On June 6, 2011 the now defunct
LulzSec released personal emails taken from Karim Hijazi, CEO of
Unveillance, and an IRC log of a conversation between members of LulzSec and Hijazi. The data implies that a US Government-funded agency considered taking malicious control of Internet servers in Libya.
Botnets, Unveillance and the CSFI
The LulzSec release came after a week of exchanges between LulzSec and the thirty-five-year-old CEO whose company Unveillance monitors data on botnets, or networks compromised by malware. During these conversations, both LulzSec and Hijazi alluded to the curious relationship between Unveillance and the
Cyber Security Forum Initiative (CSFI), a government funded organization. Hijazi and Unveillance were asked to join the CSFI due to Unveillane's superior data on compromised networks in Libya.
When the Libyan government shut down the country's phone and internet access, only a handful of servers remained active in Libya, including Mariposa and XBL botnets, which Unveillance monitored. Hijazi had previously suggested those servers belong to the Libyan government rather than a private rogue source. But after his experience with the CSFI, Hijazi confided his suspicions that the CSFI were fleecing him for botnet data for use in a malicious attack to LulzSec in an IRC chat.
The Karim Hijazi / LulzSec IRC Log
The following portion of the IRC chat log provided by LulzSec gives some context for Hijazi's experience with the government-funded CSFI (The log is presented unedited. Moondog has been verified as Karim Hijazi; the other chat members are two of the six LulzSec members):
moondog That CSFI is odd.
moondog They took my data and ran.
hamster_nipple really?
hamster_nipple should we target them/ ;)
hamster_nipple ?
moondog Well it was a bit odd. And I don't know their intent. I it was what you referred to, I
regret giving them data.
moondog I = If
hamster_nipple what data did you give them specifically?
moondog Seriously. That is not my game.
hamster_nipple it was regarding the libyan project correct?
hamster_nipple espeon/knobbles: I suspect they are doing something very funky regarding libya
knobbles id like to get my hands on that tbh
hamster_nipple moondog: what data did you give them? botnet stats regarding libyan bots that are
infected?
hamster_nipple or?
moondog Compromised hosts in Libya.
hamster_nipple figured as much
hamster_nipple they're probably looking for libyan hosts that are infected that are probably high
profile
hamster_nipple for use in penetrating libyan space
moondog Yep.
hamster_nipple karim
hamster_nipple why would you do something like that ... knowing their intentions?
hamster_nipple did you feel you had to in order to continue doing business?
hamster_nipple honest question
moondog I didn't know the intent and was in marketing mode. I am truly starving guys.
Earlier in the log LulzSec attempts to request money in exchange for their help and silence. In a statement LulzSec said they were "stringing him along" to embarrass him at a later date. A statement supported by the motivations for releasing Hijazi's personal information related in the following email:
Hijazi Speaks in an Official Statement
In an
official statement Hijazi wrote: I am now, and have been, in full cooperation with the FBI. In fact, I contacted the FBI and US-CERT immediately after I began receiving threats from LulzSec to request their assistance – and to explain the nature of the threat. I offered my full cooperation to the FBI in an effort to rectify the situation.
However, Hijazi has yet to recant or deny his comments on the CSFI's intentions regarding the Libyan botnet data he provided. But the emails provided by LulzSec show that Hijazi was unsure about the CSFI from the start of their relationship. He reached out to friend James Hunt for information on the CSFI, who responded on April 10th, saying, "It is always interesting to see if they are really a non-profit focused on quality stuff or they are a ruse to have a bunch of guys pay money to support some guys who otherwise can't get a job..." To which Hijazi replied in an email on the same date, "hahaha. Exactly. I will keep you posted."
Questional Question
Was the CSFI playing Karim Hijazi for details on compromised server data in Libya that they couldn't acquire themselves to use in a malicious takeover of Libyan Internet as LulzSec and Hijazi suggest in the IRC chat?
*Images courtesy of LulzSec
