4 ms·
Can you please explain how "GET /iccid/12345" is hacking? I must be missing something here, could you elaborate a bit?
by cheald 14y ago
Can you please explain how "GET /iccid/12345" is hacking? I must be missing something here, could you elaborate a bit?
- smsm42 14y agoIt is not. As far as I can see in reports, however, this is not what Andrew Auernheimer did. He wrote a tool that bruteforces massive amounts of IDs and downloaded massive number of private emails, which were not public data. The fact the it was easy for him is irrelevant, just as the fact that somebody had weak password is irrelevant if you bruteforce it and access his bank or email account. If you do that - you'll probably be liable for unauthorized access, and excuse "he had a weak password, so it's like public information" is not going to work.
- cheald 14y agoIf you've read the reports, then you'd know that what he did was write a tool that performed gets of URLs with an incrementing ID component. Like, http://news.ycombinator.com/item?id=4812496 http://news.ycombinator.com/item?id=4812496 has an integer component of "4812496". You can change that to "4812497" and get a different story. That's what he did. AT&T published a bunch of customer data on a URL endpoint with an integer component, and he wrote a script that just iterated through the integers. It's a "brute force attack" only in the loosest sense of the term. It's an insult to actual brute force attacks to call it that. A password-protected system is, by definition, protected. A URL - "Uniform Resource Locator" - is a string that identifies how to reach a given resource, which may or may not include access control. And in this case, didn't. This was not protected information. The fact that anyone could consider this technically-protected information long enough to get a criminal conviction flies in the face of the entire structure of the internet.
- jasonlotito 14y agoIt wasn't just this action that got him convicted. Intent also plays a role. His intent was malicious, with the intent to benefit from what a reasonable person would conclude was access to intentionally private data. Had his actions after discovering the problem been one of a responsible adult the results would have been different. The difficulty has little to do with it. Easily getting access to something you shouldn't have access to does not instilled you with special rights. This also means intent plays a critical role. Read past the headlines and actually understand the entire story before posting.
- s_henry_paulson 14y agoHe knew that he was obtaining sensitive information that he shouldn't have been able to access (through at&t's negligence), however instead of following any sort of responsible disclosure, and reporting the incident to the company, he goes to IRC and talks openly about trying to use the information to benefit himself through insider trading and then gives the information to Gawker (again instead of contacting AT&T). He probably could have had the charges dropped, had he composed his actions differently.
- cheald 14y agoAbsolutely. He was a dick about it. I don't think that anyone would argue differently. But the fact of the matter is, he's been convicted for unauthorized access to a public computer system. Last I checked, being a dick and a braggart wasn't criminal. I think he was rather stupid about the whole thing, but criminal? The fault should lie with AT&T, who put their customer data on a public webserver for the world to see.
- smsm42 14y agoBeing a dick in general is not criminal. Being a dick by stealing 100K private emails and giving them to press, apparently, is criminal.