16 ms·
The search for dirt on Mudge
- DanAtC 4y agoWhat's stopping someone from taking the money and giving them nothing of value in return? Missed opportunity.
- bdhe 4y agoIntegrity? Something the world seems awfully short of, these days.
- bloppe 4y agoIt's probably more like a plea deal negotiation. They pay for the info not just the conversation.
- awinder 4y agoYeah I’m with you, once the friends group clued in that it was a bunch of financial types trying to make trades on a feeling, they should have spit all kinds of divergent information into that idiot machine.
- danielmarkbruce 4y agoYou can do that once, at best. Most of them have a phone system which counts the minutes and you get prorated. The people paying the money aren't idiots. They'll cut you off after 10 minutes if it seems like you are full of it. Then the relevant expert network never calls you again. The other side (the people that pay) do reviews etc. "Mr X appears incompetent".
- throwoutway 4y agoAt this point, the Twitter board needs to bring in an outside investigatory team. Mudge, who is well respected in the industry, is saying the executives are lying to the board. Twitter’s CEO publicly mocks him, refuses to testify to Congress, and instead we hear that people are being offered money to dish dirt on their respected colleague. If Twitter’s board does not act, then they’re willfully ignorant to the behavior and that negligence is going to harm investors. Lastly, if the board does not act, then the investors need to bring this to vote at the next shareholder meeting.
- vmoore 4y ago> Mudge, who is well respected in the industry Keep in mind, although he's classed as an 'ethical' hacker, many whitehats come from blackhat backgrounds, and turned whitehat because of fear of getting caught up in draconian CFAA[0] trials. Every hacker in their youth done some stupid stuff that could haunt them later. If you didn't do stupid stuff in your youth, you never really grew or learned from it. [0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- nekoashide 4y agoThat's why you don't request your personal file from the FBI, either they have a file on you from your youth or you have given them reason to suspect you did something at some point. I'm curious, but not that curious.
- woodruffw 4y agoTens of thousands of people FOIA their DOJ files each year. Unless you're already pinged for something, I doubt the FBI is going to expend any additional effort solely because you've asked for some personal files.
- jjulius 4y ago>If you didn't do stupid stuff in your youth, you never really grew or learned from it. So, he's... just like most people? Do you have any specific incident(s) to point to, re: Mudge, or is this just speculation that can be applied to nearly everyone?
- deleted 4y ago[deleted]
- dweez 4y agoMatt Levine today: > Surely the highest-variance aspect of the Twitter vs. Musk saga is Zatko’s whistle-blower complaint. If Zatko can make a compelling case that Twitter is horribly bad — that its information security is so bad that it violates the law, that it has fraudulently concealed its problems, etc. — then that is probably Musk’s best argument to get out of the deal: Twitter is doing fraud, it has suffered a material adverse effect, etc. If Zatko is just a run-of-the-mill paranoid security researcher who is aggrieved about being fired and making mountains out of molehills, then his complaint will quickly be kicked out of court and won’t affect the Musk deal. Zatko’s credibility — whether he’s telling the truth, and also whether he is exaggerating or underselling the importance of Twitter’s problems — is a key input into your evaluation of Twitter’s stock value. The more credible he is, the less likely it is that Twitter will get $54.20 per share, and the less Twitter will be worth without Musk’s deal. > So if you are a hedge fund, or an expert-network firm working on behalf of hedge funds, you obviously want to know how credible he is. You might, for instance, want to talk to some of his old coworkers to get a feel for him. You might offer to pay them a lot of money for a one-hour phone call, because you might have a lot of money riding on the Twitter deal, which means specifically that you have a lot of money riding on your evaluation of Zatko’s credibility.
- neonate 4y agohttps://www.bloomberg.com/opinion/articles/2022-09-13/crypto-wants-some-sec-rules https://www.bloomberg.com/opinion/articles/2022-09-13/crypto... https://archive.ph/YoBJQ https://archive.ph/YoBJQ
- anonymouse008 4y agoWell hell, I made the wrong choice at a fork in the road then. If finance is willing to buy a tighter confidence interval based on insight to Mudge’s credibility, then I severely underpriced the potential payout in finance. E-mail is open to those who want tighter intervals re this deal or similar: my new pivot.
