FBI Arrests Two Suspects Involved With Hacking Of CIA Director's Personal Email Account

from the hack-the-CIA-and-FBI,-but-keep-chatlogs-and-use-Twitter-DMs-because-?? dept

The alleged hackers who social engineered their way into CIA director John Brennan’s personal email account have been rounded up by the FBI. The so-called “Crackas With Attitude” collective lost two of its members to the federal court system late last week.

Andrew Otto Boggs, 22, who allegedly used the handle Incursio, or IncursioSubter, and Justin Gray Liverman, who is suspected of using the moniker D3f4ult, were arrested on Thursday, according to a press release by the US State’s Attorney’s Office in the Eastern District of Virginia.

The affidavit [PDF] in support of the arrest warrant is a hell of a read — although possibly a very trying read for those with limited patience for txt spk and l33t h4x0r screen names. It’s also a cautionary tale of hubris winning out over operational security, somewhat ironic for a group of hackers who took obvious glee in pointing out how terrible everyone else’s security is.

The group made heavy use of social media, and in particular Twitter, to spread news of the dumps and mock victims. However, according to the affidavit, Boggs allegedly connected to one of the implicated Twitter accounts (@GenuinelySpooky) from an IP address registered to his father, with whom Boggs lived.

Much the same mistake led to Liverman’s identification: an IP address used to access the Twitter handle @_D3F4ULT and another account during the relevant time period was registered to an Edith Liverman. According to the affidavit, publicly available information revealed that Justin Liverman lived with Edith at the time.

The affidavit also includes several sets of Twitter direct messages between members of the group.

Also uncovered during the investigation were stored chat logs and screen recordings of the hackers in action.

Possibly of use in connecting the dots for the FBI was one of the accused’s (supposed) participation in the Pentagon’s bug bounty program — something he would have had to sign up for using verifiable information.

Justin Liverman, who goes by the handle “D3F4ULT,” according to a press release by the US Attorneys Office for the Eastern District of Virginia, states on his LinkedIn page that he participated in the HackThePentagon program.

Or not…

HackerOne would not confirm or deny whether Liverman participated in its HackThePentagon program. However, requirements for gaining clearance to submit to the bounty were lax. To qualify, hackers had to be US persons and couldn’t appear on the US Treasury Department’s Specially Designated Nationals list of people and organizations engaged in terrorism, drug trafficking and other crimes, according to a Department of Defense press release.

Tough to verify when the person in question spent nearly as much time shit-posting as hacking. All in all, CWA seemed to be a fun, if not overly-cautious bunch that truly enjoyed worming their way into the inner computing spaces of high-ranking government officials.

However, this does not mean the group was mostly harmless. The affidavit shows the arrestees allegedly engaged in nastier activities as well.

Liverman also allegedly used a phone number linked to the @_D3F4ULT account to call one of the unnamed victims, and even recorded himself paying for a phone-bombing service to bombard the target’s device with calls.

The affidavit contains one of the hackers stating another sent a victim’s phone “720 voicemail threats and like a thousand goatse sms image messages.”

Also from the affidavit, a little IM action about calling in a bomb threat at a local law enforcement office.

Meanwhile, those remaining are claiming two things: that there are more hackers still on the loose. And that the FBI has the wrong guy… in all senses of the word.

Zoom claimed to have been raided earlier this year, but said he hasn’t been arrested nor charged yet. The hacker also claimed that the FBI got the wrong person arresting Boggs because Incursio was actually a woman.

“Its not like this isn’t the first time the FBI has been confused,“ Zoom said.

If nothing else, the CWA hackings proved government agencies like the DHS and FBI must not be able to hear themselves talk when they demand more data on Americans, despite not being able to secure the information they already have from 16-year-old hackers who go by the name of “penis” on Twitter. Their efforts also made it clear that most cell phone service providers’ authentication processes have miles to go before they even approach “competent.”

Filed Under: , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “FBI Arrests Two Suspects Involved With Hacking Of CIA Director's Personal Email Account”

Subscribe: RSS Leave a comment
That Anonymous Coward (profile) says:

I await for the charges to be piled into the stratosphere, to make sure no one else would dare do this. And then they will go back to how they’ve always done things, secure that threats of a lifetime in jail will keep someone from making them look like fools again.

Even after this, anyone want to bet that these same holes exist? There might be a secret word required now, but how hard is it to get the dogs name?

Security through obscurity not working?
Try security through insane sentencing minimums.

Roger Strong (profile) says:

Re: Re: Re: Re:

Unlikely. With a private server when you delete an email you can ensure that it stays deleted. With AOL not only are they probably keeping backups, but their “marketing partners” may have copies.

To be thorough you do like some in Congress: Declare that you “don’t use email.” Then communicate through an aide’s email account. Preferably on a private server.

Croaker Jianghu says:

Twitter is as leaky as Karl ROVES ass

Note in these filings the prominent use of Twitter, and DM’s as ‘evidence?

Cuz Twitter has coders and InfraGard working te “back channel” and every time they pull off an eploit and pass the data to .mil or DHS or FBI, they perform cleanup operations.

It circumvents the warrant requirement/due pocess completely.

Wanna see how? #backchannel #cleanuprequest ‘back channel cleanup request’

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...