16 ms·

Teens Who Hacked Microsoft's Xbox Empire and Went Too Far

515 points by wolfgke 8y ago

hastes 8y ago
This is one of the best reads in a long time. Awesome article and extremely interesting. I have friends a long time ago that used to buy CoD modded lobbies from these guys. Crazy to see how their lives unfolded.
- StudentStuff 8y ago
  It is quite a good read, but its sad to see how computing has continued to be locked away from the end user, affording them access to a walled garden of the manufacturers choosing, with no ability to change OSes or even install basic security updates without the hardware manufacturers consent and involvement.
  - digi_owl 8y ago
    Yet at the other end you will find people that in full earnestness argues for further locking down, because "owners" can't trusted with proper maintenance. This is why the "home" PC varaiants of Windows 10 force reboots and removed the group policy tool that could have made disabling it easy.
  - zeusk 8y ago
    I interned in the Graphics kernel team at Microsoft and we worked quite a lot with xbox. None of those people like DRM and copy protection bullshit but the studios (both gaming and media) demand it and not having them could mean losing market share to others that are willing. Cheat prevention is another big reason that often came up for the hardened environment.
    - throwaway2048 8y ago
      Its easy to abstract away personal responsibility to well crafted punching bags, but in the end its still a choice.
      - mikec3010 8y ago
        It's also your choice to not write your own gaming console that is DRM-free. What's stopping you? If you need money, go to venture capital and make your pitch about a gaming console that asks people to pay, but allows trivial copying and sharing of titles.
        ShabbosGoy 8y ago
        So you think the current copyright system in the US is perfect, then? You’re part of the problem if you support overaggressive copyright enforcement. It’s my device, I paid for it, I should be allowed to do WHATEVER the hell I want with it.
        untog 8y ago
        I'm not sure what about the OPs post would make you think they consider the copyright system to be perfect. They merely suggested that there is nothing stopping you creating a DRM-free console.
        freeflight 8y ago
        "Nothing stopping you from creating your own" is quite a trivialization of how difficult it actually is to break into the, rather entrenched, video game console market. Having to compete with companies that haven't just been around and known for decades, but have massive resources and synergies due to their sheer size, is a pretty daunting task, and that's just the hardware side. Trying to convince major developers, and especially publishers, to get on board with such a project is also no small feat, you'd pretty have to convince publishers to do a 180° on how they've handled a lot of things so far because publishers are also known to be quite big fans of draconian copyright laws.
        InitialLastName 8y ago
        >"Nothing stopping you from creating your own" is quite a trivialization of how difficult it actually is to break into the, rather entrenched, video game console market. No, "nothing stopping you from selling your own" would be a trivialization (because there are things). It's easy enough (~20 hours of effort, including research) to build a computer, install Linux, and start playing DRM free games. If you want to distribute it, that's another story.
  - Qwertie 8y ago
    At the same time there has never been another point in history where so much open source software is freely available to everyone.
- AgentME 8y ago
  I think I used Pokora's utility for adding water to Halo 2 levels. I remember when it came out and it seemed like all of the new custom Halo 2 levels people were making on halomods.com had customized water immediately.
michaelmcmillan 8y ago
What a fantastic article – technical, interesting and well written. Kudos!
ythn 8y ago
Great article, and was happy to see they got reasonable prison sentences.
brod 8y ago
Interesting article, I think it represents the trials and tribulations of underground adolescent hacking cultures quite well. For people who currently find themselves in similar situations I'm sure it's inspiring and very confronting.
makkesk8 8y ago
Really really great article! Hopefully, this sheds some light on people who are in similar situations to ask themselves if it's worth it.
dleslie 8y ago
And herein you see evidence to why the industry is growing more interested in SaaS and doubling-down on DRM; they face an endless army of thrill-seeking adolescents without a care for the side-effects of their actions. Software security is hard; placing any trust whatsoever in software you cannot completely control is a recipe for insecurity. Game development security is a nightmare.
- omeid2 8y ago
  Utter rubbish. If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. Yes, security is hard, but it is an spectrum, from compromisable by adolescent thrill-seekers to state-nation actors. Most systems are there to facilitate business, personal, or even more critical, industrial or military operation, none of which you want to be easy to compromise. And as for SaaS, it does nothing to security but increase the attack surface by requiring more components in your system and requiring the system to be always online, in 99% of cases anyways. On top of that, with SaaS you not only have to secure your systems but also safeguard your clients' data, which only reinforces the idea that: if you can't do basic security, you should be out of business. And in what world does DRM helps with security? DRM is nothing short of a device of enforcing draconian copyright laws.
