sygeek
Technomancer
Here's brilliant post by a Reddit user with the name "throwawaylulz11" explaining the true side of LulzSec than the one they're trying to show:
Greetings Reddit! There's been quite a few congratulatory posts on Reddit lately about the activities of a group called "LulzSec". I was in the "public hacking scene" for about six years, and I'm pretty familiar with the motivations and origins of these people. I may have even known several of their members.
Let's look at a few of their recent targets:
If LulzSec just was about exposing security holes in order to protect consumers, that would be okay. But they have neglected a practice called responsible disclosure, which the majority of security professionals use. It involves telling the company of the hole so that they can fix it, and only going public with the exploit when it's fixed or if the company ignores them.
Instead, LulzSec has put hundreds of thousands of people's personal information in the public domain. They attack first, point fingers, humiliate and threaten customers, ddos innocent websites and corporations that have done nothing wrong, all in the name of "lulz". In reality, it's a giant ploy for attention and nothing more.
Many seem to believe these people are actually talented hackers. All they can do is SQL inject and use LFI's, public exploits on outdated software, and if they can't hack into something they just DDoS it. That puts these people on the same level as Turkish hacking groups that deface websites and put the Turkish flag everywhere.
It would be a different story if LulzSec had exposed something incriminating -- like corruption -- but all they have done is expose security problems for attention. They should have been responsible and told the companies about these problems, like most security auditors do, but instead they have published innocent people's contact information and taken down gameservers just to piss people off. They haven't exposed anything scandalous in nature.
In the past, reddit hasn't given these types of groups the credibility and attention that LulzSec is currently getting. We don't accept this behavior in our comments here, so we should stop respecting these people too.
If anything, we will see more government intervention in online security when these people are done. Watch the "Cybersecurity Act of 2011" be primarily motivated by these kids. They are doing no favors for anyone. We need to stop handing them so much attention and praise for these actions. It only validates what they have done and what they may do in the future.
I made a couple comments here and here about where these groups come from and what they're really capable of.
tl;dr: LulzSec hasn't done anything productive, and we need to stop praising these people. It's akin to praising petty thieves, because they aren't even talented.
Let's look at a few of their recent targets:
- Pron.com, leaking tens of thousands of innocent people's personal information
- Minecraft, League of Legends, The Escapist, EVE Online, all ddos'd for no reason
- Bethesda (Brink), threatening to leak tons of people's information if they don't put a top hat on their logo
- Fox.com, leaked tens of thousands of innocent people's contact information
- PBS, because they ran a story that didn't favorably represent Wikileaks
- Sony said they stole tens of thousands of people's personal information
If LulzSec just was about exposing security holes in order to protect consumers, that would be okay. But they have neglected a practice called responsible disclosure, which the majority of security professionals use. It involves telling the company of the hole so that they can fix it, and only going public with the exploit when it's fixed or if the company ignores them.
Instead, LulzSec has put hundreds of thousands of people's personal information in the public domain. They attack first, point fingers, humiliate and threaten customers, ddos innocent websites and corporations that have done nothing wrong, all in the name of "lulz". In reality, it's a giant ploy for attention and nothing more.
Many seem to believe these people are actually talented hackers. All they can do is SQL inject and use LFI's, public exploits on outdated software, and if they can't hack into something they just DDoS it. That puts these people on the same level as Turkish hacking groups that deface websites and put the Turkish flag everywhere.
It would be a different story if LulzSec had exposed something incriminating -- like corruption -- but all they have done is expose security problems for attention. They should have been responsible and told the companies about these problems, like most security auditors do, but instead they have published innocent people's contact information and taken down gameservers just to piss people off. They haven't exposed anything scandalous in nature.
In the past, reddit hasn't given these types of groups the credibility and attention that LulzSec is currently getting. We don't accept this behavior in our comments here, so we should stop respecting these people too.
If anything, we will see more government intervention in online security when these people are done. Watch the "Cybersecurity Act of 2011" be primarily motivated by these kids. They are doing no favors for anyone. We need to stop handing them so much attention and praise for these actions. It only validates what they have done and what they may do in the future.
I made a couple comments here and here about where these groups come from and what they're really capable of.
tl;dr: LulzSec hasn't done anything productive, and we need to stop praising these people. It's akin to praising petty thieves, because they aren't even talented.