Operation Payback
Encyclopedia
Operation Payback is a coordinated, decentralized group of attacks on opponents of Internet piracy by Internet activists using the "Anonymous
" moniker - a group sometimes affiliated with the website 4chan
. Operation Payback started as retaliation to distributed denial of service
(DDoS) attacks on torrent
sites; piracy proponents then decided to launch DDoS attacks on piracy opponents. The initial reaction snowballed into a wave of attacks on major pro-copyright and anti-piracy organizations, law firms, and individuals. Following the United States diplomatic cables leak
in December 2010, the organizers commenced DDoS attacks on websites of banks who had withdrawn banking facilities from WikiLeaks
.
companies hired Aiplex Software
to launch DDoS attacks on websites that did not respond to software takedown notices. Piracy activists then created Operation Payback in September 2010 in retaliation. The original plan was to attack Aiplex Software directly, but upon finding some hours before the planned DDoS that another individual had taken down the firm's website on their own, Operation Payback moved to launching attacks against the websites of copyright stringent organisations Motion Picture Association of America
(MPAA) and International Federation of the Phonographic Industry, giving the two websites a combined total downtime of 30 hours. In the following two days, Operation Payback attacked a multitude of sites affiliated with the MPAA, the Recording Industry Association of America
(RIAA), and British Phonographic Industry
. Law firms such as ACS:Law
, Davenport Lyons
and Dunlap, Grubb & Weaver (of the US Copyright Group
) were also attacked.
was subjected to a DDoS attack as part of Operation Payback. When asked about the attacks, Andrew Crossley, owner of ACS:Law, said: "It was only down for a few hours. I have far more concern over the fact of my train turning up 10 minutes late or having to queue for a coffee than them wasting my time with this sort of rubbish."
When the site came back online, a 350MB
file which was a backup of the site was visible to anyone for a short period of time. The backup, which included copies of emails sent by the firm, was downloaded and made available onto various peer-to-peer
networks and websites including The Pirate Bay
. Some of the emails contained unencrypted Excel
spreadsheets, listing the names and addresses of people that ACS:Law had accused of illegally sharing media. One contained over 5,300 Sky broadband
customers whom they had accused of illegally sharing pornography
, while another contained the details of 8,000 Sky customers and 400 Plusnet
customers accused of infringing the copyright on music by sharing it on peer-to-peer networks
. This alleged breach of the Data Protection Act has become part of the ongoing investigation into ACS:Law by the Information Commissioner's Office.
On 30 September, the Leesburg, VA office of Dunlap, Grubb & Weaver law firm – also doing business as the "U.S. Copyright Group
" – was evacuated by the police after an emailed bomb threat was received. It's believed the event could be connected to Anonymous. Non-related copyright or law firms sites, such as websheriff.com, were also attacked. These attacks were originally organized through an Internet Relay Chat
channel. The attacks also became a popular topic on Twitter
.
citizens can’t access thepiratebay.org, Associação do Comércio Audiovisual de Portugal (ACAPOR) has filed a complaint against The Pirate Bay
. The complaint was filed with the General Inspection of Cultural Activities, which is part of the Portuguese Ministry of Culture
. According to the movie rental association, The Pirate Bay is directly responsible for about 15 million illegal downloads in Portugal every year. By installing a Pirate Bay block at all ISP
s, ACAPOR hopes to decrease the financial damage they claim it causes.
On 18 October 2010, the ACAPOR website was defaced
, presenting a speech from Operation Payback and a redirect to The Pirate Bay after a few seconds. In addition to defacing the website, they also managed to grab a copy of the email database of ACAPOR and uploaded it to thepiratebay.org. The leaked e-mails so far revealed ACAPOR's methods of denunciation, their dissatisfaction with the Portuguese government and justice system, their perception of the copyright debate as war, and their antagonism with the ISPs. ACAPOR claimed that "the business of ISPs is illegal downloading."
website and the Gallant Macmillian website.
On 7 October 2010, they attacked the website of the Spanish copyright society, sgae.es. As of 7 October 2010, total downtime for all websites attacked during Operation Payback was 537.55 hours.
On 15 October 2010, Copyprotected.com was SQL injected
and defaced, and three days later Operation Payback launched a DDoS attack against the UK Intellectual Property Office.
Production companies SatelFilm.at and Wega-Film.at were hit by "drive-by" DDoSes during October 21, 2010, in response to their efforts to gain a court injunction against an ISP that refused to block a movie streaming website, and Operation Payback then knocked porn website Hustler.com
offline the following day.
convention, Gene Simmons
of KISS
stated:
In response to Gene Simmons' comments, members of Operation Payback switched their attentions to his two websites SimmonsRecords.com and GeneSimmons.com, taking them both offline for a total of 1 day and 14 hours. At some point during the course of this DDoS, GeneSimmons.com was hacked and redirected to ThePirateBay.org
, In response to the attack Simmons wrote:
This led to additional attacks and subsequently more downtime for his websites. Later, Simmons's message was removed from his website.
was ordered to disable the "searching, downloading, uploading, file trading and/or file distribution functionality" after losing a court battle with the RIAA over claims of copyright infringement. The RIAA also announced intentions to pursue legal action over the damages caused by the program in January to compensate the affected record labels. In retaliation, members of Operation Payback announced that they will attack RIAA's website on October 29, despite that the group typically doesn't hit targets twice. On October 29, riaa.org was taken offline via denial-of-service attack
. After the attack, riaa.com and riaa.org sites became unavailable from Europe. Operation Payback's main site was attacked later that day and they moved their website from tieve.tk to anonops.net.
