21 ms·
Ticketmaster will pay $10M for hacking rival ticket seller
- pizza 6y agoNever heard the name Ticketmaster associated with any type of behavior but scummy behavior, to be honest. $10M seems quite cheap a fine.
- Neil44 6y agoThis should be in the dictionary under password expiry.
- deleted 6y ago[deleted]
- bawolff 6y agoNot really. Ex-employee had access. If his password expired, he could just choose a new one and keep access. Revoking credentials of employees after they leave and doing regular audits of the access list, are controls that would be relevant here.
- Neil44 6y agoI read it that wasn’t just his own account he was accessing but yes you’re not wrong about employee termination procedures also.
- olliej 6y agoRemember when Aaron Schwarz didn't break the CFAA, or hack into any other person or organisation's private data, but was nonetheless brutally assaulted by the government until he committed suicide? Then here's Ticketmaster caught literally hacking into their competitors systems and they get a slap on the hand. No one going to jail, no one becoming a felon, no one's life ruined.
- gunnihinn 6y agoThis is America. Schwarz was not prosecuted for his crimes but for his failure to monetize them.
- minot 6y agoI’ve said this before and I’m more convinced of this now: the cfaa is unsalvagable and must be completely repealed/scrapped. All of it. No half measures. It does nothing to stop what matters: corporations or nation states. Horrible corporations like LinkedIn try to use it. Having the CFAA is literally worse than not having any laws about this. Not only must WE repeal it, the US must go around the world helping people understand that other countries must not enact or must scrap such laws.
- tricolon 6y agojust pointing out that his name is Aaron Swartz
- olliej 6y agodammit
- elken 6y ago> his old employer used non-protected but difficult-to-find preview links for ticketing pages. Oh come on, I find it difficult to have sympathy for a company that does this. It's a ticking time bomb, and certainly not hacking.
- emsy 6y agoWhat are passwords if not difficult to guess strings? It’s usually safer to create a link with 32 random characters than letting users come up with their own passwords such as „qwer1234“.
- paulgb 6y agoI disagree. There’s a reason why security by obscurity gets a bad rap. Browsers generally treat passwords as sacred — not saving or logging them unless the user explicitly asks. On the other hand, the URL bar gets saved to history, sent as a referrer when links are clicked (in some browsers), might be sent to an external server by the browser or extensions, etc.
- emsy 6y agoI agree with the part about an URL being less secured than a password. However, it's not security by obscurity. It's just less secure and more convenient. But the URL scheme merely grants you access to a ticket, not the whole account, so the potential damage is negligible.
- bawolff 6y ago32 random characters (192 bits of entropy if you assume base64) is a lot more than just "difficult" to find. I'm pretty sure that is not what the article meant by difficult to find pages.
- borski 6y agoSure, but in this case the attacker had inside knowledge and took it to a competitor. That, itself, is scummy, as well as criminal.
- 6y ago
- copperwater69 6y agoTerry A Davis used to work at ticketmaster Must have a hell of a culture there
- noodlesUK 6y agoIf we’re gonna go after pentesters (coalfire), or pursue people for copyright infringement, we have to go after people who deliberately commit crimes and corporate espionage. This is no different to breaking or sneaking into a competitors facility and stealing their documents. Assembling a spreadsheet of artists using public data is different, but straight up corporate espionage with stolen creds is absolutely unacceptable and should result in criminal penalties for the company and its directors.
- purplecats 6y agobut this is america
- jollofricepeas 6y agoAgreed. Agreed. Agreed. There are countless names of “hackers” that have sat in prison and are currently sitting in prison for lengthy terms regardless of their intent. A Ticketmaster exec should have to do the same. https://en.m.wikipedia.org/wiki/List_of_computer_criminals https://en.m.wikipedia.org/wiki/List_of_computer_criminals RIP Aaron Swartz.
- adamcstephens 6y agoI’d argue this is worse, since Ticketmaster is likely violating antitrust statutes s as well. Lawlessness will continue until the government starts charging individuals.
- sneak 6y agoTicketmaster has no hands and cannot act. Some human being, or set of human beings, did this, and some federal prosecutor declined to bring CFAA charges against those people who committed those crimes. There are two sets of laws in that country: those that apply to them, and the other set that applies to you.
