Am I the only one who thinks this sounds completely out of character for LulzSec / Anonymous?
They aren't stupid. They surely know that waging war against Facebook would be silly.
I'd bet this is someone completely different, looking to pose as Anonymous. Try looking at the sources --- you won't be able to trace it back to an announcement by Anonymous. So who are these guys?
In this short time lapse, we've heard and saw the panic of Facebook progrmmers. It seems that now they are offering US$ 500 to find errors on their webpage. It is clear that nothing of this is real. They only do this to make the world believe that they have the power, and nothing can be done against them. As we have said before, we are tired of Facebook stealing people's information and selling it to powerful people like pieces of paper. This regime has come to an end.
Facebook will cease to exist.
In November 5th the Facebook Operation will take place succesfully, and nothing will be able to stop it.
We are anonymous, we are legion. We don't forget, we don't forgive. Expect us.
----
Now that I listen to it carefully, the way they put it sounds pretty weird, to say the least.
"Uh, who do we hate besides the government? They can, you know, arrest us and stuff." ... "Facebook! Yeah, let's get fucking Facebook! I hate Zuckerberg, all young and successful."
Sounds about right to me. Seemingly random target fits their MO.
From #AnonOps: "TO PRESS: MEDIAS OF THE WORLD... STOP LYING! #OpFacebook is just ANOTHER FAKE! WE DONT "KILL" THE MESSENGER. THAT'S NOT OUR STYLE #Anonymous"
That's not to say that Facebook won't be attacked, but most likely not by the people that form that Anonymous that WE think of when we think Anonymous. Although I suppose that any one or group could be Anonymous because of how they define themselves.
I really don't buy this as a... 'full force,' if you will, attack by Anonymous. I would want to see this confirmed by sources like https://twitter.com/#!/anonymousirc before I believed it to really be an 'Anonymous' 'movement.'
Of course, their strength is also their weakness. Without any names, what is and is not 'Anonymous' can forever be questioned. Like others, I want to say "they are too smart for this," but then they ('they') also attacked Amazon a few months back and that certainly did not go as well as the Visa attacks...
I'm not sure if Anon fully understands the level of infrastructure and the level of preparation Facebook has... They'll need to come up with something a lot more compelling than a bunch of guys at home with LOIC.
This attack is scheduled to come soon after anon switches from LOIC to a "new cannon" dubbed #RefRef (http://anonops.blogspot.com/2011/08/new-hacking-tools-by-ano...). They're probably way overconfident in their abilities (#RefRef's description is thoroughly unconvincing), but at least they don't think they're going to DDoS one of the best-prepared sites in the world, AFTER telling them exactly what day the attack will occur on.
So if we assume these people have any idea what they're talking about, it's some kind of SQLi attack... presumably mySQL? I wonder at what point it'll occur to them that Facebook mostly serves data from memcached.
Uh... did I get something wrong here? A correction or something would be nice.
"RefRef is a revolutionary DoS java site. Basically, by using an SQL and .js vulnerability, you can send a page request packet from your home computer with embedded .js file, because of the vulnerability in the SQL/Javascript engine on MOST websites, the site actually TEMPs the .js file on its own server. So now the .js is in place on the host of the site. Next since you still have the request, it picks up the .js file, and all of the requesting for packets power happens on the server, not the requestee. I send two packets from my iphone, and everything else happens on the server. Basically eats itself apart, because since both are on the server, its all a local connection."
"The tool is very effective, a 17-seconds attack from a single machine resulting in a 42-minute outage on Pastebin yesterday. As expected, the Pastebin admins weren't very happy with their platform being used for such tests and tweeted 'Please do not test your software on us again.'"
"The effectiveness of RefRef is due to the fact that it exploits a vulnerability in a widespread SQL service. The flaw is apparently known but not widely patched yet. The tool's creators don't expect their attacks to work on a high-profile target more than a couple of times before being blocked, but they don't believe organizations will rush to patch this flaw en masse before being hit."
first of all, there's no javascript "engine" on most websites. and every major vendor of SQL databases has it's own, so good luck in finding a vulnerability that works with MSSQL/Oracle/Mysql/Postgresql.
also, even if you manage to store a .js file in a temp directory (which would be handled by the web server, btw. nothing to do with sql/js) it's usually a very locked down directory (you can't even execute from /tmp by default in most GNU/Linux servers)
even so, you would still need to execute that .js file (and how? most servers can't run javascript)
I'm not saying this tool doesn't exist, but I'm pretty sure that's not how it works
i think you're getting downvoted because anonymous has proven many times in the past that at least the people "in charge" (as much as you can call it that) definitely know what they're talking about and are possibly comprised of security experts.
if this is in fact anonymous. i'm not convinced, too big a target for them to have so little fanfare/flair.
No way, you tell them you're attacking on Thursday night/Friday morning at midnight. Then do a headfake, a completely impotent showing, but keep at it for at least three hours. Then let it fall apart as users drift off.