, which Anonymous heavily affiliates with through its use of Guy Fawkes
masks. After that event, Operation Payback took a break from attacking websites to organize.
, the FBI
launched an investigation. FBI representatives did not respond to interview requests. They later arrested eleven people accused of taking part in the attack on Paypal.
announced that her website and personal credit card information were compromised. Palin's team believed the attack was executed by Anonymous, though Anonymous never tweeted anything about choosing Palin as a target for the DDoS attack. An Anonymous member has stated "We don’t really care about Sarah Palin that much, to be honest. I don’t really know what she’s trying to accomplish or what attention she is trying to gain. We personally don’t care about Sarah Palin" Her technical team posted a screenshot of a server log file showing the wikileaks.org URL Visa attacks had been denial of service attacks, but credit card data was not compromised. It is unknown whether Palin's card was compromised as part of a broad attack on Visa or a specific attack on the Palins. Sarah Palin's email had already been hacked
by a member of Anonymous in 2008.
came under intense pressure to stop publishing secret United States diplomatic cables. Corporations such as Amazon
, PayPal
, BankAmerica, PostFinance
, MasterCard
and Visa either stopped working with or froze donations to WikiLeaks due to political pressures. In response, those behind Operation Payback directed their activities against these companies for dropping support to WikiLeaks. Operation Payback launched DDoS attacks against PayPal, the Swiss bank PostFinance and the Swedish Prosecution Authority. On 8 December 2010, a coordinated DDoS attack by Operation Payback brought down both the MasterCard and Visa websites. On 9th December 2010, prior to a sustained DDoS attack on the Paypal website that caused a minor slowdown to their service, Paypal announced on its blog that they would release all remaining funds in the account of the Wau Holland Foundation
that was raising funds for WikiLeaks, but would not reactivate the account. Regarding the attacks, WikiLeaks spokesman Kristinn Hrafnsson denied any relation to the group and said: “We neither condemn nor applaud these attacks. We believe they are a reflection of public opinion on the actions of the targets.” On the same day, a 16-year-old boy was arrested in The Hague
, Netherlands
, in connection with the distributed denial-of-service attacks against MasterCard and PayPal. The boy was an IRC operator under the nickname of Jeroenz0r.
On 10 December 2010, The Daily Telegraph
reported that Anonymous had threatened to disrupt British government websites if Assange were extradited to Sweden. Anonymous issued a press release in an attempt to clarify the issue.
Electronic Frontier Foundation
co-founder John Perry Barlow
described the attacks as "the shot heard round the world
—this is Lexington
."
The following is a list of sites and domains known to have been targeted:
Operation Payback's attempt to take down Amazon.com was aborted after they failed to recruit enough users to their botnet.
In late December the FBI began to raid suspected participants in Operation Payback.
At the beginning of 2011, Operation Payback brought down Zimbabwe
an government websites after the Zimbabwean President's
wife
sued a newspaper for US $15 million for publishing a WikiLeaks cable that linked her with the alleged trade in illicit
diamonds. On January 27, 2011, five males aged between 15 and 26 were arrested in early morning raids in the U.K. on suspicion of involvement and 40 search warrants were executed on the same day by the FBI.
citizens of access to information they have a democratic right to see, and by taking offline KISS
member Gene Simmons' sites, Operation Payback members were depriving him of his right to free speech.
A spokesman for the MPAA said: "It's troubling that these groups seem more concerned about the rights of those who steal and copy films, music, books, and other creative resources than the rights of American workers who are producing these products."
There was also some criticism from the Pirate Party UK
and United States Pirate Party, who in a joint public statement urged the group to "Immediately cease the Distributed Denial-of-Service (DDoS) attacks and to instead seek out a legal method to express your frustration and disquiet with the copyright industry, and their perversions of copyright law for personal gain”
While acknowledged that the DDoS attacks on credit card and banking web sites serve as political protests, cyber experts have said that Operation Payback has not done any long-term damage: most sites are back online, these attacks have not penetrated and brought down entire banking systems used to conduct transactions, and people are still continuing to use their credit cards to make payments. "This is more like a noisy political demonstration, like a mob surrounding a bank and refusing to let anyone in or out" said one cyber expert.
, where it can be controlled remotely. This allows computers with LOIC installed on them to behave as if they were a part of a botnet
. Utilising this tool, the coordinators of Operation Payback were able to quickly take down websites belonging to anti-piracy groups. Botnets of all sizes have also been used.
Communication consists of an IRC channel where targets are decided upon, after which "attack posters" are produced and posted on the various imageboards (4chan/7chan/711chan/420chan/808chan). Media such as Twitter
and Facebook
have previously been utilised for co-ordination, but on December 8, 2010 Operation Payback's Facebook
page was removed and their official Twitter
account was suspended. Also, according to Valleywag
, Encyclopedia Dramatica
was forced to delete their article on Operation Payback.
Anonymous (group)
Anonymous is an international hacking group, spread through the Internet, initiating active civil disobedience, while attempting to maintain anonymity. Originating in 2003 on the imageboard 4chan, the term refers to the concept of many online community users simultaneously existing as an anarchic,...