- ryandrake 4y agoYea, wow, I had no idea someone would pay that much simply for an ex-employee to spin a bunch of bullshit about their former company or colleague. Incredible! I remember a surreal experience after having left a Silicon Valley tech company. I was contacted over LinkedIn by someone wanting to "do research" about that company. Reading between the lines, he wanted company dirt, secrets, and so on. Having no intention of violating my (very serious) NDA, I declined, but he was insistent and offered to buy me dinner. I figured I could just go, chew my food and not answer questions, so why not get a free meal out of it? We met, I started chowing down, not answering anything, and just treating it like a lovely dinner date. He eventually excused himself to the bathroom, and then disappeared, leaving me with the bill. So, I guess my plan didn't work, but I got a stupid story out of it so I've got that going for me.
- zhxshen 4y agoSome of this digging might not be to discredit Mudge, but to estimate how well his claims will hold up in the crossfire. That would be useful information to some hedgie looking to make a big play on twitter stock (or tesla stock, indirectly).
- danielmarkbruce 4y agoAlmost all of it will be that. The companies looking for the information are all expert networks, where the paying customer is almost always a hedge fund or private equity. There are billions of dollars at stake, of course they are looking for any insight they can get on the guy.
- tpmx 4y ago[flagged]
- icpmacdo 4y agohttps://archive.ph/IOy3u https://archive.ph/IOy3u
- deleted 4y ago[deleted]
- ineptech 4y ago> Zatko told me, “These tactics should be beneath whoever is behind them.” Hahahaha! Probably time to get a padlock for your garbage cans. edit: apparently I should clarify, this was a humorous suggestion that the people who do research for hedge funds will stoop considerably lower than the tactics Mudge was referring to, not a serious suggestion that he actually padlock his garbage cans
- tablespoon 4y ago> Hahahaha! Probably time to get a padlock for your garbage cans. How would that even work? Give the garbageman a key? Probably time to get a shredder, or a firepit, or both.
- fmajid 4y agoDIN 66399 P-5 shredders (1.9x15mm micro-cut) are not that expensive, I paid less than £300 for my HSM Securio C18. Just get the good kind, not the made-in-China junk. The NSA requires P-7, which can still be had for slightly over $1200.
- wrycoder 4y agoWe wore out a commercial shredder on a GOCO proposal. At the end, we hired a kid to stand there and spray it with WD-40 as he fed it.
- sophacles 4y agoThe garbage area at a lot of retail stores is fenced off behind a padlock. Those places live in constant fear of someone making use of their trash for reasons other than making the trash problem worse.
- scottyah 4y agoLots of small businesses have padlocks on their garbage bins to prevent others from filling their (paid)bin. Getting rid of a pickup-truck load of garbage (from a house renovation or something) is actually quite expensive.
- ramraj07 4y agoSnippets from Zatko’s Wikipedia page: > Mudge was responsible for early research into a type of security vulnerability known as the buffer overflow. In 1995 he published "How to Write Buffer Overflows", one of the first papers on the topic. > He was one of the seven L0pht members who testified before a Senate committee in 1998 about the serious vulnerabilities of the Internet at that time. And they say he wasn’t doing a good enough job at a company whose only job is to pass some text back and forth lol. Didn’t the breach happen because some slack channel inside Twitter had the password pinned to the top? https://en.m.wikipedia.org/wiki/Peiter_Zatko https://en.m.wikipedia.org/wiki/Peiter_Zatko
- fmajid 4y agoEr, the (in)famous Robert Tappan Morris worm of 1988 used a buffer overflow. Zatko may be a renowned security expert but he didn't invent the buffer overflow. I'm inclined to believe everything he says about Twitter from my experience implementing Twitter APIs then constantly working around their incessant random breakage.
- stonogo 4y agoNobody claimed he invented the buffer overflow. The claim is that he was one of the first researchers to investigate them. That claim is justified.
- tptacek 4y agoLiterally every "researcher" in 1995 was working on this problem. I was in the room with Mudge at Pumpcon while he was doing the research work for this, with like a dozen other people. All of them were I believe primarily motivated by 8lgm --- that's why Mudge's post uses a contrived syslog(3) example instead of a real bug, because the 8lgm Sendmail exploit was an overflow in syslog(3). It's fine, it's a solid post, it's an early post. But Lopatic and 8lgm set this in motion, and the actual blueprint for this attack was probably splitvt.
