UK cops: How we sniffed out convicted AnonOps admin 'Nerdo'

Hint: Sometimes gamer tags give the game away


Analysis of IRC logs and open source intelligence played a key role in the successful police prosecution that led up the conviction of a member of Anonymous for conspiracy to launch denial of service attacks against PayPal and other firms.

Christopher "Nerdo" Weatherhead, 22, was convicted on one count of conspiracy to impair the operation of computers following a guilty verdict by a jury at Southwark Crown court last week.

Weatherhead, 22, was studying at Northampton University when he allegedly took part in "Operation Payback", the DDoS campaign launched by the hacktivists in defence of whistle-blowing site WikiLeaks. Targets included the entertainment industry and later financial services firms that had suspended payment processing of donations to WikiLeaks after it controversially published leaked US diplomatic cables in late 2010.

Ashley Rhodes, 27, from Camberwell, south London; Peter Gibson, 24, from Hartlepool; and an 18-year-old male had already pleaded guilty to the same charge, relating to offences that took place between August 2010 and January 2011.

Payback's a bitch

Sandip Patel, prosecuting, said that attacks by various Anonymous hacktivists had cost PayPal £3.5m ($5.5m) and forced it to call in 100 staff from parent firm eBay in order to keep its website up and running over the course of a series of DDoS assaults that spanned several weeks.

The attacks were launched using the Low Orbit Ion Canon (LOIC) packet-flooding tool widely used by Anonymous at the time. LOIC spills the IP addresses of those taking part in attacks. However evidence from IRC channels where the hacktivists hung out and planned attacks was the more important evidence in the police investigation.

Operation Payback attacks began against firms known to oppose copyright piracy (such as those of the Ministry of Sound nightclub, the British Recorded Music Industry and the International Federation of the Phonographic Industry) before the hacktivists switched targets to concentrate packet-slamming assaults on payment-processing firms including PayPal and MasterCard - which had angered Anonymous by choking off a source of income to WikiLeaks.

Sniffing around in AnonOps' channel

Weatherhead (Nerdo) was a network administrator and among a small group of leaders on an AnonOps IRC channel that became the focus of a police investigation, spearheaded by members of Scotland Yard's Police Central eCrime Unit.

Former Detective Constable Trevor Dickey, who has left the Met and found work in the private sector since the successful conclusion of the investigation, explained: "In a nutshell we identified Weatherhead via the IRC network."

"We identified their IRC channels and captured several weeks of chat. During that time we looked at the status of nicks such as admins and operators," he added.

"We then did some keyword searching and spent a lot of time looking social leakage. Combining all these elements we then identified the nicks of interest and did open source research on them. Weatherhead was easy to identify as he had been using the nick of 'Nerdo' for quite some time," he concluded.

Ray Massie, a self-employed computer forensic and open-source training consultant who served as a detective sergeant with the Met Police and led the investigation, explained that UK police decided to target the administrators of Anonymous-run channels, focusing on instigators of attacks rather than Anonymous "foot soldiers" otherwise involved in DDoS assaults. This is contrast to US law enforcement clampdowns, which also targeted simple participants in hacktivist actions who had played no part in selecting targets or planning attacks.

"We went after organisers and facilitators rather than foot soldiers. US authorities went after a mix," Massie explained.

The police operation began in October 2010 with attacks on the Ministry of Sound and the BPI. "It was quickly clear that Anonymous was running similar attacks against different anti-piracy organisations in the USA, Germany, France, Spain and elsewhere. They would select a target, post the named of a target online along with dates and times of an attack and, in some cases, a countdown clock. Everything from signposted from IRC channels."

Massie explained that over time, hacktivists made more use of Facebook and Twitter but this was mainly for promotion and propaganda. "Would-be participants were directed to IRC channels, where plans were all laid out," he said. Links provided on IRC provided advice on how to use LOIC (the favoured DDoS attack tool of Anonymous at the time), how to cover their tracks, and other hacker trade-craft tips.


Other stories you might like

  • Prisons transcribe private phone calls with inmates using speech-to-text AI

    Plus: A drug designed by machine learning algorithms to treat liver disease reaches human clinical trials and more

    In brief Prisons around the US are installing AI speech-to-text models to automatically transcribe conversations with inmates during their phone calls.

    A series of contracts and emails from eight different states revealed how Verus, an AI application developed by LEO Technologies and based on a speech-to-text system offered by Amazon, was used to eavesdrop on prisoners’ phone calls.

    In a sales pitch, LEO’s CEO James Sexton told officials working for a jail in Cook County, Illinois, that one of its customers in Calhoun County, Alabama, uses the software to protect prisons from getting sued, according to an investigation by the Thomson Reuters Foundation.

    Continue reading
  • Battlefield 2042: Please don't be the death knell of the franchise, please don't be the death knell of the franchise

    Another terrible launch, but DICE is already working on improvements

    The RPG Greetings, traveller, and welcome back to The Register Plays Games, our monthly gaming column. Since the last edition on New World, we hit level cap and the "endgame". Around this time, item duping exploits became rife and every attempt Amazon Games made to fix it just broke something else. The post-level 60 "watermark" system for gear drops is also infuriating and tedious, but not something we were able to address in the column. So bear these things in mind if you were ever tempted. On that note, it's time to look at another newly released shit show – Battlefield 2042.

    I wanted to love Battlefield 2042, I really did. After the bum note of the first-person shooter (FPS) franchise's return to Second World War theatres with Battlefield V (2018), I stupidly assumed the next entry from EA-owned Swedish developer DICE would be a return to form. I was wrong.

    The multiplayer military FPS market is dominated by two forces: Activision's Call of Duty (COD) series and EA's Battlefield. Fans of each franchise are loyal to the point of zealotry with little crossover between player bases. Here's where I stand: COD jumped the shark with Modern Warfare 2 in 2009. It's flip-flopped from WW2 to present-day combat and back again, tried sci-fi, and even the Battle Royale trend with the free-to-play Call of Duty: Warzone (2020), which has been thoroughly ruined by hackers and developer inaction.

    Continue reading
  • American diplomats' iPhones reportedly compromised by NSO Group intrusion software

    Reuters claims nine State Department employees outside the US had their devices hacked

    The Apple iPhones of at least nine US State Department officials were compromised by an unidentified entity using NSO Group's Pegasus spyware, according to a report published Friday by Reuters.

    NSO Group in an email to The Register said it has blocked an unnamed customers' access to its system upon receiving an inquiry about the incident but has yet to confirm whether its software was involved.

    "Once the inquiry was received, and before any investigation under our compliance policy, we have decided to immediately terminate relevant customers’ access to the system, due to the severity of the allegations," an NSO spokesperson told The Register in an email. "To this point, we haven’t received any information nor the phone numbers, nor any indication that NSO’s tools were used in this case."

    Continue reading

Biting the hand that feeds IT © 1998–2021