" moniker - a group sometimes affiliated with the website 4chan
4chan
4chan is an English-language imageboard website. Launched on October 1, 2003, its boards were originally used for the posting of pictures and discussion of manga and anime...
. Operation Payback started as retaliation to distributed denial of service
Denial-of-service attack
A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...
(DDoS) attacks on torrent
Torrent file
A torrent file stores metadata used for BitTorrent. It is defined in the BitTorrent specification.Simply, a torrent is data about a target file, though it contains no information about the content of the file. The only data that the torrent holds is information about the location of different...
sites; piracy proponents then decided to launch DDoS attacks on piracy opponents. The initial reaction snowballed into a wave of attacks on major pro-copyright and anti-piracy organizations, law firms, and individuals. Following the United States diplomatic cables leak
United States diplomatic cables leak
The United States diplomatic cables leak, widely known as Cablegate, began in February 2010 when WikiLeaks—a non-profit organization that publishes submissions from anonymous whistleblowers—began releasing classified cables that had been sent to the U.S. State Department by 274 of its consulates,...
in December 2010, the organizers commenced DDoS attacks on websites of banks who had withdrawn banking facilities from WikiLeaks
Wikileaks
WikiLeaks is an international self-described not-for-profit organisation that publishes submissions of private, secret, and classified media from anonymous news sources, news leaks, and whistleblowers. Its website, launched in 2006 under The Sunshine Press organisation, claimed a database of more...
.
Background and initial attacks
In 2010, several BollywoodBollywood
Bollywood is the informal term popularly used for the Hindi-language film industry based in Mumbai , Maharashtra, India. The term is often incorrectly used to refer to the whole of Indian cinema; it is only a part of the total Indian film industry, which includes other production centers producing...
companies hired Aiplex Software
Aiplex Software
Aiplex Software is a company based in India contracted by the MPAA to deliver copyright notices to websites that they deem violate copyright laws, and distributed denial-of-service attacks to said sites if they fail to remove the offending content...
to launch DDoS attacks on websites that did not respond to software takedown notices. Piracy activists then created Operation Payback in September 2010 in retaliation. The original plan was to attack Aiplex Software directly, but upon finding some hours before the planned DDoS that another individual had taken down the firm's website on their own, Operation Payback moved to launching attacks against the websites of copyright stringent organisations Motion Picture Association of America
Motion Picture Association of America
The Motion Picture Association of America, Inc. , originally the Motion Picture Producers and Distributors of America , was founded in 1922 and is designed to advance the business interests of its members...
(MPAA) and International Federation of the Phonographic Industry, giving the two websites a combined total downtime of 30 hours. In the following two days, Operation Payback attacked a multitude of sites affiliated with the MPAA, the Recording Industry Association of America
Recording Industry Association of America
The Recording Industry Association of America is a trade organization that represents the recording industry distributors in the United States...
(RIAA), and British Phonographic Industry
British Phonographic Industry
The British Phonographic Industry is the British record industry's trade association.-Structure:Its membership comprises hundreds of music companies including all four "major" record companies , associate members such as manufacturers and distributors, and hundreds of independent music companies...
. Law firms such as ACS:Law
ACS:Law
ACS:Law was a United Kingdom law firm specialising in intellectual property law. Prior to 2009, its most notable case was the defence of a British national accused of public indecency in Dubai. The firm is best known for its actions against persons allegedly infringing copyright through...
, Davenport Lyons
Davenport Lyons
Davenport Lyons is a London-based law firm who provide legal advice and services across various fields. Although most of their work concerns corporate acquisitions, in 2007 their actions against file sharers became news in the United Kingdom...
and Dunlap, Grubb & Weaver (of the US Copyright Group
US Copyright Group
The US Copyright Group is a business registered by the law firm Dunlap, Grubb & Weaver that also operates under the SaveCinema.org moniker. It is engaged in suing people in the U.S...
) were also attacked.
Attacks on the recording industry
Law firms
On 21 September 2010, the website of ACS:LawACS:Law
ACS:Law was a United Kingdom law firm specialising in intellectual property law. Prior to 2009, its most notable case was the defence of a British national accused of public indecency in Dubai. The firm is best known for its actions against persons allegedly infringing copyright through...
was subjected to a DDoS attack as part of Operation Payback. When asked about the attacks, Andrew Crossley, owner of ACS:Law, said: "It was only down for a few hours. I have far more concern over the fact of my train turning up 10 minutes late or having to queue for a coffee than them wasting my time with this sort of rubbish."
When the site came back online, a 350MB
Megabyte
The megabyte is a multiple of the unit byte for digital information storage or transmission with two different values depending on context: bytes generally for computer memory; and one million bytes generally for computer storage. The IEEE Standards Board has decided that "Mega will mean 1 000...
file which was a backup of the site was visible to anyone for a short period of time. The backup, which included copies of emails sent by the firm, was downloaded and made available onto various peer-to-peer
Peer-to-peer
Peer-to-peer computing or networking is a distributed application architecture that partitions tasks or workloads among peers. Peers are equally privileged, equipotent participants in the application...
networks and websites including The Pirate Bay
The Pirate Bay
The Pirate Bay is a Swedish website which hosts magnet links and .torrent files, which allow users to share electronic files, including multimedia, computer games and software via BitTorrent...
