LFI to RCE via access_log injection

#LulzSec #hacker 'Sabu' released after 'work' for #FBI


Hector Monsegur spent the last three years as a model law enforcement informant, quietly drawing out his fellow hackers and directly aiding in the arrest of members of the LulzSec hacking crew and Anonymous hacker Jeremy Hammond. His hard work was rewarded Tuesday, when a judge sentenced him to time served and released him.
Judge Loretta Preska determined that the seven months Monsegur, known by his hacker handle “Sabu,” spent in pre-trial detention was sufficient punishment for one of the most active hackers in the Anonymous collective and the vocal leader of the splinter group Lulzsec. Monsegur will be subjected to one year of supervised release that will include monitoring of his computer use, and he may yet be forced to pay restitution to the victims of his hacking.
The lenient sentence was the result, Preska said, of the “truly extraordinary” help Monsegur gave law enforcement since June, 2011. He spent more than three years as a well-connected mole within Anonymous during a period when it was rampaging through hundreds of hacking targets. She particularly praised Monsegur’s decision in 2011 to immediately begin aiding the FBI in tracking his friends, as a delay might have given Lulzsec and other Anonymous hackers time to destroy evidence.
“The immediacy of Mr. Monsegur’s cooperation and its around-the-clock nature was particularly helpful to the government,” she said. “That personal characteristic of turning on a dime to doing good, not evil, is the most important factor in this sentencing.”
Monsegur, a hulking man with a close-trimmed beard and hair, appeared in court wearing a billowing black shirt, and told the court he is no longer the Sabu who had brazenly led Lulzsec on dozens of hacking campaigns and spouted revolutionary rhetoric from a highly active Twitter feed. “Over the last three years I’ve gone through a lot of changes and learned a lot of lessons,” he said in a short statement. “I’ve done a lot of soul searching… and I realized I hurt my family the most.
“I’m not the same person you saw here three years ago.”
The judge also considered the harassment and threats Monsegur and his family have faced since he was publicly identified as a federal informant in March, 2012. The publicity led to an assault on Monsegur’s brother and prompted his family’s decision to leave their New York home. “His family has been subject to threats, assaults, and all manner of danger,” said Preska. “For all these reasons, I find that Monsegur is entitled to a downward departure,” she added, using the legal jargon for a lighter-than-expected sentence.
In a motion (.pdf) filed over the weekend, prosecutors requested that Monsegur receive the minimum sentence in reward for his role as an “extremely valuable cooperator” with law enforcement agents. The motion stated that his work drawing out his fellow hackers in online chats and sharing their communications with the FBI helped federal authorities prosecute eight other Anonymous associates who currently face charges or have served prison sentences. Hammond was sentenced to ten years in prison last November—in the same courtroom and the same judge as the Monsegur sentencing—for his role in the hacking of the private intelligence firm Stratfor.
Monsegur’s sentence won’t end the controversy around the role he’s played on both sides of a three-year hacking saga. Questions still loom about why the FBI allowed Monsegur to continue aiding in and occasionally directing attacks–which caused millions of dollars in damage–on dozens of targets while he was under the agency’s control. During his sentencing in November, Hammond told the court Monsegur had relayed to him targets including foreign government sites. The information he stole from those sites often was passed to Monsegur. “I think the government’s use of this data needs to be investigated,” Hammond said in his sentencing statement.
In court Tuesday, however, Monsegur was instead praised as having warned authorities of security vulnerabilities he had learned about and helping get them fixed. The potential targets he was credited with helping to protect include the water supply of “a major American city” and the supply chain of a foreign energy firm. His defense attorney cited “more than 300 intrusions” he helped law enforcement prevent.
“The things you did were not so good,” Preska said to Monsegur in her final words in the hearing. But “you have done as much as any human can do” to make up for those actions, she added, “and I salute you for that.”

Comments