  - sdhgaiojfsa 8y ago
    > If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. So, literally everyone deserves to be out of business? I am not aware of any major software company that has at all times been invulnerable to thrill-seeking adolescents. Perhaps we should coin a new law. The law concerns a statement of the form: "If X, you deserve to be out of business." The law is that the statement is generally false.
    - omeid2 8y ago
      > So, literally everyone deserves to be out of business? No. "If X, you deserve Y" is a figure of speech which means Y is a reasonable consequence of X. Just Desert.[0] However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. [0] https://en.wikipedia.org/wiki/Desert_(philosophy) https://en.wikipedia.org/wiki/Desert_(philosophy)
cududa 8y ago
This really hit home with me. As a kid I hacked Microsoft and leaked some Windows Longhorn (the precursor to Vista) builds. One of those kids was wondering around the exact floor where my desk was. I got a job and career out of it, these kids got jail time and one suicide. Geez.
- heydonovan 8y ago
  This is such a turn-off to the industry. I'm not going to accidentally login to an unencrypted URL and get jail time because it's considered unauthorized. I'd love to be a hacker, but the thought of prison is too much.
  - brandonjm 8y ago
    Have you considered looking into white hat hacking? You could essentially be paid by companies to hack their own product entirely legally for the purpose of better securing it against potentially malicious hackers.
    - wolfgke 8y ago
      > Have you considered looking into white hat hacking? In my observation, this is a branch of industry that is very hard to get into. > You could essentially be paid by companies to hack their own product entirely legally for the purpose of better securing it against potentially malicious hackers. For this purpose, one uses quite different techniques than for blackhat hacking. E.g. in the whitehat case, the source code is often available etc.. So brutal code reviews, which require rather different skills (e.g. knowing all the subtle details of the language standard (e.g. C/C++)), are much more effective to secure applications than using the typical "blackhat techniques" (reverse engineering, knowing subtle details of CPU behaviour etc.).
      - refoundglory 8y ago
        Blackbox testing is a huge part of security jobs. Look at pen testing.
gulperxcx 8y ago
anyone mind giving a tl;dr version of this article? I find the text really strenuous to look at.
- code_duck 8y ago
  Some kids started hacking game companies and finding ways to cheat and download pre-release versions of games. This turned into a business, they got were thrill seeking and coveted more money, and got caught.
- mratzloff 8y ago
  "Pokora had long been aware that his misdeeds had angered some powerful interests, and not just within the gaming industry; in the course of seeking out all things Xbox, he and his associates had wormed into American military networks too. But in those early hours after his arrest, Pokora had no clue just how much legal wrath he’d brought upon his head: For eight months he’d been under sealed indictment for conspiring to steal as much as $1 billion worth of intellectual property, and federal prosecutors were intent on making him the first foreign hacker to be convicted for the theft of American trade secrets. Several of his friends and colleagues would end up being pulled into the vortex of trouble he’d helped create; one would become an informant, one would become a fugitive, and one would end up dead."
home_boi 8y ago
> Clark had just turned 27 and left behind an estate valued at more than $4 million. He got to keep the money even though he got convicted for wire fraud?
- foota 8y ago
  I think the wire fraud was probably something aside from their main activities -- like how Al Capone got put away for tax evasion.
- SolarNet 8y ago
  How do you think most estates started? Profiting off crime and leaving it to their family. The fundamental problems of capitalism include exactly this scenario.
- pishpash 8y ago
  Also the estate is presumably still open to civil suits.
blancotech 8y ago
Really great article. As someone who first became interested in computer science from Xbox “hacking” and JTAGing 360s this shows an alternative path that would have been easy to go down. When you become enveloped by the status you attain in forums, meet sketchy “friends” online, and start getting easy money, then the path of least resistance becomes the one in this article.
- wolfgke 8y ago
  > When you become enveloped by the status you attain in forums, meet sketchy “friends” online, and start getting easy money, then the path of least resistance becomes the one in this article. I rather believe that most such people (including adolescents) are not that willing to go down the path of easy money. The problem rather is in my opinion: The other side is simply not there to make counteroffers (i.e. less money, but perfectly legal etc.). So it is not a choice between "going on the dark side vs light side" (which is a serious decision to make, and confronted with this decision, I believe, most people (again including adolescents) would indeed choose the "light side"), but rather a situation of "only the dark side makes an offer: will you go into it or not - 'we have lots of money to offer'". Confronted with this, I can understand quite well that there exist people (in particular adolescents might be prone to that because they have less life experience) who will go into it. So provocatively one could even state that the problem rather is that "the other side is at fault", since they make no serious legal offers to prevent such people from "turning much into the dark side".
