8 ms·

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone. That's quite a feat. > Rockstar Games

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone. That's quite a feat. > Rockstar Games alone told the court that the hack cost it $5m to recover from plus thousands of hours of staff time. Either the kid is a genius or Rockstar really don't value their security much. Or maybe a bit of both?

jvanderbot 3y ago
From TFA, and given prior hacks, he's very skilled.
- imglorp 3y ago
  Someone should hire him as a white hat. Maybe they have some kind of custodial guardianship where the employer can monitor him staying clean.
  - ungamedplayer 3y ago
    No company will do this because you can hire competent, non violent white hat hackers that don't need monitoring.
  - CaptainOfCoit 3y ago
    It's tough though, how do you know that they won't use those skills against you? The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can. Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well. Hopefully this story will have a somewhat happy ending, because it seems to not end yet.
    - Freak_NL 3y ago
      He'd need a dedicated handler, and even then judging from the article's portrayal he seems like a hopelessly unmanageable type. He'd fit in with a modern-day A-team, come to think of it.
      - lamontcg 3y ago
        Could set him to work on hacking official state enemies, but you'd have to expect that he'd still engage in side-projects against whoever pissed him off or he had contempt for.
    - chris_wot 3y ago
      It’s not going to happen. He’s going to be closely supervised in a hospital indefinitely.
    - RecycledEle 3y ago
      > The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can. Admitting you will continue to fight evil is not evil.
  - s1artibartfast 3y ago
    That would be interested, but is impossible as long as they refuse to avoid crime and state that they plan to commit more at the first opportunity
  - make3 3y ago
    That wouldn't work, you could never trust him at all, as he's expressed zero remorse and actually intent to continue to do crime, and is apparently very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable as a white hat hacker
    - hnbad 3y ago
      > very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary. Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
      - make3 3y ago
        >>> The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to. This is exactly what I was referring to. We agree.
      - RecycledEle 3y ago
        > Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to. Very true.
  - hnbad 3y ago
    Having seen that play out in real life before, I don't think he'd be as much of an asset as a liability. The problem with white hats is they need to have an interest in following some set of rules. With this guy it sounds more like his rule set is defined by whatever he finds interesting with little concern for legality or what others might find acceptable. It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.
    - throwaway5959 3y ago
      I’ve seen the opposite, the worthless manager, way more than the asshole genius.
      - hnbad 3y ago
        To be fair, there are very few actual geniuses and a lot more unremarkable assholes.
  - drivingmenuts 3y ago
    How about the British intelligence apparatus? Seems like a person they would be very interested in acquiring.
    - arp242 3y ago
      Also seems like the sort of person who would leak everything, and not just for some principled whistleblower reasons, but "for teh lulz" or whatever. Trust is more important than ability.
  - RecycledEle 3y ago
    Maybe the only thing more dangerous than holding someone in a "hospital" as a sentence is to allow an employer to decide if they should be allowed out or sent back to serve their life sentence. It's just as bad as H-1 visas, or allowing illegal aliens into the USA with babies who are not given US citizenship. (I am not taking sides on whether we should give US citizenship to those people, deport them, or what. I am pointing out that making someone the slave of their employer is bad for society.)