. Some of the emails contained unencrypted Excel
Microsoft Excel
Microsoft Excel is a proprietary commercial spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS X. It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications...
spreadsheets, listing the names and addresses of people that ACS:Law had accused of illegally sharing media. One contained over 5,300 Sky broadband
Sky Broadband
Sky Broadband is an internet service provider for Sky customers.As of March 2008 Sky claims to have reached 1.428 million customers, and unbundled 1,179 exchanges, covering 70% of the United Kingdom. In October 2007, Sky reached the 1 million mark in terms of customer numbers, and claim to be...
customers whom they had accused of illegally sharing pornography
Pornography
Pornography or porn is the explicit portrayal of sexual subject matter for the purposes of sexual arousal and erotic satisfaction.Pornography may use any of a variety of media, ranging from books, magazines, postcards, photos, sculpture, drawing, painting, animation, sound recording, film, video,...
, while another contained the details of 8,000 Sky customers and 400 Plusnet
Plusnet
Plusnet is an Internet Service Provider based in Sheffield, South Yorkshire, England. Plusnet was floated on the Alternative Investment Market in July 2004, making them a Public limited company . It has been owned since 30 January 2007 by BT Group, but operates as a separate business...
customers accused of infringing the copyright on music by sharing it on peer-to-peer networks
Peer-to-peer file sharing
P2P or Peer-to-peer file sharing allows users to download files such as music, movies, and games using a P2P software client that searches for other connected computers. The "peers" are computer systems connected to each other through internet. Thus, the only requirements for a computer to join...
. This alleged breach of the Data Protection Act has become part of the ongoing investigation into ACS:Law by the Information Commissioner's Office.
On 30 September, the Leesburg, VA office of Dunlap, Grubb & Weaver law firm – also doing business as the "U.S. Copyright Group
US Copyright Group
The US Copyright Group is a business registered by the law firm Dunlap, Grubb & Weaver that also operates under the SaveCinema.org moniker. It is engaged in suing people in the U.S...
" – was evacuated by the police after an emailed bomb threat was received. It's believed the event could be connected to Anonymous. Non-related copyright or law firms sites, such as websheriff.com, were also attacked. These attacks were originally organized through an Internet Relay Chat
Internet Relay Chat
Internet Relay Chat is a protocol for real-time Internet text messaging or synchronous conferencing. It is mainly designed for group communication in discussion forums, called channels, but also allows one-to-one communication via private message as well as chat and data transfer, including file...
channel. The attacks also became a popular topic on Twitter
Twitter
Twitter is an online social networking and microblogging service that enables its users to send and read text-based posts of up to 140 characters, informally known as "tweets".Twitter was created in March 2006 by Jack Dorsey and launched that July...
.
Australian pro-copyright organization
On 27 September 2010, the DDoS attack on the Australian Federation Against Copyright Theft (AFACT) unintentionally brought down 8,000 other small websites hosted on the same server.ACAPOR
In September 2010, in an attempt to ensure that PortuguesePortugal
Portugal , officially the Portuguese Republic is a country situated in southwestern Europe on the Iberian Peninsula. Portugal is the westernmost country of Europe, and is bordered by the Atlantic Ocean to the West and South and by Spain to the North and East. The Atlantic archipelagos of the...
citizens can’t access thepiratebay.org, Associação do Comércio Audiovisual de Portugal (ACAPOR) has filed a complaint against The Pirate Bay
The Pirate Bay
The Pirate Bay is a Swedish website which hosts magnet links and .torrent files, which allow users to share electronic files, including multimedia, computer games and software via BitTorrent...
. The complaint was filed with the General Inspection of Cultural Activities, which is part of the Portuguese Ministry of Culture
Ministry of Culture (Portugal)
The Ministry of Culture was a department of the Portuguese government, responsible for issues related to the Portuguese culture. The last minister was Gabriela Canavilhas. After the 2011 legislative elections the new government disestablished the ministry.-External links:*...
. According to the movie rental association, The Pirate Bay is directly responsible for about 15 million illegal downloads in Portugal every year. By installing a Pirate Bay block at all ISP
Internet service provider
An Internet service provider is a company that provides access to the Internet. Access ISPs directly connect customers to the Internet using copper wires, wireless or fiber-optic connections. Hosting ISPs lease server space for smaller businesses and host other people servers...
s, ACAPOR hopes to decrease the financial damage they claim it causes.
On 18 October 2010, the ACAPOR website was defaced
Website defacement
A website defacement is an attack on a website that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own....
, presenting a speech from Operation Payback and a redirect to The Pirate Bay after a few seconds. In addition to defacing the website, they also managed to grab a copy of the email database of ACAPOR and uploaded it to thepiratebay.org. The leaked e-mails so far revealed ACAPOR's methods of denunciation, their dissatisfaction with the Portuguese government and justice system, their perception of the copyright debate as war, and their antagonism with the ISPs. ACAPOR claimed that "the business of ISPs is illegal downloading."
More attacks
On 4 October 2010, Operation Payback launched an attack on the Ministry of SoundMinistry of Sound
Ministry of Sound London, commonly referred to as simply Ministry of Sound or MoS, is a nightclub based in London, United Kingdom and an associated record label. It was ranked fourth in the 2010 DJ Magazine top 100 clubs poll 2010. As well as the nightclub in London, there is another in Egypt and...
website and the Gallant Macmillian website.
