Amidst the turmoil, chaos and outrage that has followed the death of George Floyd on the streets of Minneapolis, a familiar presence returned to our news feeds: the Guy Fawkes-masked face of Anonymous.
The loosely-defined, online hacktivist collective, in a video, promised to “expose the many crimes” of the Minneapolis Police Department to the world. That video attracted more than 85,000 responses on Facebook. After its release, outward signs suggested something was afoot. The City of Minneapolis webpage appeared to go offline, as did the Minneapolis Police Department’s website. In online forums, individuals began circulating a list of almost 800 email addresses and passwords that Anonymous purported to have stolen from Minneapolis Police Department systems.
Cue the headlines: “George Floyd: Anonymous hackers re-emerge amid US Unrest,” wrote the BBC. “After Anonymous Promises Retribution for George Floyd’s Death, Minneapolis Website Shows Signs It Was Hacked,” read the story on Time.com.
As has so often been the case with Anonymous over the years, however, what got hacked this week was our minds -or at least our attention spans – more than any IT systems operated by the Minneapolis Police Department.
Round Up the Usual Emails
How do we know? First, security researcher Troy Hunt raised a red flag about the provenance of the 800 or so leaked emails that were being promoted online as belonging to Minneapolis PD officers. Hunt, who runs the data breach tracking website HaveIBeenPwned.com, noted that almost all of the emails purported to have come from the Minneapolis PD’s systems were already in the HIBP database – 654 of 689 unique email addresses, or 95%. Hunt described that as “massively higher than any all-new legitimate breach,” where the match rate typically ranges between 60% and 80%.
Hunt also noted the appearance of the same addresses multiple times with different passwords in the dump – a sign that the list may have been pinched from one used for “credential stuffing” attacks in which hackers use automated tools to guess the password of a known account, trying commonly used password values.
In other words, the MPD “dox” looks to be a copy/paste of data that was already floating around the cyber underground and which has no clear link to the Minneapolis Police Department – or even the City of Minneapolis.
As for those web site outages? So far there hasn’t been any explanation of the interruption that was coincident with the Anonymous video appearing. DDoS was certainly a common tactic in attacks attributed to Anonymous over the past decade, but such interruptions could also be explained by organic web traffic, as people around the world go online to follow or respond to Floyd’s death and the events unfolding on the streets of Minneapolis.
K-pop Eye on the Anonymous Guy
Researchers have also observed some curious behavior associated with prominent Anonymous social media accounts in recent days. Specifically, accounts including @YourAnonCentral and @YourAnonNews saw their social media following explode; @YourAnonCentral’s Twitter following jumped from 170,000 at the end of May to over 5 million followers this week. The same was true with YourAnonNews, which jumped from 1.5 million followers to 6.5 million followers.
Researcher Gabriella Coleman of McGill University says that kind of growth is rare and, in the case of the Anonymous accounts, appears to be manufactured. “It did not happen organically,” she said in a phone interview.
Bot networks account for some of the millions of new followers, Coleman said. More interesting is the intersection of Anonymous and the “K-pop Network,” a massive collective of Twitter and other social media accounts operated by fans (sometimes referred to as “stalker fans” or “stans”) of Korean Pop stars. That network mostly promotes the profiles of favored Korean pop stars, for example by posting short videos (or “fancams”). But the KPOP network has become more politically active of late: supporting popular protests in Chile as well as causes like Black Lives Matter in the United States. In recent days, the same group has promoted Anonymous accounts and flooded Twitter with fancams to drown out right wing memes and hashtags. “Anonymous was able to manufacture support using fake accounts and by tapping into the K-pop network,” Coleman said.
Hacking our Attention
The bigger story here is the way that Anonymous has once again hacked the public imagination and co-opted a real news event – Mr. Floyd’s death and the ensuing protests – to promote a fake one (their alleged hack) and the Anonymous brand, more generally.
That’s true to form. Anonymous has often walked what Coleman refers to as the “line between organic support and illusion.” With the latest convulsions of social unrest in the U.S., the group is “riding on the wave of increased visibility to get its message out,” she said. That extends to efforts to subsume millions of K-pop fan accounts into the Anonymous collective.
“Anonymous K-pop divisions are currently taking down police streams across the United States. Operations to spam police apps with fancams to protect protester identities are underway,” Tweeted the account @YourAnonCentral on June 1. But Coleman said it is doubtful that Twitter users that are part of the K-pop network also consider themselves a branch of Anonymous.
And while news coverage of Anonymous actions (or “OPs”) present the image of an organized hacktivist group with stable leadership, and a coherent agenda, nothing could be further from the truth, experts say.
“Anonymous is a loose collective with no membership roster, not a monolithic group,” wrote IAmTheCavalry founder Joshua Corman in 2011. “One could say it is an ‘idea,’ but even that is incorrect, as it is a collective of ideas,” he wrote.
As with the “hack” of the Minneapolis Police Department, there are often questions about whether Anonymous “OPs” are real or concocted. If they are real, there are questions about whether the individuals or groups behind Anonymous’ many affiliated social media accounts played a part. In the past, malign actors including nation-state affiliated hacking groups have played on that uncertainty: co-opting the Anonymous brand, language and methods to muddy attribution and “act with impunity,” Corman said.
More than anything, Corman sees Anonymous as a symptom rather than a cause -and one that is exacerbated by social unrest and uncertainty. “There will be an Anonymous not just in 2020, but in 2090 and it will have nothing to do with the original Anonymous,” he said in a phone interview. “Anonymous is the angry mask of the Zeitgeist at any given time. Who wears the mask and for what purpose is what matters.”
Achieve Goals You Never Thought Possible 4X Faster
