6 ms·

You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a

by aftbit 2y ago

You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail.

beaglesss 2y ago
What if they incremented a number in a url on a publicly available website?
- debo_ 2y ago
  Is this a reference to a past event? I don't get it.
  - deleted 2y ago
    [deleted]
  - hyperhello 2y ago
    It's an incredibly basic form of pen testing. For example, this reply page URL refers to id=41393364, which is presumably your comment. So what happens if I replace it with a different number? Probably something innocent, but maybe not.
    - deleted 2y ago
      [deleted]
  - qup 2y ago
    Yes. https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may_be_going_to_prison_under_the/ https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_ma...
    - bjoli 2y ago
      Jeez, I just read about him. Was he the first who went down the alt right pipeline? What happened there? From goatse security to the Daily Stormer.
  - beaglesss 2y ago
    In part yes but inevitably devolves into an ad hominem attack against the most high profile case of a guy who did it, who is now hiding in Ukraine on a Prednistrovian passport after having his conviction overturned (temporarily) giving him an escape window.
    - fnfjfk 2y ago
      > hiding in Ukraine Huh. Uh, weird choice, given, well, you know…
      - bjoli 2y ago
        Before he spent some time in Transnistria as well, which is also a weird choice.
        beaglesss 2y ago
        It's an excellent choice IMO from his perspective. They grant citizenship after 1 year with not a lot of questions and have a cash economy. And they don't extradite to the US.
        jojobas 2y ago
        They'll also not above confiscating your cash and killing you if its suits them. Or (before the war) they wouldn't think twice to send you to Russia to be used as a bargaining chip.
        beaglesss 2y ago
        Weev is effectively banned from the banking system. The list of places with enough infrastructure to survive as a hacker, without foreign citizenship and in a cash/crypto economy with no extradition treaty is thin. I'm sure Transnistria might do that but apparently it wasn't worth their time to kill him. Seems better than North Korea, Iran, or the bush of Africa.
      - 2y ago
  - debo_ 2y ago
    Thanks for all the references / replies, folks. I appreciate it.
  - mmsc 2y ago
    Another one from Australia from over a decade ago: https://amp.smh.com.au/technology/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html https://amp.smh.com.au/technology/super-bad-first-state-set-...
- aftbit 2y ago
  Yeah I wouldn't have convicted weev either. There is a difference though. He used that incremented number to access actual user PII. These guys created a user with no PII and no actual malicious use.
  - rawling 2y ago
    It looks like they got access to a list of names of existing users.
mrguyorama 2y ago
>You're not wrong, but I would have a hard time as a jury member Which is why Jury selection usually removes people who understand the situation.
IshKebab 2y ago
Yeah so best case you spend tens of thousands on lawyers and probably win. Doing this under your own name is insane.
- aftbit 2y ago
  Best case, assuming you even get charged, your case gets picked up by the EFF, ACLU, IFJ, etc. You spend nothing, you win, and you get a lot of free publicity for your pen testing company. Worst case, nobody comes to help you, you spend all of your money, still lose the case, end up in a shitty US prison, and get stabbed in the shower by some guy driven crazy by spending months in solitary. Personally, I would not mess with security research on anything even distantly related to US Gov.
smsm42 2y ago
That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest". The jury won't be from the HN crowd, it would be random people who don't know anything about CFAA or computer systems, it will be the easiest thing in the world to convict. Those guys got so lucky DHS exhibited unusually sensible behavior, they could have ruined their lives.
- ruthmarx 2y ago
  > That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest". The only real protection is the fact that you can vote whatever way you want and not even a judge can compel you to state your reasoning.
- mariodiana 2y ago
  As my good fortune would have it, I'm called to jury duty two weeks from now. I doubt I'll be sat though. Should I be, I'll keep the above in mind.
  - linuxftw 2y ago
    If it's a criminal case, be sure to checkout the innocence project to inform yourself on some of the junk science police and prosecutors like to use.
  - SpaceNoodled 2y ago
    They tend to specifically choose against people with critical thinking skills.
    - Spivak 2y ago
RHSeeger 2y ago
But would it really matter if they were convicted, after being in jail for who knows how long awaiting trial, losing their job, etc?
newscracker 2y ago
> You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail. I think it could go any which way. The prosecution could argue that the defendant may have tampered with existing records or deleted some. In this particular case, it’s probable that the system does not have any or adequate audit trails to prove what exactly transpired. Or the claim could be that the defendant exfiltrated sensitive data (or that the defendant is trying to hide it) to share with hostile entities.
- t0mas88 2y ago
  If the system has no audit logs, the prosecutor would have no evidence of any of that. And in a system this broken the defence could even argue that anyone could have done it and modified the logs to implicate the defendant. You can't use any data from this system as evidence.

