12 ms·

AT&T employees were bribed to install phone unlocking malware on company network

332 points by starpilot 7y ago

gingerbenage357 7y ago
This is one of the problems with the cloud as well. You assume your website is well and safe but a Digital Ocean (or whatever) employee could always hack it.
- somehnguy 7y ago
  That isn't cloud specific, you could say the same about anything.
- kbar13 7y ago
  this is one of the problems with datacenters as well. you assume your router is well and safe but the NSA (or whatever) employee could always intercept it in transit and hack it.
  - rolltiide 7y ago
    this is the problem with offshore hosts as well. you assume the lack of an information sharing treaty and plain text writing of a law ensures the privacy of your data, but the government can just arbitrarily hand it over to the first FBI agent that asks
    - balabaster 7y ago
      this is the problem with hosting it at home on your own server with your own hardware. Your kids will hack it when you're not looking and install a Roblox server and let every idiot into your server to do whatever they want with it. Also, kids are stupidly easy to bribe.
chendragon 7y ago
Is this how the eBay phone unlocking services work? Usually they say something about servers and "sending your IMEI to the server" etc, and sometimes it can take a certain number of hours.
- gruez 7y ago
  You’d think that this would be easy to crack down. All you need to do is pay for an unlock and trace where the unlock request came from.
- JRKrause 7y ago
  I bought an ATT locked iPhone SE from Ebay just 2 months ago. The unlocking process was essentially just going to ATT website and typing in the IMEI and they unlock it within 15 minutes for free. I assume all the "pay $10 to unlock your phone" services are just counting on the average person being too lazy to discover your can just do the legwork yourself.
  - withinrafael 7y ago
    The mobile operator provided unlock only works on devices of a certain age. You can't typically, for example, purchase a new flagship device and unlock it on day one. The illegitimate methods bypass this restriction.
    - WrtCdEvrydy 7y ago
      Also, AT&T will only allow two unlocks for non-customers. So if you left AT&T, you can only unlock two devices.
    - therealx 7y ago
      Theres a method of unlocking new/any iOS device using the GSX api that Apple maintains for the remaining list of Authorized Stores. Apple will not approve anyone new for the list, and they have changed up the requirements to connect to the API lately from just a username/password (which were often hacked or bribed), to client side certificates and blessed static ips (at a time when even the OS X networking libraries didn't support this), to a new version just now that I won't give the details but you can find if you do some github searching.
alfalfasprout 7y ago
Given how poorly AT&T and the like treat customers I can't really feel bad that they lost out on $5mm of fees on their crappy overpriced contracts.
olliej 7y ago
Companies need to assume that their network is compromised. Ignoring anything else that means they need to adopt E2E encryption for all user data (except where legally mandated to be insecure, or when the data has a fundamental need to be accessible - e.g. your bank needs to know how much money you have). Anything else, including dumbass politicians demanding magic crypto, makes your user data a valuable and achievable target.
jzunit 7y ago
His methods were illegal but can we please recognize this guy for being an ABSOLUTE HERO for unlocking all those phones and giving the people what they wanted.
- intopieces 7y ago
  Agreed, I don’t see much in the way of negativity here. It doesn’t seem like customers were defrauded, only AT&T.
- deleted 7y ago
  [deleted]
- jdblair 7y ago
  A contract was violated when these phones were unlocked. In return for a locked phone the buyer received a subsidy from AT&T on the cost of the hardware. I don't want people to violate contracts with me, why should I recognize someone as a hero just because I don't like the contract? To be absolutely clear, I don't like locked phones, either, so I always buy non-carrier-locked devices and it means I pay the full, unsubsidized hardware price. [edited to fix a typo]
  - qwsxyh 7y ago
    The contract sucks shit that's why
    - nordsieck 7y ago
      > The contract sucks shit that's why All those people were free to buy unsubsidized phones elsewhere. They knew exactly what they were getting into when they signed up.
      - thedaemon 7y ago
        You give them too much credit. People don't read phone contracts and few people even know what an unlocked phone is.
sundayedition 7y ago
I wonder what the footprint is do the SIM hijacking, e.g. is anyone a sufficiently high enough bribe away from the type of scheme that compromises their account because it only takes 1 employee to effect it. I've been switching to hardware keys when I'm able but it's not always feasible. I just bought a Titan key combo and you can't use most 3rd party email clients with it so that made it kind of useless to me (since Gmail's mail app isn't that great)
- Nextgrid 7y ago
  Fraudulent SIM swaps are already being done and it's a lot less sophisticated than this - just show up to a store with a fake ID (or bribe the low-wage employee who isn't paid enough to give a shit so I can't really blame them).
  - shiftpgdn 7y ago
    Your SMS based 2FA is only as secure as the lowest paid employee at a cell phone store.
    - Nextgrid 7y ago
      Lowest paid employee at the store? How about lowest paid idiot at the outsourced customer "service" centre.
kiallmacinnes 7y ago