ramshanker 8y ago
Awesome article. Reminded me of Albus Dumbaldore dialogue to Harry. "Curiosity must be handled with care".
jrochkind1 8y ago
it oughta be illegal that we can't run the software we want and the software we write on the devices we buy.
- tluyben2 8y ago
  Yeah, I mean; stealing things from a campus and breaking into networks aside; people shouldn’t charged for anything illegal for hacking devices they buy and passing on that info. It’s crazy it’s not allowed in the first place. There is a perfectly fine way of preventing that; just say the device is not yours but you paid to rent it for a period (say 10 years); the device does not belong to you. Then you can say it’s illegal to mod, but if it’s yours I find it absolutely insane you cannot reverse engineer, repair or mod it.
  - jrochkind1 8y ago
    It is no less insane if they "just say the device is not yours but you paid to lease it".
    - tluyben2 8y ago
      Why? If it’s not your property... If you rent a car, you cannot remove the doors, if you buy it you can, that’s accepted. What’s the difference? In return, when it’s broken, the owner (the one you rent it from) needs to repair it. Unlike when it’s bought and out of (some kind of) warranty.
      - jrochkind1 8y ago
        Because it's essentially a lie. As revealed by your formulation "just say" -- your experience is no different if everything in your possession is 'owned' by you and illegal to modify, or if they change their mind and "just say" everything in your possession that matters with regard to this isn't really 'owned' by you at all. It's not a step forward, it leaves you in exactly the same position. If it is insane, then "just saying" something doesn't make it more sane. My concern is the experience of not having control over our equipment (not a good experience or way to live), not a semantic technicality.
hsrada 8y ago
The lure of making money as a child is a temptation far stronger than most can resist. If I had access to the things these guys had, I can totally see myself going down the exact same path. Now, a little older, the prospect of fines that will take a lifetime to repay and/or prison is way more deterring. As a kid, you just never think about it.
- deleted 8y ago
  [deleted]
- thewhitetulip 8y ago
  It starts as fun Then profit Then greed!
- wolfgke 8y ago
  > Now, a little older, the prospect of fines that will take a lifetime to repay and/or prison is way more deterring. As a kid, you just never think about it. I believe one does think about that, but concludes that the risk to get rich is worth it (because one has few such chances in life) and if all things go bad, there is still the suicide option.
  - klenwell 8y ago
    Actually this subject is taken up directly in a chapter of Robert Sapolsky's Behave that I just read titled, appropriately enough, "Adolescence; or, Dude, Where's My Frontal Cortex?" Some interesting stuff in there, some of which you're probably already familiar with. You could argue that a kid does "think" about it. But to use the word "concludes" may be a stretch. I found this passage by Sapolsky on the neurobiology of risk/reward assessment in adolescents especially interesting and relevant here: Age differences in absolute levels of dopamine are less interesting than differences in patterns of release. In a great study, children, adolescents, and adults in brain scanners did some task where correct responses produced monetary rewards of varying sizes. During this, prefrontal activation in both children and adolescents was diffuse and unfocused. However, activation in the nucleus accumbens in adolescents was distinctive. In children, a correct answer produced roughly the same increase in activity regardless of size of reward. In adults, small, medium, and large rewards caused small, medium, and large increases in accumbens activity. And adolescents? After a medium reward things looked the same as in kids and adults. A large reward produce a humongous increase, much bigger than in adults. And the small reward? Accumbens activity declined. In other words, adolescents experienced bigger-than-expected rewards more positively than do adults and smaller-than-expected rewards as aversive. A gyrating top, nearly skittering out of control. This suggests that in adolescents strong rewards produce exaggerated dopaminergic signaling, and nice sensible rewards for prudent actions feel lousy. That's not the whole story when it comes to kids' decision making, but it's of a piece with the rest of the chapter and shows that most kids are literally -- anatomically -- unable to think about things like this in a way they will be able to a few years later.
Born_Again 8y ago
Fantastic article. It reminds me of the story of Paul Le Roux, a man who also took his love of programming too far. Although he had more malicious intentions. https://magazine.atavist.com/the-mastermind https://magazine.atavist.com/the-mastermind HN Discussion: https://news.ycombinator.com/item?id=11381625 https://news.ycombinator.com/item?id=11381625
dynjo 8y ago
This could honestly be turned into a movie.
- CPUstring 8y ago
  Hax0rz2
- pishpash 8y ago
  Yeah, much more interesting than the Facebook movie.
Pica_soO 8y ago
