6 ms·

To be fair the Tribune subsidiary should have revoked that access a LONG TIME AGO. The million dollars spent after the attack was to fix their security I bet.

by baldfat 11y ago

To be fair the Tribune subsidiary should have revoked that access a LONG TIME AGO. The million dollars spent after the attack was to fix their security I bet. Don't think what he did was right and he did have someone illegally attack the LA Times but it does seem strange that this case is so big and the charges against him so large.

tptacek 11y ago
You leave a job, you keep the keys to your office, your employer forgets to take them back, you then deliberately copy the keys and hand them out to vandals. What court in the world would put any of the responsibility for that on the company? Trib didn't spend millions in cleanup, but if any breach investigation were done --- to rule out the attackers having done things to retain access after credentials were revoked, and to ensure Trib's clients that no PII was taken --- would easily run into the mid tens of thousands.
- sarciszewski 11y ago
  Even the tens of thousands could be a stretch for the actual cost. When I was handed a copy of my Pre-Sentencing Report, for an incident that took place on June 21, 2011, they billed from June 16-24. I pointed out that I did not own a time machine, then they quickly changed the dates to June 21-27 and dropped the "damages" by over 60%. That's the difference between certain prison time and probation with house arrest. (This was Sylint, maybe they're just scumbags and wanted to make as much money as they could off my mistake.)
  - tptacek 11y ago
    I'm sorry, but this just isn't correct. It's hard to imagine any outside forensics investigation happening for less than $20k ($50k is a more reasonable estimate), and those outside investigations are often mandatory in breach cases. Insurance companies and, sometimes, regulated data protection usually require that the company take steps to ensure that everyone knows the limits of the attack --- and those limits, as you know, aren't at all obvious from the attackers overt actions. It looks like the attackers just fucked up a bunch of web pages. But they broke in; how do you know they didn't leave backdoors, or exfiltrate databases? You often don't, unless you engage an outside firm to verify.
    - sarciszewski 11y ago
      > It's hard to imagine any outside forensics investigation happening for less than $20k In my case, Sylint was the web host and the forensics investigator. That might also explain their duplicity and lack of consistency in the reports to the court. Aside, is knowing how to use Encase really that lucrative? I should switch specialties.
      - tptacek 11y ago
        I agree that EnCase jockeys are overpaid, and I generally think of forensics as a lower-status specialty than software security, but website breach investigations are much more annoying than just imaging hard drives.
        sarciszewski 11y ago
        I can only imagine, especially if the logging/auditing policy was "pretty much non-existent" and you don't know how extensive the access was for a given user account (nor how much of that access could have been used in the short window of compromise). If it were SSH access, I'd call it game over.
  - nmrm2 11y ago
    A "Business Management Consultant" group focused on "cyber" security? You shouldn't have been surprised ;-)
    - sarciszewski 11y ago
      Four years ago, I knew practically nothing about the security industry (or of business). I was a self-taught web programmer who knew really obvious ways to defend websites from attackers.
- msandford 11y ago
  You work for a bank and you have the keys to the vault. You quit. The bank doesn't immediately change the locks to ensure that their security isn't compromised. What happens to the keys after that is in my made up example doesn't matter. The bank is at fault because the bank has a responsibility to ensure the security of their operation, irrespective of how ethically or unethically their former employee acts from that point onwards. A newspaper is an information bank especially in the Internet age. EDIT: I should have specified "the bank is at fault for the total amount of damage" not that the bank is at fault full stop.
  - forgetsusername 11y ago
    >The bank is at fault because the bank has a responsibility to ensure the security of their operation Yes, and in the case of the Tribune company here, it cost them tens of thousands of dollars to "repair" the breach. That's the punishment for their failing of responsibility. It's not like they are suing to recover that money. But I'm not sure how that absolves the actual criminal here.
    - baldfat 11y ago
      > it cost them tens of thousands of dollars to "repair" the breach No they claimed just shy of a million dollars.
      - nmrm2 11y ago
        Right. I think the reasonable complaint in these cases is that the damages should cover the cost of investigation that resulted directly from the breach, not the cost of fixing the original security vulnerability and/or auditing the entire system. If you break into a bank, then the bank is right to ask for damages of amount stolen + amount necessary to sweep their building for any backdoors you might've added and repair any damage. That's fair. They shouldn't be suing for the cost of an upgrade to their security system or a new training course for their security officers.
    - msandford 11y ago
danso 11y ago
