10 ms·

Former pentester here. Though I’m largely sympathetic with Goodwolf, note that releasing actual data is almost always a bad idea. It’s why bug bounty programs h

Former pentester here. Though I’m largely sympathetic with Goodwolf, note that releasing actual data is almost always a bad idea. It’s why bug bounty programs have limited scope. The city seems upset that he shared data about ongoing investigations and undercover police reports. Depending on what exactly he shared, it’s hard to fault the city for that. It doesn’t really matter where the data currently exists; grabbing it and handing it off to others is obviously not a good idea. If his goal was to prove to the reporters that such data existed and was available for download, he had many options that didn’t require accessing the data: screenshot the forum posts, send links to the reporters, detail what kind of data was there without actually showing any of it, and so on. Now, if that’s what he did, and the city is still reacting this way, that’s obviously abuse. But it doesn’t seem unreasonable to order someone to stop disseminating data about ongoing investigations to reporters. Would you want your private cases to be more widely spread? I’m really sympathetic to him, because this is an easy mistake to make. Before I got into the industry, I thought that this was white hat hacking; it’s obviously good that he’s spreading awareness about the breach. But how you do it really matters. (Caveat: I worked in the industry for about a year in 2016, so maybe things have changed. But I’d be shocked if distributing actual data from any breach was condoned by anyone who works as a pentester, even today.) > the city says Goodwolf is threatening to publicly share the city's stolen data in the form of a website that he will create himself. Goodwolf previously told 10TV he does plan to set up a website, but it would only allow people to see if their name was part of the data breach. This isn’t the same as setting up a site to see if your password was compromised. It could let anyone type in someone’s name and see whether they’re a witness in a criminal investigation.

