12 ms·

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical oblig

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of normal people with whoever can plead a case.

calvinmorrison 4y ago
Yeah cause we should totally have a top secret no fly list
- ericpauley 4y ago
  Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.
  - calvinmorrison 4y ago
    Top secret stazi lists should absolutely be shared. It's why we have 'we have right to know' laws, so the government can't just lock people up in a jail and disappear them.
    - ben_w 4y ago
      While this is true, it is also true that many people think "where there's smoke, there's fire". Or, to put it another way, governments can make people disappear by publishing such lists and having the police be busy somewhere else when a mob happens.
    - subroutine 4y ago
      If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? This seems more likely to be used as a form of public shaming than a way to expose injustice.
      - lmm 4y ago
        > If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? How would they know? How would they prove it? There's a known case a few years ago where a woman was trapped away from the US for 3 years - her estranged husband put her on the list when she went to visit her parents, and boom, she's not allowed into the US and no-one will tell her why, making it easy for him to get divorced and keep the house. (If she'd known what had happened, and been able to put her hands on enough money, she could maybe have flown to Canada/Mexico and entered overland; all she knew was she was denied boarding)
        IAmGraydon 4y ago
        >There's a known case a few years ago where a woman was trapped away from the US for 3 years - her estranged husband put her on the list when she went to visit her parents, and boom, she's not allowed into the US and no-one will tell her why, making it easy for him to get divorced and keep the house. How does one "put her on the list"? It's not that easy.
        lmm 4y ago
        Apparently if you happen to be working in the right government department then it is. It was only discovered when he applied for a promotion and they did an extended background check.
        AngriestLettuce 4y ago
        Just because things should work a certain way doesn't mean they do.
        gggggg5 4y ago
        You can almost certainly get anyone put on this list by simply creating an email account like firstname.lastname@protonmail.com and sending out a few threatening emails to the right places.
      - anigbrowl 4y ago
        It's not like the federal government sends you a letter to tell you about it and what to do if you have an issue with it. While you raise a valid concern, I think it's a lot more likely to function as the basis of a class action suit - a sufficiently plausible and timely piece of evidence that would move a court to compel proper discovery.
    - jeffchien 4y ago
      I think you may not be reading the parent comment correctly. They're saying that those on the list have a right to privacy, therefore outright leaking the list is wrong. Being able to find out whether or not you are on the list is not incompatible with maintaining others' right to privacy.
      - calvinmorrison 4y ago
        I am reading it correctly. They do not have a right to privacy, because we all have the right to know who the government is keeping on lists. Regardless the line of thinking reeks with hypocrisy - the government of the United States has been doing nothing but trampling privacy, yet when it comes to top secret government surveillance state programmes they hold it close to their chests
        jeffchien 4y ago
        I don't understand your reasoning. To me, you seem to be saying that since the state violated everyone's privacy, the general public now has the right to violate these individuals' privacy even further to get back at the state. Publishing the list as-is would also imply that you believe the state is infallible and can't err when putting people on this list. There are thousands of people out there who have redress numbers because they have the same name as someone on the list. Can you imagine if getting a redress number is necessary for employment? Leaking the list would ironically increase the state's control. (edit: Again, I'm not disagreeing with letting individuals find out if they themselves are on the list, just disagreeing with the method)
        berkle4455 4y ago
        > They do not have a right to privacy What the fuck is wrong with you? Do you understand the repercussions of it being found someone is on a no-fly list (because we all know the US government makes mistakes).
      - landemva 4y ago
        > those on the list have a right to privacy, therefore outright leaking Those Americans on list have a right to question their accuser in court before a right (to travel) is restricted. When did we agree to suspend due process, 14th amendment?
    - dclowd9901 4y ago
      And then, what, some hapless person on there gets doxxed and some red neck asshole rolls up on their house and shoots them cause ‘Merica? After 9/11 we had these idiots killing brown people left and right just because “they could be terrorists.” Don’t be so naive. Lists of people are almost inherently dangerous things. I don’t like that a no-fly list exists in the first place but it would be completely irresponsible to just publish it and wash your hands of it.
