6 ms·

Man to pay $300k in damages for hacking employer

whatnotests 9y ago
That's like $2000/month for 7 years. In cases like this, I would expect that $300K to drop later, or to be renegotiated at some point.
- obstinate 9y ago
  Maybe! The justice system allows for damages beyond just compensation. Sometimes, it's about sending a message.
  - cm2187 9y ago
    In France the judge doesn't have any discretion on damages. The defendant is liable for all damages as a result of his action. Even if these amount to $1 billion.
    - kuroguro 9y ago
      What's the point? There's no way anyone could pay that.
      - tyingq 9y ago
        Just in case they win the lottery perhaps? Debt is debt.
    - 77pt77 9y ago
      https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel >he was found guilty and sentenced to five years of prison, with two years suspended, full restitution of the $6.7 billion which was lost Good luck with that when >permanent ban from working in financial services
- deleted 9y ago
  [deleted]
- tyingq 9y ago
  I don't think a typical California security guard makes $2k/month. However, it was pretty egregious, and several incidents. And the amount seems like it's not a horribly inflated number.
- brookside 9y ago
  For 12.5 years, no? (Rockstar/10x dev hunters, come and get it...)
photoGrant 9y ago
Maybe not the time for semantics, but curious where people's line in the sand is with regards to calling logging in with the correct admin credentials as 'hacking'.
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- SmellyGeekBoy 9y ago
  It's unauthorised access, TFA says that he "obtained login credentials - without ever having been given them - and accessed the records without authorisation". The phrase "hacking" doesn't quite sit right with me either but I guess it's close enough to the truth in this case. I'll personally give them a pass this time. ;)
  - DanBC 9y ago
    Using the correct login credentials has been defined as hacking for many years. See this clip from a 1983 film: https://www.youtube.com/watch?v=U2_h-EFlztY https://www.youtube.com/watch?v=U2_h-EFlztY
- scarface74 9y ago
  He didn't just log in and start snooping. He defrauded the company while he was there and then used the credentials to deface the web site.
- dtech 9y ago
  It feels weird, but if you use social engineering to get access you can also call that hacking.
- dsacco 9y ago
  I consider "hacking" to be any instance of an entity deliberately undermining the confidentiality, integrity or availability assurances (the CIA triad) of a technical security control; be it passively or actively, and regardless of the apparent weakness of the control. Information security begins with confidentiality, which brings us to the concept of authorization and and the use of encryption. When Bob and Alice want to communicate in secret, they want to assure confidentiality, and they use encrypted messages. Then we also have integrity: when Bob and Alice are enjoying a confidential communication, they want to make sure no one has altered the messages even if they can't read them, so we get hash functions and MACs. Maybe Bob wants authentication: he wants to make sure the person who sent him the message really is Alice, even if he's already sure it's confidential and unaltered, so now we've got digital signature schemes. Eventually Alice decides she wants non-repudiation, or peer entity auth, etc. Every technical security control can be modeled as the practical implementation of one of these desires for a particular type of assurance. This is neat, because it precludes pernicious questions like, "Well what if it's weak and the 'hacker' just incremented a value in a URL" - we shift the slippery-slope problem of ascribing malicious intent to the legal sphere without sacrificing the cleanly drawn technical definition. Under this definition, I'd consider the individual in this story to have "hacked" their employer. A login interface is a technical security control designed to provide authorization/access control as a method of implementing confidentiality (among other things). The employee logged in as a user other than themselves, thereby undermining the control. Furthermore, he did it intentionally, which establishes the deliberation requirement. It was not a sophisticated hack, but then again real world hacking very rarely is technically sophisticated. Despite the composition of Blackhat/DEFCON proceedings every year, the median company is far more likely to be compromised through a social engineering or endpoint failure (e.g. executive is phished, employee pirates media and gets a virus, etc). EDIT: Apparently this is an unpopular answer, that's fine. But it's an answer that probably goes the farthest and with the fewest rabbit holes. Humans need to trust software in different ways, and if you deliberately break that trust by bypassing the implementation that assures it, you've hacked the software.
arthulia 9y ago
Assuming this is the correct website, it appears to still be defaced: http://www.capatrol.com/ http://www.capatrol.com/
- SmellyGeekBoy 9y ago
  Wow, that's crazy! You'd think that part of the ruling would include restoring the website to its former glory...
  - vacri 9y ago
    It's bizarre that the issue made it to court and the website still hasn't been fixed. That's a long time.
- tyingq 9y ago
  It is the correct site. The court record says "Mr. Fischbach first examined Nick Tsotsikyan, founder, owner, and Director of Operations of Security Specialists." Nick Tsotsikyan is noted on the about page of the website you linked to.
AmVess 9y ago
"Then, he noticed that someone had tampered with the program’s 'Lunch' field. Four hours had been added into the lunch field each day, which accounted for the unexplained extra 40 hours of overtime in Garcia’s records. The hours had been entered in black text on a black background, in one-point font. As a result, the alterations to Garcia’s hours would not have been noticeable to the casual observer. The alterations resulted in Garcia’s being paid wages for overtime that, presumably, he did not work." That's just one of the things he did. If you're going to be a criminal, at least be a smart criminal. He's going to be stuck with trying to pay off $300k on a fast food worker's wages which will take him the rest of his life unless he inherits a lot of money or plans on winning the lotto. He effectively removed himself from consideration from any decent job and thus his ability to pay the fine in a comfortable manner.
- deleted 9y ago
  [deleted]
bbcbasic 9y ago
Why not criminal charges?