> “Now he will be held accountable for the fraud and the lives he has derailed.” Whoa there. What? Yes, he's committed a crime and should be held accountable for that. But.. Who's lives has he derailed? If I was to accept a bribe to commit a crime, nobody is derailing my life but me - to say anything else suggests a level of intelligence bordering on inability to understand and take responsibility for my actions. Can I use this defence for non bribery related crimes? How about assassin for hire? Prosecute him for the crimes he committed and prosecute those who accepted bribes for their crimes. Theres just no reason to exaggerate like this. Edit: And, to add, I dislike the discount / rental / lock in model the carriers use, but it does sound like crimes were committed.
- gowld 7y ago
  More than one person can be at fault for a violation.
  - kiallmacinnes 7y ago
    Exactly. The statement quoted makes it sound like people accepting bribes is entirely the fault of the person proposing the bribe. The blame is shared, nobody had their lives derailed by anyone but themselves as far as I can tell.
- moftz 7y ago
  I guess you could consider all of the employees that got fired/will get fired/left before they got fired. Their lives got derailed but that's on them. No one held a gun to their head, this guy was on the other side of the world and convinced some AT&T techs to do this for money. If they were willing to install malware for money, AT&T is just lucky the guy was only after unlocked phones. I'm sure the employee handbook doesn't explicitly say "don't install malware for strange Pakistani men for money" but I'm sure they had enough training to put all of the pieces together...
- brentm 7y ago
  Federal prosecutors love a good dramatic press conference.
deogeo 7y ago
1.) How is unlocking a phone "malware"? Isn't the lock malware, and the unlocking serves the owner of the device? Calling it malware reeks of regurgitating AT&T propaganda. 2.) How did this "deprive AT&T of the stream of payments it was owned under the customers’ service contracts and installment plans."? A phone getting unlocked doesn't void a contract, so those customers are still on the hook.
- ijpoijpoihpiuoh 7y ago
  1. It's malware from the perspective of the entity whose computers it was installed on. To respond to your meta-point, phone locks are merely a technical control to help ensure consumers abide by their contractual obligations. At least, this is the case since companies have been obligated to offer unlocks for phones whose contracts are paid off. 2. Presumably, it's a combination of a number of mechanisms, like judgment-proof consumers or identity thieves unlocking and reselling devices.
  - rconti 7y ago
    Are they really obligated to offer unlocks now? I stopped getting subsidized phones 5 or so years ago (and it seems carriers mostly don't offer them anymore anyway), but I fought tooth and nail with multiple carriers to get my paid-for device unlocked, and usually the answer was "piss off".
    - sokoloff 7y ago
      Yes, since the enaction of this: https://www.congress.gov/bill/113th-congress/senate-bill/517 https://www.congress.gov/bill/113th-congress/senate-bill/517
      - kaibee 7y ago
        Technically yes, but in my experience... no. Recently my parents switched carriers for whatever reason, so I had to get a new phone. Honestly I would have kept my Note4 for another year, but whatever. Being a phone from, what 2014? it was well paid off at this point. 1. I went to the AT&T Store, asked them to unlock my phone. Was told, no sorry, we don't do that here. "Call the support line." 2. Called the support line, waited 20 minutes, was transferred to the correct department, waited another 20 minutes. Was told, we don't do that over the phone anymore. Go to this website here. 3. Went to the website. It asks for the number that is printed behind the battery (y'know back in my day, you could remove batteries from the devices you owned and replace them) Next, it asks for some device ID Number that you need to ask the phone for. So you turn it back on, follow the directions, etc. Then you submit the form. Then they tell you it can take up to 48 hours to get the unlock code. 4. Wait. 5. Receive absolutely no confirmation or acknowledgement that your request was received or actioned on at all. 6. Buy a new phone because it isn't worth the hassle.
_bxg1 7y ago
Wait... what? The "malware" just unlocked the phones' carrier locks? Was it the phones' owners who were paying him to unlock them from AT&T? Why is an illegal scheme even necessary for doing that? I'm quite confused.
- thedanbob 7y ago
  Carriers typically won't unlock a phone that someone still owes money on or that's under a contract.
- gear54rus 7y ago
  Why is illegal scheme necessary to create derivative works of Mickey mouse? Because this world, while being peaceful, is overrun with hostile actors at every corner.
  - _bxg1 7y ago
    No, I mean, you can literally ask AT&T and they'll unlock your phone. Or if this was before that was possible, you could still just root it yourself. I don't see why the network or its employees had to be involved at all.
    - throwfDfZ9yPK 7y ago
      NO! Rooting your phone will not result in a carrier unlock. I am not aware of the specific technical details, but there are mechanisms in place which RMS would call "Negative in the freedom dimension." In my case I followed your advice, thinking like a logical human, that rooting my phone could allow myself to unlock my device (which I paid retail price from their walled garden market for pre-locked devicess, no subsidy and also following years of service) but i discovered many many months after the fact that the cellular megacorp can use their OTA update service in some instances to reverse your assertion of control over your device somehow. I used a dodgy unlock service in a time of desperation, and would later find myself locked out from my fully paid device yet again. The handset cost as much as a crappy but roadworthy car and was paid in full. These convoluted service lock agreements do nothing at all but ensure paying customers are beholden to the capricious will of these amoral corporate entities. The marketing and lobbying makes us think this is a good deal. EDIT: I used an opensource rooting method, and later used a dodgy unlock service which i believe this person may have been involved in reselling.
