What will happen to the Lizard Squad hackers ?

Lizard Friends

When the UK police arrested an 18-year-old man over the online attack in December that knocked both the XBox Live and PlayStation Network offline, plenty of people raised knowing eyebrows.

On Twitter, the chatter was that the person arrested was someone known as “Jordie”, whose profile picture – and occasional tweets - suggests a black teenager from Rio de Janiero’s favelas, rather than the resident of Southport that the arrest (and his other tweets) reveals him to be.

Among those who follow hacker culture, the arrest had only been a matter of time. Those observers see it as inevitable that Lizard Squad will follow what is now a standard narrative arc: burst to prominence, hack something, hack something bigger, until someone makes a mistake that leads to one or more members being arrested. Court cases will follow, the gang will break up, and the members will quietly fade from view with only their search history linking them to what happened.

Examples going back through three decades of hacking show this arc repeated again and again. Kevin Mitnick became famous in the 1990s for stealing the source code for various computer systems; he went on the run, and then was caught, and served time in jail. Now he’s a successful security consultant.

In 1994, a group of people, mostly in their twenties, were indicted for stealing credit card numbers. Now they’re living apparently regular, suburban lives.

In 1995 I met a hacker calling himself “Coldfire”, who explained to me how some business phone exchanges could be used to make cheap calls internationally. From time to time Coldfire (I never knew his real name, though we met in person) got in touch. Then he told me he’d been arrested and bailed. Then, nothing.

Fast forward about 20 years, and LulzSec coalesced out of Anonymous, hacked some games sites, hacked some bigger sites – including the Serious Organised Crime Agency – and then were arrested. After what seemed an age for the legal process, some served sentences; now they’re getting on with life outside hacking. Two British ex-LulzSec members, Jake “Topiary” Davis and Mustafa “Tflow” al-Bassam, are quietly engaged with legitimate work – or in al-Bassam’s case, university studies. (Both declined to be interviewed.)

“LizardSquad reminds me of LulzSec,” says Mikko Hypponen, chief research officer at F-Secure, who has watched malware wash back and forth across the internet for years, and hacker groups rise and fall. “High-profile antics, surprisingly effective attacks, and shortlived – which LizardSquad will be, no doubt.”

There’s nothing to suggest Lizard Squad is any different from scores of hacker groups that have preceded it. So if its demise is certain (even if the timing isn’t), what is different about hacker culture now – and how is it changing?


Every hacking crew starts through people meeting; in the 1970s through to the rise of the internet in the 1990s, it used to be through physical acquaintance. Steve Jobs and Steve Wozniak used to be “phone phreaks”, who would use “blue boxes” to make long-distance (often prank) calls for free. By the 1990s, groups such as 2600 (its name refers to a blue box frequency) held meetings in cities; Coldfire told me he first learnt about phone hacking through a 2600 city meet. But the rise of the internet over the past 20 years means that would-be hackers don’t have to physically meet up; they can get in touch over the net.

What’s more, the sources of inspiration to become a hacker has changed, explains Gabriella Coleman, a media studies professor (and trained anthropologist) at McGill University in Montreal. Coleman has spent years documenting the hacker culture, and written a book “Hacker, Hoaxer, Whistleblower, Spy: the many faces of Anonymous” which delves into the underground world of the hacking collective.

What most people call “hacking”, she more carefully defines as “transgressive hacking”, emphasising the idea that it violates our norms of ownership and control. She has studied hacking culture – which in her definition includes the creation of open-source tools and messing around with code for political ends – for around 15 years. “I’ve spoken to hackers who first saw War Games [from 1983] as a kid and asked for a modem for a Christmas present. The difference now is that these are actual hacker groups on Twitter and so on, rather than a representation. But just like with films and articles, this is a way more hackers are produced. While more elite hackers may frown upon [Lizard Squad] as ”skiddies” [”script kiddies”, who use others’ instructions to carry out hacks], even so young people are interested in it,” she told me.

“What has been interesting to track is the diversification of communities that have sprung up around the moniker ‘hacker’: open source, crypto, gray hat, hacktivism, security hackers, subversive hacking, black hat criminal hacking,” she says. Some old-school hackers are almost appalled at the idea of using Twitter; in the past, it was an underground activity, and treated like Fight Club: the first rule was you didn’t talk about it.

“The rise of activist groups and then hacker crews like A-Team, Panthers, Lulzsec, Antisec, and Lizard Squad have undoubtedly brought the idea/ethos/style of hacking to larger swathes of the population, and it does make it attractive,” Coleman says.

Some criminal hacking is never visible to the ordinary public, such as theft of source code for games and apps from corporate systems in order to sell them on black markets. Credit card fraud, known as “carding”, is commonplace too. Only when those involved come to court do we hear about them. By contrast the activities of younger hackers tend to be far more visible. And that’s often how they want it.

“Now what is different is that anyone can interact with hackers via Twitter, and this is a big change from the past, where you had to have a bit more skill to find them,” says Coleman, who says she hadn’t grasped the significance of social media previously.

