3 ms·

I guess maybe the disconnect here is, and help me understand, but why did he need to gather 110k email addresses? If he never had any intention of using them,

I guess maybe the disconnect here is, and help me understand, but why did he need to gather 110k email addresses? If he never had any intention of using them, or just wanted to publicize the breach, why not gather two or three and then go to the press? I guess an analogy might be - I see a bunch of boxes on the curb outside a doctor's office. I open one up and look at the first manila folder - it's someone's medical records. I open the second, it's also medical records. If I take those two to go show a reporter, or yell at the doctor's office, I'm ethically clean. But if I take the boxes home with me, I'm in a much trickier legal and ethical situation, as why did I need to take the records home?

nitrogen 14y ago
In computers, the only quantities that matter are zero, one, or many. My guess: weev wrote a script that incremented IDs just to see what would happen, it ran for a short time, and... whoops, there's 110k addresses there! It's difficult to analogize this to the physical world; maybe you could say that you are the garbage collector, so your automated truck picking up one box of trash that happened to contain medical records is the same as picking up all the boxes, but that's still far from a perfect analogy.
- BryantD 14y ago
  It's worth reading the indictment, here (thanks to ssclafani for digging this up): http://www.scribd.com/doc/113664772/46-Indictment http://www.scribd.com/doc/113664772/46-Indictment "The Account Slurper attached AT&T's servers for several days in or around June 2010, and was designed to harvest as many ICC-ID/email pairings as possible." This is the indictment, so not proven, but the period for which the script ran is probably accurate. So nah, not a short time. There's also some great IRC logs later on where they're talking about using the collected email addresses for phishing, debating whether or not it's worth the effort if they don't get passwords, and talking about selling the resulting email database.
  - lesterbuck 14y ago
    I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.
    - sneak 14y ago
      Those are the things they DISCUSSED doing - what ACTUALLY HAPPENED was that they sent excerpts to the media and deleted their own copies. It looks bad but I think it's more important to focus on the fact that they ended up doing the Right Thing with the data instead of fucking anyone directly - even when distinctly aware of the various opportunities available for misusing that data. Many greyhat researchers don't have those ethics or morals.
      - tptacek 14y ago
        That's why they've been charged with "Conspiracy", isn't it? The elements of federal Conspiracy: (1) An agreement between two or more persons to commit at least one crime. (2) A person joining the conspiracy knowing of at least one of its objects and intending to help accomplish it. (3) One of the members of the conspiracy performed at least one overt act for the purpose of carrying out the conspiracy. So, here: 1. Let's build a database of stolen AT&T email addresses associated with iPads and then sell them to spammers. 2. Here, run this script as I adjust to to increase the number of accounts it successfully finds. 3. Oh, look, I ran this script and got 100,000 email addresses. Not good, right? Look, if you read Spitler's indictment, it really doesn't seem like this particular conspiracy wanted to do anything but troll a huge company with thousands of people's personal information. I don't have a whole lot of sympathy for the defendants here, but it does seem like an injustice that could have been addressed in civil court. It seems like a stretch to convince a jury that these people really wanted to sell the information they collected. On the other hand, I think the idea that AT&T made this information available to the public in such a manner that you could have in good faith harvested hundreds of thousands of addresses is pretty much bunk. It's not going to help that A.A.'s first instinct was to run to the media because simply having the addresses was such a big story that they'd be on the front page of NEWS.GOOGLE.COM. He more or less immediately made clear to everyone that he knew he had no business handling that data.

nitrogen 14y ago

In computers, the only quantities that matter are zero, one, or many. My guess: weev wrote a script that incremented IDs just to see what would happen, it ran for a short time, and... whoops, there's 110k addresses there! It's difficult to analogize this to the physical world; maybe you could say that you are the garbage collector, so your automated truck picking up one box of trash that happened to contain medical records is the same as picking up all the boxes, but that's still far from a perfect analogy.

BryantD 14y ago
It's worth reading the indictment, here (thanks to ssclafani for digging this up): http://www.scribd.com/doc/113664772/46-Indictment http://www.scribd.com/doc/113664772/46-Indictment "The Account Slurper attached AT&T's servers for several days in or around June 2010, and was designed to harvest as many ICC-ID/email pairings as possible." This is the indictment, so not proven, but the period for which the script ran is probably accurate. So nah, not a short time. There's also some great IRC logs later on where they're talking about using the collected email addresses for phishing, debating whether or not it's worth the effort if they don't get passwords, and talking about selling the resulting email database.
- lesterbuck 14y ago
  I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.
  - sneak 14y ago
    Those are the things they DISCUSSED doing - what ACTUALLY HAPPENED was that they sent excerpts to the media and deleted their own copies. It looks bad but I think it's more important to focus on the fact that they ended up doing the Right Thing with the data instead of fucking anyone directly - even when distinctly aware of the various opportunities available for misusing that data. Many greyhat researchers don't have those ethics or morals.
    - tptacek 14y ago
      That's why they've been charged with "Conspiracy", isn't it? The elements of federal Conspiracy: (1) An agreement between two or more persons to commit at least one crime. (2) A person joining the conspiracy knowing of at least one of its objects and intending to help accomplish it. (3) One of the members of the conspiracy performed at least one overt act for the purpose of carrying out the conspiracy. So, here: 1. Let's build a database of stolen AT&T email addresses associated with iPads and then sell them to spammers. 2. Here, run this script as I adjust to to increase the number of accounts it successfully finds. 3. Oh, look, I ran this script and got 100,000 email addresses. Not good, right? Look, if you read Spitler's indictment, it really doesn't seem like this particular conspiracy wanted to do anything but troll a huge company with thousands of people's personal information. I don't have a whole lot of sympathy for the defendants here, but it does seem like an injustice that could have been addressed in civil court. It seems like a stretch to convince a jury that these people really wanted to sell the information they collected. On the other hand, I think the idea that AT&T made this information available to the public in such a manner that you could have in good faith harvested hundreds of thousands of addresses is pretty much bunk. It's not going to help that A.A.'s first instinct was to run to the media because simply having the addresses was such a big story that they'd be on the front page of NEWS.GOOGLE.COM. He more or less immediately made clear to everyone that he knew he had no business handling that data.