nostrademons 2y ago
It's somewhat unclear exactly what was shared and how. The article and the linked article about the data breach itself suggested that Goodwolf downloaded the data to verify its contents and then showed the data to a reporter, but he didn't actually release any data, nor distribute it into the permanent possession of the reporter. This is akin to Boeing saying "We had no knowledge of the 737 MAX's problems", and then an employee showing screenshots of confidential memos to the media saying "Yes you did, here is the truth." I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to.
- sillysaurusx 2y ago
  Sure, but the fact that it’s unclear is exactly what the city is reacting to. The point of the restraining order is that they have a reasonable belief that he might have distributed it to reporters, and he’s on the record saying he might create a website where anyone can see information related to ongoing criminal investigations or witness identities. Note that showing the data to the reporter counts as distribution. He didn’t need to do that to prove to the reporter that the data was out there. Even sending screenshots of the data would’ve been ok if he’d redacted anything remotely confidential (it would be obvious from context that the document is probably legit, and the reporter would dig in further). If he didn’t send any sensitive data to anyone, then I completely agree with you. But pentesters generally don’t send actual data to prove a breach exists to anyone but the target of the breach. Publicizing the breach itself is fine, but the article is pretty clear that’s not why they’re going after him.
  - oxygen_crisis 2y ago
    Showing it to a reporter with a reputable news agency shouldn't count as distribution. Reporters and their editors are meant to be the experts on the ethics and legalities of what should be redacted and what level of detail is in the public interest to report. You should be able to fork over everything to a reporter securely and let them defer to their ethics, consult with their lawyers, liaise with law enforcement, etc. to determine what level of disclosure is appropriate.
- Spivak 2y ago
  > I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to. He still should. The dispatch article has more information, this was data that has already been leaked, there is no means of protecting it anymore. The only thing to do is release it so people know if they've been exposed. https://www.dispatch.com/story/opinion/columns/2024/08/30/columbus-dark-web-connor-goodwolf-randomware-restraining-order-against/75001552007/ https://www.dispatch.com/story/opinion/columns/2024/08/30/co... Like it sucks that this is the best option but you can't make it go away, the data is free.
AmericanChopper 2y ago
According to what I read in that article, Goodwolf didn’t release the data. The hackers released the data, the city lied about it, Goodwolf went and retrieved the publicly accessible data and gave it to journalists to prove the city’s lie. Unless that article is seriously mischaracterising what happened, I can’t see how this is anything other than a massive civil liberties infringement by the city, who are just trying to scapegoat this Goodwolf person. All of the damages they are describing were caused by their own negligence.
- sillysaurusx 2y ago
  Retrieving publicly accessible data and then giving it to anyone else is the problem when the data contains the identities of witnesses for ongoing criminal investigations. I’m really far on the side of hackers here, but I’m having trouble justifying sending any data whatsoever to journalists related to criminal investigations. Even one witness’s name, sent merely to prove that the breach happened, could be enough to cause direct harm to that case if the reporter decided to reveal it. You don’t need to do that to show a reporter that the breach happened. And it’s up to the reporter themselves to prove the breach is real.
  - Spivak 2y ago
    And that's why you send the data to reporters. Literally the people whose job it is to handle this correctly. They are the next stop when the city doesn't give you the time of day. He didn't send it to some disreputable news podcaster, they're the primary newspaper for the city.
  - dccoolgai 2y ago
    But that "harm" was caused by the City failing to secure the data - not this one person who said "the city failed to secure the data - anyone can get it".
    - sillysaurusx 2y ago
      Intent matters. The city was incompetent, but distributing data about active criminal investigations is malicious, or at least dangerous. And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Here’s an example from my own life: I created books3, an AI training dataset of almost 200k books. This was thanks to The Eye, who hosted a copy of Bibliotik, a popular shadow library. But everyone is suing the AI companies themselves for using the training data, even though the original harm was caused by The Eye and Bibliotik. > not this one person who said "the city failed to secure the data - anyone can get it". If he simply said that, there wouldn’t have been a problem. He sent actual data related to ongoing criminal investigations, and was on the record saying he might set up a website to more widely disseminate information about that data — which could include names of witnesses in those investigations.
lima 2y ago
This is data that criminals already publicly released.
- sigseg1v 2y ago
  If criminals already sell drugs publicly, and you go obtain those drugs and give them away to other members of the public, you will be in trouble. I don't think this is too difficult of a concept to grasp.
kayodelycaon 2y ago
I happen to know this guy. He has an extremely bad reputation in the furry community for doxing people and bringing up old criminal records to publicly shame and cancel people. He actively tries to hurt people. He’s about as far from an ethical hacker as you can be. He’s on a crusade. Now that doesn’t mean this should be illegal but I’m not on his side.
- someguydave 2y ago
  It could be that there are assholes on four sides here (blackhat guys, city, whitehat guy, journalists)
  - ta988 2y ago
    It is often the case yes... Which is why picking sides without beeing involved is often a mistake.
