LulzSec leader's digital trail led rival hackers and possibly FBI to him

Information uncovered about Sabu by rival hackers in the past proved to be fairly accurate

The disclosure Tuesday by U.S. authorities that Sabu, the former leader of prominent hacker group LulzSec, is a 28-year-old man from New York City named Hector Xavier Monsegur, corresponds with much of the information released about him by rival hackers in the past.

Sabu had been secretly arrested by the FBI last year and has since allegedly acted as an informant for the authorities, according to court papers in the case. The whole law enforcement operation resulted in the arrest of five more alleged hackers linked to LulzSec and Anonymous.

Back in June 2011, a few weeks before LulzSec decided to disband, several rival hacker crews like TeaMp0isoN (Team Poison), lone hacktivists like th3j35t3r (The Jester) and other Internet users unhappy with the group's actions, launched a virtual war against its members.

LulzSec's enemies engaged in an activity known in the hacker community as doxing, which consists of gathering personal information about an online user and publishing it online with the goal of exposing his real identity.

One of the first information dumps targeting LulzSec members was done by a group called the A-Team, and while the information later proved largely incomplete and bogus, the details about Sabu in particular appear spot on.

A-Team claimed that Sabu was a Puerto Rican man named Hector Xavier Montsegur who was living in New York. The group said that this information matched archived whois data for prvt.org, a domain name believed to be owned by Sabu, that has since been anonymized.

According to the A-Team, some of the online aliases used by Sabu were 548U, hectic_les and leon, the last of which is mentioned by the authorities in Montsegur's unsealed indictment.

A separate Sabu dox report posted by an anonymous user on Pastebin on June 21 last year, traces Montsegur's alleged online activity to as far back as 2003. It claimed that he was involved in several software and security-related projects over the years under the aliases Xavier Kaotico and Xavier de Leon -- another fake identity mentioned in his indictment.

On August 17, around the time when Montsegur is said to have started working with the FBI as a cooperating witness, another Sabu doxing project was started on a blog. It listed the hacker's known email addresses, including many that contain Sabu, Xavier and Monsegur in their names.

The project concluded that Sabu lives in New York City, is a NY Giants fan and even includes a picture of him grabbed from a MySpace profile.

Information gathered with the help of Google search and other freely available services suggests that the LulzSec leader may have been careless at the beginning of his hacking career and failed to switch to another identity when things started to get more serious.

LulzSec members left electronic fingerprints behind that made their arrest inevitable, said Rob Rachwald, director of security strategy at security firm Imperva. In one incident, a LulzSec member changed his online identity, but left clues about it on a public forum, he said.

There is very much a trail of history on hacker forums, just as there is on Facebook, and if you are loud enough through your actions, like LulzSec was, you will determine law enforcement to search for it, Rachwald said.

The security expert drew a parallel between Sabu's case and that of famous mobster John Gotti, whose similar defiance of law enforcement eventually led to his downfall.

It's somewhat curious that Sabu's accomplices didn't wonder why the hacker never got arrested despite so much information about him being exposed online, even if he did try to deny its accuracy.

It was in June of 2011, at about the same time as Sabu's arrest, that Eric Corley, publisher of quarterly hacker magazine 2600, told The Guardian that, in his opinion, one in four U.S. hackers had been turned into FBI informants. Hackers are susceptible to intimidation because of the harsh penalties involved and their inexperience with the law, he said at the time.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?