LulzSec is keeping people busy all over the interwebs this week and filling up the news with their headline activities.  The latest attack was a DDOS takedown of the CIA’s main public web site, cia.gov.  This latest in a series of brazen attacks comes on the heels of their hacking request line stunt known as Titanic Takeover Tuesday.   The group has acted as though they are untraceable, with reckless abandon, based on its latest choice of targets including the CIA, the FBI affiliate, and the U.S. Senate webpage.

Just how skilled are the members of this group?  Their actions have exposed the insecure nature of the vast majority of sites on the internet, particularly for their maligned targets.  Exposing these weakly secured sites information through known tools, exploits and techniques and then notoriously publicizing them summarizes their modus operandi.  Add to that the very public profiles of their targets, and it seems that the nature of the group at least on the surface does not appear to be for profit or other gains.  They seek notoriety and they are certainly getting it.  These factors, the ever-increasing rate, the Twitter feed, the news stories, the dial-a-hack hotline, they all indicate that the group is succeeding in their efforts for publicity.  In reviewing their base of targets and daylight attacks, they express confidence in their ability to not be discovered, even taunting the very agencies that would be tasked to finding them.

So the question remains whether this group can be stopped.  It is quite possible that the key people behind the group will be found.  Sooner or later someone could potentially screw up and they might be discovered by technological means.  This could be means of forensic discovery, meaning log information from systems and networks, it could mean an ISP turns over information, or key pieces of information might be discovered that lead to an email or credit card.  But you see, the people behind the veil of this group know this.  No – the most likely ending is a well-known script that has a familiar ring to it.

We saw it with the capture of Osama Bin Laden.  After years of technical surveillance, technical warfare, massive bounties and perhaps the biggest manhunt in human history, it was the basics of detective work that turned him up.  Staying away from the politics of it all, bits of information built on bits of information until the trail led investigators right to where he was in the most surprising of places.  With LulzSec, they may find the same thing.  Nothing and noone should be above suspicion, but in all likelihood we will start to see some members or associates of the group begin to turn up in busts until eventually the group is silent or exists no more.  This is one of the basic tenets of security in play, the social engineering hack and investigators have that tool at their disposal.  With all of this bragging and public profiling, one of the people that they either have turned up, or will turn up will probably produce actionable leads and eventual arrests. The FBI and other agencies have decades of skill in investigative methods and with a heightened sense of urgency, it can be surmised that they have dozens of agents on these cases.  Already a couple of days ago 35 Anonymous hackers were reportedly arrested in Turkey.  Previous arrests were made in Spain and the U.K.  Theories abound on whether how or if the groups Anonymous, LulzSec, and the website 4chan are associated.  Mentions of retaliation for Wikileaks and other motives have been expressed all over their statements, their home page, and Twitter feed.

The spectacular grand theater it all is, the takeaway can be easily lost.  It is high time for a renewal of security efforts throughout government and private industry.  LulzSec is exposing by means of basic exploitations: a sad state of cybersecurity that generally exists.  This should be a call for industries and enterprise with something to protect – to escalate the effort with increased technology and methods that include detection, prevention, forensic technologies, as well as training and policy objectives.  This is not the time for a shift of control and power to a government agency, or an internet “kill switch”, or other proposed interventions.  Government agencies themselves have been exposed as ineffective in securing their own most public entities; No -the whole thing would stifle innovation and in all likelihood, backfire on many, many levels.

Make no mistake about it, LulzSec is at the top of many lists, but even if they were all caught tomorrow, the next group would emerge.  LulzSec is a manifestation of anti-corporate, and lately anti-government sentiment.  Their opportunity to come to prominence exists because poor security practices in place in many organizations have produced a climate ripe for internet abuse.  A continued specter in this all with the publicity around it is that the efforts and sentiment will continue to grow.  Their post-conquest  messages may seem light-hearted and even funny to some, but the implications are significant and should not be lost.  LulzSec is a sustained and rising force that is currently driving renewed security efforts in many organizations and in some ways is serving a greater purpose to the industry in general in terms of vigilance in general, and remediation to those that are affected by their attacks.  It very well could be that one day we will all look to the body of cyberattacks in this period of time as a seminal period for the computing industry and the LulzSec incidents as one of the genesis of serious focus of security practice across the industry.