- Spivak 2y ago
  This is a bit "what were you doing at the devil's sacrament" but I digress it's not that important. You should be able to be the worst person in the world and not hung for it. There's no reason to not be on his side, it doesn't mean you endorse him. The other side is an embarrassed government throwing their weight around to hang him for what isn't and shouldn't be a crime.
  - tourmalinetaco 2y ago
    > You should be able to be the worst person in the world and not hung for it. Do you just believe that someone should be allowed to do anything they want and not face repercussions?
    - kbelder 2y ago
      Well, they should be able to do anything they want that's legal without facing legal repercussions.
ang_cire 2y ago
This was not "releasing" information, though, it was already public. The "dark web" isn't someplace you require some special invite-only connection to, it's just regular websites (even if they use TOR) that anyone can access if they know where to look.
- unethical_ban 2y ago
  It is naive to suggest that it is equally easy for the general public to search the dark web for an illicit data breach vs. go to a a publicized website. Hell, I am in infosec and it would probably take me a few hours or more to find raw data. A grandma can click a website on CBS and type a name.
  - ang_cire 2y ago
    Your argument essentially sets up certain websites as being "more public" than others as a legal test for liability, in a way I can only assume would be based on Google index and search results (how Grandma finds it), which is wild to suggest. How would that even work? You linked to something that Google didn't index, so you're liable for spreading private info, but another person who posted the same data, but whose reference site was indexed by Google, isn't liable?
  - progmetaldev 2y ago
    I upvoted you stance, but at this point in technology, it's fairly easy to find articles on how to get on Tor and use a search engine that indexes Onion content. The two are not equivalent, but is it possible that you worry about visiting the dark web, versus the actual difficulty to do so? You are in infosec, so you are probably very conscious of what you can and can't do and track easily. The dark web is more difficult to track, but is it that much more difficult to access if you don't care about general privacy concerns? There are so many "easy" methods online to get you on the dark web, and most don't care too much about privacy like you or I care about. Just food for thought, I don't go searching the dark web, to keep my security to a level I can understand, and I don't think there's anything wrong with that.
rockskon 2y ago
???? I'm not quite certain what law he's accused of violating. He didn't download the info from the gov website so there couldn't be allegations of unauthorized access. He didn't hack the website either. What gives?
unethical_ban 2y ago
This is an important distinction that the city fails to articulate. The city lied about the breach, so getting a restraining order immediately looks petty and abusive. But you make a good point that such a website would not actually be useful. Anyone who is in those documents knows it, and allowing the public web the ability to look people up by name is dangerous. The "hacker" is correct to speak loudly about the lies the city told. He would be incorrect to create a lookup.
- kmoser 2y ago
  > He would be incorrect to create a lookup. Not if the lookup simply acknowledged whether a name exists in the records, without giving other context (e.g. property tax, DMV, criminal investigation, etc.).
  - FireBeyond 2y ago
    I'm more concerned with "Making it so people can only look themselves up". Like how was he planning to enforce that? Trust and honesty? Or maybe you upload your ID to him first? I think that he's playing all weaselly now that there's some pressure.
    - deleted 2y ago
      [deleted]
  - unethical_ban 2y ago
    If the context is a 50% chance "witness in a criminal case" then the implied context is pretty strong.
tptacek 2y ago
For what it's worth, he didn't generate this data from an attack; he's just downloading it from Tor BBSs. The term "cybersecurity expert" contains multitudes.
- sillysaurusx 2y ago
  Downloading it wasn’t really the problem, though. I agree that pentesters should be able to. But redistributing a police database (even just to reporters) is obviously going to cause the city to file a restraining order to stop further distribution. Especially when he said he plans to make a site that would share details related to that database. If nothing else, it was probably a bad idea to do what he did. I was only trying to caution overeager outsiders against doing similar things. What do you make of all this? The lawsuit itself seems dubious, even if the restraining order made sense.
  - rockskon 2y ago
    My understanding is that there generally isn't a legal prohibiton on disseminating data you obtained legally even if the person who initially acquired it did so illegally.
    - cortesoft 2y ago
      I think it wouldn't be a crime, but you could still be sued to get you to stop distributing it.
      - rockskon 2y ago
        Sued under what grounds? "Cause we don't want you to" isn't valid legal grounds.
  - sigseg1v 2y ago
    Agreed. I think something people are getting hung up on here is that just because something is technically public, doesn't mean you can assist in distributing it. Example: Controlled drugs are public in that you can easily go to a certain area in downtown and obtain them. However, if you do so, and then you start distributing it yourself, you will be charged with a crime. Nobody has issues understanding this but they seem to have issues understanding when it's data instead of physical goods for some reason.
aaron695 2y ago
[dead]
krageon 2y ago
> it’s hard to fault the city for that It's not hard at all. The people like the decisionmakers here inflict violence upon people's willingness to help them with very bad cybersecurity issues. Which are everywhere. If we lived in a healthy society, whoever decided to prosecute this would be sacrificed to a volcano (metaphorically).

