Over the past week several big corporations, from MasterCard and Visa to PayPal and Amazon, have come under attack from loosely co-ordinated networks of hackers operating in support of WikiLeaks under the codename of Anonymous. But over the weekend of December 11 and 12, a new kind of victim fell foul of the hackers’ attentions — the hyper-fashionable, super-tech-savvy Gawker websites.
The 24-hour attack penetrated deep into Gawker’s computer systems, shattering its security shield and catching its executives off guard.
The hackers cracked more than a quarter of a million passwords in the website’s database, dumping the information on the internet, where it could easily be found — including the personal details of Gawker’s British founder and mastermind, Nick Denton.
“We understand how important trust is on the internet, and we’re deeply sorry for and embarrassed about this breach of security — and of trust,” a contrite Gawker management said, admitting that the integrity of all its nine sites had been compromised.
Within hours of the attack being launched on Saturday the assailants had gained access to Gawker’s database of usernames and passwords as well as the programs that are used to serve up the sites, known as their source code. The first sign of the attack was a tweet posted to the Twitter account of the Gawker gadget site, Gizmodo, which said “Support WikiLeaks” and added “Gawker.com hacked, 1.5 million usernames/emails/passwords taken.” The use of Gawker’s own Twitter feed by the hackers to announce their ploy was a breathtaking act of defiance.
Even more audaciously, they then went on to post real-time email exchanges between Gawker staffers that they had hacked into, in which the employees discussed how they were coming under attack.
The attack took the recent flurry of mass hacking escapades into new territory. Previous corporate targets such as PayPal and MasterCard have been selected for their failure to support WikiLeaks as part of the so-called Operation Payback launched by fans of the whistleblower site.
Gawker by contrast has had no special involvement in the WikiLeaks events and appears to have been singled out more for its past tussles with the hacking fraternity than for anything to do with its reporting of the embassy cables.
The cyber attack was claimed by a previously unknown group of hackers going by the name of Gnosis.
In an email exchange with the website Mediaite, one of its members said it had attacked Gawker because it wanted to expose the “outright arrogance” of Gawker’s management by highlighting the site’s inadequate security. “Gawkmedia has possibly the worst security I have ever seen. It is scary how poor it is,” the correspondent said. The complaint of arrogance appears to have been a reference to a feud that has been running for more than a year between Gawker and 4Chan, an image board frequently used by hackers, including those who orchestrated the Anonymous pro-WikiLeaks attacks over the past 10 days.
A sub-board on 4Chan, known as /b/, acts as a meeting house for some of the most dedicated hackers.
Among its many actions was the memorable prank in which it hijacked an internet poll asking fans of the teenage pop star Justin Bieber to decide which country he should tour next. 4Chaners latched on to the vote and swamped it, pushing North Korea into prime position.
The image board has been the subject of regular posts on Gawker written in the site’s trademark snarky and forthright style. Gawker has called 4Chan the “ground zero for internet mischief”, “[home of] the internet’s worst trolls”, and likened the experience of reading it to consuming “heroin mixed with fibreglass”.
Last July, Gawker accused the wholly anonymous frequenters of 4Chan of hounding an 11-year-old girl so ferociously that she required police protection.
Within hours 4Chan hit back, organising a group attack on Gawker that succeeded in slowing, though not bringing down, the site.
“Hows this for ‘script kids?’
Denton in turn ramped up the war by calling his assailants “script kiddies”, ridiculing them as “3Chan” and goading them with the combative words: “The best response to dumb young guys trying to intimidate their enemies online is to refuse to be intimidated. If any of you sad 4chaners have a problem with that, you know how to reach me.” It took five months but it seems that the “sad 4chaners” have now indeed reached Denton, with a vengeance. Though the Gnosis correspondent denied any formal link with 4Chan, it is clear that Gawker’s sustained and critical coverage of the image board was an important motive for the cyber attack.
In the 500MB file the hackers placed on the file-sharing system BitTorrent, containing the information hacked out of Gawker’s database, the attackers left a clear reference to Denton’s earlier challenge. They wrote: “Hows this for ‘script kids?’ Your empire has been compromised ... You wanted attention, well guess what, You’ve got it now!” The attackers also posted snippets from email exchanges between Gawker staff reporters that they stole, having broken into Gawker’s private back channel. Several of the emails referred to 4Chan, with Gawker staffers composing joke headlines such as “We Are Not Scared of 4chan Here” and “Nick Denton Says Bring It On 4Chan”.
In the wake of the attack, Gawker has brought in an independent security company to vamp up its protection. Denton is keeping uncharacteristically silent about 4Chan, though nobody expects his restraint to last for long.
Copyright: Guardian News & Media 2010
