8 ms·

Man arrested in VTech hack that exposed data for millions of kids

23 points by shawndumas 11y ago

therein 11y ago
VTech made me think it was Virginia Tech.
- geoffpado 11y ago
  I have thought that for the entire time this story has been in the news and only today realized it wasn't.
_Codemonkeyism 11y ago
I always wonder why the guy is prosecuted and not VTech for failing to protect the images of children in any way - and worse obviously not making any serious effort for data protection.
- jacquesm 11y ago
  "Shoot the messenger". So make sure you're protecting your identity when you do stuff like this, oh, and also don't take data from systems that you have no business accessing in the first place, even if it is to prove a point it can still get you into a lot of trouble.
- realusername 11y ago
  Basically my thoughts. Some random 21 year old boy exploits a flash login page with a SQL injection straight from the 90's and it does not shock anyone that he was even able to do it.
  - aaronem 11y ago
    > 21 year old boy Old enough to drink in a bar, vote in an election, die for his country, and he's a "boy"?
- wglb 11y ago
  When I first read The Cuckoo's Egg I thought that companies connected to the internet that leave open doors, e.g., the service account with username "field" password "service" should be the ones prosecuted, not the teenagers that find it. Mind you, the arrested hacker here went way beyond what was necessary to illustrate the vulnerability.
- noxToken 11y ago
  In the US, the law is written in defense of the host. The attacker is considered at fault for breaching a system that they are not supposed to have access to. From the CFAA(a)(2)(C)[1]: >Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer; The spirit of this law is fine: security is notoriously hard to get right. We have to account for the human component that will inevitably fudge something. Thus companies that give reasonable attempts at securing their data yet still fall short in certain areas are still protected under the law. Conversely, companies that don't care are also protected due to the letter, rather than the spirit, of the law. [1]: https://www.law.cornell.edu/uscode/text/18/1030#a_2 https://www.law.cornell.edu/uscode/text/18/1030#a_2
- tptacek 11y ago
  One reason for that is that to be prosecuted, you have to commit a crime that was on the books when you did it. As a software developer, how comfortable are you with criminal liability for security vulnerabilities?
  - _Codemonkeyism 11y ago
    Not very comfortable, but I wonder what effects this would have on our industry.
jacquesm 11y ago
Choice quote from a thread the other day on HN: "Us enthusiasts don't mean any harm and almost never perform tests that break the software (or network). There's a reason why bounty programs exist." https://news.ycombinator.com/item?id=10730400 https://news.ycombinator.com/item?id=10730400
thesehands 11y ago
Exposing expoits prior to letting the vulnerable party know is a pretty poor way to go about things, but at what point should legal action be taken against VTech for not properly securing this info?
tptacek 11y ago
Whether you have bounty-style permission to test someone's site or not, a red line you never cross: post-exploit privilege exploitation and pivoting. If you find a SQLI vulnerability, you assume you own not just the site but the whole deployment environment. You won. Don't go trying to prove you won. Very few companies, even the ones that post bug bounties, will put up with random people on the Internet owning up their backend servers. Even on professional pentests, you ask permission to pivot. If it wasn't in the rules of engagement when the test began, chances are the answer is "no". (That's no surprise: there isn't much to be learned by the target from it. A gameover is a gameover.)
- ashurov 11y ago
  How would you inform the general public of the severity of the problem?! "Hey they have an SQLI vulnerability! I own them!" or "Hey I just downloaded millions of records including the photo's you took". See the difference? I agree with your point, but that approach doesn't translate the severity of the problem to the public. I don't have the solution to this problem, except perhaps educating the general public?!
  - tptacek 11y ago
    People ask that all the time. The answer is simple. No matter what you say and do, some people are going to rationalize and minimize impact. You don't get to solve that. You make the best argument you can with the facts that are available to you without pivoting.
- therockhead 11y ago
  What does pivot mean in this context ?
  - tptacek 11y ago
    https://en.wikipedia.org/wiki/Exploit_(computer_security)#Pivoting https://en.wikipedia.org/wiki/Exploit_(computer_security)#Pi...

