After a couple of high-profile hacks, which even saw Rahul Gandhi losing access to his Twitter account and emails of many prominent people including journalist Barkha Dutt dumped out in the open, everyone is asking who is Legion. The hackers -- or is it just a lone wolf -- who have hacked Rahul Gandhi, Barkha Dutt, Vijay Mallya and now are going after Lalit Modi, claim that their group is called Legion. They have become active on Twitter and are supposedly threatening everyone in India who they believe is corrupt. "Okay Brothers we're back. #legion. Support our cause to expose the rats in our system," the Legion recently tweeted. The "group" also exhorts that people should expose the corrupt persons by leaking their details to Legion through an email id. The mail is hosted on SIGAINT, a fairly secure email service available to public. So who exactly are the guys -- or girls -- behind Legion and how they are hacking into the accounts of prominent people in India
Who are Legion? These are not the engineering students who hack the Pakistani government websites. These guys are also not the Indian white hackers aka bug-bounty hunters who often find exploits and bugs in services like Facebook and Google and are then rewarded for their work. The Legion is most likely made up of genuine hackers who do this stuff for their living in some way or other. So they seem a bit more knowledgeable than your average computer engineering student.
Delhi Police, which is probing the Rahul Gandhi hack, claims that according to Twitter his account was accessed from five countries: United States, Sweden, Canada, Thailand and Romania. Some have theorised that this means the Legion hackers are based in five countries. It is possible but extremely unlikely. The IP addresses came from several places because that is how Tor browser or proxy sites work, by bouncing the traffic through various servers to obfuscate its origin.
How are they doing it? Once again, it is tough to say. But it does seem that for now the Legion has got lucky. The way it seems so far, it is clear that Legion did not gain direct access to Twitter accounts by attacking Twitter servers. In other words, when Legion got into the accounts of Rahul Gandhi and others, it had genuine passwords. How it got those passwords is the mystery that is explained by the fact that Legion compromised the mail servers of its intended victims.
In fact, the overall state of web security in India is quite shoddy. It is so poor that government websites are routinely hacked by engineering kids from Pakistan. And the same is true for many organisations, which have seen their networks hacked by hackers in the last couple of years. Many had to pay ransom to take the control back. The Legion, even as it exploits the vulnerabilities in web and email hosts, is also possibly hiding its tracks well. It is definitely using TOR and proxies to mask its identities and is possibly even using somewhat more advanced techniques like IP spoofing etc to ensure that its tracks are well hidden.
--
Sneak peak into BJP hack. More soon. We are The Legion. #Legion