Yes, I agree...in fact, Tribune should be secretly thanking Keys...no matter what his actual intent, the incident got them to implement proper security...the $900K they spent they would've had to spend anyway and is a bargain compared to what could've happened. But "oh the company should've had better security" is a not strong legal defense, in the same way that "the victim shouldn't have been walking alone at might" is not. edit: just to clarify, I'm being flippant here since most of the main arguments for and against Keys have already been made...but I don't interpret Keys's actions as any kind of "white hat" hacking. According to the evidence, he most certainly tried to get Anonymous to burn the company to the ground, and he and Tribune are very lucky they didn't. However, I do think it's dishonest for the Tribune to claim $900K in damages when that was the amount used to shore up their security after the breach. But the $17K they spent as incident response seems very reasonable. But to then tack on the $900K so that the maximum possible prison time is more politically palatable helps to perpetuate the worst parts of the CFAA and the justice system.
jccc 11y ago
it does seem strange that this case is so big and the charges against him so large. Because he was caught up in the Feds surveillance of Anonymous. It is at least worth noting that Keys says it wasn't him. FTA: ----- “Let’s be clear: I never passed a username or password to Anonymous,” he said. Keys, who went on to serve as deputy social media editor for Reuters before his indictment in 2013, said he was investigating Anonymous in chatrooms when his username was used without his permission by parties unknown. Five years ago, Anonymous was in the news for its attacks on Visa and PayPal — and, according to Keys, he was just doing his job. “It occurred to me that no one had looked into these guys,” he said. “They were talking at a level above my head. … Anybody could co-opt [the username] and it looks like in this case somebody did.” Keys said the Tribune company — by then his former employer to whom he nonetheless pitched his story about Anonymous — should have supported him. This was about freedom of the press, not passwords. “Tribune Media – what are they thinking?” he said. “Do they care about journalism at all? Do they care about the government prosecuting a journalist who decided to keep his sources undisclosed? That is beyond disgusting.”
- sarciszewski 11y ago
  For the record, I'm aware of a group of blackhats who have co-opted the screen names of popular whitehats (including one who goes by briankrebs).
  - tptacek 11y ago
    This case would be more like blackhats co-opting Kreb's Twitter password.
    - sarciszewski 11y ago
      Did Keys use NickServ authentication? Was the person using his screen name at the time authenticated? Etc.
- tptacek 11y ago
  He says it wasn't him, but if it was someone else, they were much more thorough than just his username, since there's network evidence tying Keys to this as well (see again the search warrant).
pp19dd 11y ago
So, I have a very strong opinion of this whole matter, and the person behind it. I've forced myself to ignore everything I wanted to write or reply to about it, but what struck a chord was your perspective, which is that credentials should have been revoked. Journalism is a set of very specialized jobs. It's also a small cultural subset and after a time, everyone knows everyone. When you change jobs in news, you either go to an another news organization or pretty much retire from news (meaning you leave it and go do something else - it's rare that you'd ever come back to it and the barrier to re-entry becomes steeper.) What I mean to say is that your reputation definitely precedes you and it sticks around for a very long time. There are some in this thread who have written or implied that "most journalists" have no ethics or self-restraint and all they're guided by is the end result. In some organizations, that's true and those places keep their notoriety all to themselves. For every bad apple in every industry, there are thousands of notable ones who do their work, and more than enough of them have self-respect to uphold their integrity. Having said all that, I don't disagree with what you're saying at all. But here's an anecdote to help illustrate the culture and level of trust typically found in news. In early 2013 Nelson Mandela got sick. Many news organizations prepared a number of packages for the eventuality of his death - that included everything ranging from special reports, photo galleries, videos, memorials, and other special projects. A very talented colleague of mine put together a montage of Nelson Mandela's 1994 acceptance speech being read by various children living in South Africa today. It was pretty moving and showed just how things changed in those 20 years since. The project was finished, and readied in case it was ever needed. Then in mid-2013, that person left us and went to work for a large national newspaper, which was a great career move for them. Soon thereafter, a number of staff changes occurred and on the evening (local time) of Nelson Mandela's death, no one was left on duty who remembered the tribute package existed. The ones who did weren't on duty at the time and the material they could immediately put together was very lacking and would take some hours, perhaps a day to properly acknowledge the man and his work. That ex-colleague of mine tried to get in touch with duty editors, but was unable to get through. Given the timing and possibility that this material would never see the light of day, they remotely logged into our CMS (because none of the credentials were yet revoked), prepared the material as a draft and sent a note to the entire office letting them know it was ready for publishing. Some of the recipients on that list probably didn't even yet know the sender had left the organization, but from the email trail were very grateful to have the package ready to go. This is the kind of hard-working journalist with integrity I'd have expected Matthew Keys to be. He's not one.