- sitkack 6y agoProsecutors end up deciding who the law applies to. That they have so much leeway is the source of these issues. But we also need other parts of the justice system to bend and morph to the issue, otherwise it is just a big heartless machine has to be coded for every possible input.
- samwhiteUK 6y agoThis title is ambiguous. Sounds like they're offering a bounty
- kikokikokiko 6y agoJournalism is dead. I am at the point where I don't believe any headlines anymore. It's either willful manipulation of the facts, clickbait, or just plain stupidity on the part of the writer/corporation behind the article.
- 93po 6y agoSame here. Even for "institutions" of journalism. Even the BBC and the NYT. They're all awful.
- bavell 6y agoYes, the "newspaper of record" is such a joke - just as laughable as Cuomo receiving an Emmy. Bunch of self-dealing slimebags. Group-think and blind zealotry have gotten so bad there, even the few pieces of actual journalism they put out are tainted with it. Hard to trust anything they say when you know how many lies they've pushed in bad faith.
- edoceo 6y agoI used to write bots against TM back in the day, loads of folks were. The whole industry around ticking (and secondary!) is crazy, and OMG! fees on everything! Surprised it took so long for one of the dirtiest players to get a little slap on the wrist.
- bisRepetita 6y ago>Ticketmaster apparently lost access to the system by 2015, the same year CrowdSurge merged with Songkick. Songkick sued Live Nation and Ticketmaster for violating antitrust laws. But it soon sold or shut down its services, and in 2018, it accepted a $110 million settlement — plus an undisclosed sum to sell some of its remaining assets to Ticketmaster. >Ticketmaster expressed satisfaction with the outcome in a statement Crime pays off, in the end.
- xwdv 6y agoIf it didn’t there wouldn’t be any crime.
- NateEag 6y agoHumans are not perfectly rational agents, so this does not follow.
- bbrree66 6y agoCongratulations, you win stupidest comment of the day!
- curtainsforus 6y agoStill, if crime never paid off for anyone, people would wise up eventually- save for exploratory divergent forays in case the situation has changed.
- MaxBarraclough 6y agoCrimes of passion are rarely rational.
- curtainsforus 6y agoIt's all evopsych game theory
- 6y ago
- danellis 6y ago"Worth it." -- Ticketmaster
- tester34 6y agoThis guy shouldn't be able to work in IT/CS or anything non-freelance & computer related Same should happen to Anthony Levandowski, but of course things are tricky when you're world leading Self-Driving Cars Expert
- kodah 6y agoAnthony's story is exceptionally brazen. Corporate espionage, reckless public endangerment, and embezzlement while having produced very little.
- jimnotgym 6y agoIt doesn't sound to me like any settlement Ticketmaster could make with the company they hacked should prevent an anti-trust investigation continuing. If Ticketmaster used anti-competitive tactics it is not just other companies that suffered a loss, it was also the public.
- btown 6y agoThis was a settlement with the US Department of Justice, which apparently believes a $10M fine adequately protects the public. One wonders if the timing of this announcement is coincidental.
- sschueller 6y agoProtect the public? If anything the public needs protection from ticket master ands it's crime syndicate. I just noticed that the word "master" is in ticket master. With every one renaming git branches etc. why hasn't ticket master been attacked for its "racist name"? Not that I personally give a shit.
- Spooky23 6y agoTicketmaster is really good at being evil. If professional sports teams with government protected monopolies can’t beat them, SJW types are like cannon fodder.
- gruez 6y ago>Ticketmaster is really good at being evil More like, taking all the heat so everyone else can keep their hands clean. >BUDISH: So Ticketmaster takes all the P.R. hit for these egregious service fees. But actually a lot of that money spreads its way around the rest of the food chain. >MARCUS: It’s actually historically kind of part of Ticketmaster’s business model to take on the burden of that negative sentiment. https://freakonomics.com/podcast/live-event-ticket-market-screwed/ https://freakonomics.com/podcast/live-event-ticket-market-sc...
- seventytwo 6y agoGeez, reading the title, I thought Ticketmaster was offering $10M to hack its competitor...