roflchoppa2 7y ago
this dudes my hero.
Humdeee 7y ago
> ... while he induced young workers to choose greed over ethical conduct Corrected: > ... while he induced young workers to choose ethical conduct over corporate greed
- 4ntonius8lock 7y ago
  Agreed. Did he commit a crime? Yes. Did he commit a crime against criminals? Yes. ATT is such a horrible, rent seeking parasite on our economy, I'm rooting for whoever is redistributing that wealth. I'm not too fond of the guy, but the enemies of my enemies can be friends.
dmitrygr 7y ago
Absolutely no pity for at&t, and please tell me where I can contribute to the defense fund. Phone locking is idiotic and anyone working against that is my hero.
tehjoker 7y ago
Hero. Free our man!
spectrum1234 7y ago
ATT support is awful. I recently had to contact support and through chat support the person said they were adding notes to my account. Of course when I call support another day they have no record of this. They then proceed to forward my call to 2 other departments each of which has no idea why I'm calling. I talked to each of these people for several minutes. How can a company possibly function like this?
- Scoundreller 7y ago
  As an oligopolist. If AT&T was your neighbourhood grocery store, they’d be crushed like a bug.
- belltaco 7y ago
  Same with Comcast, if not worse. For some reason their systems appear to take forever to load a customer account. One could probably find and pull a physical file of a user account faster in the pre-computer days out of a huge room full of wall to wall filing cabinets. I am not sure if it's ineptness or they pretend to take long to make support calls as frustrating as possible.
  - tzs 7y ago
    The trick I've found with Comcast is to go to their offices. The in-person support people have always been able to deal with whatever I was there for quickly and satisfactorily.
    - munk-a 7y ago
      I don't want to, as a consumer I'd like to get decent customer service in a manner that isn't directly inconveniencing to either me or, even, the company. I don't demand that reps show up at my door, but it is seriously annoying how far Comcast will go out of their way refusing to help you.
      - sokoloff 7y ago
        I've had pretty excellent support from Comcast via chat on the 3 occasions I've needed to use them in the last 5 years or so. It doesn't seem like it's going to be as fast as a phone call, but it seems like I can easily express what I want/need and the chat agent seems to respond intelligently and effectively.
nvr219 7y ago
This guy deserves a medal
chiefalchemist 7y ago
Looks like they completely buried the lead. That is, US carriers use proprietary hardware/software devices to establish and maintain a profitable strangle-hold on the consumer. No doubt the law the broken. There's no justification for that. However, the lead is the lead is the lead, and it's burried.
- psychometry 7y ago
  It's "lede"...
  - starpilot 7y ago
    Is it? https://news.ycombinator.com/item?id=16387567 https://news.ycombinator.com/item?id=16387567
  - caymanjim 7y ago
    Stop trying to force this abomination on people. It's never been "lede" except with people who like to feel like they're cool. It's a neologism that needs to be quashed.
  - dredmorbius 7y ago
    By usage, not so much. https://books.google.com/ngrams/graph?content=bury%20the%20lede%2C%20bury%20the%20lead&year_start=1800&year_end=2000&corpus=15&smoothing=3&direct_url=t1%3B%2Cbury%20the%20lead%3B%2Cc0 https://books.google.com/ngrams/graph?content=bury%20the%20l...
  - chiefalchemist 7y ago
    Ah. Thanks. I knew something didn't feel right.
- hughes 7y ago
  Is it really a stranglehold if it's a condition of a contract that consumers agree to in exchange for subsidized hardware? Personally I would never buy a carrier-locked phone, but I have the resources available to make that choice. Though the difference is maybe not huge, how many people do you think are online directly because of a carrier subsidy?
walshemj 7y ago
How do you avoid charges that serious by "leaving" the company sounds like AT&T security is a bit wishy washy. I would AT&T would have wanted to make an example some of them. In the UK getting busted by the Plod / MET or the Security Service would have been preferable to the internal security.
- greenyoda 7y ago
  It's possible that some executive wanted to cover it up to avoid the embarrassment of having this happen on their watch. If they press charges, the matter becomes public (both inside and outside the company). If they let the perpetrators walk, nobody finds out (or so they might have thought).
ixtli 7y ago
This person did nothing wrong. Laws holding people accountable for helping people who are being abused by an unaccountable power are themselves abusive and should be struck down.
supercanuck 7y ago
malware is defined as software that will cause damage. This doesn't appear to have caused any damage to the owner's phone.
pinewurst 7y ago
I think it's very important to note the long-term crappy treatment of AT&T employees by management - most recently illustrated by the wholesale transfer of thousands of senior IT people to IBM (an even worse employer, doubtlessly for off-the-AT&T books elimination). A good employer, and most are better than AT&T, has a certain level of loyalty as a defense. This bribe thing doesn't surprise me one tiny bit.
deleted 7y ago
[deleted]
trhway 7y ago
>The indictment doesn’t get into how Fahd was caught. He was arrested in Hong Kong in February 2018 at the request of U.S. authorities. Fahd was extradited from Hong Kong to the U.S. last week to face 14 different charges in federal court interesting that extradiction to US is ok while to mainland China - isnt. Speaks volumes about whom HK people trusts more, and it doesn't look very promising wrt. peaceful and harmonious full integration of HK. Wrt. the original post - impressive that AT&T couldnt notice what was happening at that scale for that long. Somebody need to sell them one more audit software package.