  - _yb2s 4y ago
    I think the intention here is to leak the list to a journalist, that will report on it's contents, but still not leak the list publicly.
  - mempko 4y ago
    What are you talking about? The list is literally designed to harm those people. It's a no-fly-list. If anything, having it public could provide public pressure to get them off the list.
  - BeFlatXIII 4y ago
    It also provides proof to the victims that they were on it. It may not bring justice from the same government that put them there in the first place, but spreading their stories may (hopefully) reduce its legitimacy and revoke the consent of the governed.
- steve_adams_86 4y ago
  Though I don’t like the idea of it, I’m also not certain that I know better than people whose careers are in national defence. I’m not convinced that it’s a black and white thing. There are bad actors out there, and sometimes it’s clearly advantageous to hide information from them, which means hiding it from everyone. Maybe there are reasons this is short sighted or I’m missing a greater point. I’d be interested to hear ideas in any case.
- deleted 4y ago
  [deleted]
_yb2s 4y ago
Am I missing something? It seems Maia didn't share the data at all, and only offers to if someone can demonstrate they will use it responsibly. Moreover, depending on the contents of the list, this likely offers proof of what is generally suspected, that the no fly list is a form of discrimination and authoritarian overreach, targeting people that haven't been convicted of a crime but are "suspected" due to race, religion, etc. The whole thing is probably unconstitutional/illegal, but it's hard to prove that since it's been secret. This seems like a clear case of hacktivism- trying to expose an unethical government program for what it is, so that it can be stopped.
- toss1 4y ago
  >>demonstrate they will use it responsibly. The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this. Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum... [EDIT: pronouns]
  - Rhinozz 4y ago
    >>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... ...and it has a Wikipedia article (https://en.wikipedia.org/wiki/maia_arson_crimew https://en.wikipedia.org/wiki/maia_arson_crimew), and has demonstrated in other cases (cf. https://www.dailydot.com/debug/feelyou-mental-health-app-data-leak/ https://www.dailydot.com/debug/feelyou-mental-health-app-dat...) that it has at least a reasonable grasp on what to leak and what not to leak.
    - toss1 4y ago
      Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...
infoseek12 4y ago
And incidentally some of it is entirely illegal but sense she is already facing extradition for a federal indictment - in for a penny, in for a pound.
- deleted 4y ago
  [deleted]
WatchDog 4y ago
Seems to making it's prosecutors jobs really easy, by incriminating itself.
- ripdog 4y ago
  Perhaps this is just my autism speaking, but am I the only one who gets completely freaked out by sentences like the above? "It" refers to inanimate objects, things which can't have free will, do crimes, or be prosecuted. It's almost like you're talking about how a lawnmower decided to run a child over and then incriminate itself by boasting about it on social media. It makes no sense! I know she picked that pronoun herself, but I really wish she didn't. It just makes communication difficult.
  - driverdan 4y ago
    [flagged]
    - ripdog 4y ago
      I find it particularly amusing that you used the wrong pronoun while scolding me to use the correct pronouns for her. If that doesn't prove the impracticality of using "it" as a pronoun, I don't know what does. It breaks the rules of English that we all understand subconsciously, so it's difficult to do without consciously thinking about every single usage of a pronoun in a sentence, which is not how most people type.
      - driverdan 4y ago
        I use the word "they" in that context all the time regardless of gender or pronoun. I actually thought about that before using it. It's a common use of the word "they" in casual English.
        Jerrrry 4y ago
        And most people use "he/she," point being, "you" should of called "it" "it" instead of "they" during "your" own "self"-righteous quip.
driverdan 4y ago
You have it backwards. Ethical obligations mean unethical things like government blacklists should be leaked in their entirety.
Miner49er 4y ago
Maybe I missed it, but what data of normal people was stolen?
- Rebelgecko 4y ago
  >full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more
dclowd9901 4y ago
Hacker is anti-capitalist (cool), so I’m not sure they’re concerned with what hat they’re wearing in the endeavor. Graciously, though, they’re at least feigning caution with handing out the no-fly list.
deleted 4y ago
[deleted]
this_steve_j 4y ago
Hard agree here, with a qualifier. Breaking into private S3 buckets because you are bored is not considered an appropriate “Step 1” by the _professional community_ (people who get paid to do this for a living) at large. Among people who plan to be financially rewarded for their work and also not be in handcuffs, Step 1 is usually to “Get written permission”.