by baldfat 11y ago

tptacek 11y ago

You leave a job, you keep the keys to your office, your employer forgets to take them back, you then deliberately copy the keys and hand them out to vandals. What court in the world would put any of the responsibility for that on the company? Trib didn't spend millions in cleanup, but if any breach investigation were done --- to rule out the attackers having done things to retain access after credentials were revoked, and to ensure Trib's clients that no PII was taken --- would easily run into the mid tens of thousands.

sarciszewski 11y ago
Even the tens of thousands could be a stretch for the actual cost. When I was handed a copy of my Pre-Sentencing Report, for an incident that took place on June 21, 2011, they billed from June 16-24. I pointed out that I did not own a time machine, then they quickly changed the dates to June 21-27 and dropped the "damages" by over 60%. That's the difference between certain prison time and probation with house arrest. (This was Sylint, maybe they're just scumbags and wanted to make as much money as they could off my mistake.)
- tptacek 11y ago
  I'm sorry, but this just isn't correct. It's hard to imagine any outside forensics investigation happening for less than $20k ($50k is a more reasonable estimate), and those outside investigations are often mandatory in breach cases. Insurance companies and, sometimes, regulated data protection usually require that the company take steps to ensure that everyone knows the limits of the attack --- and those limits, as you know, aren't at all obvious from the attackers overt actions. It looks like the attackers just fucked up a bunch of web pages. But they broke in; how do you know they didn't leave backdoors, or exfiltrate databases? You often don't, unless you engage an outside firm to verify.
  - sarciszewski 11y ago
    > It's hard to imagine any outside forensics investigation happening for less than $20k In my case, Sylint was the web host and the forensics investigator. That might also explain their duplicity and lack of consistency in the reports to the court. Aside, is knowing how to use Encase really that lucrative? I should switch specialties.
    - tptacek 11y ago
      I agree that EnCase jockeys are overpaid, and I generally think of forensics as a lower-status specialty than software security, but website breach investigations are much more annoying than just imaging hard drives.
      - sarciszewski 11y ago
        I can only imagine, especially if the logging/auditing policy was "pretty much non-existent" and you don't know how extensive the access was for a given user account (nor how much of that access could have been used in the short window of compromise). If it were SSH access, I'd call it game over.
- nmrm2 11y ago
  A "Business Management Consultant" group focused on "cyber" security? You shouldn't have been surprised ;-)
  - sarciszewski 11y ago
    Four years ago, I knew practically nothing about the security industry (or of business). I was a self-taught web programmer who knew really obvious ways to defend websites from attackers.
msandford 11y ago
You work for a bank and you have the keys to the vault. You quit. The bank doesn't immediately change the locks to ensure that their security isn't compromised. What happens to the keys after that is in my made up example doesn't matter. The bank is at fault because the bank has a responsibility to ensure the security of their operation, irrespective of how ethically or unethically their former employee acts from that point onwards. A newspaper is an information bank especially in the Internet age. EDIT: I should have specified "the bank is at fault for the total amount of damage" not that the bank is at fault full stop.
- forgetsusername 11y ago
  >The bank is at fault because the bank has a responsibility to ensure the security of their operation Yes, and in the case of the Tribune company here, it cost them tens of thousands of dollars to "repair" the breach. That's the punishment for their failing of responsibility. It's not like they are suing to recover that money. But I'm not sure how that absolves the actual criminal here.
  - baldfat 11y ago
    > it cost them tens of thousands of dollars to "repair" the breach No they claimed just shy of a million dollars.
    - nmrm2 11y ago
      Right. I think the reasonable complaint in these cases is that the damages should cover the cost of investigation that resulted directly from the breach, not the cost of fixing the original security vulnerability and/or auditing the entire system. If you break into a bank, then the bank is right to ask for damages of amount stolen + amount necessary to sweep their building for any backdoors you might've added and repair any damage. That's fair. They shouldn't be suing for the cost of an upgrade to their security system or a new training course for their security officers.
  - msandford 11y ago

danso 11y ago

Yes, I agree...in fact, Tribune should be secretly thanking Keys...no matter what his actual intent, the incident got them to implement proper security...the $900K they spent they would've had to spend anyway and is a bargain compared to what could've happened. But "oh the company should've had better security" is a not strong legal defense, in the same way that "the victim shouldn't have been walking alone at might" is not. edit: just to clarify, I'm being flippant here since most of the main arguments for and against Keys have already been made...but I don't interpret Keys's actions as any kind of "white hat" hacking. According to the evidence, he most certainly tried to get Anonymous to burn the company to the ground, and he and Tribune are very lucky they didn't. However, I do think it's dishonest for the Tribune to claim $900K in damages when that was the amount used to shore up their security after the breach. But the $17K they spent as incident response seems very reasonable. But to then tack on the $900K so that the maximum possible prison time is more politically palatable helps to perpetuate the worst parts of the CFAA and the justice system.

