HBGary Federal

» see hbgaryfederal.com as it lived, on the wayback machine

~ the goodbye ~

The part nobody mentions is that HBGary Federal was already finished before any of this happened. It could not meet its revenue projections, and in the first weeks of 2011 it was being shopped to two interested buyers. Aaron Barr, its chief executive, needed something that would make the firm look like it was worth acquiring, and what he decided to produce was the identity of the people running Anonymous.

His method was a correlation. People who were active in Anonymous IRC channels were also, he reasoned, on Facebook, and if you line up when an account posts in one place against when a nickname appears in the other, you can match them. He told the Financial Times on 4 February 2011 that about thirty members were steadily active, that senior figures sat in New York and California with several more in Germany, and that they had left enough of themselves in public to be arrested. Wikipedia cites a Financial Times piece of 7 February instead, which may be the print edition or a follow-up; the 4 February date is the one the later reporting uses as the trigger.

The response arrived over the following weekend. By the end of it the company website was compromised, Barr's Twitter account was being used to publish his home address and his social security number, somebody claimed to have remotely wiped his iPad, and the email of both HBGary Federal and its parent company was being mirrored in public. The sale negotiations ended that week.

~ the chronicle ~

~ how it was actually done ~

The technical account is unglamorous and that is the point. A third-party content management system running the company's site took an SQL injection, which produced password hashes. Those passwords had been used in more than one place. From there the attackers reached the email of Greg Hoglund, who founded the parent company in 2003 and ran a well-known security site called rootkit.com, and used his account to ask the site's administrator to open the firewall and reset his password. The administrator did. Hoglund described that last step to Brian Krebs himself.

Hoglund has since argued that Anonymous never got into the company's actual network, while conceding the security was poor, so the victim disputes the standard version of his own disaster. The volume is easier to agree on. The public mail archive listed 71,800 messages, broken out as 27,606 of Hoglund's, 16,906 of Barr's, 15,156 belonging to Phil Wallisch and 12,134 belonging to Ted Vera, who was HBGary Federal's president and chief operating officer. Another twenty thousand were released on 13 February, a week after the first batch, which tells you the release was being paced rather than dumped.

~ team themis ~

What made this more than an embarrassing weekend for one security firm was a proposal found in the mail. HBGary Federal, Palantir Technologies and Berico Technologies had formed a group calling itself Team Themis, and the client chain ran from Bank of America through the law firm Hunton and Williams, which according to Wikipedia had been recommended to the bank by the United States Department of Justice. The target was WikiLeaks. One of Barr's suggestions was applying pressure to the journalist Glenn Greenwald.

The money never changed hands and should not be written as though it did. What was proposed, according to the leaked threads as read by ThinkProgress and others, was $200,000 for a first month of research followed by $2 million a month for six months, divided fifty percent to Palantir and twenty-five each to Berico and HBGary. Barr thought the number was high and said so in writing. A separate set of documents appeared to show the firms being engaged against critics of the US Chamber of Commerce, which the Chamber denied, stating that no money for any purpose was paid to any of the three. Palantir's chief executive Alex Karp apologized to Greenwald on 11 February and cut all contact; Berico did the same.

~ what happened to everybody ~

On 14 February HBGary pulled out of the RSA Conference in San Francisco entirely, booth and speaking slot together, after threats arrived by fax and by voicemail and someone wrote "Anon. is in it for the lulz" across the company's display. Barr resigned on 28 February, saying he needed to look after his family and rebuild his reputation. On 1 March seventeen House Democrats, in a letter written by Representative Hank Johnson, asked four Republican committee chairmen to open an investigation into what the correspondence showed. No investigation was ever held. In July Barr was pulled from a DEFCON panel by a legal threat and canceled a Black Hat appearance in the same week.

The parent company survived by being a different company. ManTech International announced on 29 February 2012 that it was buying the assets of HBGary, Inc., and closed on 2 April for $23.8 million according to ManTech's own annual report; the products went on as ManTech Cyber Solutions International and were sold again, to CounterTack, on 15 July 2015. HBGary Federal was reported closed in the coverage of that first announcement, and that is as precise as its ending gets. There is no dissolution record to find. A search of the Colorado business register, where its president worked, returns nothing under the name at all, which fits the contemporaneous descriptions of it as a division rather than a company. It never published a revenue figure or a headcount. What it left behind was the mail.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »