6 ms·
Jury convicts NY man accused of AT&T-iPad hacking
- JungleGymSam 14y agoWhy a sad face? Did the article not represent his crime correctly? I don't know this person or his back story but if he committed a crime why shouldn't he suffer the consequences?
- dietrichepp 14y agoI'm guessing the mods will come in and delete that shortly...
- JungleGymSam 14y agoIs asking questions against the rules here?
- gwillen 14y ago"Delete that" meaning remove the editorializing from the title, which they indeed have (not delete your question.)
- JungleGymSam 14y agoMy apologies.
- deleted 14y ago[deleted]
- chimeracoder 14y agoIn case you're not trolling, here's a link to what's currently #2 on the front page, which explains it well: http://erratasec.blogspot.com/2012/11/you-are-committing-crime-right-now.html http://erratasec.blogspot.com/2012/11/you-are-committing-cri...
- JungleGymSam 14y agoIt's my ignorance showing so be gentle. I'm not trolling. I don't read every link on the front page and what piques my interest may not be what piques yours. Having said that, I will read the article you linked to.
- chimeracoder 14y agoMy apologies, your comment seemed more sarcastic to me when I first read it for some reason. In any case, I hope that was helpful.
- deleted 14y ago[deleted]
- clarky07 14y agoI suspect it is because many people don't think the "crime" he committed either actually is a crime, or if it is that it should be a crime. Lots of gray area around this particular activity.
- hayksaakian 14y agoWere they doing it for the lolz? As far as I can tell from the article, they're just regular criminals.
- jack-r-abbit 14y agoThat article's bias is showing. If that is all you read about the incident then sure.. they are just regular criminals. But there is more to the case than that. From what I've read elsewhere, the Feds used a bit of stretching to make that law fit.
- smsm42 14y agoCould you back it up with some other sources then? if there's more to the case, where this more can be found?
- jack-r-abbit 14y agoI can't tell if you are trolling or are actually asking me how to Google for more info on this guy's case?
- smsm42 14y agoI don't ask you how to Google. I ask you to substantiate your claims that the article is biased and the truth is different from what is described there. If you are convinced this is the case, it must be easy for you to provide some evidence. Of course, you may consider this trolling and refuse to continue the discussion. The readers would then left to judge if your bare unsubstantiated claims are proof enough. I was assuming you wrote that comment in order to try to convince the readers in the truth of your claims. However maybe I was wrong.
- jack-r-abbit 14y agoThe article's bias is pretty evident where it referred to them as "trolls". The only "evidence" I have that there is more to the story than what this article said is just what I read in other articles. Sadly, I did not bookmark any of them so I can't easily return to them to provide links to you. I'd have to Google for them. So if you would like to read more than just this one account, you would need to Google as well. But if you want to base your opinion on only what you read in this one article AND what some random guy on the Internet (me) gives you, then I won't judge you for that. Carry on.
- k-mcgrady 14y agoThe title of this should be changed. Actual title is: Jury convicts NY man accused of AT&T-iPad hacking
- saurik 14y agoI don't know what the title was before, but this new title, while accurate to the article, is really confusing and I will say downright misleading if you aren't following this closely already... there were no iPads hacked, for example; this was an issue with AT&T's website, and probably would have worked against any targeted set of devices (where you could reasonably guess the ICCID; even if not, it is still entirely related to accessing servers). (I saw this, semi-freaked as I'm constantly hacking iPads, and then read the article to find out the title sucked.)
- Mithrandir 14y agoFor future reference, the title was "Weev Convicted :-(".
- saurik 14y ago(OK, yeah, that title was even worse. ;P)
- beatpanda 14y ago"Provided the information to Gawker" casts doubt on any criminal intent in my mind
- gwillen 14y agoApparently they have IRC logs of him first talking about selling the information to spammers or using it to go phishing, which makes it a little worse.
- guard-of-terra 14y agoI would have said the same thing after discovering the stash. Not because I actually planned to do this but because the situation is bizzare and that's some sort of humiliating humour.
- jasonlotito 14y agoCouple that with how he reported it, the script he used to download the data, and everything else he did. You can't look at each action in isolation.
- jamesaguilar 14y agoCasts doubt on any benign intent in my mind.
- welder 14y agoFrom what I just read, he didn't hack anything. He found out that AT&T didn't require a password to check if an email was valid, then just got a list of valid email addresses. How could a jury equate this with conspiracy to access a computer?
- ajross 14y agoThe computer held a list of addresses. It did not present that list to the public. He found a trick where he could probe the addresses, and used that trick to extract the list counter to the desires of the owner (and the owners of the addresses). I can't imagine how you think that access was authorized. Now, sure, it's not much of a "hack" in a security analysis sense. And it was a terribly dumb bug, and a huge security goof by AT&T. But why should criminal law care about how difficult something is? You don't get off of burglary charges if someone's door is unlocked. And if AT&T is culpable for their poor engineering, they are so in a civil sense for damages; it doesn't make the hack less of a crime. Admittedly there's a spectrum between "full disclosure" security research and grey hat anarchic asshattery, and there are cases where people have been wrongly prosecuted. But this case looks pretty black and white to me.
- scotty79 14y agoInformation whether email is valid or not was made publicly available by AT&T. Shouldn't access to publicly available information be assumed to be authorized by the one who made the information public? If you forget to wear your pants in public you are the one who is to be charged with indecent behavior not the people looking at you with intrusion on your privacy.
- cmsj 14y agoWhat about if you walk around and peek under everyone's coat to see if they forgot to wear pants?