noodlesUK 7y ago
When a phone is “locked”, what does that entail? Is there a list of IMEIs somewhere that carriers check against when phones connect to their network, or is it something on the handset itself? If it’s software on the phone, surely it’s possible to hack it on the phone itself?
- Scoundreller 7y ago
  Handset itself. Though blacklists can exist too (depends on country and product). For some older phones, you could download a keygen because the algo has been cracked. But, for Apple, I understand all unlocks go through Apple HQ via the provider. Hence the need to malware the provider. My guess is that the tech for locking is pretty good. It’s probably a prerequisite for these providers to sell your device. Possibly with some penalty if the manufacturer can’t keep its lock robust.
  - noodlesUK 7y ago
    Wouldn’t it be a nice value-add if manufacturers provided an unlock after say a year or two after initial purchase? My experience with carriers is that even if you’re eligible for an unlock they’re a nightmare to get.
- rasz 7y ago
  simlock. War between hackers and carriers/handset manufacturers has been raging since before the Mitnick days (Motorola firmware hack). For example mikeselectricstuff (hackaday readers will immediately recognize the name https://www.youtube.com/user/mikeselectricstuff/videos https://www.youtube.com/user/mikeselectricstuff/videos , he is known among other things for Reverse Engineering the iPod Nano 6 screen and hacking FLIR E4 Thermal Imaging Camera to full resolution) has been making a living cracking GSM handset firmware in the nineties.
jasoneckert 7y ago
I blame the movie "Office Space" for influencing the AT&T employee's behavior (just kidding ;-)
digikata 7y ago
I have a feeling that multiple carriers have a similar problem. I traveled to another city and noticed that some incoming spam calls shifted to incoming numbers with the local area code.
mschuster91 7y ago
> Now he will be held accountable for the fraud and the lives he has derailed What? Whose lives? Those of the executives who got a couple thousand dollars less on their multi million boni packages? Don't get me wrong, bribing people to install malware is reprehensible, but that argument is just... unbelievably braindead.
throwaway3627 7y ago
Seems like a public service IMHO. ;)
55555 7y ago
> The indictment doesn’t get into how Fahd was caught. He was arrested in Hong Kong in February 2018 at the request of U.S. authorities. Fahd was extradited from Hong Kong to the U.S. last week to face 14 different charges in federal court in Seattle, including wire fraud, violating the Travel Act and intentional damage to a protected computer. How was Edward Snowden allowed to chill in Hong Kong? Was it because the indictment/extradition request was political and they don't honor those on our behalf? I thought HK just ignored US arrest warrants.
- lawnchair_larry 7y ago
  He wasn’t. That’s why he had to leave abruptly, and why he was stranded at his layover in Russia.
throwfDfZ9yPK 7y ago
Throwaway here. This bit me in the ass. (I think) Quite a while ago I was on an AT&T family plan with my aforementioned family. An unexpected death in my family caused a falling out/estrangement situation which jeopardized our cellular service, along the lines of an intestate inheritance, forfeited property, decades of fraud/extortion...and my borderline personality mother becoming enraged at the fact that we would now be reassessing my family's troubled history in the wake of this tragedy. The result of these events were that my (quite old) AT&T smartphone service was unexpecgedly cancelled, leaving me out in the cold. I needed service fast, and got a sim card ASAP but I did not reckon that my (fully paid for) cellular device would be carrier locked. This is my mistake of course, but the result is that I was, late at night, caught out with no functional device to use with my sim card, and a brand new MVNO service agreement. I took to the internet in order to find a solution, and ended up using my privacy.com account to pay for a rather sketchy Samsung unlock service, which worked like a charm. Eager to forget this entire affair, I moved on with my life. One day about a month or two ago, my Samsung handset began demanding a carrier unlock code. Confused, and in need of service, I shelled out for the nearest used smartphone thing I could find. This was rather alarming as I was cut off, yet again, and until this day I had no idea how my handset had relocked itsself! my MVNO CSR couldn't help, bless his/her soul, insisting I would need to contact the carrier for the unlock code. Instead, I hit that thing with a hammer and called it a night. After I used the dodgy unlock software which I paid a 20 for, I had monitored my handset for malicious activity via my personal security gateway but could never identify anything unusually malicious. Now I have a backup plan, and carry a spare flip phone. If your mother has access to lexisnexis, I might consider a restraining order if your situation sounds familiar. I concluded that AT&T has rescinded these unlock codes, leaving untold numbers of legitimate users without a way to conduct business. Carrier locked devices should be outlawed. AT&T appears to my naive eyes as a malevolent shitshow, much like verizon and comcast and other rent seeking walled garden extortionists. The history of these telephone companies precedes them, but gosh i wish that my real life didn't feel like it existed in Eve Online.
benguild 7y ago
I was always wondering who was on payroll at AT&T for this.
qwerty456127 7y ago
Good. Locking phones should be fought and, ideally, outlawed.