calvinmorrison 4y ago

Yeah cause we should totally have a top secret no fly list

ericpauley 4y ago
Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.
- calvinmorrison 4y ago
  Top secret stazi lists should absolutely be shared. It's why we have 'we have right to know' laws, so the government can't just lock people up in a jail and disappear them.
  - ben_w 4y ago
    While this is true, it is also true that many people think "where there's smoke, there's fire". Or, to put it another way, governments can make people disappear by publishing such lists and having the police be busy somewhere else when a mob happens.
  - subroutine 4y ago
    If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? This seems more likely to be used as a form of public shaming than a way to expose injustice.
    - lmm 4y ago
      > If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? How would they know? How would they prove it? There's a known case a few years ago where a woman was trapped away from the US for 3 years - her estranged husband put her on the list when she went to visit her parents, and boom, she's not allowed into the US and no-one will tell her why, making it easy for him to get divorced and keep the house. (If she'd known what had happened, and been able to put her hands on enough money, she could maybe have flown to Canada/Mexico and entered overland; all she knew was she was denied boarding)
      - IAmGraydon 4y ago
        >There's a known case a few years ago where a woman was trapped away from the US for 3 years - her estranged husband put her on the list when she went to visit her parents, and boom, she's not allowed into the US and no-one will tell her why, making it easy for him to get divorced and keep the house. How does one "put her on the list"? It's not that easy.
        lmm 4y ago
        Apparently if you happen to be working in the right government department then it is. It was only discovered when he applied for a promotion and they did an extended background check.
        AngriestLettuce 4y ago
        Just because things should work a certain way doesn't mean they do.
        gggggg5 4y ago
        You can almost certainly get anyone put on this list by simply creating an email account like firstname.lastname@protonmail.com and sending out a few threatening emails to the right places.
    - anigbrowl 4y ago
      It's not like the federal government sends you a letter to tell you about it and what to do if you have an issue with it. While you raise a valid concern, I think it's a lot more likely to function as the basis of a class action suit - a sufficiently plausible and timely piece of evidence that would move a court to compel proper discovery.
  - jeffchien 4y ago
    I think you may not be reading the parent comment correctly. They're saying that those on the list have a right to privacy, therefore outright leaking the list is wrong. Being able to find out whether or not you are on the list is not incompatible with maintaining others' right to privacy.
    - calvinmorrison 4y ago
      I am reading it correctly. They do not have a right to privacy, because we all have the right to know who the government is keeping on lists. Regardless the line of thinking reeks with hypocrisy - the government of the United States has been doing nothing but trampling privacy, yet when it comes to top secret government surveillance state programmes they hold it close to their chests
      - jeffchien 4y ago
        I don't understand your reasoning. To me, you seem to be saying that since the state violated everyone's privacy, the general public now has the right to violate these individuals' privacy even further to get back at the state. Publishing the list as-is would also imply that you believe the state is infallible and can't err when putting people on this list. There are thousands of people out there who have redress numbers because they have the same name as someone on the list. Can you imagine if getting a redress number is necessary for employment? Leaking the list would ironically increase the state's control. (edit: Again, I'm not disagreeing with letting individuals find out if they themselves are on the list, just disagreeing with the method)
      - berkle4455 4y ago
        > They do not have a right to privacy What the fuck is wrong with you? Do you understand the repercussions of it being found someone is on a no-fly list (because we all know the US government makes mistakes).
    - landemva 4y ago
      > those on the list have a right to privacy, therefore outright leaking Those Americans on list have a right to question their accuser in court before a right (to travel) is restricted. When did we agree to suspend due process, 14th amendment?
  - dclowd9901 4y ago
    And then, what, some hapless person on there gets doxxed and some red neck asshole rolls up on their house and shoots them cause ‘Merica? After 9/11 we had these idiots killing brown people left and right just because “they could be terrorists.” Don’t be so naive. Lists of people are almost inherently dangerous things. I don’t like that a no-fly list exists in the first place but it would be completely irresponsible to just publish it and wash your hands of it.
- _yb2s 4y ago
  I think the intention here is to leak the list to a journalist, that will report on it's contents, but still not leak the list publicly.
- mempko 4y ago
  What are you talking about? The list is literally designed to harm those people. It's a no-fly-list. If anything, having it public could provide public pressure to get them off the list.
- BeFlatXIII 4y ago
  It also provides proof to the victims that they were on it. It may not bring justice from the same government that put them there in the first place, but spreading their stories may (hopefully) reduce its legitimacy and revoke the consent of the governed.
steve_adams_86 4y ago
Though I don’t like the idea of it, I’m also not certain that I know better than people whose careers are in national defence. I’m not convinced that it’s a black and white thing. There are bad actors out there, and sometimes it’s clearly advantageous to hide information from them, which means hiding it from everyone. Maybe there are reasons this is short sighted or I’m missing a greater point. I’d be interested to hear ideas in any case.
deleted 4y ago
[deleted]