I guess this a lecture for all those script-kiddies- leave the actually exploiting to the pros- sell your zero-days on the black market. Obviously investing in secure software is more costly then having a lobbyist for prison sentences in Washington and a good PR-Department. The problem is, that way, the whole stack from the metal up is basically crumble, untested and very frail - should one big time agent release a autonomous attack into the wild. But hey, we saved a dime today. Tomorrow there might be no more dimes, so if it were not for those meddling kids, the bookies would have gotten away with it.
- lawnchair_larry 8y ago
  FYI, script kiddies don’t have 0days by definition.
ajeet_dhaliwal 8y ago
For kicks, he says, the guards tossed the prisoners’ sandwiches onto the floor of the van, knowing that the tightly shackled men couldn’t reach them. Why is this permitted? Does anyone other than me think the guards should also be prosecuted for this behavior? Worst of all who are the sort of people who apply for these jobs, behave like this all day and then just go home at the end of the day to have a nice evening with family. Very disturbing. Aside, odd feeling reading this article featuring a US-Canada border crossing right after playing Detroit: Become Human last night.
- sdhgaiojfsa 8y ago
  You mean, assuming it happened? It's probably not permitted. It'd fall under the category of cruel and unusual punishment, or maybe extrajudicial punishment. Plenty of things happen that are not permitted.
  - skj 8y ago
    If there are no consequences, there is no prohibition.
    - sdhgaiojfsa 8y ago
      A facile response. Sometimes prohibited activities are not observed. In these cases, it's hard to impose consequences. But it's much more complex than this. There's a question of how much we want to prevent such things, and, even supposing we're willing, how many resources we're willing to dedicate to the solution. There's also a question of prevention via cultural change, which is a hard problem if there ever was one.
- ratsimihah 8y ago
  > just go home at the end of the day to have a nice evening with family You mean, assuming they have do have a family and are capable of having a nice evening? Sometimes people's behavior convey their inner issues. Not that I'm justifying their behavior in any way, just objective thinking.
arnvald 8y ago
Great article, I enjoyed reading it! Also, the illustrations are great, they perfectly fit the vibe of the article.
rozzzly 8y ago
Lol I used to talk to Anthony back in the Halo 3 era. I never did anything nefarious/illegal, but it's interesting to know that some of my IMs were probably read by an FBI agent at one point.
floatboth 8y ago
> The Gears of War 3 leak triggered a federal investigation, and Epic began working with the FBI to determine how its security had been breached Ugh. Why do even supposedly "cool" companies go to the cops when they get pwned? Own up to your mistakes, change your passwords, fix your security. Don't report anything to the fucking authorities. What would punishing a kid even give you?
- shagie 8y ago
  Most organizations don't have the resources to find out where the way the crackers got in. Once someone is in, changing the passwords and fixing the security may not be sufficient to prevent them from getting in again. Until that someone is tracked down and identified, there is no way to know if this is some kid doing it for fun or industrial espionage from a competitor. Furthermore, there's no way to know what they actually got - source code to a product? plans to some hardware? Payroll and identity information? It isn't practical for each organization to maintain a staff of forensic security specialists. When one does need them, they can be found rather inexpensively in law enforcement given that a crime (likely) has been committed.
- justapassenger 8y ago
  You don’t act “cool” when someone attacks core of your multi billion dollar business. This isn’t high school popularity contest.
- s2g 8y ago
  They don't know it's some kid. Millions of dollars in IP and potential liability depending on what was taken.
rosstex 8y ago
Awesome read!
cbanek 8y ago
Physical security is so important. I was really surprised when the Xbox team moved from the RedWest campus to Studio A. In RedWest, we had a building that was pretty much all Xbox employees, and other Microsoft employees couldn't just badge in. In Studio A, if I remember correctly, it was all just public access. The consoles are everywhere, and people's offices weren't normally locked (before most people moved into to bullpens, which didn't even have doors). For the most part, you can trust the employees. We had take home consoles that were signed with the proper keys to run retail games, but could also be debugged and get crash logs, and those were fairly safe and well tracked. (You were told, don't let your friends see/play them) But you can't trust anyone else who just randomly enters the building, and with teams so big that you don't know everyone, politely holding the door open for someone is just asking for it. Source: I worked on the Xbox 360 team.
eecc 8y ago
TL:DR but it befuddles me how corporate expects people to sit in front of a shiny toy and just use it as instructed rather than take it apart and mess around to understand how the damn thing works. That’s how we evolved as bloody apes, checking out the other monkeys’ sticks and stones and learning by example. They’re literally trying to lawyer out evolution..
s2g 8y ago
> After finishing his prison sentence, Pokora spent several more months awaiting deportation to Canada in an immigration detention facility in Newark, New Jersey So I've never done anything that would result in my being deported, but man does this scare me. The current climate, if I fuck up in some minor way, I still feel like I could end up in prison for months waiting for them to send me back north. It's just scary.

