How a schoolboy hacked the CIA and the Pentagon

BadB

Professional
Messages
1,636
Reaction score
1,536
Points
113
In today's episode, I'll tell you about a schoolboy hacker named tFlow (LulzSec), who terrorized the whole of England and the USA. He and his team hacked the CIA, the Pentagon, and many other global corporations. His collaboration with Anonymous showed the world that they were no joke. I'll also tell you how and why he managed to avoid punishment and how he turned from a dangerous hacker into a person who collaborates with Facebook.

Imagine an ordinary schoolboy who sat silently in class, got grades, and no one even guessed that at night he was hacking the CIA and FBI websites. At the age of sixteen, he was already negotiating with Anonymous hackers, and a couple of months later he found himself in one of the most dangerous cyber groups of the decade. LulzSec, a name that was hated by the US and UK intelligence agencies. In 50 days, this group destroyed the image of the largest companies, extracted millions of data, and laughed at the FBI.

And behind all this was tFlow, Mustafa Al-Bassam. In this thread, I will tell you about how a schoolboy became a digital terrorist, and then how he attacked Sony, the FBI and the government, and how all this turned into a crypto startup that was bought by Mark Zuckerberg. It will definitely not be boring.

So, if you are interested, I will wait for you there too. Well, now, let's go! In school photos, Mustafa Al-Bassam is an ordinary guy. Thin, with an eternally tired face, with a hunched back, with an absent-minded look. As if his thoughts are anywhere but in this class. None of the teachers complained about him. He seemed to be a good student. He was not rude, did not skip classes. His party neighbors remember that he often clicked a pen and wrote something in a notebook, some formulas, diagrams, some strange diagrams.

He was a child prodigy, but a quiet one, not one of those who raise their hand and shine. He is one of those who simply understand everything the first time, but remains silent because he knows that everyone around him is too slow. It all started in London, in an area where people are used to not asking unnecessary questions. Mustafa lived in a family of immigrants, his parents were ordinary workers. A computer appeared in their family quite early. First, an old Dell, and then a newer one - Toshiba.

And already at the age of 12, he wrote scripts, cheated the school grading system, spied on the logs of teachers' accounts. At 14, he read docs on Python and SQL. He was interested in vulnerabilities, bypasses, holes - everything that makes the system different from what it seems. He did not dream of being a programmer, he dreamed of understanding how lies work. The Internet became a secret laboratory for him. First, ordinary hacker forums, and then IRC chats.

Plain text rooms where everything happened in real time. No avatars, no interface, just a black screen, white font and nicknames of people hidden behind monitors. He sat in channels like Hack, Exploit, Darknet, something like that. They discussed all sorts of vulnerabilities, shared dumps, without data, wrote scripts on the fly. And he didn’t just read it, he lived it and absorbed it all. He was known as T Flow, and no one knew that this nickname belonged to a teenager in a school uniform.

2010, Mustafa turned 16, and at the same time, anonymous cyberwar broke out. WikiLeaks, diplomatic cable leaks, the persecution of Julian Assange, and then a sudden response. Hackers from all over the world united under the black banner of Anonymous to avenge the attempts to silence WikiLeaks.

When the largest companies Amazon, PayPal, MasterCard and Visa refused to service the project after the publication of secret documents, the Internet community perceived this as censorship, and Anonymous responded with attacks.

Reference:
Anonymous is one of the largest groups of Avengers, which hacks companies and governments. You have seen them put on their masks in protest. They prefer to stay in the shadows.

And tFlow was among them, he participated in widespread attacks on corporate sites. At first, these were simple DDoS attacks, but then he got hooked, he did not want to just be an executor, he liked to go deeper. And at 16, Mustafa spent his nights not playing games, like ordinary children or teenagers, but sorting through payloads, and he understood that a site is not just a web page, it is a door, the only question is the key, and he found it.

Not alone, of course, there were several like him. Through IRC chats, he met other participants, more aggressive, more courageous, and some of them even took down government portals, and someone leaked databases. By the way, while tFlow was looking for vulnerabilities and learning to work with systems, you and I live in a different time, where technologies not only break, but also earn money. Well, we return to tFlow and to the group that turned the entire cyberspace order upside down in 50 days.

Thus, the group that tFlow was a part of got a common name - LulzSec. Six people got together not for money, not for politics, but for the lulz, for chaos and, of course, for laughter. Lulz is what they call black humor on the Internet. Fun that comes from someone else's shock, chaos or pain. This is not just a joke, it is a cruel pleasure from the fact that the system is collapsing before our eyes.