23 points by shawndumas 11y ago

therein 11y ago

VTech made me think it was Virginia Tech.

geoffpado 11y ago
I have thought that for the entire time this story has been in the news and only today realized it wasn't.

_Codemonkeyism 11y ago

I always wonder why the guy is prosecuted and not VTech for failing to protect the images of children in any way - and worse obviously not making any serious effort for data protection.

jacquesm 11y ago
"Shoot the messenger". So make sure you're protecting your identity when you do stuff like this, oh, and also don't take data from systems that you have no business accessing in the first place, even if it is to prove a point it can still get you into a lot of trouble.
realusername 11y ago
Basically my thoughts. Some random 21 year old boy exploits a flash login page with a SQL injection straight from the 90's and it does not shock anyone that he was even able to do it.
- aaronem 11y ago
  > 21 year old boy Old enough to drink in a bar, vote in an election, die for his country, and he's a "boy"?
wglb 11y ago
When I first read The Cuckoo's Egg I thought that companies connected to the internet that leave open doors, e.g., the service account with username "field" password "service" should be the ones prosecuted, not the teenagers that find it. Mind you, the arrested hacker here went way beyond what was necessary to illustrate the vulnerability.
noxToken 11y ago
In the US, the law is written in defense of the host. The attacker is considered at fault for breaching a system that they are not supposed to have access to. From the CFAA(a)(2)(C)[1]: >Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer; The spirit of this law is fine: security is notoriously hard to get right. We have to account for the human component that will inevitably fudge something. Thus companies that give reasonable attempts at securing their data yet still fall short in certain areas are still protected under the law. Conversely, companies that don't care are also protected due to the letter, rather than the spirit, of the law. [1]: https://www.law.cornell.edu/uscode/text/18/1030#a_2 https://www.law.cornell.edu/uscode/text/18/1030#a_2
tptacek 11y ago
One reason for that is that to be prosecuted, you have to commit a crime that was on the books when you did it. As a software developer, how comfortable are you with criminal liability for security vulnerabilities?
- _Codemonkeyism 11y ago
  Not very comfortable, but I wonder what effects this would have on our industry.

jacquesm 11y ago

Choice quote from a thread the other day on HN: "Us enthusiasts don't mean any harm and almost never perform tests that break the software (or network). There's a reason why bounty programs exist." https://news.ycombinator.com/item?id=10730400 https://news.ycombinator.com/item?id=10730400

thesehands 11y ago

Exposing expoits prior to letting the vulnerable party know is a pretty poor way to go about things, but at what point should legal action be taken against VTech for not properly securing this info?

tptacek 11y ago

Whether you have bounty-style permission to test someone's site or not, a red line you never cross: post-exploit privilege exploitation and pivoting. If you find a SQLI vulnerability, you assume you own not just the site but the whole deployment environment. You won. Don't go trying to prove you won. Very few companies, even the ones that post bug bounties, will put up with random people on the Internet owning up their backend servers. Even on professional pentests, you ask permission to pivot. If it wasn't in the rules of engagement when the test began, chances are the answer is "no". (That's no surprise: there isn't much to be learned by the target from it. A gameover is a gameover.)

ashurov 11y ago
How would you inform the general public of the severity of the problem?! "Hey they have an SQLI vulnerability! I own them!" or "Hey I just downloaded millions of records including the photo's you took". See the difference? I agree with your point, but that approach doesn't translate the severity of the problem to the public. I don't have the solution to this problem, except perhaps educating the general public?!
- tptacek 11y ago
  People ask that all the time. The answer is simple. No matter what you say and do, some people are going to rationalize and minimize impact. You don't get to solve that. You make the best argument you can with the facts that are available to you without pivoting.
therockhead 11y ago
What does pivot mean in this context ?
- tptacek 11y ago
  https://en.wikipedia.org/wiki/Exploit_(computer_security)#Pivoting https://en.wikipedia.org/wiki/Exploit_(computer_security)#Pi...