3 ms·

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email address. He supplied a range of valid ICC-IDs and scraped the returned addresses. He was eventually convicted[1]. [0]: https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-addresses-leaked-by-att-servers/ https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-... [1]: https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/

exolymph 9y ago
And while Weev totally sucks as a person, IMO, it was wrong for him to be convicted in this case. He was punished from AT&T's negligence.
- leggomylibro 9y ago
  Although, not purposefully exfiltrating loads of data after you've found a vulnerability is like, ethical reporting 101. Otherwise you get situations like Uber paying out an enormous "bug bounty" totally-not-in-exchange for having their stolen data destroyed. If that person had simply pointed out that they had credentials published in a public repository, how much would they have been paid? Probably somewhere within an order of magnitude of the program's stated maximum payout.
- UncleMeat 9y ago
  Punk test. Advocacy groups are way less likely to want to turn your case into a test case if you are a racist asshole.
deleted 9y ago
[deleted]