515 points by wolfgke 8y ago

This is one of the best reads in a long time. Awesome article and extremely interesting. I have friends a long time ago that used to buy CoD modded lobbies from these guys. Crazy to see how their lives unfolded.

StudentStuff 8y ago
It is quite a good read, but its sad to see how computing has continued to be locked away from the end user, affording them access to a walled garden of the manufacturers choosing, with no ability to change OSes or even install basic security updates without the hardware manufacturers consent and involvement.
- digi_owl 8y ago
  Yet at the other end you will find people that in full earnestness argues for further locking down, because "owners" can't trusted with proper maintenance. This is why the "home" PC varaiants of Windows 10 force reboots and removed the group policy tool that could have made disabling it easy.
- zeusk 8y ago
  I interned in the Graphics kernel team at Microsoft and we worked quite a lot with xbox. None of those people like DRM and copy protection bullshit but the studios (both gaming and media) demand it and not having them could mean losing market share to others that are willing. Cheat prevention is another big reason that often came up for the hardened environment.
  - throwaway2048 8y ago
    Its easy to abstract away personal responsibility to well crafted punching bags, but in the end its still a choice.
    - mikec3010 8y ago
      It's also your choice to not write your own gaming console that is DRM-free. What's stopping you? If you need money, go to venture capital and make your pitch about a gaming console that asks people to pay, but allows trivial copying and sharing of titles.
      - ShabbosGoy 8y ago
        So you think the current copyright system in the US is perfect, then? You’re part of the problem if you support overaggressive copyright enforcement. It’s my device, I paid for it, I should be allowed to do WHATEVER the hell I want with it.
        untog 8y ago
        I'm not sure what about the OPs post would make you think they consider the copyright system to be perfect. They merely suggested that there is nothing stopping you creating a DRM-free console.
        freeflight 8y ago
        "Nothing stopping you from creating your own" is quite a trivialization of how difficult it actually is to break into the, rather entrenched, video game console market. Having to compete with companies that haven't just been around and known for decades, but have massive resources and synergies due to their sheer size, is a pretty daunting task, and that's just the hardware side. Trying to convince major developers, and especially publishers, to get on board with such a project is also no small feat, you'd pretty have to convince publishers to do a 180° on how they've handled a lot of things so far because publishers are also known to be quite big fans of draconian copyright laws.
        InitialLastName 8y ago
        >"Nothing stopping you from creating your own" is quite a trivialization of how difficult it actually is to break into the, rather entrenched, video game console market. No, "nothing stopping you from selling your own" would be a trivialization (because there are things). It's easy enough (~20 hours of effort, including research) to build a computer, install Linux, and start playing DRM free games. If you want to distribute it, that's another story.
- Qwertie 8y ago
  At the same time there has never been another point in history where so much open source software is freely available to everyone.
AgentME 8y ago
I think I used Pokora's utility for adding water to Halo 2 levels. I remember when it came out and it seemed like all of the new custom Halo 2 levels people were making on halomods.com had customized water immediately.

michaelmcmillan 8y ago

What a fantastic article – technical, interesting and well written. Kudos!

ythn 8y ago

Great article, and was happy to see they got reasonable prison sentences.

brod 8y ago

Interesting article, I think it represents the trials and tribulations of underground adolescent hacking cultures quite well. For people who currently find themselves in similar situations I'm sure it's inspiring and very confronting.

makkesk8 8y ago

Really really great article! Hopefully, this sheds some light on people who are in similar situations to ask themselves if it's worth it.

dleslie 8y ago

And herein you see evidence to why the industry is growing more interested in SaaS and doubling-down on DRM; they face an endless army of thrill-seeking adolescents without a care for the side-effects of their actions. Software security is hard; placing any trust whatsoever in software you cannot completely control is a recipe for insecurity. Game development security is a nightmare.

omeid2 8y ago
Utter rubbish. If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. Yes, security is hard, but it is an spectrum, from compromisable by adolescent thrill-seekers to state-nation actors. Most systems are there to facilitate business, personal, or even more critical, industrial or military operation, none of which you want to be easy to compromise. And as for SaaS, it does nothing to security but increase the attack surface by requiring more components in your system and requiring the system to be always online, in 99% of cases anyways. On top of that, with SaaS you not only have to secure your systems but also safeguard your clients' data, which only reinforces the idea that: if you can't do basic security, you should be out of business. And in what world does DRM helps with security? DRM is nothing short of a device of enforcing draconian copyright laws.
- sdhgaiojfsa 8y ago
  > If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. So, literally everyone deserves to be out of business? I am not aware of any major software company that has at all times been invulnerable to thrill-seeking adolescents. Perhaps we should coin a new law. The law concerns a statement of the form: "If X, you deserve to be out of business." The law is that the statement is generally false.
  - omeid2 8y ago
    > So, literally everyone deserves to be out of business? No. "If X, you deserve Y" is a figure of speech which means Y is a reasonable consequence of X. Just Desert.[0] However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. [0] https://en.wikipedia.org/wiki/Desert_(philosophy) https://en.wikipedia.org/wiki/Desert_(philosophy)

