3 ms·

Hacker Sentenced to 20 Years for Breach of Credit Card Processor

3 points by j_baker 17y ago

tptacek 17y ago
Before somebody says it: The minimum Federal sentence for murder appears to be ~20 years (the sentencing range is ~20-25 years, for second degree murder, for someone with no criminal history). The minimum Federal sentence for first degree murder is life. Yes, you can rape someone and spend less than 20 years in prison. Personally, the problem I see there is with the rape sentence, not with the sentence for selling 100 million people's credit cards to the Russian Mafia.
- rms 17y ago
  20 years in prison for most crimes short of murder seems ridiculous to me. It is only relatively recently in human history that long prison terms as punishment have become normal. http://en.wikipedia.org/wiki/Prison_abolition_movement http://en.wikipedia.org/wiki/Prison_abolition_movement
  - tptacek 17y ago
    That's an interesting article about a movement that appears to conflate everything that is wrong about criminal justice, and everything that is reasonable about criminal justice into a single issue. 10 years for aggravated rape? Aggravated rape: throw away the keys.
- bad_user 17y ago
  The scary thing ... a robber can get from a house something like $100.000 (and that's on a good day). A good cracker can get tens of millions in a week. I think he should've gotten the full 25 years. But the software company should've also been fined, depending on the stupidity of the bug that allowed for an SQL injection.
  - tptacek 17y ago
    There's a popular fallacy --- at least, I think it's a fallacy? --- that involves people being shocked at the consequences of doing stupid things with computers. Sometimes it's outrage at the fact that the perpetrator was just joking, or was just exploring. Other times it's outage at the fact that the "victim" was so vulnerable or took so few precautions. The reality is that none of this matters. If you crash a system that would not have crashed on its own by running something called an "attack" on it, and that costs the victim tens of millions of dollars, guess what? You just did tens of millions of dollars in damages. There is some BS involved in assessing damages, where cost of investigation and cleanup gets inflated, just like your landlords inflate cleanup costs to get your whole security deposit. But the fact that you used a computer to casually attack someone who was not adequately protected doesn't insulate you from the consequences of your actions. Be more careful. Computers amplify bad consequences as well as good ones.
    - wglb 17y ago
      While I was first reading "The Cuckoo's Egg" when it first came out, I found myself asking "instead of laws penalizing the teenagers that are penetrating these open systems, how about making it an equivalent felony for putting into a production a system that has the service account userid/password 'field/service'". I wonder if a couple of public wrist slaps or stronger, depending on the damage, might have changed that course of history.
petercooper 17y ago
I can't say he didn't deserve the sentence, but the name "Gonzalez" had no bearing on the sentence given? No siree bob.. Max Ray Vision, the "carders market" guy, got 13 years recently, and that was the longest hacking related jailtime sentence ever given till now. Other big cases didn't yield significant jailtime: 5 years for Mitnick on a second offence. 8 months for "MafiaBoy". David L. Smith (Melissa virus) 20 months. Sven Jaschan, 3 years probation. Kim "Kimble" Schmitz, 2 years for Internet credit card fraud.
- tptacek 17y ago
  I don't know the stories on most of these cases, but I know the Mitnick case wasn't anything nearly as bad as the TJX case. Mitnick didn't set up a business selling the results of his exploits to organized crime. When you exploit security flaws to help the mafia, or, worse, profit from helping the mafia, you become part of the mafia. A tip for people considering a life of crime: don't become part of the mafia.
- ax0n 17y ago
  I have a few thoughts on this. First off, Max Vision got a hefty sentence because he went above and beyond "hacking" - People don't really get arrested for Hacking. Hacking is the end result of curiosity. Semantics, yes, but Max vision blew it. Big time. Bigger than Mafiaboy, YC's own Robert Morris or even Kevin Mitnick. We're talking multiple counts of wire fraud and sale of identity information. Also, this wasn't Max's first time in FPMITA prison, either. The dude had it coming. Gonzales was right there with him, in my book. I was almost certain that when he went on trial, his sentence would be heftier than Max's. I was figuring 15 years, but 20 doesn't surprise me at all. Mafia involvement and financial havoc have so much more to do with it than his last name.
moe 17y ago
So and how long did the companies get that stored "130 million credit cards" in systems vulnerable to SQL injection attacks?