- 4y ago
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- th0ma5 4y agoSure does seem like a ton of effort to try to "expose" those trying to stop all the far right influence campaigns.
- fmajid 4y agoAlmost as bad as eBay's campaign of harrassment against David and Ina Steiner. It's long past time for executives to face personal criminal liability for their misdeeds on the company's dime.
- ericbarrett 4y agoStrongly disagree: > Ina and David Steiner say eBay employees tortured them for two years because they posted online reviews about the site. Staffers allegedly sent the couple bizarre items, including a pig Halloween mask, insects and a book on losing a spouse. (Source: https://www.cbsnews.com/boston/news/ebay-lawsuit-cyberstalking-natick-steiner/ https://www.cbsnews.com/boston/news/ebay-lawsuit-cyberstalki...) The oppo research mentioned in the article surely leaves a bad taste in one's mouth, but it's not even in the same league as what the Steiners say they faced. Edit/additional thoughts: Mudge is a well-known executive who held high-profile position in several organizations, and who released very serious accusations about Twitter, where he was an officer of a public company, in the midst of a multi-billion dollar business dispute. Whereas the Steiners were just two of millions of eBay sellers who were allegedly criminally harassed by senior staff for the content of their newsletter (IIRC). So there's also an enormous difference in the relationship between these individuals and the entities opposing them.
- r00fus 4y agoLet's just agree that both are the result of private stalking gone wild. I'd agree the Steiners' eBay harassment was much worse but silencing of any critical voices is definitely in the authoritarian playbook and bad for a functioning society.
- jahewson 4y agoThey do face liability for their own misdeeds. The problem is that “their own” is very hard to isolate.
- deleted 4y ago[deleted]
- fmajid 4y ago> He also said that the company was led by executives willing to cover up the platform’s security issues, including by discouraging Zatko from informing its board of directors about them. (Hahn, the Twitter spokesperson, told me that Zatko’s portrayal of the company was “riddled with inconsistencies and inaccuracies, and lacks important context.”) I'm guessing the missing context is that Twitter's board itself did not want to know (plausible deniability), otherwise they would also become liable for breach of fiduciary duty.
- joe_the_user 4y agoTwitter's board itself did not want to know (plausible deniability) Oh seems plausible and I'd guess Mudge would expect that. And I'd also guess that when making a complaint, you gotta pretend that going through channels is the proper thing only few bad apples will try to stop, IE that everyone involved here isn't implicitly in on the scheme. And I doubt Twitter would raise this explicitly the "lacking context", to say the least.
- smm11 4y agoMusk wants to settle Mars. Twitter is noise.
- Maursault 4y ago> Musk wants to settle Mars. Twitter is noise. I think this is backwards. I think perhaps more accurately Musk wants to make ungodly amounts of money on selling the dream of settling Mars. Mars settlement is a monorail. And I don't think Twitter is just noise. It appears to me that Musk knew exactly what he was doing and got the results he desired, knocking the value of Twitter down 11% for his own personal political and/or narcissistic agendas.
- phendrenad2 4y agoI think Musk wants to make ungodly amounts of money so he can settle Mars.
- lmm 4y agoHe already had ungodly amounts of money before he got involved in SpaceX, which at the time looked far more likely to burn money than make it. I'm no fan of the guy but I do think he's serious about the space stuff.
- Maursault 4y agoLEO is proven; there's a need, thus a market, and the science is sound. Mars, not so much. No need, just dreams for an irresponsible solution to Earth-bound problems that still will need solved. The lack of air on Mars can be solved; we could terraform it, over a long time, create the air needed to support life. The lack of a planetary dynamo and magnetic shield from radiation probably can't be solved. What is the difference between tin cans in LEO using centripetal force for artificial gravity and tin cans on Mars? One is a lot less expensive, and if something goes wrong, there is at the very least a possibility of escape or rescue. Mars is somewhat of a death trap. So no doubt Musk cares about space stuff, which has been profitable for him. I'm just not sure he's really serious about Mars or if it is his version of a reality distortion field. It really looks like a monorail to me.