On 7 October 2010, they attacked the website of the Spanish copyright society, sgae.es. As of 7 October 2010, total downtime for all websites attacked during Operation Payback was 537.55 hours.
On 15 October 2010, Copyprotected.com was SQL injected
SQL injection
A SQL injection is often used to attack the security of a website by inputting SQL statements in a web form to get a badly designed website in order to dump the database content to the attacker. SQL injection is a code injection technique that exploits a security vulnerability in a website's software...
and defaced, and three days later Operation Payback launched a DDoS attack against the UK Intellectual Property Office.
Production companies SatelFilm.at and Wega-Film.at were hit by "drive-by" DDoSes during October 21, 2010, in response to their efforts to gain a court injunction against an ISP that refused to block a movie streaming website, and Operation Payback then knocked porn website Hustler.com
Hustler
Hustler is a monthly pornographic magazine aimed at men and published in the United States. It was first published in 1974 by Larry Flynt. It was a step forward from the Hustler Newsletter which was cheap advertising for his strip club businesses at the time. The magazine grew from a shaky start to...
offline the following day.
Musician and copyright advocate
During the 2010 MIPCOMMipcom
-MIPCOM:MIPCOM is a TV and entertainment market which is held in the town of Cannes once every year, normally in October.It is essentially a content event for co-producing, buying, selling, financing and distributing entertainment content...
convention, Gene Simmons
Gene Simmons
Gene Simmons is an Israeli-American entrepreneur, singer-songwriter, actor, and rock bassist. Known as "The Demon", he is the bassist/vocalist of Kiss, a hard rock band he co-founded in the early 1970s.-Early life:...
of KISS
KISS (band)
Kiss is an American rock band formed in New York City in January 1973. Well-known for its members' face paint and flamboyant stage outfits, the group rose to prominence in the mid to late 1970s on the basis of their elaborate live performances, which featured fire breathing, blood spitting,...
stated:
Make sure your brand is protected...Make sure there are no incursions. Be litigious. Sue everybody. Take their homes, their cars. Don't let anybody cross that line.
In response to Gene Simmons' comments, members of Operation Payback switched their attentions to his two websites SimmonsRecords.com and GeneSimmons.com, taking them both offline for a total of 1 day and 14 hours. At some point during the course of this DDoS, GeneSimmons.com was hacked and redirected to ThePirateBay.org
The Pirate Bay
The Pirate Bay is a Swedish website which hosts magnet links and .torrent files, which allow users to share electronic files, including multimedia, computer games and software via BitTorrent...
, In response to the attack Simmons wrote:
Some of you may have heard a few popcorn farts re: our sites being threatened by hackers.
Our legal team and the FBI have been on the case and we have found a few, shall we say "adventurous" young people, who feel they are above the law.
And, as stated in my MIPCOM speech, we will sue their pants off.
First, they will be punished.
Second, they might find their little butts in jail, right next to someone who's been there for years and is looking for a new girl friend.
We will soon be printing their names and pictures.
We will find you.
You cannot hide.
Stay tuned
This led to additional attacks and subsequently more downtime for his websites. Later, Simmons's message was removed from his website.
RIAA
On October 26, 2010, LimeWireLimeWire
LimeWire is a free peer-to-peer file sharing client program that runs on Windows, Mac OS X, Linux, and other operating systems supported by the Java software platform. LimeWire uses the gnutella network as well as the BitTorrent protocol. A free software version and a purchasable "enhanced"...
was ordered to disable the "searching, downloading, uploading, file trading and/or file distribution functionality" after losing a court battle with the RIAA over claims of copyright infringement. The RIAA also announced intentions to pursue legal action over the damages caused by the program in January to compensate the affected record labels. In retaliation, members of Operation Payback announced that they will attack RIAA's website on October 29, despite that the group typically doesn't hit targets twice. On October 29, riaa.org was taken offline via denial-of-service attack
Denial-of-service attack
A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer resource unavailable to its intended users...
. After the attack, riaa.com and riaa.org sites became unavailable from Europe. Operation Payback's main site was attacked later that day and they moved their website from tieve.tk to anonops.net.
November 5
Around October 28, 2010, the group set up a new website with the intention of coordinating protests around the world to raise awareness of their cause. The date for the protest activities were on November 5, the intended day of the Gunpowder PlotGunpowder Plot
The Gunpowder Plot of 1605, in earlier centuries often called the Gunpowder Treason Plot or the Jesuit Treason, was a failed assassination attempt against King James I of England and VI of Scotland by a group of provincial English Catholics led by Robert Catesby.The plan was to blow up the House of...
, which Anonymous heavily affiliates with through its use of Guy Fawkes
Guy Fawkes
Guy Fawkes , also known as Guido Fawkes, the name he adopted while fighting for the Spanish in the Low Countries, belonged to a group of provincial English Catholics who planned the failed Gunpowder Plot of 1605.Fawkes was born and educated in York...
masks. After that event, Operation Payback took a break from attacking websites to organize.
FBI investigation
After an attack on the United States Copyright OfficeUnited States Copyright Office
The United States Copyright Office, a part of the Library of Congress, is the official U.S. government body that maintains records of copyright registration in the United States. It is used by copyright title searchers who are attempting to clear a chain of title for copyrighted works.The head of...
