Can Anonymous Be Stopped?

Anonymous, the elusive hacker movement, thinks of itself as a kind of self-appointed immune system for the Internet, striking back at anyone the group perceives as an enemy of freedom, online or offl ine. Anonymous fi rst gained widespread notoriety when it staged an attack against the Church of Scientology in 2008. In the ensuing years it has carried out hundreds of cyberstrikes. One particularly controversial attack was directed against the Vatican in August 2011. The campaign against the Vatican involved hundreds of people, some of whom possessed hacking skills and some who did not.

A core group of participants openly encouraged support for the attack using YouTube, Twitter, and Facebook. Other activists searched for vulnerabilities on the Vatican Web site. When those efforts failed, Anonymous enlisted amateur recruits to fl ood the site with traffi c, hoping to cause it to crash. The attack, even though it was unsuccessful, provides insight into the recruiting, reconnaissance, and warfare tactics that Anonymous employs. The Vatican attack was initially organized by hackers in South America and Mexico before it spread to other countries. It was timed to coincide with Pope Benedict XVI's visit to Madrid in August 2011 for World Youth Day. Hackers fi rst tried to take down a Web site that the Catholic Church had set up to promote the pope's visit, handle registrations, and sell merchandise. Anonymous's goal- according to YouTube messages delivered by an Anonymous spokesperson-was to disrupt the event. The YouTube videos that were posted included a verbal attack on the pope.

One video even called on volunteers to "prepare your weapons, my dear brothers for this August 17th to Sunday August 21st, we will drop anger over the Vatican." The hackers spent weeks spreading their message via their own Web site as well as social media sites such as Twitter and Flickr. Their Facebook page called on volunteers to download free attack software while imploring them to "stop child abuse" by joining the cause. This message featured split-screen images of the pope seated on a gilded throne on one side and starving African children on the other. It also linked to articles about abuse cases and blog posts itemizing the church's assets. It took 18 days for the hackers to recruit enough people to launch their attack. Then, the reconnaissance phase of the mission began. A core group of approximately 12 skilled hackers spent three days poking around the church's World Youth Day Web site, looking for common security holes that could let them inside. Probing for such loopholes used to be tedious and slow, but the emergence of automated scanning software to locate security weaknesses has made the process much simpler and quicker. In this case, the scanning software failed to turn up any vulnerabilities. So, the hackers turned to a distributed denial-of-service (DDoS) attack that clogs a Web site with data requests until it crashes. Even unskilled supporters could take part in this attack from their computers or smartphonesOver the course of the campaign's final two days, Anonymous enlisted as many as a thousand people. In some cases it encouraged them to download attack software. In other instances it directed them to custom-built Web sites that allowed them to participate in the campaign using their smartphones. Visiting a particular Web address caused the phones to instantly start flooding the target Web site with hundreds of data requests each second, without requiring any special software.

On the first day of the DDoS, the Church site experienced 28 times its normal amount of traffic, increasing to 34 times on the following day. Hackers involved in the attack, who did not identify themselves, stated via Twitter that the two-day effort succeeded in slowing down the Web site's performance and making the page unavailable in several countries. Imperva (www.imperva.com), the firm hired by the Vatican to counter the attack, denied that the site's performance was affected. Imperva asserted that the company's technologies had successfully defended the site against the attack and that the Vatican's defenses held strong because it had invested in the infrastructure needed to repel cyber attacks. Following this unsuccessful attack, Anonymous moved on to other targets, including an unofficial site about the pope, which the hackers were briefly able to deface. Hacker movements such as Anonymous are now able to attract widespread membership through the Internet. They represent a serious threat to Web sites and organizations. Unknown to the members of Anonymous, the FBI had arrested one of the group's leaders in 2011. He had continued his hacking activities while being monitored by the agency, which had been gathering information needed to identify members of Anonymous. In a series of arrests in the summer of 2012, authorities around the world arrested more than100 alleged group members. It is impossible to say if the arrests will shut down, or even seriously inconvenience, Anonymous. The group claims is that it is not organized and it has no leaders. The possibility that Anonymous cannot be shut down by arresting key participants concerns powerful institutions worldwide. Meanwhile, Anonymous is continuing its activities. In February 2013, the group posted the phone numbers, computer login information, and other personal information of more than 4,000 bank executives on a government Web site. In that same month it threatened a massive WikiLeaks-style exposure of U. S. government secrets. The group announced details of their plan on a hacked government Web site, the U.S. Sentencing Commission (www .ussc.gov).

Questions

1. Describe the various components of Anonymous's attack on the Vatican. Which aspects of the attack are of most concern to security companies?

2. Will the arrest of key members of Anonymous shut down the group? Decrease the effectiveness of the group? Why or why not? Support your answer.

3. Debate the following statement: Anonymous provides necessary oversight of harmful activities by organizations and government agencies.