Anonymous fake OS, who is behind it?

In recent days, by chance I discussed with colleagues the relationship between the Vatican and Anonymous groups because I consider the Holy See a very attractive target for several reason. A few hours later the site of Vatican went down, while I was writing of the possibility of OpBlackout and regarding the basting operations to discredit the group in terms of media.
As repeatedly noted, hacktivism is not negligible, I believe it is the true phenomenon of the last decade that can change in a radical mode the policies and the choices at the global level of several countries. Contrary to what many think, Anonymous groups as well as stimulate dialogue on the technological effectiveness of many defense systems, focuses on many hot topics for today’s society. For this reason, even against the public opinion, I think Anonymous is an opportunity for the security industry. Of course there is the flip side, the possibility that the group is infiltrated and used for military purposes or operations of intelligence. Given what let’s we see what is happened during the week. In the Internet was published the news of the availability of a release of the “Anonymous” operating system.

The released distribution is an Ubuntu called Anonymous dedicated to the famous group of hacktivist. The news has had the desired effect, arousing great interest among the many supporters, collecting over 20,000 downloads  in less than four days, and while a couple of the comments on SourceFourge indicate that it was a fake, it still has a user rating of 62%, with 37 users giving it the thumbs up

The operating system promises the availability of an arsenal of tools installed and configured to take part in operations of the group while maintaining the anonymity.
When I learned the news I jumped from my chair and immediately I wondered who was behind this operation. Almost immediate response of the Group through the major social networks like twitter, the operating system is a fake.

Despite the great success it is foolish to install a release of an operating system just to show an act of faith to a group, whether it’s our PC than you mobile phone. Just this context raises some concern, we have a widespread diffusion of mobile devices, especially among young people, for which there is a widespread practice of jailbreaking. These parallel versions are not controlled and may have been packed with all sorts of malware. Do you drive a car at full speed without control?

But who could have an interest in exploiting the name of the group to disclose an infected version of an operating system? 

Narrowing the large series of hypotheses, some of which really fanciful, I believe two are the most likely.

  • Some criminal organizations exploiting the name of the famous group has released to a wide audience the system equipped with backdoors and viruses for the construction of a large-scale fraud. I believe this hypothesis should be supported by concrete investigation of distribution to understand if agents hidden are making reference to the same group control server (C & C).
  • Some government agency, probably American or European is continuing to operate in an attempt to discredit the group and at the same time to trace the participants in the operations. Just in recent weeks, one of the main tools used by supporters of Anonymous, Slowloris Denial of Service tool, was distributed in an infected version. Someone is trying to undermine the relationship of confidence in the group and in the systems used during the attacks. Participate in an operation must be perceived as a danger, someone is trying to spread the awareness that the hacktivism is a crime and the perception that the systems used are not as safe as they should.

At this point if I were a member of the team would commit to thoroughly analyze the version of the popular fake operating system to be able publicly to unmask those behind the operation. In any case I believe that such an analysis is under way by the leading names in security and we will soon solve the mystery.

This eventuality would be a coup for the group and reinforce the conviction of its increased technological capabilities.

Pierluigi Paganini

 

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Experts warn of an ongoing malware campaign targeting WP-Automatic plugin

A critical vulnerability in the WordPress Automatic plugin is being exploited to inject backdoors and…

7 hours ago

Cryptocurrencies and cybercrime: A critical intermingling

As cryptocurrencies have grown in popularity, there has also been growing concern about cybercrime involvement…

9 hours ago

Kaiser Permanente data breach may have impacted 13.4 million patients

Healthcare service provider Kaiser Permanente disclosed a security breach that may impact 13.4 million individuals…

9 hours ago

Over 1,400 CrushFTP internet-facing servers vulnerable to CVE-2024-4040 bug

Over 1,400 CrushFTP internet-facing servers are vulnerable to attacks exploiting recently disclosed CVE-2024-4040 vulnerability. Over…

11 hours ago

Sweden’s liquor supply severely impacted by ransomware attack on logistics company

A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …

13 hours ago

CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog

CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…

24 hours ago

This website uses cookies.