# Did anonymous make that security firm (HBGary) look stupid? **URL:** \ **Category:** Factual Questions\ **Created:** [February 8, 2011, 8:04pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683 "2011-02-08T20:04:26Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [February 11, 2011, 7:31pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/21 "2011-02-11T19:31:38Z")
> [@Joey\_Tightlips](#): > > Great new Wired article about the saga [here](http://www.wired.com/threatlevel/2011/02/anonymous/?utm_source=twitterfeed&utm_medium=twitter). Much more details about the CEO guy who decided to stir up the Anon hornets nest in the first place and how he got royally owned. That is an awesome article. Thanks! And, I love the professionalism of those emails between the HBGary staff. They just seem like a bunch of unserious, ill-prepared bozos. ---
**Author:** ![Joey\_Tightlips](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@Joey\_Tightlips](https://boards.straightdope.com/u/Joey_Tightlips)\ **Post date:** [February 11, 2011, 8:07pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/22 "2011-02-11T20:07:26Z")
Yeah, when I stumbled across that article (before seeing this thread), I thought for sure it was some kind of joke, like it was too good to be true. I’d love to know what’s the deal with Barr and his personal coder. I can’t imagine saying some of the stuff the coder said to even my lowest level manager, let alone to the CEO of the company. Geez. ---
**Author:** ![TruCelt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/trucelt/32/523_2.png) [@TruCelt](https://boards.straightdope.com/u/TruCelt)\ **Post date:** [February 14, 2011, 3:07am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/23 "2011-02-14T03:07:43Z")
> [@](#): > > His programmer had doubts, saying that the scraping and linking work he was doing was of limited value and had no commercial prospects. As he wrote in an e-mail: > Step 1 : Gather all the data > Step 2 : ??? > Step 3 : Profit > But Barr was confident. “I will sell it,” he wrote. I loved that too. I wish I trusted my employees to be that honest with me. ---
**Author:** ![Rhythmdvl](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Rhythmdvl](https://boards.straightdope.com/u/Rhythmdvl)\ **Post date:** [February 14, 2011, 4:00am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/24 "2011-02-14T04:00:13Z")
> [@willthekittensurvive](#): > > made me think of this [comic](http://xkcd.com/834/) Heh. In reading above comments about fighting it, I thought of [this](http://xkcd.com/591/)one. > [@GiantRat](#): > > Hell, SQL isn’t exactly a new thing… and we’ve known about crap like dropping tables for 20+ years. …and then there’s [Little Bobby Tables](http://xkcd.com/327/). ---
**Author:** ![Rick](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@Rick](https://boards.straightdope.com/u/Rick)\ **Post date:** [February 14, 2011, 5:06am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/25 "2011-02-14T05:06:21Z")
> [@Joey\_Tightlips](#): > > Great new Wired article about the saga [here](http://www.wired.com/threatlevel/2011/02/anonymous/?utm_source=twitterfeed&utm_medium=twitter). Much more details about the CEO guy who decided to stir up the Anon hornets nest in the first place and how he got royally owned. After reading that article, I am reminded of a quote from that famous American Philosopher [Harry Callahan](http://www.imdb.com/title/tt0070355/) > [@](#): > > A mans got to know his limitations! ---
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [February 17, 2011, 4:26pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/26 "2011-02-17T16:26:16Z")
For anyone who’s still interested, [this article](http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars/) goes into much more detail on how the attack was carried out, step by step. The writer makes the same point that a couple of us in this thread made – namely, that HBGary made stupid mistakes and should have known better. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [February 17, 2011, 4:40pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/27 "2011-02-17T16:40:33Z")
The long and the short of it is that they didn’t use some kind of super-duper whizz-kid code hacks. They pretty much just exploited the laziness and/or stupidity of HBGary employees who didn’t bother to follow proper security protocols. ---
**Author:** ![panamajack](https://avatars.discourse-cdn.com/v4/letter/p/47e85d/32.png) [@panamajack](https://boards.straightdope.com/u/panamajack)\ **Post date:** [February 17, 2011, 4:57pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/28 "2011-02-17T16:57:49Z")
That “Wired” article is really an Ars Technica article (they’re both Conde Nast, so the distinction is a bit muddled, but they’ve been on the story with more depth). Here’s [yet another piece](http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when-aaron-barr-met-anonymous.ars)(older) that gets into the chat log details. For some reason I keep imagining this guy as Fisher Stevens. ---
