4 ms·

That'll be an excellent example on many security talk slides in the future (PW strength, reuse of PWs, salting) They probably could have made some money by com

by kriro 10y ago

That'll be an excellent example on many security talk slides in the future (PW strength, reuse of PWs, salting) They probably could have made some money by combining some day trading of FB stock with a well timed announcement of resignation due to health concerns or something. Announce, anticipate drop, buy...leak it was fake, sell. Or whatever else you can come up with with some thinking. [maybe not because he'd post that on FB]

deanCommie 10y ago
I don't understand your logic. "If you're going to trespass on someone's property you might as well deface it and steal some of their stuff" I am not a lawyer but I could see password breaching in the interest of white hat security could be is looked an a lot differently by the courts than what you're suggesting
- kriro 10y ago
  I believe the passwords came from the 2012 LinkedIn breach and was referring to the original criminals. If you have the criminal energy to steal that data you might as well use it. I don't think there was anything white hat about that incident.
  - toyg 10y ago
    > If you have the criminal energy to steal that data you might as well use it. No no no. Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story (or at least someone who will put further space between him and the goods).
    - jacquesm 10y ago
      > Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story I think that contains a contradiction.
      - toyg 10y ago
        ok, "will not gain from directly leveraging goods acquired in a break-in against the same victims of such break-in". Thieves usually don't try to sell your TV back to you, and the ones who do are widely mocked. But you know what I meant.
jacquesm 10y ago
Sounds like an excellent way to spend some time in jail.
- MichaelGG 10y ago
  Think so? I'm sure lots of people have limit orders in at low prices, so that part alone isn't suspicious. But it might put you on a shortlist of potential hacker suspects.
  - mseebach 10y ago
    The features that makes orders not suspicious are the same that make them not terribly profitable in this event. Having a standing buy order at a few percent below current trading is fine, having one for several million dollars isn't (it implies that you know the stock is going to bounce back).
uola 10y ago
It would be an excellent example in a security talk 10 years ago. If anything it should be used to promote better authentication solutions.
tajen 10y ago
Anyone knows a CEO who used "cube" as a password? I wonder why the top of the extremely competent people can be so sloppy sometimes. I'll suggest that's what you get when you found a startup straight after uni: You don't understand what it's like to jump through employment hoops.
- vthallam 10y ago
  > I'll suggest that's what you get when you found a startup straight after uni There's no statistical correlation for this. If anything, i would say it's the opposite, most of the young founders knows the importance of the security in this day and age.
jasonlotito 10y ago
I'd say that it makes the argument that reuse of passwords is more dangerous than simply using poor passwords. After all, it's complexity didn't seem to matter in this case. In fact, one could argue that the only thing a user of a site need concern themselves with is not using the same password in multiple locations. Once that is achieved, I wonder, if the chances of your account being hacked dramatically decrease more than any other safety precaution you can take, apart from simply not having any account.
elorant 10y ago
And then they'd spend all that money hiring lawyers to keep them out of jail. First rule of hacking is to stay away from high profile targets because they attract too much attention. I think they handled it nicely. They exposed the vulnerability without doing anything harmful.
- cloudjacker 10y ago
  First rule of hacking is to separate liability to stay out of jail. Prosecution is typically limited because the person that discovers the hack isn't the person that exploits the hack, isn't the person day trading Facebook stock after the fake press releases. And of course - and still up for controversy - selling hacks isn't restricted in any way right now.
  - nostrebored 10y ago
    Neither is selling antivirus-circumventing RATs. Both are usually sold with the disclaimer "for educational purposes only".
caseysoftware 10y ago
There are way more subtle ways to cause problems and make money that would be less likely to land you in jail. Are you an entrepreneur? What is it worth to have "Mark" tweet about your company/product? Or maybe make a warm intro to a top tier investor? Sure, none of them are likely to radically change your business but some things just need a little push to get going and turn into something bigger. I wrote about this (and other) scenarios in 2010: http://caseysoftware.com/blog/social-media-for-social-evil-part-i-impersonation http://caseysoftware.com/blog/social-media-for-social-evil-p...

by kriro 10y ago

deanCommie 10y ago

I don't understand your logic. "If you're going to trespass on someone's property you might as well deface it and steal some of their stuff" I am not a lawyer but I could see password breaching in the interest of white hat security could be is looked an a lot differently by the courts than what you're suggesting

kriro 10y ago
I believe the passwords came from the 2012 LinkedIn breach and was referring to the original criminals. If you have the criminal energy to steal that data you might as well use it. I don't think there was anything white hat about that incident.
- toyg 10y ago
  > If you have the criminal energy to steal that data you might as well use it. No no no. Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story (or at least someone who will put further space between him and the goods).
  - jacquesm 10y ago
    > Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story I think that contains a contradiction.
    - toyg 10y ago
      ok, "will not gain from directly leveraging goods acquired in a break-in against the same victims of such break-in". Thieves usually don't try to sell your TV back to you, and the ones who do are widely mocked. But you know what I meant.

jacquesm 10y ago

Sounds like an excellent way to spend some time in jail.

MichaelGG 10y ago
Think so? I'm sure lots of people have limit orders in at low prices, so that part alone isn't suspicious. But it might put you on a shortlist of potential hacker suspects.
- mseebach 10y ago
  The features that makes orders not suspicious are the same that make them not terribly profitable in this event. Having a standing buy order at a few percent below current trading is fine, having one for several million dollars isn't (it implies that you know the stock is going to bounce back).

uola 10y ago

It would be an excellent example in a security talk 10 years ago. If anything it should be used to promote better authentication solutions.

tajen 10y ago

Anyone knows a CEO who used "cube" as a password? I wonder why the top of the extremely competent people can be so sloppy sometimes. I'll suggest that's what you get when you found a startup straight after uni: You don't understand what it's like to jump through employment hoops.

vthallam 10y ago
> I'll suggest that's what you get when you found a startup straight after uni There's no statistical correlation for this. If anything, i would say it's the opposite, most of the young founders knows the importance of the security in this day and age.

jasonlotito 10y ago

I'd say that it makes the argument that reuse of passwords is more dangerous than simply using poor passwords. After all, it's complexity didn't seem to matter in this case. In fact, one could argue that the only thing a user of a site need concern themselves with is not using the same password in multiple locations. Once that is achieved, I wonder, if the chances of your account being hacked dramatically decrease more than any other safety precaution you can take, apart from simply not having any account.

elorant 10y ago

And then they'd spend all that money hiring lawyers to keep them out of jail. First rule of hacking is to stay away from high profile targets because they attract too much attention. I think they handled it nicely. They exposed the vulnerability without doing anything harmful.

cloudjacker 10y ago
First rule of hacking is to separate liability to stay out of jail. Prosecution is typically limited because the person that discovers the hack isn't the person that exploits the hack, isn't the person day trading Facebook stock after the fake press releases. And of course - and still up for controversy - selling hacks isn't restricted in any way right now.
- nostrebored 10y ago
  Neither is selling antivirus-circumventing RATs. Both are usually sold with the disclaimer "for educational purposes only".

caseysoftware 10y ago

There are way more subtle ways to cause problems and make money that would be less likely to land you in jail. Are you an entrepreneur? What is it worth to have "Mark" tweet about your company/product? Or maybe make a warm intro to a top tier investor? Sure, none of them are likely to radically change your business but some things just need a little push to get going and turn into something bigger. I wrote about this (and other) scenarios in 2010: http://caseysoftware.com/blog/social-media-for-social-evil-part-i-impersonation http://caseysoftware.com/blog/social-media-for-social-evil-p...