332 points by starpilot 7y ago

This is one of the problems with the cloud as well. You assume your website is well and safe but a Digital Ocean (or whatever) employee could always hack it.

somehnguy 7y ago
That isn't cloud specific, you could say the same about anything.
kbar13 7y ago
this is one of the problems with datacenters as well. you assume your router is well and safe but the NSA (or whatever) employee could always intercept it in transit and hack it.
- rolltiide 7y ago
  this is the problem with offshore hosts as well. you assume the lack of an information sharing treaty and plain text writing of a law ensures the privacy of your data, but the government can just arbitrarily hand it over to the first FBI agent that asks
  - balabaster 7y ago
    this is the problem with hosting it at home on your own server with your own hardware. Your kids will hack it when you're not looking and install a Roblox server and let every idiot into your server to do whatever they want with it. Also, kids are stupidly easy to bribe.

chendragon 7y ago

Is this how the eBay phone unlocking services work? Usually they say something about servers and "sending your IMEI to the server" etc, and sometimes it can take a certain number of hours.

gruez 7y ago
You’d think that this would be easy to crack down. All you need to do is pay for an unlock and trace where the unlock request came from.
JRKrause 7y ago
I bought an ATT locked iPhone SE from Ebay just 2 months ago. The unlocking process was essentially just going to ATT website and typing in the IMEI and they unlock it within 15 minutes for free. I assume all the "pay $10 to unlock your phone" services are just counting on the average person being too lazy to discover your can just do the legwork yourself.
- withinrafael 7y ago
  The mobile operator provided unlock only works on devices of a certain age. You can't typically, for example, purchase a new flagship device and unlock it on day one. The illegitimate methods bypass this restriction.
  - WrtCdEvrydy 7y ago
    Also, AT&T will only allow two unlocks for non-customers. So if you left AT&T, you can only unlock two devices.
  - therealx 7y ago
    Theres a method of unlocking new/any iOS device using the GSX api that Apple maintains for the remaining list of Authorized Stores. Apple will not approve anyone new for the list, and they have changed up the requirements to connect to the API lately from just a username/password (which were often hacked or bribed), to client side certificates and blessed static ips (at a time when even the OS X networking libraries didn't support this), to a new version just now that I won't give the details but you can find if you do some github searching.

alfalfasprout 7y ago

Given how poorly AT&T and the like treat customers I can't really feel bad that they lost out on $5mm of fees on their crappy overpriced contracts.

olliej 7y ago

Companies need to assume that their network is compromised. Ignoring anything else that means they need to adopt E2E encryption for all user data (except where legally mandated to be insecure, or when the data has a fundamental need to be accessible - e.g. your bank needs to know how much money you have). Anything else, including dumbass politicians demanding magic crypto, makes your user data a valuable and achievable target.

jzunit 7y ago

His methods were illegal but can we please recognize this guy for being an ABSOLUTE HERO for unlocking all those phones and giving the people what they wanted.

intopieces 7y ago
Agreed, I don’t see much in the way of negativity here. It doesn’t seem like customers were defrauded, only AT&T.
deleted 7y ago
[deleted]
jdblair 7y ago
A contract was violated when these phones were unlocked. In return for a locked phone the buyer received a subsidy from AT&T on the cost of the hardware. I don't want people to violate contracts with me, why should I recognize someone as a hero just because I don't like the contract? To be absolutely clear, I don't like locked phones, either, so I always buy non-carrier-locked devices and it means I pay the full, unsubsidized hardware price. [edited to fix a typo]
- qwsxyh 7y ago
  The contract sucks shit that's why
  - nordsieck 7y ago
    > The contract sucks shit that's why All those people were free to buy unsubsidized phones elsewhere. They knew exactly what they were getting into when they signed up.
    - thedaemon 7y ago
      You give them too much credit. People don't read phone contracts and few people even know what an unlocked phone is.

sundayedition 7y ago

I wonder what the footprint is do the SIM hijacking, e.g. is anyone a sufficiently high enough bribe away from the type of scheme that compromises their account because it only takes 1 employee to effect it. I've been switching to hardware keys when I'm able but it's not always feasible. I just bought a Titan key combo and you can't use most 3rd party email clients with it so that made it kind of useless to me (since Gmail's mail app isn't that great)

Nextgrid 7y ago
Fraudulent SIM swaps are already being done and it's a lot less sophisticated than this - just show up to a store with a fake ID (or bribe the low-wage employee who isn't paid enough to give a shit so I can't really blame them).
- shiftpgdn 7y ago
  Your SMS based 2FA is only as secure as the lowest paid employee at a cell phone store.
  - Nextgrid 7y ago
    Lowest paid employee at the store? How about lowest paid idiot at the outsourced customer "service" centre.