cududa 8y ago

This really hit home with me. As a kid I hacked Microsoft and leaked some Windows Longhorn (the precursor to Vista) builds. One of those kids was wondering around the exact floor where my desk was. I got a job and career out of it, these kids got jail time and one suicide. Geez.

heydonovan 8y ago
This is such a turn-off to the industry. I'm not going to accidentally login to an unencrypted URL and get jail time because it's considered unauthorized. I'd love to be a hacker, but the thought of prison is too much.
- brandonjm 8y ago
  Have you considered looking into white hat hacking? You could essentially be paid by companies to hack their own product entirely legally for the purpose of better securing it against potentially malicious hackers.
  - wolfgke 8y ago
    > Have you considered looking into white hat hacking? In my observation, this is a branch of industry that is very hard to get into. > You could essentially be paid by companies to hack their own product entirely legally for the purpose of better securing it against potentially malicious hackers. For this purpose, one uses quite different techniques than for blackhat hacking. E.g. in the whitehat case, the source code is often available etc.. So brutal code reviews, which require rather different skills (e.g. knowing all the subtle details of the language standard (e.g. C/C++)), are much more effective to secure applications than using the typical "blackhat techniques" (reverse engineering, knowing subtle details of CPU behaviour etc.).
    - refoundglory 8y ago
      Blackbox testing is a huge part of security jobs. Look at pen testing.

gulperxcx 8y ago

anyone mind giving a tl;dr version of this article? I find the text really strenuous to look at.

code_duck 8y ago
Some kids started hacking game companies and finding ways to cheat and download pre-release versions of games. This turned into a business, they got were thrill seeking and coveted more money, and got caught.
mratzloff 8y ago
"Pokora had long been aware that his misdeeds had angered some powerful interests, and not just within the gaming industry; in the course of seeking out all things Xbox, he and his associates had wormed into American military networks too. But in those early hours after his arrest, Pokora had no clue just how much legal wrath he’d brought upon his head: For eight months he’d been under sealed indictment for conspiring to steal as much as $1 billion worth of intellectual property, and federal prosecutors were intent on making him the first foreign hacker to be convicted for the theft of American trade secrets. Several of his friends and colleagues would end up being pulled into the vortex of trouble he’d helped create; one would become an informant, one would become a fugitive, and one would end up dead."

home_boi 8y ago

> Clark had just turned 27 and left behind an estate valued at more than $4 million. He got to keep the money even though he got convicted for wire fraud?

foota 8y ago
I think the wire fraud was probably something aside from their main activities -- like how Al Capone got put away for tax evasion.
SolarNet 8y ago
How do you think most estates started? Profiting off crime and leaving it to their family. The fundamental problems of capitalism include exactly this scenario.
pishpash 8y ago
Also the estate is presumably still open to civil suits.

blancotech 8y ago

Really great article. As someone who first became interested in computer science from Xbox “hacking” and JTAGing 360s this shows an alternative path that would have been easy to go down. When you become enveloped by the status you attain in forums, meet sketchy “friends” online, and start getting easy money, then the path of least resistance becomes the one in this article.

wolfgke 8y ago
> When you become enveloped by the status you attain in forums, meet sketchy “friends” online, and start getting easy money, then the path of least resistance becomes the one in this article. I rather believe that most such people (including adolescents) are not that willing to go down the path of easy money. The problem rather is in my opinion: The other side is simply not there to make counteroffers (i.e. less money, but perfectly legal etc.). So it is not a choice between "going on the dark side vs light side" (which is a serious decision to make, and confronted with this decision, I believe, most people (again including adolescents) would indeed choose the "light side"), but rather a situation of "only the dark side makes an offer: will you go into it or not - 'we have lots of money to offer'". Confronted with this, I can understand quite well that there exist people (in particular adolescents might be prone to that because they have less life experience) who will go into it. So provocatively one could even state that the problem rather is that "the other side is at fault", since they make no serious legal offers to prevent such people from "turning much into the dark side".