- encryptluks2 4y agoIf we used Congress hearings and feelings of Republicans as a testament of honesty, then at this point Mudge shares as much credibility as the election being rigged. We have literal breaches of credit reporting agencies storing all your data but this is what Congress wants to focus on. Heck, I saw worse than what Mudge is reporting in actual GovCloud environments involving PHI. Wake me up when people are not so easily manipulated by the news cycle and their self-interests.
- TotoHorner 4y ago
- programmarchy 4y agoI watched the committee hearing, and there didn't seem to be much partisan politicking going on. The primary focus was protecting the privacy of users, which impressed me. However, at one point Lindsey Graham mentioned he and Elizabeth Warren were in agreement enough to start fleshing out some kind of social media operator licensing regime, which sounds terrible.
- unconed 4y agoWhat bothered me the most is that they vaguely referred to Europe's data protection having more teeth, even though the GDPR has all but been neutered via Legitimate Interest. Most GDPR popups now classify "building a personal profile", "serving personalized ads" and "linking multiple devices" as legitimate interest, and they still default it to on, without a clear and equally-visible "No" button next to the "Agree". This is so obviously against the intended spirit of the legislation but it's everywhere. So yeah, large targets like Twitter might need to watch out, but third parties are still harvesting data left and right, so what's the point?
- danielmarkbruce 4y agoThis isn't great reporting. A much simpler explanation is that hedge funds betting on the outcome of the twtr/musk case are trying to understand the situation so they can make bets on the outcome of the deal.
- autoexec 4y agoWith so many people willing to dismiss this kind of prying as simply being hedge funds and nothing to worry about for some reason why wouldn't anyone who really did want to find dirt to discredit a whistleblower take advantage of the situation and join in?
- danielmarkbruce 4y agoYou are right, they might. Good reporting would have shown the obvious motivation and some not so obvious motivations. They could cover who would want to discredit a whistleblower, how that would work practically and so on. It could have been an interesting read.
- dan-robertson 4y agoSeems like they’re asking the wrong people, e.g. https://nitter.fly.dev/igb/status/1569679325359919104 https://nitter.fly.dev/igb/status/1569679325359919104 https://nitter.fly.dev/search?f=tweets&q=from%3A%40igb+mudge+OR+%40dotMudge&since=&until=&near= https://nitter.fly.dev/search?f=tweets&q=from%3A%40igb+mudge... (Direct Twitter links: https://twitter.com/igb/status/1569679325359919104 https://twitter.com/igb/status/1569679325359919104 https://twitter.com/search?f=tweets&q=from%3A%40igb+mudge+OR+%40dotMudge&since=&until=&near= https://twitter.com/search?f=tweets&q=from%3A%40igb+mudge+OR... ) The basic claim (from someone I understand was reasonably senior and worked reasonably closely to Mudge) is basically that the guy was not good for Twitter security and so to a great extent his whistleblower complaint is ‘Twitter put me in charge of security which was highly negligent of them’ eg https://nitter.fly.dev/igb/status/1562087069391785984 https://nitter.fly.dev/igb/status/1562087069391785984
- remote_phone 4y agoMeh. There’s no indication that those Twitter accounts are of people who are any better or worse. I’ll take mudge’s reputation over two unknowns whose motivations are unknown.
- londons_explore 4y agoMudge developed password cracking tools.... It seems likely that when he was starting out as a security researcher he did some more "legally shady" things... and I'm sure someone out there is willing to share information about that for enough money... His only hope is that computers in the 80's/90's were typically far less interconnected, and any records of mudge's hacking may have been lost to history.
- 1letterunixname 4y agoThe only political move left is a political move: shout and point "HaCkER! HaCkEr!" Maybe if The Donald did it, it would sway some of the ignorati.
- Test0129 4y agoI always questioned his openness to share his handle considering his association with cDc. But I guess there is enough plausible deniability, or his utility is so great, that people will look past it. I doubt anyone would be shocked a hacker was involved in "legally shady" things. If they want dirt they're probably going to be looking for other things of a more personal nature.
- nibbleshifter 4y agoNone of the cDc people really have done anything "interesting" (actually in violation of the CFAA) in well over 20, maybe close to 30 years. Its a whitehat larp gang that somehow retains the trappings of the scene, much like many other groups.
