5 ms·

I thought weev was charged (and convicted) for hacking at AT&Ts website and extracting a bunch of people's personal information? He was certainly not engaging

I thought weev was charged (and convicted) for hacking at AT&Ts website and extracting a bunch of people's personal information? He was certainly not engaging in what you would call "ordinary behavior." Now, is this something that I, with a bit of idle time, curl, and awk might have done on a lark - yup. Does it scare me that I then might have been found guilty of criminal behavior? Yes. Would I have done something like publish people's personal information on Gawker? Not anymore. Would I let AT&T know personally that they had a security hole? Probably not - likely to be the messenger that would get shot. Is the NET result of this that the bad guys, who keep quiet, and make use of this information for nefarios purposes now have free rein, because nobody will mention it to AT&T? Yes. Is the NET-EFFECT of this law a reduction in security and increased number of security exploitations? Yes. Should the Law be Fixed? Yes.

sp332 14y ago
The information was available just by putting a URL into a browser and nothing more. Just change the number at the end to your iPad/iPhone ID, and the server will send you the user's information. There's no hacking or fraud involved.
- shpiel 14y ago
  Just because something is easy to do does not mean it should be legal. A person could walk into a business and find documents with private information that have been carelessly left in the open. That does not make it ok to take and publish them. There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.
  - sp332 14y ago
    Let's not use metaphors. This isn't about federally-protected mailboxes or taking information from a private place like an office. The information was already published when AT&T put it on their public web site. Weev's activity after that was publicizing and commenting on the data.
- jcromartie 14y ago
  Really, though, what's the difference between this and guessing a password? Are ICCIDs secret?
  - sp332 14y ago
    They're random, but each carrier has constraints. So they only had to search AT&T's space. http://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_email_address_leak http://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_e... Here's the ICCID structure http://en.wikipedia.org/wiki/ICC-ID#ICCID http://en.wikipedia.org/wiki/ICC-ID#ICCID Edit: To be clear, ICCID's are not private, they're printed on the outside of the SIM card.
- BryantD 14y ago
  Not exactly. He also had to change the User-agent header. Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed. The intent of the owner of the data does, in fact, count.
  - sp332 14y ago
    I'm not convinced that intent of the owner counts, but let's say it does. AT&T intentionally put the information on a publicly accessible server. They even distributed a script that fetched the data when it was requested, when users set up an iPad. So as far as "intent" counts, this data was intended to be accessed.
    - BryantD 14y ago
      ... by the user setting up that iPad. Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.
      - sp332 14y ago
        The ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.
        lukeschlather 14y ago
        Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc. The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.
        sp332 14y ago
        It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.
- ghshephard 14y ago
  What he was doing certainly fell under the auspices of "hacking". I don't think there was any fraud. If you read my response, I make it clear it's the sort of thing I might have done if I had idle time on my hand. Well, except I probably won't anymore given the potential criminal sanctions. Realistically, there isn't any legitimate reason for me to be doing this to AT&T's website anyways, other than idle juvenile curiosity (which I'll admit to having an abundance of).
  - sp332 14y ago
    > What he was doing certainly fell under the auspices of "hacking". I really don't see how. He used the exact same query that AT&T's own script used. The server did not break, or expose any unexpected behavior - in fact it worked exactly as AT&T designed and intended for it to work. I don't think you can pin any of this on weev when it's clearly AT&T who screwed up and provided all their customers' data for the asking.
    - ghshephard 14y ago
      It was hacking because AT&T certainly didn't intend for people to be retrieving other people's personal information by randomly guessing ICCID numbers, and changing their User-agent header. Look, I'm not arguing that this should be criminal behavior, and it certainly doesn't merit a jail term. I can't tell you how many times I've done stuff exactly like this - probably in the hundreds of times. Is it hacking when I paid $15 for a 1 week pass and then used curl to download 11 gigabytes and 10+ years of the American Journnal of Clinical Nutrition? Probably. But, to give all due credit to the AJCN, they detected my repeated queries, and redirected me to a page that asked me to wait 30 seconds between each query when doing bulk downloads. So, there is a case where I wasn't doing the obvious (downloading through the web interface), "hacking", if you will, but the AJCN was clearly fine with it, they just wanted me to ease up a bit, and instructed me how to do so in a friendly way. If weev is guilty of anything, it was not realizing that posting high-profile individuals names onto gawker was probably a Really Bad Idea (TM).
      - tolmasky 14y ago

