breach, and was criticized by many cyber security professionals. At the end they had to accept and take responsibility.
3. Jonathan James’ NASA & USDOD Hack :
● Jonathan is one of the youngest hackers to hack into NASA and the US Department of Defense. At the age of 15, he had managed to penetrate the computers of a US Department of Defense division and installed a ‘backdoor’ on its servers. This allowed him to intercept thousands of internal emails from different government organisations including ones containing usernames and passwords for various military computers.
● By using the stolen information, James was able to steal a piece of NASA software. According to NASA, “the software [purported to be worth $1.7 million] supported the International Space Station’s physical environment, including control of the temperature and humidity within the living space.” loss of which cost the space exploration agency $41,000 as systems were shut down for three weeks.
● James was later caught but received a light sentence due to his young age.
4. 2008 Attack on Church of Scientology :
● We have heard many attacks on the Church of Scientology due to their attempts to obstruct the freedom of speech for religion and aggressively promote their own beliefs for the same.
● In January 2008, a New Jersey teenager along with a gang of hackers launched a DDoS attack that crippled the Church of Scientology website for several days.
● Dmitriy Guzner, who was 19 years old, was charged and convicted for the DDoS attack. The maximum penalty was 10 years prison and a $250,000 fine but he was ultimately sentenced to two years probation and was ordered to pay the Church of Scientology $37,500.
5. Kevin Poulsen’s Hack for Porsche :
● In our life, we all have wished to own a nice car like Porsche, but how many have hacked to get it? Kevin Poulsen a former computer hacker, best known for hack involved penetrating telephone company computers in the early 1990s to win radio station phone-in contests.
● LA KIIS FM was offering a Porsche 944 S2 Cabriolet to the 102th caller. Poulsen guaranteed his success as he took control of the phone network and effectively blocked incoming calls to the radio station’s number.
➔ My Favourite : Well, from the above list, I would say my favourite hack would be “Mobikwik data breach”. Many Indian companies don’t bother to invest much in cybersecurity, and consider it a waste of money, while as a bug hunter I have also faced that many Indian companies take reports , fix them and don’t pay or respond to the researcher. Now this breach would definitely be an eye opener for Indian companies about the importance of cybersecurity and the need to pay a security professional to secure them. After this breach there has definitely been a boom of Indian companies wanting to secure their systems and are ready to pay.
➔ References: https://www.who.int/news/item/23-04-2020-who-reports-fivefold-increase-in-cyber-attacks-urges-vigilance
Part-4 : Interesting 5 Cybersecurity Related Quotes :
1. “Digital freedom stops where that of users begins… Nowadays, digital evolution must no longer be offered to a customer in trade-off between privacy and security. Privacy is not for sale, it’s a valuable asset to protect.”
― Stephane Nappo
2. “Toughen up cupcake, the Prince of Nigeria is sad too; no one falls for his emails anymore.”
– Anonymous
3. “Will my smart fridge tell my mother about my chocolate cake addiction?”
– Anonymous
4. “For me personally, cloud security isn’t a worry. My data is such a mess that no one would find anything anyway.”
– Anonymous
5. “If you think that patience is a virtue, try running a business without high-speed internet.”
– Anonymous
➔ References:
https://www.goodreads.com/quotes/tag/cyber-security
This is all for today’s writeup.
Thanks For Reading 😊
Profile Links:
Twitter: https://twitter.com/SAPT01
LinkedIn: https://www.linkedin.com/in/prajit-sindhkar-3563b71a6/
Instagram: https://instagram.com/prajit_01?utm_medium=copy_link
BUG XS Official Website: https://www.bugxs.co/
