> series: anatomy_of_a_breach —— part: 025 —— target: hbgary_federal —— attacker: anonymous —— emails_leaked: 71,000<span class="cursor-blink">_</span>_
In early February 2011, Aaron Barr, CEO of security firm HBGary Federal, told the Financial Times that he had used social media analysis to identify the leaders of hacktivist collective Anonymous and planned to present his findings to the FBI. Within hours of the article's publication, Anonymous demonstrated exactly why threatening to unmask a decentralised hacking collective is an exceptionally poor business decision.
Anonymous compromised HBGary Federal's website via a SQL injection vulnerability in its custom CMS, used password reuse to pivot into Aaron Barr's email account and social media, and ultimately leaked 71,000 internal company emails. They defaced the website, took over the company's Twitter account, and remotely wiped Barr's iPad. The leaked emails exposed embarrassing details including proposals to use disinformation campaigns against WikiLeaks supporters, plans to attack journalists, and details of contracts with government agencies. Barr resigned within weeks. HBGary Federal's parent company was eventually sold. The security firm that had claimed to be expert enough to unmask Anonymous could not protect its own email server from a SQL injection.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe attack chain was remarkably straightforward — and remarkably effective. It exploited the same vulnerability classes we have documented throughout this series, combined with the social engineering and persistence that Anonymous brought to ideologically motivated attacks.
| Step | Technique | What It Exploited |
|---|---|---|
| 1 | SQL injection against the HBGary Federal CMS | A custom-built content management system with an unpatched SQL injection vulnerability. A web application penetration test would have found this in hours. |
| 2 | Password hash extraction and cracking | MD5-hashed passwords with no salting. Aaron Barr's password was cracked quickly, revealing a weak password that he reused across multiple services. Our password cracking article demonstrates exactly this technique. |
| 3 | Credential reuse pivot | Barr's cracked password was used to access his personal email, Twitter, and LinkedIn — all using the same password. From his email, Anonymous found credentials for additional HBGary systems. |
| 4 | Social engineering of HBGary's IT administrator | Using Barr's compromised email, Anonymous social-engineered a system administrator into providing root SSH access to HBGary's Linux servers — by impersonating Barr in an email requesting 'urgent' access. |
| 5 | Full compromise and data exfiltration | With root access, Anonymous downloaded the entire email archive (71,000 emails), defaced the website, wiped systems, and took control of social media accounts. |
The HBGary breach is the ultimate reminder that expertise does not confer immunity. A security firm — staffed by people who understood cyber threats professionally — was compromised through the most basic, well-documented vulnerabilities. The lesson for every organisation is that knowing about security is not the same as implementing it. Policies, knowledge, and awareness are necessary but not sufficient — only tested, verified, technically enforced controls actually protect you.
Our penetration testing verifies that controls work — not that they exist on paper. Cyber Essentials certification requires evidence of implementation, not just documentation. SOC in a Box monitors continuously for the anomalous access patterns that indicate compromise. Because if a security firm cannot protect itself from SQL injection and password reuse, the question for every organisation is not whether your defences are theoretically sound — but whether they have been tested.
Our <a href="/penetration-testing/web-application">web application testing</a> finds the SQL injections. Our <a href="/blog/from-the-hacker-desk-cracking-passwords-afternoon">password assessments</a> crack the hashes. Our <a href="/penetration-testing/social-engineering">social engineering tests</a> test your staff. Because HBGary proved that claiming to be secure is not the same as being secure.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call