- squarefoot 3y ago
  And has no empathy, which makes him a lot more dangerous.
  - aszantu 3y ago
    autism doesn't mean he doesn't have emotions
    - 6stringmerc 3y ago
      A valid diagnosis of one condition doesn’t preclude a litany of seriously dangerous other ones, either, correct?
      - rainonmoon 3y ago
        You might as well say "He has psoriasis, he might also be an axe murderer." No, one fact doesn't preclude the existence of other facts, very good. That doesn't mean that making stigmatising connections is reasonable.
        Dx5IQ 3y ago
        There was no connection made, GP merely pointed out their observation based on what he has done so far
        candiodari 3y ago
        He's a kid that "found" some pictures of an upcoming game, using dodgy means. But these pictures were publicly accessible, he didn't deceive an actual human to get them. Making them hidden, but public was a mistake by the company. The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence) During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places. But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...) A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral). I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do. Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.
- deleted 3y ago
  [deleted]
- DoItToMe81 3y ago
  Each hack was going into a company Slack server and saying "hell o i am the admin gibe me password". I'm not impressed.
  - jvanderbot 3y ago
    Personally, I think that a skilled exploiter is the one who finds such an easy loophole and exploits it efficiently and first; not the one who writes the most impressive code or finds the deepest algorithmic backdoor. I respect social engineering as much as anything when it comes to this domain.
gdsdfe 3y ago
shouldn't they at least try to use this kid for good instead of locking him up ? but then who know maybe a 3 letter gov agency will take him to a bunker somewhere
- dharmab 3y ago
  He's violent and uncooperative: > The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage. The TLA aren't hurting for talent these days either.
- Cthulhu_ 3y ago
  "Use" implies control / coercion, given that this guy doesn't seem to respect authority, that's not going to work. You can't make anyone work for you or "do good".
  - getwiththeprog 3y ago
    Conversely, it seems pretty easy to pay people to do bad things.
  - gdsdfe 3y ago
    They have lions in zoos and circus for decades, just saying
Nextgrid 3y ago
> That's quite a feat. Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device? The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access. I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.
- hdjrbrbn 3y ago
  To be fair: it is hard to not be around internet connected devices now
- 6stringmerc 3y ago
  This is a really great angle and perspective to add in - I agree a noted habit / trend / short-hand in “severity” sometimes with technical subjects. I read through and also have heard some similar routine prep stories. Unusual? Absolutely! Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are. So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?
  - h0l0cube 3y ago
    > Add that in with, reportedly a physical violence time in life Throwing an autistic person into prison will do that. The child abuse that autistic people often receive in their childhood will do that > the persistent threat maybe can heal out of it? Or maybe just give them a job instead of throwing them in a padded cell for life?
    - 3y ago
kazinator 3y ago
An genius would not only pull of the heist but get away with it. There is no physical evidence: DNA, fingerprints.
HackeNewsFan234 3y ago
If he didn't have a keyboard and typed on his phone like I do, they could also say that he "hacked them using only his thumbs".