kiallmacinnes 7y ago

> “Now he will be held accountable for the fraud and the lives he has derailed.” Whoa there. What? Yes, he's committed a crime and should be held accountable for that. But.. Who's lives has he derailed? If I was to accept a bribe to commit a crime, nobody is derailing my life but me - to say anything else suggests a level of intelligence bordering on inability to understand and take responsibility for my actions. Can I use this defence for non bribery related crimes? How about assassin for hire? Prosecute him for the crimes he committed and prosecute those who accepted bribes for their crimes. Theres just no reason to exaggerate like this. Edit: And, to add, I dislike the discount / rental / lock in model the carriers use, but it does sound like crimes were committed.

gowld 7y ago
More than one person can be at fault for a violation.
- kiallmacinnes 7y ago
  Exactly. The statement quoted makes it sound like people accepting bribes is entirely the fault of the person proposing the bribe. The blame is shared, nobody had their lives derailed by anyone but themselves as far as I can tell.
moftz 7y ago
I guess you could consider all of the employees that got fired/will get fired/left before they got fired. Their lives got derailed but that's on them. No one held a gun to their head, this guy was on the other side of the world and convinced some AT&T techs to do this for money. If they were willing to install malware for money, AT&T is just lucky the guy was only after unlocked phones. I'm sure the employee handbook doesn't explicitly say "don't install malware for strange Pakistani men for money" but I'm sure they had enough training to put all of the pieces together...
brentm 7y ago
Federal prosecutors love a good dramatic press conference.

deogeo 7y ago

1.) How is unlocking a phone "malware"? Isn't the lock malware, and the unlocking serves the owner of the device? Calling it malware reeks of regurgitating AT&T propaganda. 2.) How did this "deprive AT&T of the stream of payments it was owned under the customers’ service contracts and installment plans."? A phone getting unlocked doesn't void a contract, so those customers are still on the hook.

ijpoijpoihpiuoh 7y ago
1. It's malware from the perspective of the entity whose computers it was installed on. To respond to your meta-point, phone locks are merely a technical control to help ensure consumers abide by their contractual obligations. At least, this is the case since companies have been obligated to offer unlocks for phones whose contracts are paid off. 2. Presumably, it's a combination of a number of mechanisms, like judgment-proof consumers or identity thieves unlocking and reselling devices.
- rconti 7y ago
  Are they really obligated to offer unlocks now? I stopped getting subsidized phones 5 or so years ago (and it seems carriers mostly don't offer them anymore anyway), but I fought tooth and nail with multiple carriers to get my paid-for device unlocked, and usually the answer was "piss off".
  - sokoloff 7y ago
    Yes, since the enaction of this: https://www.congress.gov/bill/113th-congress/senate-bill/517 https://www.congress.gov/bill/113th-congress/senate-bill/517
    - kaibee 7y ago
      Technically yes, but in my experience... no. Recently my parents switched carriers for whatever reason, so I had to get a new phone. Honestly I would have kept my Note4 for another year, but whatever. Being a phone from, what 2014? it was well paid off at this point. 1. I went to the AT&T Store, asked them to unlock my phone. Was told, no sorry, we don't do that here. "Call the support line." 2. Called the support line, waited 20 minutes, was transferred to the correct department, waited another 20 minutes. Was told, we don't do that over the phone anymore. Go to this website here. 3. Went to the website. It asks for the number that is printed behind the battery (y'know back in my day, you could remove batteries from the devices you owned and replace them) Next, it asks for some device ID Number that you need to ask the phone for. So you turn it back on, follow the directions, etc. Then you submit the form. Then they tell you it can take up to 48 hours to get the unlock code. 4. Wait. 5. Receive absolutely no confirmation or acknowledgement that your request was received or actioned on at all. 6. Buy a new phone because it isn't worth the hassle.

_bxg1 7y ago

Wait... what? The "malware" just unlocked the phones' carrier locks? Was it the phones' owners who were paying him to unlock them from AT&T? Why is an illegal scheme even necessary for doing that? I'm quite confused.

thedanbob 7y ago
Carriers typically won't unlock a phone that someone still owes money on or that's under a contract.
gear54rus 7y ago
Why is illegal scheme necessary to create derivative works of Mickey mouse? Because this world, while being peaceful, is overrun with hostile actors at every corner.
- _bxg1 7y ago
  No, I mean, you can literally ask AT&T and they'll unlock your phone. Or if this was before that was possible, you could still just root it yourself. I don't see why the network or its employees had to be involved at all.
  - throwfDfZ9yPK 7y ago
    NO! Rooting your phone will not result in a carrier unlock. I am not aware of the specific technical details, but there are mechanisms in place which RMS would call "Negative in the freedom dimension." In my case I followed your advice, thinking like a logical human, that rooting my phone could allow myself to unlock my device (which I paid retail price from their walled garden market for pre-locked devicess, no subsidy and also following years of service) but i discovered many many months after the fact that the cellular megacorp can use their OTA update service in some instances to reverse your assertion of control over your device somehow. I used a dodgy unlock service in a time of desperation, and would later find myself locked out from my fully paid device yet again. The handset cost as much as a crappy but roadworthy car and was paid in full. These convoluted service lock agreements do nothing at all but ensure paying customers are beholden to the capricious will of these amoral corporate entities. The marketing and lobbying makes us think this is a good deal. EDIT: I used an opensource rooting method, and later used a dodgy unlock service which i believe this person may have been involved in reselling.

roflchoppa2 7y ago

this dudes my hero.