- scotty79 14y agoVery impolite. Criminal? Only if you check many entities and lots of them notice and it bothers them or you check one for a long time and you bother it. Might be harassment. I can't see what the coat was supposed to be in AT&T case though.
- bifrost 14y agoIts a travesty, Weev comitted no real crime.
- zalzane 14y agoWhat do you mean? It says he used an account slurper and stole people's personal information. Should this not be a crime?
- dpatrick86 14y agoA whatchamawhoseit?
- cheald 14y agoHe wrote a PHP script that downloads incrementing URLs. You know, like `curl -O http://att.net/iccid/[0-100].xml` http://att.net/iccid/[0-100].xml` AT&T put this information on a public interface and relied on obscurity of serial integers to protect it, then cried foul when someone crawled their unprotected data and claimed felony unauthorized access to a computer system because they didn't explicitly authorize him to download the contents of those publicly-accessible pages. This conviction is a travesty.
- lambda 14y agoIf I discovered that someone hadn't locked a filing cabinet, and then I rifled through it, found a whole bunch of names and social security numbers, recorded all of them, and then went to talk to a news organization with this list without ever notifying the people whose filing cabinet I'd gone through, do you think that would be OK? Because that's pretty much the equivalent of what happened here. You say "AT&T put this information on a public interface and relied on obscurity of serial numbers to protect it"; this phrasing puts the blame on AT&T. Yes, they should not have done that. But that's about equivalent to forgetting to lock a file cabinet; it's a mistake that someone made. Weev then took advantage of that mistake to violate the privacy of thousands of people, providing their personal information to a news organization. Now, I don't necessarily think that they should have been convicted of everything they were convicted of. Unless there are facts that I haven't seen, they haven't come anywhere close to committing identity theft. But you do have to admit that Weev did not exactly handle this responsibly, and did invade people's privacy.
- throwaway218781 14y agoweev is a criminal. He spent many years making a living for himself by stealing from other people. He gets to re-write this past of his because most of his former crew are gone. weevs defenders are people who didn't know him when he was most active (2003-2009). This particular case is also pretty clear-cut. If you were a whitehat, why would you retrieve so much data? Why would you give the data to someone who was not with that company? Reserve your sympathy for hackers who get set up by their businesses partners, or people who aren't thieves and backstabbers. weev is just beginning to get what he has had coming to him for ten years...
- aw3c2 14y agosources please.
- kyrra 14y agoRegardless of his past, why did he pull so much information? And turning it over to gawker seems a bit wrong. He should have contacted the company. If they didn't do anything then he should have gone to the media. It seems like he acted irresponsibily with the situation. It wasn't just one misstep, it was a few.
- gsibble 14y agoTo be fair, I doubt most "mainstream media" (ie. CNN, WSJ, NYT, etc.) would have noticed/cared about this information.
- anigbrowl 14y agoUnsuccessful troll.
- TallboyOne 14y agoThat is an incredible beard, that must be where he draws his power from.
- rhizome 14y agoThis isn't Reddit.
- noob1 14y agoNot yet... HN is full of "hackers" who don't know the difference between incrementing a counter (to fetch URLs) and making up other peoples email addresses and checking if they are valid. ajross sums it up nice: http://news.ycombinator.com/item?id=4813107 http://news.ycombinator.com/item?id=4813107 Meh
- deleted 14y ago[deleted]
- neya 14y agoAnd this my friends, is the fake world of democracy we live in. We are being illusioned to posses freedom that we don't really have. This is a game played by very powerful people at the top, who have the right amount of money at the right time and these people will continue to game this system. We need a change, desperately!
- smsm42 14y agoCould you please explain how convicting a person that hacked into AT&T means we have fake democracy? I must be missing something here, could you elaborate a bit?
- gsibble 14y agoIn my opinion he's just full of shit.
- WillP 14y agoWhile I agree that "fake democracy" is a bit over the top, I also can't see how he "hacked into AT&T". There might be enough room to dicker over whether searching for a vulnerability equates to "hacking," but does anyone really believe Auernheimer did anything illegal by manually typing in an address?
- smsm42 14y agoHacked is a very loaded word. In some circles, it means "did a brilliant work cleverly and ingeniously using some stuff not always as it was intended to be used", in others it means "did some computer voodoo and stole my data". Searching for vulnerabilities on a public sites containing live private data is not a business that one should approach lightly. I personally wouldn't do it without being specifically asked for it. But even if one does, taking then massive amount of data is definitely not what a whitehat researcher does. >>> but does anyone really believe Auernheimer did anything illegal by manually typing in an address? As far as I know, he didn't manually type an address. He wrote a script that bruteforced ID protection and downloaded a massive list of private emails. Do I have a wrong information? How is it different from bruteforcing a weak password on an email account and copying all the emails - do you think this is legitimate too and that information was public?
- tareqak 14y agoFrom my reading of the article, the defendant is being painted to be bigger, scarier target so that AT&T looks like a victim instead of a corporation failing to secure the confidential information of their customers as due diligence demands. From the comments on this thread, the defendant did not have intentions that were completely (as in 100%) benign. In addition, the co-defendant pleading guilty will probably make it harder for his legal team to prove his innocence. However, why is AT&T getting away with what basically amounts to negligence? Specifically, AT&T failed to provide reasonable (industry-standard) security to their users' confidential information (email addresses and other personal data). It says about 120,000 Apple iPad users were affected, so 120,000 counts of negligence. My "class-action lawsuit" senses are tingling. Edit: minor reformatting and rewording.
- jason_slack 14y agoWhile I agree that his past "clouds" peoples potential judgement of him, I can't help but wonder if it was really understood that this data was in publicly accessible. He didn't need to work his way through backdoors and breach what some would consider traditional security measures.