nostrademons 2y ago

It's somewhat unclear exactly what was shared and how. The article and the linked article about the data breach itself suggested that Goodwolf downloaded the data to verify its contents and then showed the data to a reporter, but he didn't actually release any data, nor distribute it into the permanent possession of the reporter. This is akin to Boeing saying "We had no knowledge of the 737 MAX's problems", and then an employee showing screenshots of confidential memos to the media saying "Yes you did, here is the truth." I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to.

sillysaurusx 2y ago
Sure, but the fact that it’s unclear is exactly what the city is reacting to. The point of the restraining order is that they have a reasonable belief that he might have distributed it to reporters, and he’s on the record saying he might create a website where anyone can see information related to ongoing criminal investigations or witness identities. Note that showing the data to the reporter counts as distribution. He didn’t need to do that to prove to the reporter that the data was out there. Even sending screenshots of the data would’ve been ok if he’d redacted anything remotely confidential (it would be obvious from context that the document is probably legit, and the reporter would dig in further). If he didn’t send any sensitive data to anyone, then I completely agree with you. But pentesters generally don’t send actual data to prove a breach exists to anyone but the target of the breach. Publicizing the breach itself is fine, but the article is pretty clear that’s not why they’re going after him.
- oxygen_crisis 2y ago
  Showing it to a reporter with a reputable news agency shouldn't count as distribution. Reporters and their editors are meant to be the experts on the ethics and legalities of what should be redacted and what level of detail is in the public interest to report. You should be able to fork over everything to a reporter securely and let them defer to their ethics, consult with their lawyers, liaise with law enforcement, etc. to determine what level of disclosure is appropriate.
Spivak 2y ago
> I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to. He still should. The dispatch article has more information, this was data that has already been leaked, there is no means of protecting it anymore. The only thing to do is release it so people know if they've been exposed. https://www.dispatch.com/story/opinion/columns/2024/08/30/columbus-dark-web-connor-goodwolf-randomware-restraining-order-against/75001552007/ https://www.dispatch.com/story/opinion/columns/2024/08/30/co... Like it sucks that this is the best option but you can't make it go away, the data is free.

AmericanChopper 2y ago

According to what I read in that article, Goodwolf didn’t release the data. The hackers released the data, the city lied about it, Goodwolf went and retrieved the publicly accessible data and gave it to journalists to prove the city’s lie. Unless that article is seriously mischaracterising what happened, I can’t see how this is anything other than a massive civil liberties infringement by the city, who are just trying to scapegoat this Goodwolf person. All of the damages they are describing were caused by their own negligence.

sillysaurusx 2y ago
Retrieving publicly accessible data and then giving it to anyone else is the problem when the data contains the identities of witnesses for ongoing criminal investigations. I’m really far on the side of hackers here, but I’m having trouble justifying sending any data whatsoever to journalists related to criminal investigations. Even one witness’s name, sent merely to prove that the breach happened, could be enough to cause direct harm to that case if the reporter decided to reveal it. You don’t need to do that to show a reporter that the breach happened. And it’s up to the reporter themselves to prove the breach is real.
- Spivak 2y ago
  And that's why you send the data to reporters. Literally the people whose job it is to handle this correctly. They are the next stop when the city doesn't give you the time of day. He didn't send it to some disreputable news podcaster, they're the primary newspaper for the city.
- dccoolgai 2y ago
  But that "harm" was caused by the City failing to secure the data - not this one person who said "the city failed to secure the data - anyone can get it".
  - sillysaurusx 2y ago
    Intent matters. The city was incompetent, but distributing data about active criminal investigations is malicious, or at least dangerous. And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Here’s an example from my own life: I created books3, an AI training dataset of almost 200k books. This was thanks to The Eye, who hosted a copy of Bibliotik, a popular shadow library. But everyone is suing the AI companies themselves for using the training data, even though the original harm was caused by The Eye and Bibliotik. > not this one person who said "the city failed to secure the data - anyone can get it". If he simply said that, there wouldn’t have been a problem. He sent actual data related to ongoing criminal investigations, and was on the record saying he might set up a website to more widely disseminate information about that data — which could include names of witnesses in those investigations.

lima 2y ago

This is data that criminals already publicly released.

sigseg1v 2y ago
If criminals already sell drugs publicly, and you go obtain those drugs and give them away to other members of the public, you will be in trouble. I don't think this is too difficult of a concept to grasp.

kayodelycaon 2y ago

I happen to know this guy. He has an extremely bad reputation in the furry community for doxing people and bringing up old criminal records to publicly shame and cancel people. He actively tries to hurt people. He’s about as far from an ethical hacker as you can be. He’s on a crusade. Now that doesn’t mean this should be illegal but I’m not on his side.

someguydave 2y ago
It could be that there are assholes on four sides here (blackhat guys, city, whitehat guy, journalists)
- ta988 2y ago
  It is often the case yes... Which is why picking sides without beeing involved is often a mistake.
Spivak 2y ago
This is a bit "what were you doing at the devil's sacrament" but I digress it's not that important. You should be able to be the worst person in the world and not hung for it. There's no reason to not be on his side, it doesn't mean you endorse him. The other side is an embarrassed government throwing their weight around to hang him for what isn't and shouldn't be a crime.
- tourmalinetaco 2y ago
  > You should be able to be the worst person in the world and not hung for it. Do you just believe that someone should be allowed to do anything they want and not face repercussions?
  - kbelder 2y ago
    Well, they should be able to do anything they want that's legal without facing legal repercussions.