Humdeee 7y ago

> ... while he induced young workers to choose greed over ethical conduct Corrected: > ... while he induced young workers to choose ethical conduct over corporate greed

4ntonius8lock 7y ago
Agreed. Did he commit a crime? Yes. Did he commit a crime against criminals? Yes. ATT is such a horrible, rent seeking parasite on our economy, I'm rooting for whoever is redistributing that wealth. I'm not too fond of the guy, but the enemies of my enemies can be friends.

dmitrygr 7y ago

Absolutely no pity for at&t, and please tell me where I can contribute to the defense fund. Phone locking is idiotic and anyone working against that is my hero.

tehjoker 7y ago

Hero. Free our man!

spectrum1234 7y ago

ATT support is awful. I recently had to contact support and through chat support the person said they were adding notes to my account. Of course when I call support another day they have no record of this. They then proceed to forward my call to 2 other departments each of which has no idea why I'm calling. I talked to each of these people for several minutes. How can a company possibly function like this?

Scoundreller 7y ago
As an oligopolist. If AT&T was your neighbourhood grocery store, they’d be crushed like a bug.
belltaco 7y ago
Same with Comcast, if not worse. For some reason their systems appear to take forever to load a customer account. One could probably find and pull a physical file of a user account faster in the pre-computer days out of a huge room full of wall to wall filing cabinets. I am not sure if it's ineptness or they pretend to take long to make support calls as frustrating as possible.
- tzs 7y ago
  The trick I've found with Comcast is to go to their offices. The in-person support people have always been able to deal with whatever I was there for quickly and satisfactorily.
  - munk-a 7y ago
    I don't want to, as a consumer I'd like to get decent customer service in a manner that isn't directly inconveniencing to either me or, even, the company. I don't demand that reps show up at my door, but it is seriously annoying how far Comcast will go out of their way refusing to help you.
    - sokoloff 7y ago
      I've had pretty excellent support from Comcast via chat on the 3 occasions I've needed to use them in the last 5 years or so. It doesn't seem like it's going to be as fast as a phone call, but it seems like I can easily express what I want/need and the chat agent seems to respond intelligently and effectively.

nvr219 7y ago

This guy deserves a medal

chiefalchemist 7y ago

Looks like they completely buried the lead. That is, US carriers use proprietary hardware/software devices to establish and maintain a profitable strangle-hold on the consumer. No doubt the law the broken. There's no justification for that. However, the lead is the lead is the lead, and it's burried.

psychometry 7y ago
It's "lede"...
- starpilot 7y ago
  Is it? https://news.ycombinator.com/item?id=16387567 https://news.ycombinator.com/item?id=16387567
- caymanjim 7y ago
  Stop trying to force this abomination on people. It's never been "lede" except with people who like to feel like they're cool. It's a neologism that needs to be quashed.
- dredmorbius 7y ago
  By usage, not so much. https://books.google.com/ngrams/graph?content=bury%20the%20lede%2C%20bury%20the%20lead&year_start=1800&year_end=2000&corpus=15&smoothing=3&direct_url=t1%3B%2Cbury%20the%20lead%3B%2Cc0 https://books.google.com/ngrams/graph?content=bury%20the%20l...
- chiefalchemist 7y ago
  Ah. Thanks. I knew something didn't feel right.
hughes 7y ago
Is it really a stranglehold if it's a condition of a contract that consumers agree to in exchange for subsidized hardware? Personally I would never buy a carrier-locked phone, but I have the resources available to make that choice. Though the difference is maybe not huge, how many people do you think are online directly because of a carrier subsidy?

walshemj 7y ago

How do you avoid charges that serious by "leaving" the company sounds like AT&T security is a bit wishy washy. I would AT&T would have wanted to make an example some of them. In the UK getting busted by the Plod / MET or the Security Service would have been preferable to the internal security.

greenyoda 7y ago
It's possible that some executive wanted to cover it up to avoid the embarrassment of having this happen on their watch. If they press charges, the matter becomes public (both inside and outside the company). If they let the perpetrators walk, nobody finds out (or so they might have thought).

ixtli 7y ago

This person did nothing wrong. Laws holding people accountable for helping people who are being abused by an unaccountable power are themselves abusive and should be struck down.

supercanuck 7y ago

malware is defined as software that will cause damage. This doesn't appear to have caused any damage to the owner's phone.

pinewurst 7y ago

I think it's very important to note the long-term crappy treatment of AT&T employees by management - most recently illustrated by the wholesale transfer of thousands of senior IT people to IBM (an even worse employer, doubtlessly for off-the-AT&T books elimination). A good employer, and most are better than AT&T, has a certain level of loyalty as a defense. This bribe thing doesn't surprise me one tiny bit.

deleted 7y ago

[deleted]

trhway 7y ago

>The indictment doesn’t get into how Fahd was caught. He was arrested in Hong Kong in February 2018 at the request of U.S. authorities. Fahd was extradited from Hong Kong to the U.S. last week to face 14 different charges in federal court interesting that extradiction to US is ok while to mainland China - isnt. Speaks volumes about whom HK people trusts more, and it doesn't look very promising wrt. peaceful and harmonious full integration of HK. Wrt. the original post - impressive that AT&T couldnt notice what was happening at that scale for that long. Somebody need to sell them one more audit software package.

noodlesUK 7y ago

When a phone is “locked”, what does that entail? Is there a list of IMEIs somewhere that carriers check against when phones connect to their network, or is it something on the handset itself? If it’s software on the phone, surely it’s possible to hack it on the phone itself?

