Rooting The Anonymous : Part 1

http://twitter.com/anonymouslk

If you know about Anonymous hackers, the cyber anarchists, Sri Lanka is no exception with our own Anonymous Sri Lanka (@anonymouslk) hackers, they are famous for their DNS spoofing attacks on Facebook, Apple, Microsoft,  Symantec and many more websites.

Credits :

This is not my own work but a team work that includes @ipv10, and @g2kev which I think are the best in the country in infosec work

The beginning of the investigation.

Today this begins a series of posts where I publish the results of a month long investigation in to finding AnonymousLK, we’re going to publish about the members of the AnonymousLK one by one.

Click to see the enlarged images, so they’ll be more clear.

There is nothing illegal regarding the information we’re publishing, all the data, pictures and everything are publicly accessible on the internet which can be found by a simple googling.

AnonymousLK is a team of 4 people :

• HackerzMafia, the leader and the person most of the time behind Twitter which we’re going to root now.
• Zonta
• ZeroThunder
• TX

On their Facebook  profile picture they show an email address to contact them, the email address is anonymoussrilanka@gmail.com. Which is also the email address of their Facebook account.

The link between the emails.

The first thing we did was to reset the password of the email account, not to hack the account, but to get an idea of the associated contact info that is used to send the password reset code/link. When resetting anonymoussrilanka@gmail.com account you get something like this,

Password reset form for anonymoussrilanka@gmail.com

You can see the anonymoussrilanka@gmail.com account is linked with an email with 12 digits that begins with h and ends in an a. and a mobile phone number ending with 84.

Most people have written time and time again that Anonymouslk is a guy called Dr Sameera De Alwis, a failed wanna be tech guy who got screwed really bad. So we did a small googling about Dr Sameera De Alwis and we found an old post he made on a forum talking about his failed xaurora browser. Link  to the post : http://www.skyscrapercity.com/showthread.php?p=21993769

http://www.skyscrapercity.com/showthread.php?p=21993769

There Sameera De Alwis is giving his contact information, note the email address : hackerzmafia@gmail.com. A 12 digit email address, that begins with a h and ends with a. 

So we decided to check the associated contact information for the hackerzmafia@gmail.com email account, and it comes up like this,

reset password form for hackerzmafia@gmail.com

There you can also see that the email account is associated with a number ending with 84 same as the anonymoussrilanka@gmail.com email account. And in the picture showing Sameera De Alwis’s contact information there is another gmail account belonging to him, dr.sameera.de.alwis@gmail.com, so we decided to reset the password for that email account and this comes up,

Password reset form for dr.sameera.de.alwis@gmail.com

And the email account dr.sameera.de.alwis@gmail.com email account is also connected to a mobile number ending in 84. We can see that anonymoussrilanka@gmail.com, hackerzmafia@gmail.com, dr.sameera.de.alwis@gmail.com all these emails are connected to a mobile number ending in 84. So we can assume that all three email accounts are connected to the same mobile number. Which means the email anonymoussrilanka@gmail.com is created by non other than Sameera De Alwis himself also known as HackerzMafia.

Sameera De Alwis also owns a website called hackimpact.com,

http://www.ewhois.com/hackimpact.com/

If you go to the contact page of hackimpact.com you’ll get something like this.

http://hackimpact.com/contact-us | Click to see clearly

We’ve censored the name because it belongs to a lawyer, probably Sameera’s lawyer, however if you see the contact number of the website owned by Sameera De Alwis (hackimpact.com) the number is : 077-2516084, well well well what have we here, a number ending with 84 that is on Sameera De Alwis’s website hackimpact.com, so we can assume that all the anonymoussrilanka@gmail.com, dr.sameera.de.alwis@gmail.com and hackerzmafia@gmail.com are linked with the number, 077-2516084.

The Typing style of AnonymousLK and Sameera De Alwis.

Both Anonymouslk and Sameera has a common typing style that you can see from time to time. For example,

See the underlines phrase..

See the phrase underlined red, “Freedom for all man kind on earth”, now where have we seen that before?

http://www.skyscrapercity.com/showthread.php?p=21993769

Sameera has used the very same phrase, “Freedom for all man kind on earth” on his online forum post, and  “May peace prevail…” is another phrase that is being commonly used by Sameera, or should I say Anonymouslk 😉

This was taken from an old blog post made by Sameera De Alwis,

http://tributesrilanka.wordpress.com/2009/09/17/6/

Sameera has used the exact phrase again.

Who is Sameera De Alwis?

The guy who created AnonymousLK, Sameera De Alwis

Sameera De Alwis was a wanna be tech guy, who reversed engineered a popular browser and released it as his own, collecting money asking for further development of the browser, however people took notice of this and Sameera had to stop his browsing adventure, lost his job as the head of IT security at Maharaja INC and lost his job as a Lecturer of SLIIT.

This article gives all the infomation about the life of Saeera De Alwis : http://sameeradealwis.wordpress.com/2009/06/16/dr-sameera-de-alwis-can-be-trusted/

Sameera’s Hi5 profile where he posted photos of his dead mother and her ashes : http://www.hi5.com/hackerzmafia 

A letter written by Dr Sameera De Alwis after the truth about xAurora browser was exposed : english.kalingasblog.com/2008/10/xaurora-the-fake-web-browser

xAurora getting caught of being a fake browser : http://forum.maxthon.com/viewthread.php?tid=74416&extra=&page=1

XAurora Browser Blog : xaurora.wordpress.com

Final conclusion

So the final conclusion is that Sameera De Alwis started the AnonymousLK accounts and he also recruited the other hackers named Zonta, ZeroThunder and TX.

This is the reason for the change of language when tweeting, Sameera is the one tweeting with bad words while Zonta is the one who tweets normally.

Hiding your ip is not enough  AnonymousLK, In prison the inmates will root you 😉 Tango Down.

External links :

Sameera De Alwis’s dotnet forum profile – HackerzMafia : dotnetforum.lk/forums/p/10216/35030.aspx