, the FBI
Federal Bureau of Investigation
The Federal Bureau of Investigation is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency . The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime...
launched an investigation. FBI representatives did not respond to interview requests. They later arrested eleven people accused of taking part in the attack on Paypal.
Sarah Palin
On December 8, Sarah PalinSarah Palin
Sarah Louise Palin is an American politician, commentator and author. As the Republican Party nominee for Vice President in the 2008 presidential election, she was the first Alaskan on the national ticket of a major party and first Republican woman nominated for the vice-presidency.She was...
announced that her website and personal credit card information were compromised. Palin's team believed the attack was executed by Anonymous, though Anonymous never tweeted anything about choosing Palin as a target for the DDoS attack. An Anonymous member has stated "We don’t really care about Sarah Palin that much, to be honest. I don’t really know what she’s trying to accomplish or what attention she is trying to gain. We personally don’t care about Sarah Palin" Her technical team posted a screenshot of a server log file showing the wikileaks.org URL Visa attacks had been denial of service attacks, but credit card data was not compromised. It is unknown whether Palin's card was compromised as part of a broad attack on Visa or a specific attack on the Palins. Sarah Palin's email had already been hacked
Sarah Palin email hack
The Sarah Palin email hack occurred on September 16, 2008, during the 2008 United States presidential election campaign when the Yahoo! personal email account of vice presidential candidate Sarah Palin was subjected to unauthorized access...
by a member of Anonymous in 2008.
Operation Avenge Assange
In December 2010, WikiLeaksWikileaks
WikiLeaks is an international self-described not-for-profit organisation that publishes submissions of private, secret, and classified media from anonymous news sources, news leaks, and whistleblowers. Its website, launched in 2006 under The Sunshine Press organisation, claimed a database of more...
came under intense pressure to stop publishing secret United States diplomatic cables. Corporations such as Amazon
Amazon.com
Amazon.com, Inc. is a multinational electronic commerce company headquartered in Seattle, Washington, United States. It is the world's largest online retailer. Amazon has separate websites for the following countries: United States, Canada, United Kingdom, Germany, France, Italy, Spain, Japan, and...
, PayPal
PayPal
PayPal is an American-based global e-commerce business allowing payments and money transfers to be made through the Internet. Online money transfers serve as electronic alternatives to paying with traditional paper methods, such as checks and money orders....
, BankAmerica, PostFinance
PostFinance
PostFinance is founded in 1906 and the financial services unit of Swiss Post, and the fifth largest retail financial institution in Switzerland...
, MasterCard
MasterCard
Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...
and Visa either stopped working with or froze donations to WikiLeaks due to political pressures. In response, those behind Operation Payback directed their activities against these companies for dropping support to WikiLeaks. Operation Payback launched DDoS attacks against PayPal, the Swiss bank PostFinance and the Swedish Prosecution Authority. On 8 December 2010, a coordinated DDoS attack by Operation Payback brought down both the MasterCard and Visa websites. On 9th December 2010, prior to a sustained DDoS attack on the Paypal website that caused a minor slowdown to their service, Paypal announced on its blog that they would release all remaining funds in the account of the Wau Holland Foundation
Wau Holland Foundation
The Wau Holland Foundation is a nonprofit foundation based in Berlin, Germany.It was established in 2003 in memory of Wau Holland, co-founder of the Chaos Computer Club...
that was raising funds for WikiLeaks, but would not reactivate the account. Regarding the attacks, WikiLeaks spokesman Kristinn Hrafnsson denied any relation to the group and said: “We neither condemn nor applaud these attacks. We believe they are a reflection of public opinion on the actions of the targets.” On the same day, a 16-year-old boy was arrested in The Hague
The Hague
The Hague is the capital city of the province of South Holland in the Netherlands. With a population of 500,000 inhabitants , it is the third largest city of the Netherlands, after Amsterdam and Rotterdam...
, Netherlands
Netherlands
The Netherlands is a constituent country of the Kingdom of the Netherlands, located mainly in North-West Europe and with several islands in the Caribbean. Mainland Netherlands borders the North Sea to the north and west, Belgium to the south, and Germany to the east, and shares maritime borders...
, in connection with the distributed denial-of-service attacks against MasterCard and PayPal. The boy was an IRC operator under the nickname of Jeroenz0r.
On 10 December 2010, The Daily Telegraph
The Daily Telegraph
The Daily Telegraph is a daily morning broadsheet newspaper distributed throughout the United Kingdom and internationally. The newspaper was founded by Arthur B...
reported that Anonymous had threatened to disrupt British government websites if Assange were extradited to Sweden. Anonymous issued a press release in an attempt to clarify the issue.
Electronic Frontier Foundation
Electronic Frontier Foundation
The Electronic Frontier Foundation is an international non-profit digital rights advocacy and legal organization based in the United States...
co-founder John Perry Barlow
John Perry Barlow
John Perry Barlow is an American poet and essayist, a retired Wyoming cattle rancher, and a cyberlibertarian political activist who has been associated with both the Democratic and Republican parties. He is also a former lyricist for the Grateful Dead and a founding member of the Electronic...
described the attacks as "the shot heard round the world
Shot heard round the world
The "Shot heard 'round the world" is a phrase that has come to represent several historical incidents. The line is originally from the opening stanza of Ralph Waldo Emerson's "Concord Hymn" , and referred to the beginning of the American Revolutionary War...