3 points by j_baker 17y ago

Before somebody says it: The minimum Federal sentence for murder appears to be ~20 years (the sentencing range is ~20-25 years, for second degree murder, for someone with no criminal history). The minimum Federal sentence for first degree murder is life. Yes, you can rape someone and spend less than 20 years in prison. Personally, the problem I see there is with the rape sentence, not with the sentence for selling 100 million people's credit cards to the Russian Mafia.

rms 17y ago
20 years in prison for most crimes short of murder seems ridiculous to me. It is only relatively recently in human history that long prison terms as punishment have become normal. http://en.wikipedia.org/wiki/Prison_abolition_movement http://en.wikipedia.org/wiki/Prison_abolition_movement
- tptacek 17y ago
  That's an interesting article about a movement that appears to conflate everything that is wrong about criminal justice, and everything that is reasonable about criminal justice into a single issue. 10 years for aggravated rape? Aggravated rape: throw away the keys.
bad_user 17y ago
The scary thing ... a robber can get from a house something like $100.000 (and that's on a good day). A good cracker can get tens of millions in a week. I think he should've gotten the full 25 years. But the software company should've also been fined, depending on the stupidity of the bug that allowed for an SQL injection.
- tptacek 17y ago
  There's a popular fallacy --- at least, I think it's a fallacy? --- that involves people being shocked at the consequences of doing stupid things with computers. Sometimes it's outrage at the fact that the perpetrator was just joking, or was just exploring. Other times it's outage at the fact that the "victim" was so vulnerable or took so few precautions. The reality is that none of this matters. If you crash a system that would not have crashed on its own by running something called an "attack" on it, and that costs the victim tens of millions of dollars, guess what? You just did tens of millions of dollars in damages. There is some BS involved in assessing damages, where cost of investigation and cleanup gets inflated, just like your landlords inflate cleanup costs to get your whole security deposit. But the fact that you used a computer to casually attack someone who was not adequately protected doesn't insulate you from the consequences of your actions. Be more careful. Computers amplify bad consequences as well as good ones.
  - wglb 17y ago
    While I was first reading "The Cuckoo's Egg" when it first came out, I found myself asking "instead of laws penalizing the teenagers that are penetrating these open systems, how about making it an equivalent felony for putting into a production a system that has the service account userid/password 'field/service'". I wonder if a couple of public wrist slaps or stronger, depending on the damage, might have changed that course of history.

petercooper 17y ago

I can't say he didn't deserve the sentence, but the name "Gonzalez" had no bearing on the sentence given? No siree bob.. Max Ray Vision, the "carders market" guy, got 13 years recently, and that was the longest hacking related jailtime sentence ever given till now. Other big cases didn't yield significant jailtime: 5 years for Mitnick on a second offence. 8 months for "MafiaBoy". David L. Smith (Melissa virus) 20 months. Sven Jaschan, 3 years probation. Kim "Kimble" Schmitz, 2 years for Internet credit card fraud.

tptacek 17y ago
I don't know the stories on most of these cases, but I know the Mitnick case wasn't anything nearly as bad as the TJX case. Mitnick didn't set up a business selling the results of his exploits to organized crime. When you exploit security flaws to help the mafia, or, worse, profit from helping the mafia, you become part of the mafia. A tip for people considering a life of crime: don't become part of the mafia.
ax0n 17y ago
I have a few thoughts on this. First off, Max Vision got a hefty sentence because he went above and beyond "hacking" - People don't really get arrested for Hacking. Hacking is the end result of curiosity. Semantics, yes, but Max vision blew it. Big time. Bigger than Mafiaboy, YC's own Robert Morris or even Kevin Mitnick. We're talking multiple counts of wire fraud and sale of identity information. Also, this wasn't Max's first time in FPMITA prison, either. The dude had it coming. Gonzales was right there with him, in my book. I was almost certain that when he went on trial, his sentence would be heftier than Max's. I was figuring 15 years, but 20 doesn't surprise me at all. Mafia involvement and financial havoc have so much more to do with it than his last name.

moe 17y ago

So and how long did the companies get that stored "130 million credit cards" in systems vulnerable to SQL injection attacks?