- nibbleshifter 4y agoThere's nothing shady about writing or publishing security tools. Also, by that point he had long since sold out and largely left the scene behind.
- londons_explore 4y agoNo, but I'm suggesting that when starting out writing password cracking tools he or his friends might have been testing those tools on computers that they perhaps shouldn't have been...
- Thoreandan 4y agoDigging for dirt. On Mudge. Apparently they forgot that he is the one who port-knocks.
- quesera 4y agoBack in the 80s and early 90s, we didn't wear hats. And if we had, exactly zero of them would have been white. It was basically impossible to be a security "researcher" in that era by following all the rules. Many of the laws didn't exist yet, but lines were grey at best, and everyone knew it. That said, Mudge has been an upright player in the industry since at least the BBN days (1995?). He was one of the first to see that cred in the scene is worth $0, but cred in the industry is worth a whole lot more. Searching for dirt on Mudge is like talking to a 60 year old politician's high school friends to find out that they trespassed and smoked some pot when they were 15. If you honestly care about that dirt, it says much more about you than it does about them.
- 1letterunixname 4y agoYep. L0pht heavy industries / @stake / PwC / Symantec / IBM made a boat-load there. I'm not sure anyone is going to find much dirt on, or discredit, Mudge. He worked for the Whitehouse.
- zimpenfish 4y ago> I'm not sure anyone is going to find much dirt on, or discredit, [someone who] worked for the Whitehouse. gestures vaguely at 2016-20 and the various characters who worked for the Whitehouse
- nibbleshifter 4y agoIndeed - he was one of the OG sellouts. Don't disrespect him for selling out though, he was honest about it, unlike many that followed who tried keep a foot in each camp.
- 1vuio0pswjnm7 4y agoA bit shocked that the top comment is an archive.ph URL. www.newyorker.com articles have looked perfect in a Javascript-free text-only browser (links) for nearly 15 years. Heck, I even tested this article in a popular graphical browser with Javascript disabled. Looks fine. The only domains required are www.newyoker.com and media.newyorker.com. The high cost of always-on Javascript and always-on cookies these days is astounding. Either that or folks really love archive.ph for some reason.^1 1. https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today The site gets blocked in certain countries. It appears the operator uses Cloudflare "bot" protection, too, in an attempt to force users to enable Javascript. The archive.ph URL is archived at archive.org where one can see the Cloudflare interstitial requiring the user to enable Javascript and solve a CAPTCHA https://web.archive.org/web/20220913183704if_/https://archive.ph/IOy3u https://web.archive.org/web/20220913183704if_/https://archiv...
- ev1 4y agoThey don't, it's a page that's intended to look like cloudflare for ... unknown reasons? They do a lot of other very suspicious things to users.
- nr2x 4y agoNo biggie, I’ve done stuff for GLG before. It’s just bankers who want to talk to people who know stuff. Good pay.
- neilv 4y agoWhat are all the motives here? One category would be to acquire information -- uses of which include predicting business outcomes of legal proceedings, and affecting legal proceedings by discrediting a witness. Could another category be to intimidate a whistleblower? Presumably, if you blanket the whistleblower's colleagues with requests for info/dirt about them, the witness is going to hear about that. Presumably they're going to feel threatened, by the fact of powerful interests not even hiding that they're out to get the whistleblower. Separate from intent, an additional possible effect is adding to the cumulative chilling effect on whistleblowers in general. We keep learning, from news and TV/movie fiction, that whistleblowers usually lose big.
- autoexec 4y ago> We keep learning, from news and TV/movie fiction, that whistleblowers usually lose big. Even when they do, the public is usually better off after knowing the truth. Whistleblowing isn't something most people do to for personal gain (although some suspect this one might be). I think most whistleblowers expect that at least some sacrifice will be required if they come forward.
- rwmj 4y agoIt's just a bunch of hedge funds trying to bet on the outcome of the case, nothing more nothing less. Paying $1000/hour is small change compared to billions in bets on stock prices. Honestly while it's a little bit scummy I don't think there's anything especially wrong with what these research companies are doing.
- arunprakash01 4y ago[dead]
- b3lvedere 4y ago"What I didn’t expect and find so disappointing are the anonymously sourced ad-hominem attacks" Did he really think people would play fair?