Then, around eight am, when the US gets to work, and anyone at Facebook who took you seriously is sleeping in after the late night? Then. That's when you pull out the big guns.
I wonder which hour of the day is their busiest... That would be my true target time.
they just haven't even done anything novel. Why should we expect them to now? Facebook is very unlikely to have the usual slough of easy sql injections.
I am quite sure that someone good could find attacks against facebook. I am dubious that anonymous can.
There are many levels of intrusion. I give Anon enough credit that they might be able to cause some mayhem, maybe even some real harm. Maybe they'll take down Facebook Chat (to the great ambivalence of everyone)... but to 0wn/DDoS the main Facebook site altogether? I dunno...
It's like, I may be able to find some way to force all the toilets at CIA Headquarters to back up. That's not the same thing as compromising their spies' identities. Not all exploits are equal.
I am aware of what "attack surface" means and stand by my claim that anonymous, having done nothing novel so far, will not find attacks against facebook.
There is no way to tell if someone is credibly "within the Anonymous subculture" and "Anonymous" "releases" conflicting "press releases" with some regularity. There is no organization to "Anonymous", it's just an MSM-manufactured boogeyman to represent any teenager and/or groups of teenagers which knows how to send a lot of requests to a website simultaneously. samstave is also correct that those in power relish this since it gives them a lot of latitude to scare the commoners and get better tracing tools in place.
Sure it does. No true scotsman breaks down to a claim that some group has some Trait, then claiming that because some individual does not share the Trait they are by definition out of the group. I guess sometimes it's valid, but not here. Anon hasn't shown itself capable of an attack like this and if you look at the attacks by anon on scientology you'll be left wondering they were able to form a group identitiy with their fringe (core?) As it is.
Palish might be right that this doesn't sound like its from any of the main group.
I was yesterday at their IRC, prepared to laugh at them, but it was quite interesting.
First, they try to look united on twitter and to media, but they quite aren't. Second, they are INCREDIBLY naive. Third, they are OBSESSED with attention of the media.
They were actually planning the attack on #OpFacebook channel (so no, it was not fake - and the channel still exists, but they probably realized it is a joke so they turned it into a joke). After they realized they quite can't attack their servers, they thought it would be better to get people passwords by "botnet keylogger" (and I am not making it up), steal about 1 million accounts and then DEACTIVATE THEM ALL, which would I guess do something terribly evil to Facebook.
Someone brought the question if this doesn't give media and police the right to label them as terrorist, and someone else replied that "police and media are the real terrorists". After that sentence, I laughed too loud and had to leave the IRC.
> they thought it would be better to get people passwords by "botnet keylogger" (and I am not making it up), steal about 1 million accounts and then DEACTIVATE THEM ALL, which would I guess do something terribly evil to Facebook.
That is not a bad approach. If you assume Facebook's network infrastructure is rock solid, then attack Facebook's human infrastructure by flooding them customer services calls.
I don't think you need a botnet keylogger to grab Facebook passwords because their users are easily confused or duped. For example, ReadWriteWeb wrote about Facebook's plans for login federation and many Facebook users, googling for "facebook login", found this blog and tried to login there!
This group calls itself anonymous as well, and uses the same 'branding', but it is useful to note that the people behind this may have no affiliation with the previous anonymous operations.
The 'original anonymous press release' was Uploaded to youtube by FacebookOp on Jul 16, 2011, and picked up by media only recently.
It is of course not impossible to create a new youtube user and a new twitter account called 'facebookop' and post a video proclaiming to attack facebook in the name of anonymous. Anyone can do it.
Have any of the "official" (whatever it means) Twitter accounts said anything against FacebookOp?
No. FacebookOp has gone entirely unmentioned by #AnonOps. Not because #AnonOps is unable to post - both Twitter and the blogspot account have posted multiple times about the London mess today.
Hi anonymous, I work at facebook. If you manage to hack us and grab our data, perhaps you'd like to apply for a job? It's not trivial getting the data even with full access, so you could really help our team! Plus the free lunches are pretty good.
I thought Anonymous is an unstructured "organization" and that anybody can do anything under their flag without authorization from a central body. How is it that there is apparently a central Twitter account?
Maybe it's a bit of a meritocracy? It seems some Twitter accounts are somewhat "official" in the sense that they are followed by most of the people involved in the Anonymous movement.
I don't think they're (if they're, because it looks like a fake) aiming for the data.
If I were them and wanted the data I'd hack a big Facebook application' account and since most of them are very intrusive with their permissions I'd get a lot of data that way.
I bet from the backend it'd be very hard to do it, and the data might be encrypted using a key that only a Facebook user has (the user might have multiple keys and share them with friends... etc etc), anyways, I'm thinking too much about this, it's too late already :).
You don't. I choose to stay anonymous for many reasons, but if it's any help, nothing I said could be construed as trying to discredit Facebook (even though I'm anonymous).
tl;dr: The action is motivated because of the poor privacy policy of Facebook.