ang_cire 2y ago

This was not "releasing" information, though, it was already public. The "dark web" isn't someplace you require some special invite-only connection to, it's just regular websites (even if they use TOR) that anyone can access if they know where to look.

unethical_ban 2y ago
It is naive to suggest that it is equally easy for the general public to search the dark web for an illicit data breach vs. go to a a publicized website. Hell, I am in infosec and it would probably take me a few hours or more to find raw data. A grandma can click a website on CBS and type a name.
- ang_cire 2y ago
  Your argument essentially sets up certain websites as being "more public" than others as a legal test for liability, in a way I can only assume would be based on Google index and search results (how Grandma finds it), which is wild to suggest. How would that even work? You linked to something that Google didn't index, so you're liable for spreading private info, but another person who posted the same data, but whose reference site was indexed by Google, isn't liable?
- progmetaldev 2y ago
  I upvoted you stance, but at this point in technology, it's fairly easy to find articles on how to get on Tor and use a search engine that indexes Onion content. The two are not equivalent, but is it possible that you worry about visiting the dark web, versus the actual difficulty to do so? You are in infosec, so you are probably very conscious of what you can and can't do and track easily. The dark web is more difficult to track, but is it that much more difficult to access if you don't care about general privacy concerns? There are so many "easy" methods online to get you on the dark web, and most don't care too much about privacy like you or I care about. Just food for thought, I don't go searching the dark web, to keep my security to a level I can understand, and I don't think there's anything wrong with that.

rockskon 2y ago

???? I'm not quite certain what law he's accused of violating. He didn't download the info from the gov website so there couldn't be allegations of unauthorized access. He didn't hack the website either. What gives?

unethical_ban 2y ago

This is an important distinction that the city fails to articulate. The city lied about the breach, so getting a restraining order immediately looks petty and abusive. But you make a good point that such a website would not actually be useful. Anyone who is in those documents knows it, and allowing the public web the ability to look people up by name is dangerous. The "hacker" is correct to speak loudly about the lies the city told. He would be incorrect to create a lookup.

kmoser 2y ago
> He would be incorrect to create a lookup. Not if the lookup simply acknowledged whether a name exists in the records, without giving other context (e.g. property tax, DMV, criminal investigation, etc.).
- FireBeyond 2y ago
  I'm more concerned with "Making it so people can only look themselves up". Like how was he planning to enforce that? Trust and honesty? Or maybe you upload your ID to him first? I think that he's playing all weaselly now that there's some pressure.
  - deleted 2y ago
    [deleted]
- unethical_ban 2y ago
  If the context is a 50% chance "witness in a criminal case" then the implied context is pretty strong.

tptacek 2y ago

For what it's worth, he didn't generate this data from an attack; he's just downloading it from Tor BBSs. The term "cybersecurity expert" contains multitudes.

sillysaurusx 2y ago
Downloading it wasn’t really the problem, though. I agree that pentesters should be able to. But redistributing a police database (even just to reporters) is obviously going to cause the city to file a restraining order to stop further distribution. Especially when he said he plans to make a site that would share details related to that database. If nothing else, it was probably a bad idea to do what he did. I was only trying to caution overeager outsiders against doing similar things. What do you make of all this? The lawsuit itself seems dubious, even if the restraining order made sense.
- rockskon 2y ago
  My understanding is that there generally isn't a legal prohibiton on disseminating data you obtained legally even if the person who initially acquired it did so illegally.
  - cortesoft 2y ago
    I think it wouldn't be a crime, but you could still be sued to get you to stop distributing it.
    - rockskon 2y ago
      Sued under what grounds? "Cause we don't want you to" isn't valid legal grounds.
- sigseg1v 2y ago
  Agreed. I think something people are getting hung up on here is that just because something is technically public, doesn't mean you can assist in distributing it. Example: Controlled drugs are public in that you can easily go to a certain area in downtown and obtain them. However, if you do so, and then you start distributing it yourself, you will be charged with a crime. Nobody has issues understanding this but they seem to have issues understanding when it's data instead of physical goods for some reason.

aaron695 2y ago

[dead]

krageon 2y ago

> it’s hard to fault the city for that It's not hard at all. The people like the decisionmakers here inflict violence upon people's willingness to help them with very bad cybersecurity issues. Which are everywhere. If we lived in a healthy society, whoever decided to prosecute this would be sacrificed to a volcano (metaphorically).