**Author:** ![wheresmymind](https://avatars.discourse-cdn.com/v4/letter/w/91b2a8/32.png) [@wheresmymind](https://boards.straightdope.com/u/wheresmymind)\ **Post date:** [February 18, 2011, 12:23am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/29 "2011-02-18T00:23:48Z")
The more I read about this Aaron Barr (the above Wired/ars technica article, also [this](http://www.wired.com/threatlevel/2011/02/spy/all/1) one from Wired), the happier I am that he got pwned. After reading the linked Wired article, it seems his big idea was to charge companies $2 million per month to stalk their potential enemies on Facebook. He clearly thought of himself as some kind of super cyber-sleuth, when in reality he was basically using the same tactics used by 16-year-olds to get info on/pictures of their current crush. A favorite tactic of his was to FB-stalk CEOs of potential clients, then shock them with the info he was able to gather. One example in the linked article includes the person’s name, where they went to school, that they ran in a particular 5K race, and has a picture of his kids. But it didn’t take some $2 million per month super sleuthing outfit working around the clock to get that data; about 20 seconds with Google would probably be plenty. ---
**Author:** ![jackdavinci](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jackdavinci/32/3259_2.png) [@jackdavinci](https://boards.straightdope.com/u/jackdavinci)\ **Post date:** [February 18, 2011, 8:12am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/30 "2011-02-18T08:12:49Z")
As others have explained more lengthily, HBGary used a web platform that was easily hackable, and Anonymous was able to hack other stuff involving the same people because they didn’t bother using different passwords for other accounts. I don’t think Anonymous is as guerilla and faceless as others suggest though. HBGary claims to have figured out the identities of some of the major players. And personally, I don’t doubt that as much. Anonymous is largely based in 4chan, and it’s not unreasonable to think that while the mass of A is more or less random, the initiative for projects are on the whole started by a limited subset of that mass. On top of the fact that, if HBGary hadn’t struck a real nerve, why would Anonymous bother with such a retaliation? ---
**Author:** ![EvilTOJ](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@EvilTOJ](https://boards.straightdope.com/u/EvilTOJ)\ **Post date:** [February 18, 2011, 9:41am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/31 "2011-02-18T09:41:06Z")
For the lulz. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [February 18, 2011, 2:43pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/32 "2011-02-18T14:43:59Z")
> [@jackdavinci](#): > > On top of the fact that, if HBGary hadn’t struck a real nerve, why would Anonymous bother with such a retaliation? If HBGary _actually_ had identified the major players behind Anonymous, do you really think they’d fuck with them and take the risk of being exposed? ---
**Author:** ![joebuck20](https://avatars.discourse-cdn.com/v4/letter/j/74df32/32.png) [@joebuck20](https://boards.straightdope.com/u/joebuck20)\ **Post date:** [February 18, 2011, 7:39pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/33 "2011-02-18T19:39:54Z")
> [@panamajack](#): > > That “Wired” article is really an Ars Technica article (they’re both Conde Nast, so the distinction is a bit muddled, but they’ve been on the story with more depth). Here’s [yet another piece](http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when-aaron-barr-met-anonymous.ars)(older) that gets into the chat log details. > > For some reason I keep imagining this guy as Fisher Stevens. Wow, you want to talk about a dumbass move. Granted the news was already out, via the Financial Times, that Barr was investigating them. But for him to go on to their chat sites, to try to reason with and basically plead for them not to “get too aggressive” was only going to inflame them further and I’m stunned he didn’t realize that. I’m not saying the guy deserved to have his privacy invaded, but I can’t say feel too sorry for him. Also, I just love the [picture of Aaron Barr](http://www.switched.com/2011/02/11/aaron-barr-infiltrated-anonymous-how-and-why/) that keeps showing up in news stories about this. The man just screams douchebag. ---