ramshanker 8y ago

Awesome article. Reminded me of Albus Dumbaldore dialogue to Harry. "Curiosity must be handled with care".

jrochkind1 8y ago

it oughta be illegal that we can't run the software we want and the software we write on the devices we buy.

tluyben2 8y ago
Yeah, I mean; stealing things from a campus and breaking into networks aside; people shouldn’t charged for anything illegal for hacking devices they buy and passing on that info. It’s crazy it’s not allowed in the first place. There is a perfectly fine way of preventing that; just say the device is not yours but you paid to rent it for a period (say 10 years); the device does not belong to you. Then you can say it’s illegal to mod, but if it’s yours I find it absolutely insane you cannot reverse engineer, repair or mod it.
- jrochkind1 8y ago
  It is no less insane if they "just say the device is not yours but you paid to lease it".
  - tluyben2 8y ago
    Why? If it’s not your property... If you rent a car, you cannot remove the doors, if you buy it you can, that’s accepted. What’s the difference? In return, when it’s broken, the owner (the one you rent it from) needs to repair it. Unlike when it’s bought and out of (some kind of) warranty.
    - jrochkind1 8y ago
      Because it's essentially a lie. As revealed by your formulation "just say" -- your experience is no different if everything in your possession is 'owned' by you and illegal to modify, or if they change their mind and "just say" everything in your possession that matters with regard to this isn't really 'owned' by you at all. It's not a step forward, it leaves you in exactly the same position. If it is insane, then "just saying" something doesn't make it more sane. My concern is the experience of not having control over our equipment (not a good experience or way to live), not a semantic technicality.

hsrada 8y ago

The lure of making money as a child is a temptation far stronger than most can resist. If I had access to the things these guys had, I can totally see myself going down the exact same path. Now, a little older, the prospect of fines that will take a lifetime to repay and/or prison is way more deterring. As a kid, you just never think about it.

deleted 8y ago
[deleted]
thewhitetulip 8y ago
It starts as fun Then profit Then greed!
wolfgke 8y ago
> Now, a little older, the prospect of fines that will take a lifetime to repay and/or prison is way more deterring. As a kid, you just never think about it. I believe one does think about that, but concludes that the risk to get rich is worth it (because one has few such chances in life) and if all things go bad, there is still the suicide option.
- klenwell 8y ago
  Actually this subject is taken up directly in a chapter of Robert Sapolsky's Behave that I just read titled, appropriately enough, "Adolescence; or, Dude, Where's My Frontal Cortex?" Some interesting stuff in there, some of which you're probably already familiar with. You could argue that a kid does "think" about it. But to use the word "concludes" may be a stretch. I found this passage by Sapolsky on the neurobiology of risk/reward assessment in adolescents especially interesting and relevant here: Age differences in absolute levels of dopamine are less interesting than differences in patterns of release. In a great study, children, adolescents, and adults in brain scanners did some task where correct responses produced monetary rewards of varying sizes. During this, prefrontal activation in both children and adolescents was diffuse and unfocused. However, activation in the nucleus accumbens in adolescents was distinctive. In children, a correct answer produced roughly the same increase in activity regardless of size of reward. In adults, small, medium, and large rewards caused small, medium, and large increases in accumbens activity. And adolescents? After a medium reward things looked the same as in kids and adults. A large reward produce a humongous increase, much bigger than in adults. And the small reward? Accumbens activity declined. In other words, adolescents experienced bigger-than-expected rewards more positively than do adults and smaller-than-expected rewards as aversive. A gyrating top, nearly skittering out of control. This suggests that in adolescents strong rewards produce exaggerated dopaminergic signaling, and nice sensible rewards for prudent actions feel lousy. That's not the whole story when it comes to kids' decision making, but it's of a piece with the rest of the chapter and shows that most kids are literally -- anatomically -- unable to think about things like this in a way they will be able to a few years later.

Born_Again 8y ago

Fantastic article. It reminds me of the story of Paul Le Roux, a man who also took his love of programming too far. Although he had more malicious intentions. https://magazine.atavist.com/the-mastermind https://magazine.atavist.com/the-mastermind HN Discussion: https://news.ycombinator.com/item?id=11381625 https://news.ycombinator.com/item?id=11381625

dynjo 8y ago

This could honestly be turned into a movie.

CPUstring 8y ago
Hax0rz2
pishpash 8y ago
Yeah, much more interesting than the Facebook movie.

