8 ms·

Florida programmer arrested for gaining unauthorized access to kernel.org

116 points by ashitlerferad 10y ago

ashitlerferad 10y ago
More discussion: https://lwn.net/Articles/699128/ https://lwn.net/Articles/699128/
kevin_thibedeau 10y ago
I wonder what evidence broke this. Did he blab about it or was this a submarined parallel construction?
- eli 10y ago
  Those are the only two ways to get an indictment?
- tptacek 10y ago
  For "parallel construction" to apply, the intelligence community would have had to create the conditions in which a search authorized for some other reason would have uncovered evidence of the kernel.org rootkits. The common example of parallel construction (because it's simple to explain, not because there's evidence it's happened) is: unauthorized electronic surveillance reveals that a drug transaction is going to happen at such-and-such corner at such-and-such time. The surveillance is shared with the police, who then station officers near the site of the transaction, and who are therefore able to observe the crime as it takes place --- giving them probable cause to effect the search themselves. In other words, parallel construction is a way of allowing the police to be at the "right place and right time". So, to move the ball forward on the conspiracy theory that some 27 year old doofus who rootkitted kernel.org with stolen credentials was so important to the NSA that they monitored him and conspired with the FBI to ensure he was charged, you must first come up with the set of circumstances in which the NSA could have shared something with the FBI that would have enabled FBI to de novo generate probable cause for a search.
  - jimrandomh 10y ago
    Investigating a rootkit on kernel.org falls squarely within the NSA's counterintelligence mission. Until they investigate, they don't know whether it was done by a random 27 year old doofus or by a nation state.
    - tptacek 10y ago
      That's the first half of the argument. The second half is why and how the NSA then set the 27 year old up to get searched by the FBI.
jrockway 10y ago
40 years in prison plus a one million dollar fine? Might as well kill a few people while he's out on bail, he already paid for it.
- slavik81 10y ago
  If anything, I would think that the bail would indicate he's unlikely to receive the maximum sentence. I suspect that few do. That said, I am not a lawyer. Edit: A bit about the United States Sentencing Guidelines, linked from the lwn thread: https://popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://popehat.com/2013/02/05/crime-whale-sushi-sentence-el...
  - jrockway 10y ago
    Yeah. On some level, I try to get people to read "he faces up to ..." as "he faces no more than ..." Still though, a little disproportionate.
    - deleted 10y ago
      [deleted]
- jsmthrowaway 10y ago
  Concurrent sentences do happen, especially when all the counts stem from one incident, though I'm unsure if they happen for federal crimes. (In that case assuming full conviction he'd serve each count at the same time, making it up to ten.) They're obviously angling toward a plea, though.
  - tptacek 10y ago
    Under the federal sentencing guidelines, a person charged with many counts of the same offense serves only the sentence associated with the most severe of those offenses; the sentences "group" by charge, and the grouping rules are part of the sentencing guidelines.
raverbashing 10y ago
Good As much as technical solutions to security are important, there, the legal aspect should not be forgotten
- aviraldg 10y ago
  40 years, or even 10 years is not a reasonable sentence for cybercrime. It should be no more than 2-3 years in the severest of cases.
  - lm2s 10y ago
    IMO it really depends on the cybercrime. Maybe in this instance 2-3 years should be sufficient. I can, however, imagine scenarios where much longer sentences should be applied. If a cybercrime results in human casualties, for (a more extreme) example.
    - nitrogen 10y ago
      There are already laws against homicide, though. Use those.
      - pessimizer 10y ago
        What if the effects result in an estimated 12 suicides, 1,000 children becoming homeless, and 10,000 teenagers not being able to go to college? Probation, or not worth charging? What if someone punches you in the face and steals your wallet, resulting in minor bruising, an adrenaline dump, the loss of $42 and at least three hours spent on the process of replacing your ID and credit cards?
    - djsumdog 10y ago
      ..and the board of directors of many major banks should all be in jail after the 2008 financial crisis. They're not only free, many of them kept their bonuses. 1% of Americans are in the incarnation system or out on parole. That's more than all of the other high income countries. Our legal system is hardly fair, and this is another example of it.
soufron 10y ago
Hacking hackers is a dangerous game.
ryanlol 10y ago
This took 5 years to prosecute and the guy has at least one shell company mentioned in the panama papers. Seems likely there's a little more to the story. (or they didn't find anything for 5 years until the guy bragged to someone) However by far the strangest thing here is how very specific the charges are, one hack 5 years ago and no co-conspirators? How on earth didn't they find anything else to charge him with? [1] [1] Of course this all could be explained away by them having a weak case, which they probably would have if they failed to seize his personal equipment
- dhimes 10y ago
  My gut agrees with yours. What's the benefit? Was he working for someone, or is this part of a plan to become Dr. Evil? Seems to be beyond a prankster act.
  - ryanlol 10y ago
    I couldn't easily figure out just who this guy was (i.e. handle) but it seems somewhat unusual that he would've performed the hack alone. Especially given the malware deployed[1] and information shared by the victims [2]. >What's the benefit? Tons, having personally tried the same thing in the past :^) Being able to serve backdoored copies of the kernel to targeted users would be all kinds of useful, and you'd be in an unique position to target the kernel developers themselves, allowing you to actually insert a backdoor into the kernel. [1] Phalanx is by far one of the most advanced pieces of publicly analysed linux malware https://volatility-labs.blogspot.de/2012/10/phalanx-2-revealed-using-volatility-to.html https://volatility-labs.blogspot.de/2012/10/phalanx-2-reveal... [2] Kernel.org folks claimed that they weren't the only target, which is to be expected (people with no prior hacking experience rarely decide to acquire/produce somewhat advanced linux malware and install it on kernel.org) [2] ctrl+f credential-stealing https://lwn.net/Articles/464233/ https://lwn.net/Articles/464233/
- saynsedit 10y ago
  What is your source on the shell company involvement? Couldn't find anything on that.
hashin 10y ago
One silver lining I would like to see is that public facing websites are starting to use the word 'programmer' rather than the plain old 'hacker' slang.
- tsegers 10y ago
  I'm not quite sure if that's a silver lining, as it's usage in such a way might do to the word "programmer" what it did to the word "hacker", namely turn an innocent word into one with connotations people would rather not associate themselves with.
puppetmaster3 10y ago
is kernel.org open source? Why do you need to hack in to access it? Is there something in kernel that is hidden I wonder.
ratsmack 10y ago
I know that motive will sometimes play into the sentencing, so it will be interesting to see what reason he had to gain access to the servers. I can't imagine what monetary gain there may have been, so it must have been something else.
hackuser 10y ago
Is this a sign of Linux' growing political influence when government agencies are investigating crimes against it and enforcing them? Would this crime have been handled by the federal government 10 years ago? 20? Would an attack on your server get a response from the FBI and the DOJ? That influence doesn't have to be the Linux Foundation; it could also be corporate or other powerful entities that are heavily invested in it, such as IBM.
gjolund 10y ago
Why is him being from FL relevant?

