3 ms·

> I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. This is a significant exaggeration,

> I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. This is a significant exaggeration, but I'm not going to dox you. Suffice to say, I'm reading your case as we speak, so stop trying to mislead people. (Good luck with that visa.) > What are you referring to? The credit card decryption key? I assure you we most definitely got that Then name it. I have the one that protected the key you retrieved memorized on account of my duties (I had to enter it every time I restarted the application), and they've changed it since then, so it's a no-op. It's not brute forceable even by nation states, so you'd have had to extract it by means your entry vector did not give you. Hash it in your reply if you want. I've always suspected you had former employee help, and I'm pretty sure I know not only exactly who, but also their motive for assisting you and "HTP". If you do have the passphrase to that key, I can almost promise it was from your assistance. I eagerly await your reply, since the passphrase is a sentence, and once you know it the gist of it is easily communicable without consulting logs.

ryanlol 9y ago
>This is a significant exaggeration, but I'm not going to dox you. It really isn't. The big number in that charge is referring to coldfusion shells the local CERT was supposedly able to "validate". At best you could blame the prosecutor for exaggeration, which I entirely agree with, the court however accepted the prosecutors claims. >Good luck with that visa. Haven't actually had visa issues anywhere since then :) Good passport I guess. >Then name it. I have it memorized, and they've changed it, so it's a no-op. No clue, people within the group disagreed on carding so the person who got it didn't post it on the channel, only dropping the cards of "interesting" individuals. I guess I'll go looking for the logs though. >It's not brute forceable even by nation states, so you'd have had to extract it by means your entry vector did not give you. Hash it in your reply if you want. As far as I know someone wrote a quick coldfusion script to extract the decrypted key from memory. >I've always suspected you had former employee help, and I'm pretty sure I know not only exactly who, but also their motive for assisting you and "HTP". This was certainly not the case. >If you do have the passphrase to that key, I can almost promise it was from your assistance. I eagerly await your reply, since the passphrase is a sentence, and once you know it the gist of it is easily communicable without consulting logs. Don't know, and I'd assume getting coldfusion to spit out the decrypted key is much easier than the decryption passphrase that's only needed once. And in any case your approach seems fundamentally flawed. Even in some parallel universe where we failed to extract the key, we'd still have been able to use your existing decryption code and the in-memory key to decrypt all the cards in the database.
- jsmthrowaway 9y ago
  > I guess I'll go looking for the logs though. I haven't typed it since 2011 and still remember it; it's a stupidly simple English sentence that is almost impossible to not memorize. I also note that you and your group were challenged for it in 2013 and declined to provide it. But sure, go consult logs. I'll hold. > This was certainly not the case. I know the network and channel where you two hang out, so OK. Keep lying to HN, I guess. (Why would you?)
  - ryanlol 9y ago
    Seems disingenuous at best to quote that out of context. >I know the network and channel where you two hang out, so OK. Then spit it out, name the network and channel, don't make vague accusations. I'm open about my beef with Linode, but what's your beef with me? If this is supposed to be more than a pathetic attempt at discrediting me with false accusations, please follow through.
    - jsmthrowaway 9y ago
      You first, "Ryan." My beef with you is that you (a) hacked Linode, (b) dumped everything you found online, then (c) spend your days in every Linode thread trying to shit on them while pulling wool over HN's eyes as some kind of moral high ground just "obligatory warning" a bunch of people about your own fucking actions. You are not the moral high ground. Please stop pretending to be as some kind of authoritative voice. I've watched you do this for years, and it's starting to grate on me. I've disclosed I'm a former employee every time I speak about them, and I've also pointed out that I harbor no ill will for them: the people who run Linode, despite making mistakes, do not deserve this stalkerish behavior from you. Move on with your life. You hacked them, you got busted, and sitting around like this four years later is just indefensible. Edit: I'm remaining vague so as not to dox you, given HN guidelines and my own personal ethics. I don't have any stake in discrediting you (you do a fine job of that yourself), but you're welcome to spin it that way. Also, your clock ran out on being uniquely positioned to comment in 2014. (As did mine, though sooner.)

ryanlol 9y ago

>This is a significant exaggeration, but I'm not going to dox you. It really isn't. The big number in that charge is referring to coldfusion shells the local CERT was supposedly able to "validate". At best you could blame the prosecutor for exaggeration, which I entirely agree with, the court however accepted the prosecutors claims. >Good luck with that visa. Haven't actually had visa issues anywhere since then :) Good passport I guess. >Then name it. I have it memorized, and they've changed it, so it's a no-op. No clue, people within the group disagreed on carding so the person who got it didn't post it on the channel, only dropping the cards of "interesting" individuals. I guess I'll go looking for the logs though. >It's not brute forceable even by nation states, so you'd have had to extract it by means your entry vector did not give you. Hash it in your reply if you want. As far as I know someone wrote a quick coldfusion script to extract the decrypted key from memory. >I've always suspected you had former employee help, and I'm pretty sure I know not only exactly who, but also their motive for assisting you and "HTP". This was certainly not the case. >If you do have the passphrase to that key, I can almost promise it was from your assistance. I eagerly await your reply, since the passphrase is a sentence, and once you know it the gist of it is easily communicable without consulting logs. Don't know, and I'd assume getting coldfusion to spit out the decrypted key is much easier than the decryption passphrase that's only needed once. And in any case your approach seems fundamentally flawed. Even in some parallel universe where we failed to extract the key, we'd still have been able to use your existing decryption code and the in-memory key to decrypt all the cards in the database.

jsmthrowaway 9y ago
> I guess I'll go looking for the logs though. I haven't typed it since 2011 and still remember it; it's a stupidly simple English sentence that is almost impossible to not memorize. I also note that you and your group were challenged for it in 2013 and declined to provide it. But sure, go consult logs. I'll hold. > This was certainly not the case. I know the network and channel where you two hang out, so OK. Keep lying to HN, I guess. (Why would you?)
- ryanlol 9y ago
  Seems disingenuous at best to quote that out of context. >I know the network and channel where you two hang out, so OK. Then spit it out, name the network and channel, don't make vague accusations. I'm open about my beef with Linode, but what's your beef with me? If this is supposed to be more than a pathetic attempt at discrediting me with false accusations, please follow through.
  - jsmthrowaway 9y ago
    You first, "Ryan." My beef with you is that you (a) hacked Linode, (b) dumped everything you found online, then (c) spend your days in every Linode thread trying to shit on them while pulling wool over HN's eyes as some kind of moral high ground just "obligatory warning" a bunch of people about your own fucking actions. You are not the moral high ground. Please stop pretending to be as some kind of authoritative voice. I've watched you do this for years, and it's starting to grate on me. I've disclosed I'm a former employee every time I speak about them, and I've also pointed out that I harbor no ill will for them: the people who run Linode, despite making mistakes, do not deserve this stalkerish behavior from you. Move on with your life. You hacked them, you got busted, and sitting around like this four years later is just indefensible. Edit: I'm remaining vague so as not to dox you, given HN guidelines and my own personal ethics. I don't have any stake in discrediting you (you do a fine job of that yourself), but you're welcome to spin it that way. Also, your clock ran out on being uniquely positioned to comment in 2014. (As did mine, though sooner.)