FBI Arrests Two Suspects Involved With Hacking Of CIA Director's Personal Email Account

from the hack-the-CIA-and-FBI,-but-keep-chatlogs-and-use-Twitter-DMs-because-?? dept

The alleged hackers who social engineered their way into CIA director John Brennan's personal email account have been rounded up by the FBI. The so-called "Crackas With Attitude" collective lost two of its members to the federal court system late last week.

Andrew Otto Boggs, 22, who allegedly used the handle Incursio, or IncursioSubter, and Justin Gray Liverman, who is suspected of using the moniker D3f4ult, were arrested on Thursday, according to a press release by the US State’s Attorney’s Office in the Eastern District of Virginia.

The affidavit [PDF] in support of the arrest warrant is a hell of a read -- although possibly a very trying read for those with limited patience for txt spk and l33t h4x0r screen names. It's also a cautionary tale of hubris winning out over operational security, somewhat ironic for a group of hackers who took obvious glee in pointing out how terrible everyone else's security is.

The group made heavy use of social media, and in particular Twitter, to spread news of the dumps and mock victims. However, according to the affidavit, Boggs allegedly connected to one of the implicated Twitter accounts (@GenuinelySpooky) from an IP address registered to his father, with whom Boggs lived.

Much the same mistake led to Liverman’s identification: an IP address used to access the Twitter handle @_D3F4ULT and another account during the relevant time period was registered to an Edith Liverman. According to the affidavit, publicly available information revealed that Justin Liverman lived with Edith at the time.

The affidavit also includes several sets of Twitter direct messages between members of the group.

Also uncovered during the investigation were stored chat logs and screen recordings of the hackers in action.

Possibly of use in connecting the dots for the FBI was one of the accused's (supposed) participation in the Pentagon's bug bounty program -- something he would have had to sign up for using verifiable information.

Justin Liverman, who goes by the handle “D3F4ULT,” according to a press release by the US Attorneys Office for the Eastern District of Virginia, states on his LinkedIn page that he participated in the HackThePentagon program.

Or not...

HackerOne would not confirm or deny whether Liverman participated in its HackThePentagon program. However, requirements for gaining clearance to submit to the bounty were lax. To qualify, hackers had to be US persons and couldn’t appear on the US Treasury Department’s Specially Designated Nationals list of people and organizations engaged in terrorism, drug trafficking and other crimes, according to a Department of Defense press release.

Tough to verify when the person in question spent nearly as much time shit-posting as hacking. All in all, CWA seemed to be a fun, if not overly-cautious bunch that truly enjoyed worming their way into the inner computing spaces of high-ranking government officials.

However, this does not mean the group was mostly harmless. The affidavit shows the arrestees allegedly engaged in nastier activities as well.

Liverman also allegedly used a phone number linked to the @_D3F4ULT account to call one of the unnamed victims, and even recorded himself paying for a phone-bombing service to bombard the target’s device with calls.

The affidavit contains one of the hackers stating another sent a victim's phone "720 voicemail threats and like a thousand goatse sms image messages."

Also from the affidavit, a little IM action about calling in a bomb threat at a local law enforcement office.

Meanwhile, those remaining are claiming two things: that there are more hackers still on the loose. And that the FBI has the wrong guy… in all senses of the word.

Zoom claimed to have been raided earlier this year, but said he hasn't been arrested nor charged yet. The hacker also claimed that the FBI got the wrong person arresting Boggs because Incursio was actually a woman.

“Its not like this isn't the first time the FBI has been confused,“ Zoom said.

If nothing else, the CWA hackings proved government agencies like the DHS and FBI must not be able to hear themselves talk when they demand more data on Americans, despite not being able to secure the information they already have from 16-year-old hackers who go by the name of "penis" on Twitter. Their efforts also made it clear that most cell phone service providers' authentication processes have miles to go before they even approach "competent."

Filed Under: andrew boggs, cia, crackas with attitude, email, hacking, jon brennan, justin liverman