jvanderbot 3y ago

From TFA, and given prior hacks, he's very skilled.

imglorp 3y ago
Someone should hire him as a white hat. Maybe they have some kind of custodial guardianship where the employer can monitor him staying clean.
- ungamedplayer 3y ago
  No company will do this because you can hire competent, non violent white hat hackers that don't need monitoring.
- CaptainOfCoit 3y ago
  It's tough though, how do you know that they won't use those skills against you? The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can. Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well. Hopefully this story will have a somewhat happy ending, because it seems to not end yet.
  - Freak_NL 3y ago
    He'd need a dedicated handler, and even then judging from the article's portrayal he seems like a hopelessly unmanageable type. He'd fit in with a modern-day A-team, come to think of it.
    - lamontcg 3y ago
      Could set him to work on hacking official state enemies, but you'd have to expect that he'd still engage in side-projects against whoever pissed him off or he had contempt for.
  - chris_wot 3y ago
    It’s not going to happen. He’s going to be closely supervised in a hospital indefinitely.
  - RecycledEle 3y ago
    > The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can. Admitting you will continue to fight evil is not evil.
- s1artibartfast 3y ago
  That would be interested, but is impossible as long as they refuse to avoid crime and state that they plan to commit more at the first opportunity
- make3 3y ago
  That wouldn't work, you could never trust him at all, as he's expressed zero remorse and actually intent to continue to do crime, and is apparently very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable as a white hat hacker
  - hnbad 3y ago
    > very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary. Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
    - make3 3y ago
      >>> The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to. This is exactly what I was referring to. We agree.
    - RecycledEle 3y ago
      > Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to. Very true.
- hnbad 3y ago
  Having seen that play out in real life before, I don't think he'd be as much of an asset as a liability. The problem with white hats is they need to have an interest in following some set of rules. With this guy it sounds more like his rule set is defined by whatever he finds interesting with little concern for legality or what others might find acceptable. It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.
  - throwaway5959 3y ago
    I’ve seen the opposite, the worthless manager, way more than the asshole genius.
    - hnbad 3y ago
      To be fair, there are very few actual geniuses and a lot more unremarkable assholes.
- drivingmenuts 3y ago
  How about the British intelligence apparatus? Seems like a person they would be very interested in acquiring.
  - arp242 3y ago
    Also seems like the sort of person who would leak everything, and not just for some principled whistleblower reasons, but "for teh lulz" or whatever. Trust is more important than ability.
- RecycledEle 3y ago
  Maybe the only thing more dangerous than holding someone in a "hospital" as a sentence is to allow an employer to decide if they should be allowed out or sent back to serve their life sentence. It's just as bad as H-1 visas, or allowing illegal aliens into the USA with babies who are not given US citizenship. (I am not taking sides on whether we should give US citizenship to those people, deport them, or what. I am pointing out that making someone the slave of their employer is bad for society.)
squarefoot 3y ago
And has no empathy, which makes him a lot more dangerous.
- aszantu 3y ago
  autism doesn't mean he doesn't have emotions
  - 6stringmerc 3y ago
    A valid diagnosis of one condition doesn’t preclude a litany of seriously dangerous other ones, either, correct?
    - rainonmoon 3y ago
      You might as well say "He has psoriasis, he might also be an axe murderer." No, one fact doesn't preclude the existence of other facts, very good. That doesn't mean that making stigmatising connections is reasonable.
      - Dx5IQ 3y ago
        There was no connection made, GP merely pointed out their observation based on what he has done so far
        candiodari 3y ago
        He's a kid that "found" some pictures of an upcoming game, using dodgy means. But these pictures were publicly accessible, he didn't deceive an actual human to get them. Making them hidden, but public was a mistake by the company. The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence) During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places. But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...) A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral). I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do. Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.
deleted 3y ago
[deleted]
DoItToMe81 3y ago
Each hack was going into a company Slack server and saying "hell o i am the admin gibe me password". I'm not impressed.
- jvanderbot 3y ago
  Personally, I think that a skilled exploiter is the one who finds such an easy loophole and exploits it efficiently and first; not the one who writes the most impressive code or finds the deepest algorithmic backdoor. I respect social engineering as much as anything when it comes to this domain.

gdsdfe 3y ago

shouldn't they at least try to use this kid for good instead of locking him up ? but then who know maybe a 3 letter gov agency will take him to a bunker somewhere

dharmab 3y ago
He's violent and uncooperative: > The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage. The TLA aren't hurting for talent these days either.
Cthulhu_ 3y ago
"Use" implies control / coercion, given that this guy doesn't seem to respect authority, that's not going to work. You can't make anyone work for you or "do good".
- getwiththeprog 3y ago
  Conversely, it seems pretty easy to pay people to do bad things.
- gdsdfe 3y ago
  They have lions in zoos and circus for decades, just saying

Nextgrid 3y ago

> That's quite a feat. Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device? The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access. I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.

hdjrbrbn 3y ago
To be fair: it is hard to not be around internet connected devices now
6stringmerc 3y ago
This is a really great angle and perspective to add in - I agree a noted habit / trend / short-hand in “severity” sometimes with technical subjects. I read through and also have heard some similar routine prep stories. Unusual? Absolutely! Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are. So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?
- h0l0cube 3y ago
  > Add that in with, reportedly a physical violence time in life Throwing an autistic person into prison will do that. The child abuse that autistic people often receive in their childhood will do that > the persistent threat maybe can heal out of it? Or maybe just give them a job instead of throwing them in a padded cell for life?
  - 3y ago

kazinator 3y ago

An genius would not only pull of the heist but get away with it. There is no physical evidence: DNA, fingerprints.

HackeNewsFan234 3y ago

If he didn't have a keyboard and typed on his phone like I do, they could also say that he "hacked them using only his thumbs".