—this is Lexington
Battles of Lexington and Concord
The Battles of Lexington and Concord were the first military engagements of the American Revolutionary War. They were fought on April 19, 1775, in Middlesex County, Province of Massachusetts Bay, within the towns of Lexington, Concord, Lincoln, Menotomy , and Cambridge, near Boston...
."
The following is a list of sites and domains known to have been targeted:
| Target | Site | Attack time | Ref. |
|---|---|---|---|
| PostFinance PostFinance PostFinance is founded in 1906 and the financial services unit of Swiss Post, and the fifth largest retail financial institution in Switzerland... |
postfinance.ch | 2010-12-06 | |
| Swedish Prosecution Authority | aklagare.se | 2010-12-07 | |
| EveryDNS EveryDNS EveryDNS.net was one of the world's largest free DNS management services, at one time providing DNS services for over 135,000 domains.- History :EveryDNS was founded in June 2001 by David Ulevitch. On the 7th of January 2010 EveryDNS was purchased by Dyn Inc.... |
everydns.com | 2010-12-07 | |
| Joseph Lieberman | lieberman.senate.gov | 2010-12-08 | |
| MasterCard MasterCard Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States... |
mastercard.com | 2010-12-08 | |
| Borgstrom Claes Borgström Claes Gustaf Borgström is a Swedish lawyer and Social Democratic politician.- Education and career :Borgström earned a law degree from Stockholm University in 1974. Thereafter he started to work as a lawyer. He has worked on several high-profile criminal cases, most notably as a defence counsel... and Bodström Thomas Bodström Thomas Lennart Bodström is a Swedish politician and member of the Swedish Social Democratic Party. He was the Swedish Minister for Justice in the two last succeeding governments of the Swedish Prime Minister Göran Persson, from 2000 to 2006. Since October 2006 until October 2010 he was the chairman... |
advbyra.se | 2010-12-08 | |
| Visa | visa.com | 2010-12-08 | |
| Sarah Palin Sarah Palin Sarah Louise Palin is an American politician, commentator and author. As the Republican Party nominee for Vice President in the 2008 presidential election, she was the first Alaskan on the national ticket of a major party and first Republican woman nominated for the vice-presidency.She was... |
sarahpac.com | 2010-12-08 | |
| PayPal PayPal PayPal is an American-based global e-commerce business allowing payments and money transfers to be made through the Internet. Online money transfers serve as electronic alternatives to paying with traditional paper methods, such as checks and money orders.... |
thepaypalblog.com | 2010-12-09 | |
| Amazon Amazon.com Amazon.com, Inc. is a multinational electronic commerce company headquartered in Seattle, Washington, United States. It is the world's largest online retailer. Amazon has separate websites for the following countries: United States, Canada, United Kingdom, Germany, France, Italy, Spain, Japan, and... |
amazon.com | 2010-12-09 (Aborted) |
|
| PayPal | api.paypal.com:443 | 2010-12-10 | |
| MoneyBookers Moneybookers Moneybookers is an e-commerce business that allows payments and money transfers to be made through the Internet. It serves as an electronic alternative to traditional paper methods such as cheques and money orders. Moneybookers performs payment processing for websites, online auction sites, and... |
moneybookers.com | 2010-12-10 | |
| Conservatives4Palin | conservatives4palin.com | 2010-12-10 | |
Operation Payback's attempt to take down Amazon.com was aborted after they failed to recruit enough users to their botnet.
In late December the FBI began to raid suspected participants in Operation Payback.
At the beginning of 2011, Operation Payback brought down Zimbabwe
Zimbabwe
Zimbabwe is a landlocked country located in the southern part of the African continent, between the Zambezi and Limpopo rivers. It is bordered by South Africa to the south, Botswana to the southwest, Zambia and a tip of Namibia to the northwest and Mozambique to the east. Zimbabwe has three...
an government websites after the Zimbabwean President's
Robert Mugabe
Robert Gabriel Mugabe is the President of Zimbabwe. As one of the leaders of the liberation movement against white-minority rule, he was elected into power in 1980...
wife
Grace Mugabe
Grace Mugabe , , is the second wife of Zimbabwe President Robert Mugabe and the First Lady of Zimbabwe from her marriage to the leader in 1996....
sued a newspaper for US $15 million for publishing a WikiLeaks cable that linked her with the alleged trade in illicit
Illicit
Illicit may refer to:* illicit antiquities* illicit drug trade** illicit drug use** Illicit Drug Anti-Proliferation Act* illicit major* illicit minor* illicit work* Illicit Streetwear clothing company* Illicit...
diamonds. On January 27, 2011, five males aged between 15 and 26 were arrested in early morning raids in the U.K. on suspicion of involvement and 40 search warrants were executed on the same day by the FBI.
Criticism
The United Kingdom Intellectual Property Office said that when its site was attacked, those responsible were depriving BritishUnited Kingdom
The United Kingdom of Great Britain and Northern IrelandIn the United Kingdom and Dependencies, other languages have been officially recognised as legitimate autochthonous languages under the European Charter for Regional or Minority Languages...
citizens of access to information they have a democratic right to see, and by taking offline KISS
KISS (band)
Kiss is an American rock band formed in New York City in January 1973. Well-known for its members' face paint and flamboyant stage outfits, the group rose to prominence in the mid to late 1970s on the basis of their elaborate live performances, which featured fire breathing, blood spitting,...
member Gene Simmons' sites, Operation Payback members were depriving him of his right to free speech.