jccc 11y ago

it does seem strange that this case is so big and the charges against him so large. Because he was caught up in the Feds surveillance of Anonymous. It is at least worth noting that Keys says it wasn't him. FTA: ----- “Let’s be clear: I never passed a username or password to Anonymous,” he said. Keys, who went on to serve as deputy social media editor for Reuters before his indictment in 2013, said he was investigating Anonymous in chatrooms when his username was used without his permission by parties unknown. Five years ago, Anonymous was in the news for its attacks on Visa and PayPal — and, according to Keys, he was just doing his job. “It occurred to me that no one had looked into these guys,” he said. “They were talking at a level above my head. … Anybody could co-opt [the username] and it looks like in this case somebody did.” Keys said the Tribune company — by then his former employer to whom he nonetheless pitched his story about Anonymous — should have supported him. This was about freedom of the press, not passwords. “Tribune Media – what are they thinking?” he said. “Do they care about journalism at all? Do they care about the government prosecuting a journalist who decided to keep his sources undisclosed? That is beyond disgusting.”

sarciszewski 11y ago
For the record, I'm aware of a group of blackhats who have co-opted the screen names of popular whitehats (including one who goes by briankrebs).
- tptacek 11y ago
  This case would be more like blackhats co-opting Kreb's Twitter password.
  - sarciszewski 11y ago
    Did Keys use NickServ authentication? Was the person using his screen name at the time authenticated? Etc.
tptacek 11y ago
He says it wasn't him, but if it was someone else, they were much more thorough than just his username, since there's network evidence tying Keys to this as well (see again the search warrant).

pp19dd 11y ago

So, I have a very strong opinion of this whole matter, and the person behind it. I've forced myself to ignore everything I wanted to write or reply to about it, but what struck a chord was your perspective, which is that credentials should have been revoked. Journalism is a set of very specialized jobs. It's also a small cultural subset and after a time, everyone knows everyone. When you change jobs in news, you either go to an another news organization or pretty much retire from news (meaning you leave it and go do something else - it's rare that you'd ever come back to it and the barrier to re-entry becomes steeper.) What I mean to say is that your reputation definitely precedes you and it sticks around for a very long time. There are some in this thread who have written or implied that "most journalists" have no ethics or self-restraint and all they're guided by is the end result. In some organizations, that's true and those places keep their notoriety all to themselves. For every bad apple in every industry, there are thousands of notable ones who do their work, and more than enough of them have self-respect to uphold their integrity. Having said all that, I don't disagree with what you're saying at all. But here's an anecdote to help illustrate the culture and level of trust typically found in news. In early 2013 Nelson Mandela got sick. Many news organizations prepared a number of packages for the eventuality of his death - that included everything ranging from special reports, photo galleries, videos, memorials, and other special projects. A very talented colleague of mine put together a montage of Nelson Mandela's 1994 acceptance speech being read by various children living in South Africa today. It was pretty moving and showed just how things changed in those 20 years since. The project was finished, and readied in case it was ever needed. Then in mid-2013, that person left us and went to work for a large national newspaper, which was a great career move for them. Soon thereafter, a number of staff changes occurred and on the evening (local time) of Nelson Mandela's death, no one was left on duty who remembered the tribute package existed. The ones who did weren't on duty at the time and the material they could immediately put together was very lacking and would take some hours, perhaps a day to properly acknowledge the man and his work. That ex-colleague of mine tried to get in touch with duty editors, but was unable to get through. Given the timing and possibility that this material would never see the light of day, they remotely logged into our CMS (because none of the credentials were yet revoked), prepared the material as a draft and sent a note to the entire office letting them know it was ready for publishing. Some of the recipients on that list probably didn't even yet know the sender had left the organization, but from the email trail were very grateful to have the package ready to go. This is the kind of hard-working journalist with integrity I'd have expected Matthew Keys to be. He's not one.