by aftbit 2y ago

beaglesss 2y ago

What if they incremented a number in a url on a publicly available website?

debo_ 2y ago
Is this a reference to a past event? I don't get it.
- deleted 2y ago
  [deleted]
- hyperhello 2y ago
  It's an incredibly basic form of pen testing. For example, this reply page URL refers to id=41393364, which is presumably your comment. So what happens if I replace it with a different number? Probably something innocent, but maybe not.
  - deleted 2y ago
    [deleted]
- qup 2y ago
  Yes. https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may_be_going_to_prison_under_the/ https://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_ma...
  - bjoli 2y ago
    Jeez, I just read about him. Was he the first who went down the alt right pipeline? What happened there? From goatse security to the Daily Stormer.
- beaglesss 2y ago
  In part yes but inevitably devolves into an ad hominem attack against the most high profile case of a guy who did it, who is now hiding in Ukraine on a Prednistrovian passport after having his conviction overturned (temporarily) giving him an escape window.
  - fnfjfk 2y ago
    > hiding in Ukraine Huh. Uh, weird choice, given, well, you know…
    - bjoli 2y ago
      Before he spent some time in Transnistria as well, which is also a weird choice.
      - beaglesss 2y ago
        It's an excellent choice IMO from his perspective. They grant citizenship after 1 year with not a lot of questions and have a cash economy. And they don't extradite to the US.
        jojobas 2y ago
        They'll also not above confiscating your cash and killing you if its suits them. Or (before the war) they wouldn't think twice to send you to Russia to be used as a bargaining chip.
        beaglesss 2y ago
        Weev is effectively banned from the banking system. The list of places with enough infrastructure to survive as a hacker, without foreign citizenship and in a cash/crypto economy with no extradition treaty is thin. I'm sure Transnistria might do that but apparently it wasn't worth their time to kill him. Seems better than North Korea, Iran, or the bush of Africa.
    - 2y ago
- debo_ 2y ago
  Thanks for all the references / replies, folks. I appreciate it.
- mmsc 2y ago
  Another one from Australia from over a decade ago: https://amp.smh.com.au/technology/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html https://amp.smh.com.au/technology/super-bad-first-state-set-...
aftbit 2y ago
Yeah I wouldn't have convicted weev either. There is a difference though. He used that incremented number to access actual user PII. These guys created a user with no PII and no actual malicious use.
- rawling 2y ago
  It looks like they got access to a list of names of existing users.

mrguyorama 2y ago

>You're not wrong, but I would have a hard time as a jury member Which is why Jury selection usually removes people who understand the situation.

IshKebab 2y ago

Yeah so best case you spend tens of thousands on lawyers and probably win. Doing this under your own name is insane.

aftbit 2y ago
Best case, assuming you even get charged, your case gets picked up by the EFF, ACLU, IFJ, etc. You spend nothing, you win, and you get a lot of free publicity for your pen testing company. Worst case, nobody comes to help you, you spend all of your money, still lose the case, end up in a shitty US prison, and get stabbed in the shower by some guy driven crazy by spending months in solitary. Personally, I would not mess with security research on anything even distantly related to US Gov.

smsm42 2y ago

That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest". The jury won't be from the HN crowd, it would be random people who don't know anything about CFAA or computer systems, it will be the easiest thing in the world to convict. Those guys got so lucky DHS exhibited unusually sensible behavior, they could have ruined their lives.

ruthmarx 2y ago
> That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest". The only real protection is the fact that you can vote whatever way you want and not even a judge can compel you to state your reasoning.
mariodiana 2y ago
As my good fortune would have it, I'm called to jury duty two weeks from now. I doubt I'll be sat though. Should I be, I'll keep the above in mind.
- linuxftw 2y ago
  If it's a criminal case, be sure to checkout the innocence project to inform yourself on some of the junk science police and prosecutors like to use.
- SpaceNoodled 2y ago
  They tend to specifically choose against people with critical thinking skills.
  - Spivak 2y ago

RHSeeger 2y ago

But would it really matter if they were convicted, after being in jail for who knows how long awaiting trial, losing their job, etc?

newscracker 2y ago

> You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail. I think it could go any which way. The prosecution could argue that the defendant may have tampered with existing records or deleted some. In this particular case, it’s probable that the system does not have any or adequate audit trails to prove what exactly transpired. Or the claim could be that the defendant exfiltrated sensitive data (or that the defendant is trying to hide it) to share with hostile entities.

t0mas88 2y ago
If the system has no audit logs, the prosecutor would have no evidence of any of that. And in a system this broken the defence could even argue that anyone could have done it and modified the logs to implicate the defendant. You can't use any data from this system as evidence.