**Author:** ![Gary\_Robson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gary_robson/32/3448_2.png) [@Gary\_Robson](https://boards.straightdope.com/u/Gary_Robson)\ **Post date:** [February 18, 2011, 8:40pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/34 "2011-02-18T20:40:33Z")
The details may be different, but the basic tactics and techniques Anonymous used are no different than what was going on 15 years ago. Buffer overruns, re-used passwords, social engineering, DDoS, hash table cracking; there’s absolutely nothing new, complicated, or fancy here. I wouldn’t think any less of Bob’s Pizza Company or Sue’s eBay Store for being taken down by this kind of attack, but an IT security company? That’s just flat-out pathetic. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [February 18, 2011, 8:55pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/35 "2011-02-18T20:55:36Z")
> [@jackdavinci](#): > > On top of the fact that, if HBGary hadn’t struck a real nerve, why would Anonymous bother with such a retaliation? Nerd rage. Underestimate it at your peril. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [February 18, 2011, 9:29pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/36 "2011-02-18T21:29:39Z")
> [@Whack-a-Mole](#): > > Nerd rage. > > Underestimate it at your peril. QFT just for example, if the dopers took on a combined effort to really screw with a company using the kinds of brainpower, time, access, and resources available to us as a group I would be willing to bet we could give decent sized company a bloody nose in some way shape or form. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [February 21, 2011, 1:28pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/37 "2011-02-21T13:28:08Z")
> [@si\_blakely](#): > > Well, maybe some members of Anonymous can do those things. But they released the [LOIC](http://en.wikipedia.org/wiki/LOIC)(Low Orbit Ion Cannon) DDOS tool, which does none of those things. Anyone who used it during the Wikileaks-triggered attacks (Operation Payback) on Visa, Amazon, etc was capable of being identified and a number of people in the UK and US have been arrested and charged. They also rely on co-operative DDOS attacks, but do not have anywhere near the coordinated capacity to hurt a big internet site (you need a coordinated botnet strike with hundreds of thousands of nodes to do any real damage these days). > > Si The way Anonymous is set up, if one person knows it, then Anonymous knows it. All it takes to be in Anonymous is to hack something that fits into Anonymous’s creed, and then say you are in Anonymous. It’s that loosely organized. Yes, that one guy actually did find an IRC that the founder uses, so there is some sort of communication. But the founder is no more the leader than anyone else. He said in that article (or another one I read) that he specifically wanted Anonymous to get out of his control. That said, I understand what you are getting at. I was over-sensationalizing it. It’s a bad habit I picked up a while back. But, still, the good hackers at least know how to execute everything remotely so they won’t get caught. It’s the noobs that are usually found. ---
**Author:** ![Rick](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@Rick](https://boards.straightdope.com/u/Rick)\ **Post date:** [March 31, 2011, 4:27am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/38 "2011-03-31T04:27:40Z")
Just saw an interesting article in business week on this whole affair. [Worth a read.](http://www.businessweek.com/magazine/content/11_12/b4220066790741.htm) ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [March 31, 2011, 7:52am UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/39 "2011-03-31T07:52:11Z")
> [@Paul\_in\_Qatar](#): > > Then we had what seems to have been a war waged by Russia by proxies on Lithuania. (Latvia?) Faceless attack on a nation. Estonia, where the Russian minority is mighty unpopular. If I remember correctly it was over the Estonians tearing down an old Soviet statue commemorating Russian fallen during the Great Patriotic War. I doubt that the Russian state was behind the attack though, several DDOSNets have their origins in the Russian Federation. ---
**Author:** ![MOIDALIZE](https://avatars.discourse-cdn.com/v4/letter/m/e274bd/32.png) [@MOIDALIZE](https://boards.straightdope.com/u/MOIDALIZE)\ **Post date:** [March 31, 2011, 3:45pm UTC](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683/40 "2011-03-31T15:45:34Z")
I love how it was the DOJ who recommended that Bank of America should hire the law firm that tapped HBGary to engage in cyber shenanigans against Wikileaks and critics of the Chamber of Commerce. Nuclear death for Washington, D.C. [Previous page](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683.md?page=1) [Next page](https://boards.straightdope.com/t/did-anonymous-make-that-security-firm-hbgary-look-stupid/570683.md?page=3)