Puppet Masters
HBGary Federal chief exec Aaron Barr has resigned in a bid to allow the firm to draw a line under the continuing revelations from the Anonymous hack attack.
Barr was the prime mover in plans to out senior members of Anonymous at the B-Sides security conference last month. But hunter became hunted after the more skilled members of Anonymous hacked into HBGary Federal's computer network before publishing its email database.
The emails included the revelation that Morgan Stanley, a HBGary client, was hit by the Operation Aurora attacks of late 2009, as well as messages that purported to show HBGary was planning a dirty tricks campaign against WikiLeaks.
HBGary, while admitting it was hacked and not denying the authenticity of any particular message, has said that the notorious mischief maker at Anonymous had plenty of opportunity to alter the published emails. Nonetheless the hack itself, to say nothing of the range of circumstances that allowed the breach (insecure web apps, weak passwords and social engineering) would be hugely embarrassing for any firm, much less a small outfit that sells its white hat hacker expertise to government agencies and banks.
Adding insult to injury, HBGary has become the topic of comedy sketches, with comedian Stephen Colbert devoting a segment of the Colbert Report to the hack on 24 January. The sketch mocked both Barr ("master of counter-hacking" and World of Warcraft "level 90 night-elf druid") and "global hacker nerd brigade" Anonymous. According to Colbert: "Anonymous is a hornets' nest and Barr said I'm gonna stick my penis in that thing."
With such unwanted and high-profile media attention, to say nothing of the doubtless awkward private exchanges between HBGary and its client in private, it comes as little surprise that Barr has decided to fall on his sword.
"I need to focus on taking care of my family and rebuilding my reputation," Barr told Threatpost in a phone interview. "It's been a challenge to do that and run a company. And, given that I've been the focus of much of bad press, I hope that, by leaving, HBGary and HBGary Federal can get away from some of that. I'm confident they'll be able to weather this storm."
HBGary is yet to comment officially on the resignation, which renews questions about its plans to move on from the hugely embarrassing Anonymous hack. We've put in a query to the firm and will update this story as and when we hear more.
Reader Comments
to your CURRENT PROFICIENCY r u aware of a thing called "cyberwarfare" and has been goin' on since 1995 ? It's not going to end because the basic principles remain the same.
One cannot obtain emails an access to secure information via a syn flood or a DOS or even a DDOS. These kinds of attacks are to "Deny Service" to a group or organization. Very different than obtaining access to protected information.
I'm not going to get into a debate as to how a person may or may not hack a server, but in order to get access to information, that information needs to be in a location where it is accessible. In the above case, that information was obviously accessible or anonymous would not have got to it.
The basic principals of attacks have indeed changed a lot since 1995. The Kevin Mitnick social engineering attack simply wont work today, and most of the routers connecting servers are protected from many kinds of older attacks.
I'm not sure what you are getting at, but you have certainly missed the point of what I was saying. Which in itself is a confirmation of exactly the point I was trying to make. Thanks for helping me make my point.




People that utilize the "all in one" server setup are begging to be abused. Some ISPs. actually many in the USSA and Canada, utilize the same server or VPS for all of their internet services. DNS, WEB, EMAIL and applications. This lack of infrastructure is a cost saving measure, but allows a relatively unskilled hacker complete access to the servers when they successfully exploit one of the services involved.
One would hope that a self professed white hat hacking organization would be knowledgeable enough to protect themselves from this rudimentary mistake. Resigning is a nice step, but they really should hang their heads in shame. Before one publicly decides to take on the legion vast that is anonymous they should make doubly sure that they aren't using an open source CMS nor keeping their laundry in a web ready format...
Thx