sp332 14y ago

The information was available just by putting a URL into a browser and nothing more. Just change the number at the end to your iPad/iPhone ID, and the server will send you the user's information. There's no hacking or fraud involved.

shpiel 14y ago
Just because something is easy to do does not mean it should be legal. A person could walk into a business and find documents with private information that have been carelessly left in the open. That does not make it ok to take and publish them. There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.
- sp332 14y ago
  Let's not use metaphors. This isn't about federally-protected mailboxes or taking information from a private place like an office. The information was already published when AT&T put it on their public web site. Weev's activity after that was publicizing and commenting on the data.
jcromartie 14y ago
Really, though, what's the difference between this and guessing a password? Are ICCIDs secret?
- sp332 14y ago
  They're random, but each carrier has constraints. So they only had to search AT&T's space. http://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_email_address_leak http://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_e... Here's the ICCID structure http://en.wikipedia.org/wiki/ICC-ID#ICCID http://en.wikipedia.org/wiki/ICC-ID#ICCID Edit: To be clear, ICCID's are not private, they're printed on the outside of the SIM card.
BryantD 14y ago
Not exactly. He also had to change the User-agent header. Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed. The intent of the owner of the data does, in fact, count.
- sp332 14y ago
  I'm not convinced that intent of the owner counts, but let's say it does. AT&T intentionally put the information on a publicly accessible server. They even distributed a script that fetched the data when it was requested, when users set up an iPad. So as far as "intent" counts, this data was intended to be accessed.
  - BryantD 14y ago
    ... by the user setting up that iPad. Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.
    - sp332 14y ago
      The ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.
      - lukeschlather 14y ago
        Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc. The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.
        sp332 14y ago
        It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.
ghshephard 14y ago
What he was doing certainly fell under the auspices of "hacking". I don't think there was any fraud. If you read my response, I make it clear it's the sort of thing I might have done if I had idle time on my hand. Well, except I probably won't anymore given the potential criminal sanctions. Realistically, there isn't any legitimate reason for me to be doing this to AT&T's website anyways, other than idle juvenile curiosity (which I'll admit to having an abundance of).
- sp332 14y ago
  > What he was doing certainly fell under the auspices of "hacking". I really don't see how. He used the exact same query that AT&T's own script used. The server did not break, or expose any unexpected behavior - in fact it worked exactly as AT&T designed and intended for it to work. I don't think you can pin any of this on weev when it's clearly AT&T who screwed up and provided all their customers' data for the asking.
  - ghshephard 14y ago
    It was hacking because AT&T certainly didn't intend for people to be retrieving other people's personal information by randomly guessing ICCID numbers, and changing their User-agent header. Look, I'm not arguing that this should be criminal behavior, and it certainly doesn't merit a jail term. I can't tell you how many times I've done stuff exactly like this - probably in the hundreds of times. Is it hacking when I paid $15 for a 1 week pass and then used curl to download 11 gigabytes and 10+ years of the American Journnal of Clinical Nutrition? Probably. But, to give all due credit to the AJCN, they detected my repeated queries, and redirected me to a page that asked me to wait 30 seconds between each query when doing bulk downloads. So, there is a case where I wasn't doing the obvious (downloading through the web interface), "hacking", if you will, but the AJCN was clearly fine with it, they just wanted me to ease up a bit, and instructed me how to do so in a friendly way. If weev is guilty of anything, it was not realizing that posting high-profile individuals names onto gawker was probably a Really Bad Idea (TM).
    - tolmasky 14y ago