Scoundreller 7y ago
Handset itself. Though blacklists can exist too (depends on country and product). For some older phones, you could download a keygen because the algo has been cracked. But, for Apple, I understand all unlocks go through Apple HQ via the provider. Hence the need to malware the provider. My guess is that the tech for locking is pretty good. It’s probably a prerequisite for these providers to sell your device. Possibly with some penalty if the manufacturer can’t keep its lock robust.
- noodlesUK 7y ago
  Wouldn’t it be a nice value-add if manufacturers provided an unlock after say a year or two after initial purchase? My experience with carriers is that even if you’re eligible for an unlock they’re a nightmare to get.
rasz 7y ago
simlock. War between hackers and carriers/handset manufacturers has been raging since before the Mitnick days (Motorola firmware hack). For example mikeselectricstuff (hackaday readers will immediately recognize the name https://www.youtube.com/user/mikeselectricstuff/videos https://www.youtube.com/user/mikeselectricstuff/videos , he is known among other things for Reverse Engineering the iPod Nano 6 screen and hacking FLIR E4 Thermal Imaging Camera to full resolution) has been making a living cracking GSM handset firmware in the nineties.

jasoneckert 7y ago

I blame the movie "Office Space" for influencing the AT&T employee's behavior (just kidding ;-)

digikata 7y ago

I have a feeling that multiple carriers have a similar problem. I traveled to another city and noticed that some incoming spam calls shifted to incoming numbers with the local area code.

mschuster91 7y ago

> Now he will be held accountable for the fraud and the lives he has derailed What? Whose lives? Those of the executives who got a couple thousand dollars less on their multi million boni packages? Don't get me wrong, bribing people to install malware is reprehensible, but that argument is just... unbelievably braindead.

throwaway3627 7y ago

Seems like a public service IMHO. ;)

55555 7y ago

> The indictment doesn’t get into how Fahd was caught. He was arrested in Hong Kong in February 2018 at the request of U.S. authorities. Fahd was extradited from Hong Kong to the U.S. last week to face 14 different charges in federal court in Seattle, including wire fraud, violating the Travel Act and intentional damage to a protected computer. How was Edward Snowden allowed to chill in Hong Kong? Was it because the indictment/extradition request was political and they don't honor those on our behalf? I thought HK just ignored US arrest warrants.

lawnchair_larry 7y ago
He wasn’t. That’s why he had to leave abruptly, and why he was stranded at his layover in Russia.

throwfDfZ9yPK 7y ago

Throwaway here. This bit me in the ass. (I think) Quite a while ago I was on an AT&T family plan with my aforementioned family. An unexpected death in my family caused a falling out/estrangement situation which jeopardized our cellular service, along the lines of an intestate inheritance, forfeited property, decades of fraud/extortion...and my borderline personality mother becoming enraged at the fact that we would now be reassessing my family's troubled history in the wake of this tragedy. The result of these events were that my (quite old) AT&T smartphone service was unexpecgedly cancelled, leaving me out in the cold. I needed service fast, and got a sim card ASAP but I did not reckon that my (fully paid for) cellular device would be carrier locked. This is my mistake of course, but the result is that I was, late at night, caught out with no functional device to use with my sim card, and a brand new MVNO service agreement. I took to the internet in order to find a solution, and ended up using my privacy.com account to pay for a rather sketchy Samsung unlock service, which worked like a charm. Eager to forget this entire affair, I moved on with my life. One day about a month or two ago, my Samsung handset began demanding a carrier unlock code. Confused, and in need of service, I shelled out for the nearest used smartphone thing I could find. This was rather alarming as I was cut off, yet again, and until this day I had no idea how my handset had relocked itsself! my MVNO CSR couldn't help, bless his/her soul, insisting I would need to contact the carrier for the unlock code. Instead, I hit that thing with a hammer and called it a night. After I used the dodgy unlock software which I paid a 20 for, I had monitored my handset for malicious activity via my personal security gateway but could never identify anything unusually malicious. Now I have a backup plan, and carry a spare flip phone. If your mother has access to lexisnexis, I might consider a restraining order if your situation sounds familiar. I concluded that AT&T has rescinded these unlock codes, leaving untold numbers of legitimate users without a way to conduct business. Carrier locked devices should be outlawed. AT&T appears to my naive eyes as a malevolent shitshow, much like verizon and comcast and other rent seeking walled garden extortionists. The history of these telephone companies precedes them, but gosh i wish that my real life didn't feel like it existed in Eve Online.

benguild 7y ago

I was always wondering who was on payroll at AT&T for this.

qwerty456127 7y ago

Good. Locking phones should be fought and, ideally, outlawed.