That's like $2000/month for 7 years. In cases like this, I would expect that $300K to drop later, or to be renegotiated at some point.

obstinate 9y ago
Maybe! The justice system allows for damages beyond just compensation. Sometimes, it's about sending a message.
- cm2187 9y ago
  In France the judge doesn't have any discretion on damages. The defendant is liable for all damages as a result of his action. Even if these amount to $1 billion.
  - kuroguro 9y ago
    What's the point? There's no way anyone could pay that.
    - tyingq 9y ago
      Just in case they win the lottery perhaps? Debt is debt.
  - 77pt77 9y ago
    https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel >he was found guilty and sentenced to five years of prison, with two years suspended, full restitution of the $6.7 billion which was lost Good luck with that when >permanent ban from working in financial services
deleted 9y ago
[deleted]
tyingq 9y ago
I don't think a typical California security guard makes $2k/month. However, it was pretty egregious, and several incidents. And the amount seems like it's not a horribly inflated number.
brookside 9y ago
For 12.5 years, no? (Rockstar/10x dev hunters, come and get it...)

photoGrant 9y ago

Maybe not the time for semantics, but curious where people's line in the sand is with regards to calling logging in with the correct admin credentials as 'hacking'.

deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
SmellyGeekBoy 9y ago
It's unauthorised access, TFA says that he "obtained login credentials - without ever having been given them - and accessed the records without authorisation". The phrase "hacking" doesn't quite sit right with me either but I guess it's close enough to the truth in this case. I'll personally give them a pass this time. ;)
- DanBC 9y ago
  Using the correct login credentials has been defined as hacking for many years. See this clip from a 1983 film: https://www.youtube.com/watch?v=U2_h-EFlztY https://www.youtube.com/watch?v=U2_h-EFlztY
scarface74 9y ago
He didn't just log in and start snooping. He defrauded the company while he was there and then used the credentials to deface the web site.
dtech 9y ago
It feels weird, but if you use social engineering to get access you can also call that hacking.
dsacco 9y ago
I consider "hacking" to be any instance of an entity deliberately undermining the confidentiality, integrity or availability assurances (the CIA triad) of a technical security control; be it passively or actively, and regardless of the apparent weakness of the control. Information security begins with confidentiality, which brings us to the concept of authorization and and the use of encryption. When Bob and Alice want to communicate in secret, they want to assure confidentiality, and they use encrypted messages. Then we also have integrity: when Bob and Alice are enjoying a confidential communication, they want to make sure no one has altered the messages even if they can't read them, so we get hash functions and MACs. Maybe Bob wants authentication: he wants to make sure the person who sent him the message really is Alice, even if he's already sure it's confidential and unaltered, so now we've got digital signature schemes. Eventually Alice decides she wants non-repudiation, or peer entity auth, etc. Every technical security control can be modeled as the practical implementation of one of these desires for a particular type of assurance. This is neat, because it precludes pernicious questions like, "Well what if it's weak and the 'hacker' just incremented a value in a URL" - we shift the slippery-slope problem of ascribing malicious intent to the legal sphere without sacrificing the cleanly drawn technical definition. Under this definition, I'd consider the individual in this story to have "hacked" their employer. A login interface is a technical security control designed to provide authorization/access control as a method of implementing confidentiality (among other things). The employee logged in as a user other than themselves, thereby undermining the control. Furthermore, he did it intentionally, which establishes the deliberation requirement. It was not a sophisticated hack, but then again real world hacking very rarely is technically sophisticated. Despite the composition of Blackhat/DEFCON proceedings every year, the median company is far more likely to be compromised through a social engineering or endpoint failure (e.g. executive is phished, employee pirates media and gets a virus, etc). EDIT: Apparently this is an unpopular answer, that's fine. But it's an answer that probably goes the farthest and with the fewest rabbit holes. Humans need to trust software in different ways, and if you deliberately break that trust by bypassing the implementation that assures it, you've hacked the software.

arthulia 9y ago

Assuming this is the correct website, it appears to still be defaced: http://www.capatrol.com/ http://www.capatrol.com/

SmellyGeekBoy 9y ago
Wow, that's crazy! You'd think that part of the ruling would include restoring the website to its former glory...
- vacri 9y ago
  It's bizarre that the issue made it to court and the website still hasn't been fixed. That's a long time.
tyingq 9y ago
It is the correct site. The court record says "Mr. Fischbach first examined Nick Tsotsikyan, founder, owner, and Director of Operations of Security Specialists." Nick Tsotsikyan is noted on the about page of the website you linked to.

AmVess 9y ago

"Then, he noticed that someone had tampered with the program’s 'Lunch' field. Four hours had been added into the lunch field each day, which accounted for the unexplained extra 40 hours of overtime in Garcia’s records. The hours had been entered in black text on a black background, in one-point font. As a result, the alterations to Garcia’s hours would not have been noticeable to the casual observer. The alterations resulted in Garcia’s being paid wages for overtime that, presumably, he did not work." That's just one of the things he did. If you're going to be a criminal, at least be a smart criminal. He's going to be stuck with trying to pay off $300k on a fast food worker's wages which will take him the rest of his life unless he inherits a lot of money or plans on winning the lotto. He effectively removed himself from consideration from any decent job and thus his ability to pay the fine in a comfortable manner.

deleted 9y ago
[deleted]

bbcbasic 9y ago

Why not criminal charges?