As said in other comments, it isn't clear if this is Anonymous because their twitter accounts didn't echo the manifesto. It could be a spinoff, a false flag op, or anything in between.
So somehow cutting people off from playing Farmville, talking to friends and family, and generally wasting time is going to endear a small group of "hacktivists" to those users?
Perhaps as effective as cutting those users off from playing PS3 games they'd already purchased.
You don't really understand protests do you? You could say the same about street protestors, endearing themselves to motorists trying to get home, or bus driver protestors causing chaos to those who use their services.
Anonymous posted to twitter concerning OpFacebook. The three posts that (I think) are relevant:
#OpFacebook is being organised by some Anons. This does not necessarily mean that all of #Anonymous agrees with it.
We prefer to face the real power and not to face to the same medias that we use as tools. #OpFacebook #Anonymous
REMEMBER THIS ARTICLE: "Are Hacker Attacks Government Operation To Push Internet Censorship Laws?"
The last one doesn't specifically mention FB, but it does seem that that sort of event - where the MSM attributes X to anon when anon isn't behind X - is beginning to worry them.
Now that anon denied it, I have a suspicion whoever released this announcement also sent a security resume/bid to Facebook. Looks like someone creating a need for himself.
Perhaps even at the very top? I mean this could just be a viral marketing campaign __for__ Facebook. Something to help them regain the street cred they are losing, something to prevent the inevitable myspacing of their business. Or maybe just a cover for planned downtime.
Maybe they are planning something they need lots of people to help with and so want the publicity in advance?
Not a clue what that could be tho.
(Yes, I have seen the tweet saying its fake but as others point out there are many anonymous, and in fact the whole anonymous thing is that everyone is anonymous, so who knows?)
I'm guessing this is partially a response to a talk given at DEFCON by 2 people trying to unmask anonymous and lulzsec members. They highlighted how they use social media to track people down, especially FB.
I would hope the real Anon understands the magnitude the challenge they just set before themselves.
"Facebook has been selling information to government agencies and giving clandestine access to information security firms so that they can spy on people from all around the world. Some of these so-called whitehat infosec firms are working for authoritarian governments, such as those of Egypt and Syria."
^ Besides, if Anonymous wanted to disgrace facebook, I think a better way to do that would be to show evidence backing up this claim.
As much as I admire anon's technical prowess, I seriously doubt that they can take down significant portions of FB which seems very well prepared (unless, of course, some former employee reveals a trapdoor or something to them). Up to now, their targets have been clueless corporations (i.e. Sony) or government agencies mostly.
Conspiracy theory in play: discredit Annon being all mighty if they fail in this Facebook attempt. Anyone can claim to be Annon, it is also a way to spot the real Annon.
What would be really awkward is if they released logs of profile/picture views. I'd be willing to bet I'm far less of a stalker than most FB users, but I'd still be pretty uncomfortable with that data out in the open.
Highly unlikely, except perhaps in Jake Davis's wet dreams.
Remember that an actual hack requires a both a great deal of skill and great deal of luck, especially when reasonably secure installations (FB obviously qualifying as "reasonably secure") are the target. If this group had the skill required, they would know enough not to be counting on getting lucky. Thus, either they already have knowledge of some vulnerability, or they're not going to find one. The former is highly unlikely - if they had that knowledge, it would require a great deal of stupidity to count on FB not discovering it for nearly three months.
Going after Facebook goes against a lot of Anon's principles. Sure they do have a pretty bad rep in the privacy department but Facebook was an invaluable tool for young people during the Arab Spring
(1) availability - DNS or route hijacking. With https they may not be able to fake their own copy, but redirecting to a 'AnOnYmOus ownz yoo' page may be possible.
(2) privacy - a pretty big profile dump, maybe of key facebook employees?
(3) quality - have the news feed, groups, walls, etc flooded with (even more?) crap. A few cracked apps could flood a lot of users.
Remember when the mydoom worm took down google for a bit due to widespread and distributed searches for itself/targets? I wonder if database resources are infinite?
Looks like Nov 5th is the target date. So in ~85 days, they are going to concoct a plan to destroy a $100 billion (allegedly) company? This should be interesting.
I am beginning to think Anonymous is a fictitious entity made up by the mainstream media to divert attention. They sound too hippy-dippy to be of serious intent.
Alexa doesn't count the internal traffic, like financial transactions. Their website is a tiny tiny share of that traffic. Just think of all the credit card transactions happening all over the world.
1) Facebook is powered by massive infrastructure which can be only be compared to likes of Google. Visa, Mastercard are too small even to be compared.
2) People at Facebook are Smart - as Facebook hired top talent. those "hackers@Facebook" know their sh!t & together they are better prepared that any of us here for thwarting ddos attacks.
so my message to annon is:
Kids, Please don't understand facebook's infrastructure & the smart people who work there.
They aren't stupid. They surely know that waging war against Facebook would be silly.
I'd bet this is someone completely different, looking to pose as Anonymous. Try looking at the sources --- you won't be able to trace it back to an announcement by Anonymous. So who are these guys?