Pierluigi Paganini
August 16, 2016
He is the Admin of #AnonSec & @L0sExtraditable hacker groups
Enjoy the Interview.
You are a talented hacker that has already participated in several hacking campaigns, could you tell me more about.
Our page on EncyclopediaDramatica should make easy for you to understand more about me. https://encyclopediadramatica.se/AnonSec & – http://pastebin.com/pm1WLXQj
Could you tell me which his your technical background and when you started hacking? Which are your motivations?
I grew up in the hacking community with my older brothers, they were part of the family business (Yakuza). However, I wanted more freedom than them, so I moved to the US with my mother when I was 16 and started hacking everything I could find while finishing high school. Most of my skillsets were either self-taught or by fellow blackhats, barely any from schooling. I have been in the scene since early 2011, I was a member of different hacker teams and I have gone by many handles you have heard before. d3f4ult the latest one, I was using it since 2013 when I joined to AnonSec and now in 2016 I have co-founded the new group @L0sExtraditable.
Which are your motivations?
Many different motivations at different points in my life. When I first started all I wanted to learn and cause mayhem. Then I became more politically motivated in my hacks as I grew up. Went through a “watch the world burn” phase during DHS hacks. However recently most of my motivations are profit driven.
What was your greatest hacking challenge?
Most definitely the @OpNasaDrones hack which took over 2 years to be completed and involved several 0days, however, I’m most proud of the Windsor University hack where we deleted the loan debts of $9.4million student .
“Sometimes I dream of saving the world…”
\!/ $9.4million student debt deleted \!/#AnonSec #WindsorUniversity pic.twitter.com/px9lTwwSDC— Dêfãult Vírüsa (@_d3f4ult) 6 ottobre 2015
We could have EASILY added BTC payment option and mass emailed all students to scam loan payments (even considered it), but decided to give back to the world instead. (Similar to MrRobot credit delete)
Which was your latest hack? Can you describe me it?
I was involved in many things I cannot talk about publically except two. One is a hack against Paypal API for business transactions that we decided to report instead of abuse except two. One is a hack against Paypal API for business transactions that we decided to report instead of abuse https://github.com/d3f4ultt/PrincesOfPaypal.
We kindly reported to Paypal bug bounty but we haven’t received any reward.bounty but we haven’t received any reward.
The other one is @L0sExtraditable’s #BushidoBot. The world first ASIC Bitcoin Mining botnet based on the QueenAnt PoC on BitMainTech’s AntMiner5s. Working with ppl on similar AntMiner7 & AntMiner9 PoCs since the src code is almost exactly the same. China is trying to take control of +51% of Bitcoin hashing power so we decided to make this botnet to try and even the odds and profit at the same time.ing botnet based on the QueenAnt PoC on BitMainTech’s AntMiner5s. Working with ppl on similar AntMiner7 & AntMiner9 PoCs since the src code is almost exactly the same. China is trying to take control of +51% of Bitcoin hashing power so we decided to make this botnet to try and even the odds and profit at the same time.ry and even the odds and profit at the same time.
What are the 4 tools that cannot be missed in the hacker’s arsenal and why?
The Importance of certain tools always depends on the target and attack vector. Like if you are going to launch a web attack then port scanners, hydra, dirbuster, reverse ip/whois lookups and automated vuln scanners like Nikto are useful. Or if you are going to launch a spear phishing attack then good spamming shells and FUD malware are advised. Or if you are going to going to launch SE/simswap, some carded skype creds, VOIP servers or burners are suggested. Look at TTP in OpNasaDrones zine for more specific tools.
Which are the most interesting hacking communities on the web today, why?
DefCon is a big part of my life and the best IRL hacker community. dark0de was the best online hacker community forum. HackForums is cancer and only good for scamming kids lol Phrack is deff the best zine community.
Did you participate in hacking attacks against the IS propaganda online? When? How?
Yes we were a BIG part of the initial hacks against ISIS. AnonSec started #OpTerror4ISIS and were heavily involved in #OpISIS with GhostSec. Our leader @MrLele1337 is actually Kurdish and in the Peshmerga Army so we have fought ISIS online and IRL, which most hacking groups can’t say.
Where do you find IS people to hack?
We worked with other groups who did most of the individual targeting and passed targets to us. We identified a lot of forums and blogs to target on our own. Some AnonSec members like Predator quit because of so many death threats from real ISIS members.
How do you choose your targets?
Generally we target people who deserve it, not very random anymore. Targets chosen 50% politically motivated & 50% profit motivated.
We often hear about cyber weapons and cyber attacks against critical infrastructure. Do you believe it is real the risk of a major and lethal cyber attack against a critical infrastructure?
Yes, of course. In my opinion, it is not a matter of if but when. SCADA and ICS have already been targeted and hacked publicly all around the world such as Iranian Nuclear Facility (Stuxnet) and Ukrainian Power Station. So it’s common sense to think there are more systems that will or have already been rekt. I would not doubt if APT is already inside the USA SCADA and ICS just like NSA The-ROC and Israel Unit8200 are ALL inside of Iran’s SCADA and ICS waiting and watching with “finger on the button”.
I suggest you to watch the documentary ZeroDays & RedTeamSecurity PoC of hacking Power Stations http://www.techinsider.io/redteam-hackers-power-grid-company-2016-4
Thanks a lot!
[adrotate banner=”9″]
(Security Affairs – hackers, Default Vírusa)