- paulpauper 6y agoWhen a person does it, they go to jail for a long time. When a company does it, it pays a fine, no wrongdoing
- iudqnolq 6y agoIsn't it nice to see our justice system at work. I'm glad to see our brave men and women keep in mind their number one imperative: never disappoint $$$. > Ticketmaster expressed satisfaction with the outcome in a statement. “Ticketmaster terminated both Zaidi and Mead in 2017, after their conduct came to light. Their actions violated our corporate policies and were inconsistent with our values. We are pleased that this matter is now resolved,” a spokesperson told The Verge. > Today’s judgment defers prosecution under the Computer Fraud and Abuse Act. Ticketmaster must pay the fine in question, maintain clear policies to detect and prevent unauthorized computer intrusion, and present annual reports on its conduct for the next three years.
- chiefalchemist 6y agoThese are criminal acts. If they were physical (i.e., not cyber) there would be more than fines. Fines are a slapon the wrist. $10 million a meaningless drop in the bucket. Cyber crime pays.
- antihero 6y ago> “Further, Ticketmaster’s employees brazenly held a division-wide ‘summit’ at which the stolen passwords were used to access the victim company’s computers.” Isn't this a felony? Why aren't these people in jail? > Live Nation hired a former CrowdSurge employee named Stephen Mead in 2013. Then, now-fired Ticketmaster executive Zeeshan Zaidi and other executives encouraged him to turn over his old employer’s secrets You know, there are ongoing extradition cases from UK->USA for people who have done far, FAR less malevolent actions than these. Why are these people not facing 10+ years in jail for hacking?
- ozim 6y agohttps://www.bleepingcomputer.com/news/security/ticketmaster-fined-10-million-for-breaking-into-rival-s-systems/ https://www.bleepingcomputer.com/news/security/ticketmaster-... "The company admitted that it is responsible for the actions of its employees under United States law." That was also my question why those employees are not in jail yet. I was thinking that company gets fine and employees get jail time but that must be some weird/interesting part of US law.
- somehnguy 6y ago>that must be some weird/interesting part of US law. Indeed. We see time and time again that corporations can get away with almost anything they want without facing any real consequence compared to individuals. What part of US law is protecting these corporations and the people involved when they flagrantly break the law? It's sickening.
- gruez 6y ago>We see time and time again that corporations can get away with almost anything they want without facing any real consequence compared to individuals. ...except that corporations are literally just groups of people, the person who perpetrated the act (Zaidi) pled guilty to hacking and is awaiting sentencing?
- 6y ago
- PopGreene 6y agoThe DOJ should send them a bill for 10M plus a 12.5% handling fee and a 4% convenience fee.
- kinoriw 6y agoShouldn't that guy that was pushed to turn over secrets have signed an NDA with the previous company? sounds bizarre
- wayanon 6y agoIs there a league table (similar to the global corruption index?) which shows which industries attract the most prosecutions?
- mindslight 6y ago... payable in vouchers for free concerts that don't actually exist, and coupons for $2 off expedited shipping of paper tickets. (I'm bitter, but that wasn't hyperbole - that was the actual award of their last class action settlement for fixing the consumer market)
- WalterSobchak 6y agoShould the URL be updated to the source article? https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0 https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...
- mattmaroon 6y agoTicketmaster's business model is evilness. Always has been.
- stevespang 6y agoTitle should include the word: "FINE"
- papito 6y agoAs usual, "corporations are people", but only until the point when there is an actual crime committed. Then it becomes an amorphous blob, impossible to hold responsible. "You can't possibly put a business in jail! It's not like we are a person!"
- CosmicShadow 6y ago"Monopolist fined equivalent of 1 cent after committing criminal acts against rival"
- xyst 6y agoticketmaster has earned billions of dollars for charging fees to various events and concerts. This is simply the price of doing business. And no surprise, there's no criminal charges.
- sibartlett 6y agoTicketmaster also acquires their competition to just shut them down and fire them all. Happened to a friend of mine this year. They all lock up all the promoters into 5-10 year contracts, so they can’t leave for the competition.
- whoknew1122 6y agoDamn, it's good to be a billion dollar company. You can hack a competitor, force them to close their doors in furtherance of your monopoly, and face what amounts to 0 consequences.