3 ms·

Does anyone remember the ATT "Hack"? These two just used curl to get e-mail address and ICC-ID of ATT iPad users which where publicly accessible. [1] It was sti

Does anyone remember the ATT "Hack"? These two just used curl to get e-mail address and ICC-ID of ATT iPad users which where publicly accessible. [1] It was still labeled a hack and went through the brain dead media that way. Instead of ATT getting in trouble Auernheimer got a 41 months sentence and the judge also ordered him and Spitler to pay $73,000 in restitution. [1] https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/

FDSGSG 6y ago
If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been a hack?
- sbarre 6y ago
  I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.
  - FDSGSG 6y ago
    The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?
    - strogonoff 6y ago
      IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
    - sbarre 6y ago
      It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.
soulofmischief 6y ago
weev had a lot of friends come forth to defend his actions, but then he went full neonazi in prison and all of that support disappeared. He now runs admin for The Daily Stormer and somehow finds a way to keep popping up in the worst places, can't seem to shake the guy. Additionally, he didn't even do the legwork for the AT&T op, but really wanted to take credit for something for cool hacker cred, and it came back and bit him. I keep company with several people involved in that ordeal.

FDSGSG 6y ago

If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been a hack?

sbarre 6y ago
I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.
- FDSGSG 6y ago
  The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?
  - strogonoff 6y ago
    IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
  - sbarre 6y ago
    It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.

soulofmischief 6y ago

weev had a lot of friends come forth to defend his actions, but then he went full neonazi in prison and all of that support disappeared. He now runs admin for The Daily Stormer and somehow finds a way to keep popping up in the worst places, can't seem to shake the guy. Additionally, he didn't even do the legwork for the AT&T op, but really wanted to take credit for something for cool hacker cred, and it came back and bit him. I keep company with several people involved in that ordeal.