And T Flow became one of them. And the whole world didn’t know yet that an ordinary schoolboy from London would in a couple of weeks sit in his bedroom and simultaneously hack Sony, Fox, the CIA, the FBI and even the Pentagon. But there was one nuance, Mustafa was not like the others, he was not eager to show off logos, he did not write everywhere that we are LulzSec on every hacked page, he was still the same silent boy, only now with access to the servers of the special services.

He got to these guys completely by accident, the IRC channel was anonymous as always. Someone left a message that someone who knows about SQL injections needed to raise one database. Mustafa, already a self-confident TFLOW, responded. A couple of days later he was added to a closed room. There, where other participants were already sitting under strange nicknames. Subwoo, Topiary, Kylo, AVUnit, PawnSource, Eon, TFLOW. Six. Different countries, different accents, different ages.

They had one thing in common — aversion to systems and genuine pleasure in their collapse. They had no logos, no office, no database. They had an ARC chat and a general rule — we do it for the lulz. Which meant, we do it for fun or for the fun of it. Lulz is not for the benefit, not for the cause, it’s for the laughs and the spectacle. Hacking a website, publishing logins, ridiculing companies — all of this was not just an attack, it was a real performance show.

And their first show was hacking Fox.Com. A huge media corporation that owns Fox News. tFlow helped gain access to one of the internal servers through a vulnerability in the login form. From there, logins, passwords, employee emails. Even participants of the American show X-Factor were among the victims. All of this was posted in the public domain, without censorship, without editing, simply because they could. A couple of days later, they moved on. Sony Pictures.

And this wasn't just lulz, this was the humiliation of a world-class corporation. The internal network was completely leaky, and tFlow and Kylo gained access to all the databases in a matter of hours. Names, addresses, dates of birth, passwords of almost a million users. Some passwords in plain text. Yes, it was that bad. LulzSec didn't just post the database, they wrote a press release with jokes, swearing and sarcasm. They turned the hack into postmodern trolling. We are lulsec, and you're all screwed, we warned you, they said.

There was a wave of delight on the forums, thousands of young hackers copied their style, tried to imitate them. The media wrote headlines with panic, an unknown group is destroying Sony's reputation, the FBI is losing face, but inside the chat itself, there was a strange calm. They didn't scream, didn't squeal with joy, they just wrote. What's next? I have an idea, bitch.

Seriously? A government agency? Why not? It's got more holes than a sieve. SOCA is the UK's Serious Organized Crime Agency. And their next target. The plan was simple. First, noise. They started with a DDoS - a distributed denial of service attack on the agency's website. SOCA-go.Uk went down almost immediately. The site went up and then down again. It would seem like a regular traffic overload, a hacker's prank.

But it wasn't that simple. Under cover of the noise, tFlow and Kylo started scanning the site for vulnerabilities. CQL injections, incorrect access rights, forgotten scripts on the server, they dug through the code like surgeons in a body looking for a tumor. And a couple of hours later, they found it. A vulnerability in one of the forms. Because of it, it was possible to get into the admin panel and start pulling out logs, letters, internal documents. A classic hole in the security, like from an old hacker textbook.

They got in. The security team was silent. No one noticed them. Mustafa sat in front of the screen all night. The terminal was blinking, numbers were flowing like water. In one window, a dump of the soc's internal data, and in another, an ERC chat with the rest. Dry phrases. Took the dump. Check. The leak started. By morning, everything was ready, and they published the files. Internal documents of the soc, employee lists, work emails, IP logs, notes on operations, internal instructions on fighting organized crime.

Nothing super secret, but enough to show that we were inside. As LulzSec themselves said, this was not just a hack, but a demonstration of weakness. They did not steal millions, they did not demand a ransom, they just came in, looked and posted it for all to see, so that the world would laugh, so that the state would feel a little ashamed and so that the hackers in the chats would write, damn, they really did it. The agency immediately shut down the site, they would later say, in order to prevent further damage.

But it was too late. The BBC, Reuters, and all the major newspapers wrote about it in the morning. LulzSec had broken through not just the defense, but the armor of the British state. And tFlow was among those quietly typing commands while his classmates discussed the weather and argued about who would go to the canteen for buns that day. But there was one detail that almost no one knew.

tFlow was afraid. He never said this directly. But in the logs that researchers would later dig up, there are phrases. What if they find us? Maybe it’s time to stop? We all still have to live somehow. He was the youngest, the most cautious, and perhaps the most sensible. While Sabur published interviews on behalf of the group, Teflow remained silent. While Tapiaru entered their Twitter with jokes, tFlow looked at the server taxes.