Pica_soO 8y ago

I guess this a lecture for all those script-kiddies- leave the actually exploiting to the pros- sell your zero-days on the black market. Obviously investing in secure software is more costly then having a lobbyist for prison sentences in Washington and a good PR-Department. The problem is, that way, the whole stack from the metal up is basically crumble, untested and very frail - should one big time agent release a autonomous attack into the wild. But hey, we saved a dime today. Tomorrow there might be no more dimes, so if it were not for those meddling kids, the bookies would have gotten away with it.

lawnchair_larry 8y ago
FYI, script kiddies don’t have 0days by definition.

ajeet_dhaliwal 8y ago

For kicks, he says, the guards tossed the prisoners’ sandwiches onto the floor of the van, knowing that the tightly shackled men couldn’t reach them. Why is this permitted? Does anyone other than me think the guards should also be prosecuted for this behavior? Worst of all who are the sort of people who apply for these jobs, behave like this all day and then just go home at the end of the day to have a nice evening with family. Very disturbing. Aside, odd feeling reading this article featuring a US-Canada border crossing right after playing Detroit: Become Human last night.

sdhgaiojfsa 8y ago
You mean, assuming it happened? It's probably not permitted. It'd fall under the category of cruel and unusual punishment, or maybe extrajudicial punishment. Plenty of things happen that are not permitted.
- skj 8y ago
  If there are no consequences, there is no prohibition.
  - sdhgaiojfsa 8y ago
    A facile response. Sometimes prohibited activities are not observed. In these cases, it's hard to impose consequences. But it's much more complex than this. There's a question of how much we want to prevent such things, and, even supposing we're willing, how many resources we're willing to dedicate to the solution. There's also a question of prevention via cultural change, which is a hard problem if there ever was one.
ratsimihah 8y ago
> just go home at the end of the day to have a nice evening with family You mean, assuming they have do have a family and are capable of having a nice evening? Sometimes people's behavior convey their inner issues. Not that I'm justifying their behavior in any way, just objective thinking.

arnvald 8y ago

Great article, I enjoyed reading it! Also, the illustrations are great, they perfectly fit the vibe of the article.

rozzzly 8y ago

Lol I used to talk to Anthony back in the Halo 3 era. I never did anything nefarious/illegal, but it's interesting to know that some of my IMs were probably read by an FBI agent at one point.

floatboth 8y ago

> The Gears of War 3 leak triggered a federal investigation, and Epic began working with the FBI to determine how its security had been breached Ugh. Why do even supposedly "cool" companies go to the cops when they get pwned? Own up to your mistakes, change your passwords, fix your security. Don't report anything to the fucking authorities. What would punishing a kid even give you?

shagie 8y ago
Most organizations don't have the resources to find out where the way the crackers got in. Once someone is in, changing the passwords and fixing the security may not be sufficient to prevent them from getting in again. Until that someone is tracked down and identified, there is no way to know if this is some kid doing it for fun or industrial espionage from a competitor. Furthermore, there's no way to know what they actually got - source code to a product? plans to some hardware? Payroll and identity information? It isn't practical for each organization to maintain a staff of forensic security specialists. When one does need them, they can be found rather inexpensively in law enforcement given that a crime (likely) has been committed.
justapassenger 8y ago
You don’t act “cool” when someone attacks core of your multi billion dollar business. This isn’t high school popularity contest.
s2g 8y ago
They don't know it's some kid. Millions of dollars in IP and potential liability depending on what was taken.

rosstex 8y ago

Awesome read!

cbanek 8y ago

Physical security is so important. I was really surprised when the Xbox team moved from the RedWest campus to Studio A. In RedWest, we had a building that was pretty much all Xbox employees, and other Microsoft employees couldn't just badge in. In Studio A, if I remember correctly, it was all just public access. The consoles are everywhere, and people's offices weren't normally locked (before most people moved into to bullpens, which didn't even have doors). For the most part, you can trust the employees. We had take home consoles that were signed with the proper keys to run retail games, but could also be debugged and get crash logs, and those were fairly safe and well tracked. (You were told, don't let your friends see/play them) But you can't trust anyone else who just randomly enters the building, and with teams so big that you don't know everyone, politely holding the door open for someone is just asking for it. Source: I worked on the Xbox 360 team.

eecc 8y ago

TL:DR but it befuddles me how corporate expects people to sit in front of a shiny toy and just use it as instructed rather than take it apart and mess around to understand how the damn thing works. That’s how we evolved as bloody apes, checking out the other monkeys’ sticks and stones and learning by example. They’re literally trying to lawyer out evolution..

s2g 8y ago

> After finishing his prison sentence, Pokora spent several more months awaiting deportation to Canada in an immigration detention facility in Newark, New Jersey So I've never done anything that would result in my being deported, but man does this scare me. The current climate, if I fuck up in some minor way, I still feel like I could end up in prison for months waiting for them to send me back north. It's just scary.