‘It has never been easier to start hacking’

How does a hacking crew form? Brian Krebs, a former Washington Post reporter who now works as a security researcher and journalist, and has infiltrated a number of underground carding forums as well as broken stories about serious hacks of US retailers, suggests that hacking is not just more visible.

“It’s never been easier for people who know next to nothing about hacking and attacking others online to get started and to appear far more skilled than they are; the widespread availability of point-and-click hacking tools dramatically lowers the barriers of entry to many types of cybercrime, from hacking websites and databases to creating botnets and launching massively disruptive denial-of-service attacks,” he says.

“Worse yet, for those novices who can’t be bothered to learn how to use these beginner-friendly point-and-click tools, there is a robust community on underground forums that will help you set all of it up, albeit for a fee.”

But there’s one way in which what Coleman calls “transgressive hackers” – and hacking crews – differ from other hacking areas, and the rest of life: the absence of women. “When giving talks about Anonymous, I often remind my audience that while there are women participants, some of them geeky and technical, when it came to the hacker crews they were composed exclusively of men. The audience gasps. Then I remind them that this is not unique to Anonymous but mirrors the transgressive hacker tradition since its inception in phreaking,” she says.

“In 15 years I have never met a black hat female with the exception of two who are transgender.”

Downtime and neecessary enemies

Getting everything in place for a hacking attack takes time; even once a target has been identified and chosen, it is like an assault on a castle, where a frontal assault is unlikely to yield any benefit.

In the case of the attack on the Malaysia Airlines website in January, Lizard Squad appears not to have broken into the site itself – but instead used a DNS redirect, hacking the system that would route a request to go to malaysiaairlines.com to a different site they had set up. Anyone who entered login details to the fake site had effectively given them to the hackers, who could then log in to the real site and gather users’ details from there. If any of those who logged in had elevated privileges on the site, the effect could be disastrous.

Such DNS hacking resembles phishing; but it’s a matter of debate among hackers whether using it demonstrates skill or not. Some DNS hacks involve “social engineering” – fooling an administrator with a fake email to change a setting – while others might require sophisticated hacking that usurps a machine. It’s not known which method Lizard Squad employed.

But whereas before Twitter it was possible to just go quiet and then come back, these days everything is public, says Coleman. “A lot of these activities online have been like a tournament of sorts,” she says. “Hackers have always tried to outdo each other, but now the game has been ratcheted up. Now it’s about media attention. ” However, as she points out, “the more public you are, the more likely to get caught”.

Now, though, every group has to outdo what has gone before; and each exploit by a group has to outdo what it did before. For Lizard Squad, hacking Malaysia Airlines wasn’t quite enough, so it claimed to be affiliated with Islamic State, just to add an extra element of outrage. So what can the group do next?

The downtime involved in such preparations, while the group isn’t – to the public eye – doing anything carries its own risks: principally, that the group will fade from notice, perhaps to be replaced by some other upstart.

What to do? Usually they pick on someone to hate, because it annoys that person, and provides a visible diversion, while not requiring any actual hacking. “These kids are so desperate for attention and validation that many of them will stop at nothing to get it,” comments Krebs. “Everyone loves drama, and these kids are good at churning it up.”

Krebs himself has been the repeated target of such attention, from Lizard Squad and others: in one case, a “carder” called Krebs’s local police station and pretended to be calling from his house, claiming there had been a kidnapping at gunpoint. The intention was to get armed police sent to the house. In Krebs’s case it didn’t work: there’s a warning with his local police about calls appearing to come from his house. Lizard Squad has vaguely threatened Krebs, and lampooned him with pictures. He laughs it off, and suggests the clock is ticking for them.

In the case of LulzSec, their nemesis was a rival hacker called The Jester, who claims to have a military background (and certainly has sympathies with the US military) and who had previously been notable for apparently knocking WikiLeaks offline with a DDOS attack in November 2010, when it was releasing the US diplomatic cables in conjunction with a number of papers, including the Guardian. The Jester, too, liked to suggest that time was running out for LulzSec, because it is a threat that is hardly ever wrong.

Having an enemy seems to provide a focus for a group that also stops people worrying. Because the signs are that when hackers are considering another exploit, they are also nervous. That emerges from the LulzSec chat transcripts, and indeed any transcript of hacking crews: there’s lots of paranoia, and discussion of whether people have been “v&’d” – vanned (put into a police van) – or might themselves be hacked, or impostors, or subverted. Even before Hector Monsegur, aka LulzSec’s “Sabu”, was revealed to have worked for the FBI, about one in four hackers was reckoned to be an FBI informant. So nobody can entirely trust anyone, creating an atmosphere where the members of a crew are constantly second-guessing each others’ motives, wondering if the next suggested hack is actually the path to betrayal.

The mistake

Everyone makes mistakes; it’s part of life. And mistakes are what lead hackers to be caught. Mitnick used programs he had stolen, which led their creator to him. Monsegur was tracked by the FBI after he logged on to a chat server directly from his laptop, instead of via the multiple proxy servers he had been using.