_yb2s 4y ago

Am I missing something? It seems Maia didn't share the data at all, and only offers to if someone can demonstrate they will use it responsibly. Moreover, depending on the contents of the list, this likely offers proof of what is generally suspected, that the no fly list is a form of discrimination and authoritarian overreach, targeting people that haven't been convicted of a crime but are "suspected" due to race, religion, etc. The whole thing is probably unconstitutional/illegal, but it's hard to prove that since it's been secret. This seems like a clear case of hacktivism- trying to expose an unethical government program for what it is, so that it can be stopped.

toss1 4y ago
>>demonstrate they will use it responsibly. The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this. Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum... [EDIT: pronouns]
- Rhinozz 4y ago
  >>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... ...and it has a Wikipedia article (https://en.wikipedia.org/wiki/maia_arson_crimew https://en.wikipedia.org/wiki/maia_arson_crimew), and has demonstrated in other cases (cf. https://www.dailydot.com/debug/feelyou-mental-health-app-data-leak/ https://www.dailydot.com/debug/feelyou-mental-health-app-dat...) that it has at least a reasonable grasp on what to leak and what not to leak.
  - toss1 4y ago
    Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...

infoseek12 4y ago

And incidentally some of it is entirely illegal but sense she is already facing extradition for a federal indictment - in for a penny, in for a pound.

deleted 4y ago
[deleted]

WatchDog 4y ago

Seems to making it's prosecutors jobs really easy, by incriminating itself.

ripdog 4y ago
Perhaps this is just my autism speaking, but am I the only one who gets completely freaked out by sentences like the above? "It" refers to inanimate objects, things which can't have free will, do crimes, or be prosecuted. It's almost like you're talking about how a lawnmower decided to run a child over and then incriminate itself by boasting about it on social media. It makes no sense! I know she picked that pronoun herself, but I really wish she didn't. It just makes communication difficult.
- driverdan 4y ago
  [flagged]
  - ripdog 4y ago
    I find it particularly amusing that you used the wrong pronoun while scolding me to use the correct pronouns for her. If that doesn't prove the impracticality of using "it" as a pronoun, I don't know what does. It breaks the rules of English that we all understand subconsciously, so it's difficult to do without consciously thinking about every single usage of a pronoun in a sentence, which is not how most people type.
    - driverdan 4y ago
      I use the word "they" in that context all the time regardless of gender or pronoun. I actually thought about that before using it. It's a common use of the word "they" in casual English.
      - Jerrrry 4y ago
        And most people use "he/she," point being, "you" should of called "it" "it" instead of "they" during "your" own "self"-righteous quip.

driverdan 4y ago

You have it backwards. Ethical obligations mean unethical things like government blacklists should be leaked in their entirety.

Miner49er 4y ago

Maybe I missed it, but what data of normal people was stolen?

Rebelgecko 4y ago
>full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more

dclowd9901 4y ago

Hacker is anti-capitalist (cool), so I’m not sure they’re concerned with what hat they’re wearing in the endeavor. Graciously, though, they’re at least feigning caution with handing out the no-fly list.

deleted 4y ago

[deleted]

this_steve_j 4y ago

Hard agree here, with a qualifier. Breaking into private S3 buckets because you are bored is not considered an appropriate “Step 1” by the _professional community_ (people who get paid to do this for a living) at large. Among people who plan to be financially rewarded for their work and also not be in handcuffs, Step 1 is usually to “Get written permission”.