A spokesman for the MPAA said: "It's troubling that these groups seem more concerned about the rights of those who steal and copy films, music, books, and other creative resources than the rights of American workers who are producing these products."
There was also some criticism from the Pirate Party UK
Pirate Party UK
Pirate Party UK is a political party in the United Kingdom. The Pirate Party's core policies are to bring about reform to Copyright and Patent laws, support privacy and reduce surveillance from government and businesses, and guarantee genuine freedom of speech for everyone.The Pirate Party UK...
and United States Pirate Party, who in a joint public statement urged the group to "Immediately cease the Distributed Denial-of-Service (DDoS) attacks and to instead seek out a legal method to express your frustration and disquiet with the copyright industry, and their perversions of copyright law for personal gain”
While acknowledged that the DDoS attacks on credit card and banking web sites serve as political protests, cyber experts have said that Operation Payback has not done any long-term damage: most sites are back online, these attacks have not penetrated and brought down entire banking systems used to conduct transactions, and people are still continuing to use their credit cards to make payments. "This is more like a noisy political demonstration, like a mob surrounding a bank and refusing to let anyone in or out" said one cyber expert.
Tools and communication
Operation Payback members use a modified version of the Low Orbit Ion Cannon (LOIC) to execute the DDoS attacks. In September 2010, a "Hive Mind" mode was added to the LOIC. While in Hive Mind mode, the LOIC connects to IRCInternet Relay Chat
Internet Relay Chat is a protocol for real-time Internet text messaging or synchronous conferencing. It is mainly designed for group communication in discussion forums, called channels, but also allows one-to-one communication via private message as well as chat and data transfer, including file...
, where it can be controlled remotely. This allows computers with LOIC installed on them to behave as if they were a part of a botnet
Botnet
A botnet is a collection of compromised computers connected to the Internet. Termed "bots," they are generally used for malicious purposes. When a computer becomes compromised, it becomes a part of a botnet...
. Utilising this tool, the coordinators of Operation Payback were able to quickly take down websites belonging to anti-piracy groups. Botnets of all sizes have also been used.
Communication consists of an IRC channel where targets are decided upon, after which "attack posters" are produced and posted on the various imageboards (4chan/7chan/711chan/420chan/808chan). Media such as Twitter
Twitter
Twitter is an online social networking and microblogging service that enables its users to send and read text-based posts of up to 140 characters, informally known as "tweets".Twitter was created in March 2006 by Jack Dorsey and launched that July...
and Facebook
Facebook
Facebook is a social networking service and website launched in February 2004, operated and privately owned by Facebook, Inc. , Facebook has more than 800 million active users. Users must register before using the site, after which they may create a personal profile, add other users as...
have previously been utilised for co-ordination, but on December 8, 2010 Operation Payback's Facebook
Facebook
Facebook is a social networking service and website launched in February 2004, operated and privately owned by Facebook, Inc. , Facebook has more than 800 million active users. Users must register before using the site, after which they may create a personal profile, add other users as...
page was removed and their official Twitter
Twitter
Twitter is an online social networking and microblogging service that enables its users to send and read text-based posts of up to 140 characters, informally known as "tweets".Twitter was created in March 2006 by Jack Dorsey and launched that July...
account was suspended. Also, according to Valleywag
Valleywag
Valleywag was a Gawker Media blog with gossip and news about Silicon Valley personalities. It was initially launched under the direction of editor Nick Douglas in February 2006. After Douglas was fired, the blog was taken over by Owen Thomas. Thomas himself left in May 2009, to be replaced by Ryan...
, Encyclopedia Dramatica
Encyclopedia Dramatica
Encyclopædia Dramatica was a satirical open wiki that used MediaWiki software. Launched on December 10, 2004, it lampooned both encyclopedic topics and current events, especially those related or relevant to contemporary internet culture. It was frequently utilized by a socially fluid and dynamic...
was forced to delete their article on Operation Payback.
See also
- Chanology
- HacktivismHacktivismHacktivism is the use of computers and computer networks as a means of protest to promote political ends. The term was first coined in 1994 by a member of the Cult of the Dead Cow hacker collective named Omega...
- LulzSecLulzSecLulz Security, commonly abbreviated as LulzSec, is a computer hacker group that claims responsibility for several high profile attacks, including the compromise of user accounts from Sony Pictures in 2011. The group also claimed responsibility for taking the CIA website offline...
- Operation LeakspinOperation LeakspinOperation: Leakspin was conceived by Anonymous, with the purpose of sorting through recent WikiLeaks releases to identify and raise awareness of potentially important and previously overlooked cables.- Background :...
- Operation TitstormOperation TitstormThe February 2010 Australian Cyberattacks were a series of denial-of-service attacks conducted by the Anonymous online community against the Australian government in response to proposed web censorship regulations. Operation Titstorm was the name given to the cyber attacks by the perpetrators...
External links
- AnonOps – Main coordination website for Operation Payback (Disfunctioning)
- AnonOps IRC Network – Main IRC network where anonymous resides on
- Pandalabs.pandasecurity.com – Chronicle of all Operation Payback events