Sometimes the errors lie in the past: Monsegur had already been identified, though not for certain, by rival hackers who had combed the internet to find his previous postings (unearthing his past hacktivism for Puerto Rico, and his New York location, and even photos). Someone in Lizard Squad might already have made the mistake that leads back to them. “It’s more fun to do hacking as a crew; you form bonds of fellowship. It’s much tougher to work with people for a month and then vanish,” says Coleman. “That goes against our natural inclination to form social ties. And that puts you in danger; the slipups in LulzSec were social as well as technical.”

Yet a disastrous mistake is not absolutely inevitable, she says. “For those in the US or UK, from the little I have learned on the topic, if you work alone and are really good about opsec [operational security] and go about your business quietly, you can dabble in criminal rings without much risk.”

She points to the hacking last year of Gamma International, which sells the FinnFisher surveillance software to governments and companies: “that hacker did it for political purposes. They linked to the source code on Reddit, and released a document about how to cover your tracks online. And then just vanished.”

She thinks we will see more of such one-off hacks, where people “smarten up” about the risks of continuing a campaign under a single banner.

The sentencing

Sentencing for hacking offences varies widely by country and by age of participant. Usually, those who are under 18 (“minors”, in the judicial sense) at the time of the offence will not get a custodial sentence. For those over that age, jail terms can run into decades, even where it looks unreasonable to onlookers.

It’s quite possible that a number of Lizard Squad’s members are under 18, and that creates its own problems, suggests Krebs. “I think they cynically (and sadly, correctly) understand that if law enforcement comes for them, it will take months, and they can have one hell of a long joyride in the process. It seems that many of them really do believe that the e-fame they get for their antics could help them get a job one day, so it’s a win-win for them.

“I think most of the kids doing this activity are probably technically (if not clinically) sociopaths who derive pleasure out of the hurting or misfortune of others. Somehow, we need to dramatically shorten the window of time from when this activity starts to when the intervention (either by parents, school, law enforcement or all of the above) happens.”

The aftermath

What happens once a crew has been broken up, or fizzled out, or just vanishes? Some give up because the police are on their case; others simply go deeper and wind up in the criminal underground, hacking for money. “Given enough time and left to their own devices, the skiddies will get better, and more involved in serious cybercrime, including extortion and sextortion, credit card theft, money laundering and DDoS attacks,” says Krebs.

Hypponen thinks that the aftermath for some is not to be caught, but instead to “go dark” and move into potentially lucrative criminal hacking. “I’m quite certain that one of the reasons teenage hackers with high-profile media personalities ‘disappear’ is that they realise they can actually make money with their skills and go dark,” he told me.

Since I spoke to Hypponen, Lizard Squad has indeed “gone dark” – apparently because both its Twitter account and website were hacked: after claiming to hack Taylor Swift’s Twitter and Instagram accounts, the group’s own @lizardmafia account was hacked, as was its lizardsquad.com domain, apparently by a group calling itself Anonymous Protection which describes itself as “a subsidiary of Anonymous dedicated to protect the people of the internet” and based in the UK. At which point one could enter into bluff and double-bluff: what if Lizard Squad somehow handed over their details so they could disappear? Or if they’re actually the ones behind it? This is the problem one faces in investigating and writing about hacking: hardly anything is certain, until it ends up in court.

But there are multiple paths. “There is also a countervailing tendency that I have seen whereby hackers who start hacking into websites for fun are lured into activism thanks to the prominence of groups like WikiLeaks and Anonymous,” says Coleman. Al-Bassam told me last year that he was interested in helping enable access to the internet in countries where it’s restricted.

Yet there are other paths – neither through the courts or into the criminal side. When LulzSec was in the ascendant, one of its biggest antagonists was “Team Pois0n”. A British teenager who was one of its members headed to Syria while on police bail, having already served six months in prison for hacking and ID theft, and is now reckoned to be behind Islamic State’s (Isis) hacking attacks on the west, such as its takeover of US Central Command’s Twitter and YouTube accounts. “There’s someone behind that stuff who clearly knows what they’re doing,” one observer of the hacking world told me.

Quite how long his hacking lifespan – or actual lifespan – might be expected to be with Isis is unknown. But the idea that someone could effectively be employed by a radical Islamic group with medieval leanings to organise its social media presence and hack for it would have belonged in science fiction even five years ago.

Given the arc so many stories follow, do hackers have a shorter lifespan now? Coleman doesn’t think so. “Older hackers in their thirties and forties, they are very smart and can cover their tracks.”

One of the most iconic hackers, John Draper, aka “Captain Crunch”, is now in his seventies, having hacked into phone systems, served prison terms and written widely used software.

Maybe the Lizard Squad members will join him in that longevity. But first they have to play out the rest of their story.

Powered by Guardian.co.ukThis article was written by Charles Arthur, for theguardian.com on Friday 20th February 2015 14.00 Europe/Londonguardian.co.uk © Guardian News and Media Limited 2010