116 points by ashitlerferad 10y ago

ashitlerferad 10y ago

More discussion: https://lwn.net/Articles/699128/ https://lwn.net/Articles/699128/

kevin_thibedeau 10y ago

I wonder what evidence broke this. Did he blab about it or was this a submarined parallel construction?

eli 10y ago
Those are the only two ways to get an indictment?
tptacek 10y ago
For "parallel construction" to apply, the intelligence community would have had to create the conditions in which a search authorized for some other reason would have uncovered evidence of the kernel.org rootkits. The common example of parallel construction (because it's simple to explain, not because there's evidence it's happened) is: unauthorized electronic surveillance reveals that a drug transaction is going to happen at such-and-such corner at such-and-such time. The surveillance is shared with the police, who then station officers near the site of the transaction, and who are therefore able to observe the crime as it takes place --- giving them probable cause to effect the search themselves. In other words, parallel construction is a way of allowing the police to be at the "right place and right time". So, to move the ball forward on the conspiracy theory that some 27 year old doofus who rootkitted kernel.org with stolen credentials was so important to the NSA that they monitored him and conspired with the FBI to ensure he was charged, you must first come up with the set of circumstances in which the NSA could have shared something with the FBI that would have enabled FBI to de novo generate probable cause for a search.
- jimrandomh 10y ago
  Investigating a rootkit on kernel.org falls squarely within the NSA's counterintelligence mission. Until they investigate, they don't know whether it was done by a random 27 year old doofus or by a nation state.
  - tptacek 10y ago
    That's the first half of the argument. The second half is why and how the NSA then set the 27 year old up to get searched by the FBI.

jrockway 10y ago

40 years in prison plus a one million dollar fine? Might as well kill a few people while he's out on bail, he already paid for it.

slavik81 10y ago
If anything, I would think that the bail would indicate he's unlikely to receive the maximum sentence. I suspect that few do. That said, I am not a lawyer. Edit: A bit about the United States Sentencing Guidelines, linked from the lwn thread: https://popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://popehat.com/2013/02/05/crime-whale-sushi-sentence-el...
- jrockway 10y ago
  Yeah. On some level, I try to get people to read "he faces up to ..." as "he faces no more than ..." Still though, a little disproportionate.
  - deleted 10y ago
    [deleted]
jsmthrowaway 10y ago
Concurrent sentences do happen, especially when all the counts stem from one incident, though I'm unsure if they happen for federal crimes. (In that case assuming full conviction he'd serve each count at the same time, making it up to ten.) They're obviously angling toward a plea, though.
- tptacek 10y ago
  Under the federal sentencing guidelines, a person charged with many counts of the same offense serves only the sentence associated with the most severe of those offenses; the sentences "group" by charge, and the grouping rules are part of the sentencing guidelines.