He didn’t want fame, he just didn’t believe in invulnerability. He sensed that someone was already watching this chaos. And so they continued. It was 2011. The newspapers were howling. The CIA was under attack. Hackers had broken into the US Senate website. The British government had been compromised. It seemed as if LolzSec were not a group of teenagers at computers, but an entire army. But the reality was much quieter.

The same RC chat, the same jokes. tFlow is silent longer than usual. Sometimes he answers briefly, sometimes he disappears for hours. He feels that they are going too far, and this is no longer just a hack for fun, this is a provocation on the level of an international conflict. Tension is also growing within the group, everyone has their own goal, someone wants glory, someone wants revenge, and someone wants a revolution.

But what did tFlow want? He just wanted to understand how a hobby turned into a war. In June, they announce a 50-day operation. Every day a new hack, a new target, and a new scandal. The FBI, Viacom, Nintendo, the Arizona police. It was digital terror in its purest form. Panic breaks out on the network, law enforcement is nervous, and US agencies are assembling emergency teams. Operation "ANTISEC", a counter-attack mission of the FBI.

Their goal is to track down and neutralize the group. And at some point, the web begins to shrink. But not from the outside, but from the inside. It turned out that Sabu was a traitor. Hector Monsegur, that was the name of the man hiding behind this nickname. June 7, 2011, New York. He makes a simple mistake, enters their RC chat without a VPN. The real IP address is already exposed, and that's enough.

The FBI agents did not have to break down the door, they just came to his home, in Manhattan, to social housing, where he lived with his children. They already had a warrant, Hector did not resist, during interrogation he was offered a choice between 124 years in prison or cooperation, and naturally he chose the latter. The next morning he is back in the chat, as if nothing had happened.

The same Nick, the same Charisma, the same goals. Only now each of his messages went to the FBI server log. He became an undercover agent, a member of a group that did not know that one of them had already given everyone up. He became a trap into which hackers were drawing themselves, and no one even suspected it. Even tFlow. By the way, tell me, would you forgive a traitor if you found out that someone was betraying you to save themselves? Or is there no justification at all? Write your opinion in the comments, it will be interesting to read.

They continued their attacks, leaked data, set the Internet on fire, and Sabu handed over every byte to the authorities. A couple of weeks later, the participants began to disappear, one after another. July 2011, Ryan Cleary, a British teenager, was arrested. He had servers at home that participated in the DDO with the Lulsec attacks. He was not a member of the main team, but he was considered a technical assistant of the group.

And this made him the first high-profile victim of the investigation. A month later, and even more loudly, Jake Davis, Tapiari, one of the most visible participants, was arrested. He ran a twitter, wrote public statements, mocked corporations and governments on behalf of the entire group.

News:
An 18-year-old teenager known as the hacker Tepiari from Lulsec was arrested today. He is one of the main suspects in this case.

The puzzle began to come together. One by one, the participants disappeared. The media wrote about it, Lulsec was exposed, the end of the era of digital anarchism. Tieflow read about it on the morning of August 1, 2011. Mustafa was sitting at the same computer from which he had recently checked Sony dumps and written scripts for attacks. He was still at large, but inside he already knew, it was only a matter of time. He tried to clear his tracks, deleted his accounts, left the ERC chat, but it was too late.

The FBI already had his logins. He knew they would come. He didn’t know when, he didn’t know how, but he knew. After Topiary’s arrest, after the publications, after it became clear that they were already on their way for each of them. But it still happened suddenly. August 2011, early morning. London outside had not yet woken up. His mother was making tea in the kitchen. There was a knock, not alarming, not aggressive.

Two men in civilian clothes were standing behind the door. One of them held a paper in his hands, a search and arrest warrant. They entered quietly, politely, without shouting and without weapons. One of them was busy with the equipment, disconnecting the laptop, checking phones, looking through paper records, and the other one was just standing nearby, watching. Mustafa didn’t ask any questions, he just sat down on a chair, calmly, as if this was not the end, but the beginning of something else.

I wonder, if someone knocked on your door like that, what would you do? Would you immediately confess to everything, remain silent, or maybe run? What do you think? Write in the comments. In short, detention, interrogation, silence. They took him to the police station, he didn’t deny anything, but he didn’t tell anything either. During the first interrogation, he said almost nothing, only monosyllabic answers. Your nickname online? Tifloe. Did you participate in the attacks on Sony, Fox, and Soca? I don’t know.

