On Twitter: @JamesFirth and @s_r_o_c (post feed)

Got a tip? tip@sroc.eu

Friday, 3 February 2012

Compromised FBI conference call tips Anonymous to imminent arrests and prosecution details

In what must be a serious blunder by transatlantic law enforcement, hackers claiming allegiance to Anonymous have obtained an audio recording of what appears to be a conference call between the FBI and British law enforcement.

UPDATE 15:51: According to Sky News, FBI admit a call was "intercepted".

Contents of the call could have tipped two further Anonymous suspects to their imminent re-arrest.  Sensitivities over delays to a forthcoming UK criminal trial are revealed, with officers wanting to achieve a delay in a way that "didn't look too suspicious" to the defence. Sensitive details of part of the case against Cleary are also discussed.

The call additionally indicates a further younger British member of Anonymous arrested last year may have made a statement revealing details of at least one hack and named two associates.

UK officers don't sound to have much further interest in the suspect, but FBI officers are heard saying he may be wanted in relation to a federal investigation, leaving the possibility that the young hacker could face extradition (although this wasn't explicitly stated).

At the time of writing, the audio was available on YouTube as well as mp3 download via numerous mirrors.  It has been widely publicised on channels frequented by Anons, ie. it is widely available and inconceivable that the bulk of those affected aren't at least aware of its existence.

In the recording, US and British agents/officers can be heard discussing details of the forthcoming criminal trial against Anons Jake Davis (AKA Topiary, an alleged member of affiliate group LulzSec) and Ryan Cleary.  The trial against both was due to start on the 27th January in London.

British officers referring to themselves as "the London contingent" announce they would delay both the start of the trial against Davis and Cleary and also the re-arrest of two further suspected anonymous members after a request from "New York" to allow for certain "operational matters".

Time frames of 6-8 weeks are discussed in relation to the delays.  In an ironic twist, British officers discuss court procedures that would allow for a delay to the trial "without the defence knowing ... that won't look suspicious",  presumably so as not to tip Anonymous to the very matters discussed in the leaked call.

The suspects due to be re-arrested are named by their handle and real name, although whoever leaked someone involved in the leaking of the recording has taken the time to bleep out the real names, presumably in some kind of show of honour so as not to unmask their identity to the general public.

Evidence on Twitter from one prominent Anon suggests that he (/she?!) knew in advance that the trial due to start on the 27th would be delayed, indicating the contents of the call were known by Anons over a week ago, adding weight to the suspicion that suspects were tipped in advance of their arrest.

A second leak - the contents of an email apparently from an FBI agent - puts the date of the call as 17th January, and opens up the possibility that Anonymous members knew about the call in advance.

No indication is given as to how the recording was obtained, however existence of the leaked email, which  reveals the conference call access number and PIN, opens up the possibility that an Anon simply dialled-in to the conference.

Numerous participants can be heard joining the call by way of beeps throughout the recording.

A standard security protocol used throughout my time working on secure government and military communications projects was for the conference initiator to check who had joined the call each time a beep was heard.  From the recording a couple of joining beeps can be heard where that protocol was not strictly followed.

Other possibilities include the call being hacked from the conference service provider, leaked by an insider or hacked/stolen/leaked from/by one of the participants on the call recording it for their own records.


No comments:

Post a Comment

Comments will be accepted so long as they're on-topic, do not include gratuitous language and do not include personal attacks or libellous assertions.

Comments are the views of the commentator and not necessarily the view of the blog owner.

Comments on newer posts are not normally pre-moderated and the blog owner cannot be held responsible for comments made by 3rd parties.

Requests for comment removal will be considered via the Contact section (above) or email to editorial@slightlyrightofcentre.com.