raverbashing 10y ago

Good As much as technical solutions to security are important, there, the legal aspect should not be forgotten

aviraldg 10y ago
40 years, or even 10 years is not a reasonable sentence for cybercrime. It should be no more than 2-3 years in the severest of cases.
- lm2s 10y ago
  IMO it really depends on the cybercrime. Maybe in this instance 2-3 years should be sufficient. I can, however, imagine scenarios where much longer sentences should be applied. If a cybercrime results in human casualties, for (a more extreme) example.
  - nitrogen 10y ago
    There are already laws against homicide, though. Use those.
    - pessimizer 10y ago
      What if the effects result in an estimated 12 suicides, 1,000 children becoming homeless, and 10,000 teenagers not being able to go to college? Probation, or not worth charging? What if someone punches you in the face and steals your wallet, resulting in minor bruising, an adrenaline dump, the loss of $42 and at least three hours spent on the process of replacing your ID and credit cards?
  - djsumdog 10y ago
    ..and the board of directors of many major banks should all be in jail after the 2008 financial crisis. They're not only free, many of them kept their bonuses. 1% of Americans are in the incarnation system or out on parole. That's more than all of the other high income countries. Our legal system is hardly fair, and this is another example of it.

soufron 10y ago

Hacking hackers is a dangerous game.

ryanlol 10y ago

This took 5 years to prosecute and the guy has at least one shell company mentioned in the panama papers. Seems likely there's a little more to the story. (or they didn't find anything for 5 years until the guy bragged to someone) However by far the strangest thing here is how very specific the charges are, one hack 5 years ago and no co-conspirators? How on earth didn't they find anything else to charge him with? [1] [1] Of course this all could be explained away by them having a weak case, which they probably would have if they failed to seize his personal equipment

dhimes 10y ago
My gut agrees with yours. What's the benefit? Was he working for someone, or is this part of a plan to become Dr. Evil? Seems to be beyond a prankster act.
- ryanlol 10y ago
  I couldn't easily figure out just who this guy was (i.e. handle) but it seems somewhat unusual that he would've performed the hack alone. Especially given the malware deployed[1] and information shared by the victims [2]. >What's the benefit? Tons, having personally tried the same thing in the past :^) Being able to serve backdoored copies of the kernel to targeted users would be all kinds of useful, and you'd be in an unique position to target the kernel developers themselves, allowing you to actually insert a backdoor into the kernel. [1] Phalanx is by far one of the most advanced pieces of publicly analysed linux malware https://volatility-labs.blogspot.de/2012/10/phalanx-2-revealed-using-volatility-to.html https://volatility-labs.blogspot.de/2012/10/phalanx-2-reveal... [2] Kernel.org folks claimed that they weren't the only target, which is to be expected (people with no prior hacking experience rarely decide to acquire/produce somewhat advanced linux malware and install it on kernel.org) [2] ctrl+f credential-stealing https://lwn.net/Articles/464233/ https://lwn.net/Articles/464233/
saynsedit 10y ago
What is your source on the shell company involvement? Couldn't find anything on that.

hashin 10y ago

One silver lining I would like to see is that public facing websites are starting to use the word 'programmer' rather than the plain old 'hacker' slang.

tsegers 10y ago
I'm not quite sure if that's a silver lining, as it's usage in such a way might do to the word "programmer" what it did to the word "hacker", namely turn an innocent word into one with connotations people would rather not associate themselves with.

puppetmaster3 10y ago

is kernel.org open source? Why do you need to hack in to access it? Is there something in kernel that is hidden I wonder.

ratsmack 10y ago

I know that motive will sometimes play into the sentencing, so it will be interesting to see what reason he had to gain access to the servers. I can't imagine what monetary gain there may have been, so it must have been something else.

hackuser 10y ago

Is this a sign of Linux' growing political influence when government agencies are investigating crimes against it and enforcing them? Would this crime have been handled by the federal government 10 years ago? 20? Would an attack on your server get a response from the FBI and the DOJ? That influence doesn't have to be the Linux Foundation; it could also be corporate or other powerful entities that are heavily invested in it, such as IBM.

gjolund 10y ago

Why is him being from FL relevant?