Did you communicate with Sabu? Maybe. The investigators didn’t press you, they didn’t need a confession. They already had all the logs, they had Soku, they had the entire IRC chat, every byte. The interrogation was just a formality. He was charged. Several episodes. Each one lasted for years, but he was a minor. At the time of some of the attacks, he was only 16 years old. And most importantly, he was not a radical, he was not a leader, he did not sell data, he did not blackmail. He was just there and wrote code, because he knew how to do it.

The trial took place in London, in one of the usual unremarkable halls. The building is old and smells of dust and old paper. Inside are several journalists, a lawyer, a prosecutor and parents. Mustafa himself in a suit that fit him like a strange shell. He looked like a student, like a guy who was just into computers. The prosecutor read out the charges - unauthorized access to information systems, violation of the Computer Crimes Act 1990, participation in a conspiracy to interfere with the activities of government agencies.

When it was time for his defense, his lawyer did not justify him. He explained, said that Mustafa was a teenager, he did not understand all the consequences, he did not receive any benefits and he was already cooperating. So he is not the one who needs to be broken, he is the one who needs to be directed in the right direction. The judge listened carefully and understood that this was not just a sentence, it was an example to others, a signal.

And the sentence was like this. 20 months probation, mandatory completion of a course on digital ethics, restrictions on internet use, regular activity reports and, most importantly, a second chance. The press wrote that the hacker tFlow avoided prison, the young genius LulzSec received a suspended sentence, but the main turning point was not visible behind the headlines, because at that moment Mustafa Albasam became a different person, he was no longer tFlow, he was a guy who went around hell and came out alive.

Not a hero, not a traitor, just a survivor. After the trial, Mustafa disappeared, not literally, he was still living in London, going to university, drinking coffee, visiting some shops, but on the network, where tFlow used to reign, there was silence. No new logins, no messages, not a single line of code that would look aggressive.

He disappeared from the hacker world's radar and no one was looking for him. He went to University College, one of the best universities in the country, studied computer science not because "it was necessary", but because he knew, he was good at it, but now knowledge was a weapon of a different kind. If before he looked for vulnerabilities to hack, now he looked to prevent. He sat quietly in lectures, as before, but his eyes were different now, calmer, deeper, not with melancholy, but with awareness.

He saw how imperfect the digital infrastructure was, and he knew that if people like him did not protect it, then people like him would destroy it. He started writing articles, serious, scientific ones, about anonymity, privacy, and the security of network protocols. He participated in information security projects, developing methods that allow users to remain safe without compromising their freedom.

Gradually, his name began to appear again, only now not on forums, but in academic publications. In 2017, he founded Chainspace, a startup that was creating a scalable blockchain platform. Unlike Bitcoin and Ethereum, Chainspace focused on privacy and code transparency.

For Mustafa, this was not just a startup, it was an ideology, answers to old questions about whether it is possible to build a system in which there is no need for chaos, where everything works honestly and you do not have to hack to get to the truth. Chainspace became loud, and in 2019 it was noticed. When Facebook launched the ambitious Libra project, a global cryptocurrency that could replace banks, they began buying up the most promising blockchain teams, and one of the first was Chainspace.

Mustafa Albasam signed a contract with Facebook. For many, it seemed absurd, like a former hacker who hacked the CIA, now works for one of the most influential corporations in the world. But for him, it was not just a contract, it was a symbol. He went from a schoolboy with a PC chat to an employee of the company whose silver he once dreamed of hacking. Inside the Libro project, he was engaged in security and research.

Not PR, not politics, he was no longer trying to change this world. He was just doing his job. But the past is still there, from time to time his name pops up again in articles, at conferences and in tweets. People still remember LulzSec, and when they talk about Mustafa, they most often add "former hacker". He does not particularly hide it, but he is not proud of it either. He simply says "I made mistakes, now I am working to fix everything."

This is the kind of exciting story we have today. Be sure to write your comments, do you think it is fair that Mustafa got off so easily, or should he have received a more severe punishment. And here is the most important question, can a person atone for his past or does the stigma remain with him forever? Also suggest ideas on what topics I should write about. And of course, do not forget to like, and this is very necessary and important. In general, I wish everyone a great day or evening, take care of yourself and bye-bye.
 
Top