11 ms·

iPad Hack Statement Of Responsibility

202 points by acremades 14y ago

AmVess 14y ago
Pardon my language, but what the fuck happened to this country.
- monochromatic 14y ago
  People started believing everything they come across that happens to fit in with a narrative they've accepted.
  - weareconvo 14y ago
    What else is new?
- driverdan 14y ago
  What do you mean? This is how hackers have been treated since the creation of the computer. This is nothing new.
ghshephard 14y ago
I wasn't sure whether this is a spoof or not. Is he serious when he writes - "I did this because I despised people I think are unjustly wealthy and wanted to embarass them. " That was his admitted rationale - that he was seeking to embarrass people he despised because they were "unjustly wealthy?"
- webXL 14y ago
  There are plenty of ways to embarrass people that are legal, and possibly moral. The question is: was this one of them?
  - jbigelow76 14y ago
    Another question would be is: does harvesting emails embarrass the, in his words, the "unjustly wealthy"? Is it the CEO or one of the board members that is responsible for web server configurations? Obviously pure speculation (mixed with cynicism) recalling this story of the email harvesting I have no problems imagining a conversation like this occurred: PR Flack: "Sir, we had a little PR snafu today and millions of email addresses of paying customers were exposed." CEO: "So what?" PR Flack: "Well it looks bad sir." CEO: "Fine, shitcan some 50K a year nerd in one of data centers and then issue a press release indicating how seriously we take customer privacy".
- mootothemax 14y ago
  I'm presuming that was satire, although why he'd write something so easy for a trial prosecution to jump on is beyond me.
DigitalSea 14y ago
When you hear of horrible stores like that of Aaron Swartz and the author of this insightful article Andrew Auernheimer it really paints a picture of just how afraid the US government is of the Internet. People lament China for their great firewall and control over its people and yet the US is starting to look more and more like China everyday. This is how revolts against governments start, absurd laws and persecution of innocent people which eventually pushes people over the edge and if they don't kill themselves they uprise and society gets thrown into disarray which only results in more oppressive laws and absurd persecution, it's a horrible cycle. All this guy did was exploit publicly available information. It seems the US is now sending people to jail for pointing out other peoples stupidity. Sure he probably went too far with the whole, "I want to embarrass AT&T thing" but trolling is not hacking and it's not like Andrew had to bypass any form of security to get the info in the first place. Anyone would swear this guy found a way to steal credit card details...
- est 14y ago
  China is not naturally terrible, China is just in that kind of shithole phase which any country might get into. It's the wrong direction a civilization evolves into.
- warmwaffles 14y ago
  eh, this article doesn't paint the whole story.
  - DigitalSea 14y ago
    It doesn't need to paint the whole story. If the dude committed any overly serious crime, he'd still be in custody right now awaiting sentencing. They don't let you out on bail if you're a serious offender. I'm sure there is more than meets the eye here, but given the the spotlight being shined upon hacking cases like this of late, it's not hard to believe that what this guy says isn't what went down. Andrew was obviously a troll in every sense of the word, reckless and irresponsible but by no means did he have to bypass any security measures to get the email addresses. I would argue it's the equivalent of a bank leaving it's doors unlocked, alarm systems deactivated and lights on and someone walking in and taking money, then the bank complaining they got robbed, but this situation is blown way out of proportion and a metaphor like that would be over the top. What he did is no different to someone writing a script that scours the web looking for email addresses (a tactic spammers have used and gotten away with for years), except no trickery was required to get the addresses AT&T were handing them over unknowingly without recourse. This can't even be considered a hack, more of an exploit if anything. The stupidity of wanting to embarrass was no doubt a really stupid move to make, but definitely not some security defying hack. People shouldn't be jailed for acting like idiots, AT&T should be the ones being scalded for allowing this to happen in the first place. A company has a responsibility to keep customer data safe, AT&T should be no exception to that rule.
zmanji 14y ago
If anyone thinks weev deserves any sympathy, you don't know the full story. weev had malicious intent and wanted to harm AT&T by exposing users data. Instead of doing anything remotely rational he took all the data and wanted to sell it. Laws take into account indent (mens rea) and there is a lot of evidence in his indictment that he wanted to profit off this act. He shouldn't be compared to Aaron Swartz
- runn1ng 14y ago
  More information about the case from ars technica, that supports your story http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
  - greenyoda 14y ago
    I don't approve of his motives or actions either, but still, it seems that spending years in jail is a disproportionate punishment for the amount of harm he may have caused AT&T or its customers. This article says that they had second thoughts about how smart their plans actually were and ended up deleting the data rather than selling it to anybody. And it's doubtful that their actions had any lasting effect on the stock price of AT&T - data leaks are a fairly frequent occurrence among large corporations.
- pprd 14y ago
  People that describe themselves as trolls are generally bigoted idiots and I feel no sympathy. I'm sorry if that's a stereotype but I can't help myself, the internet hasn't been nice to me.
  - Centigonal 14y ago
    Whether they're bigoted or idiotic shouldn't affect how the law affects them, though. If the person committing this crime was a nice, inoffensive guy, would the law remain justified?
crazygringo 14y ago
From Wikipedia: "On 20 November 2012, Auernheimer was found guilty of one count of identity fraud and one count of conspiracy to access a computer without authorization. Auernheimer tweeted that he would appeal the ruling." Is the problem that the laws themselves are terrible, or that the laws are being misused by overzealous prosecutors? I mean, if changing a public URL is considered "conspiracy to access a computer without authorization"... Or is this just not the full story, and he really was trying to do some "bad" stuff? But if not: what can be done to change the law? Is appearing "soft on hacking" such a bad idea that politicians just won't support something better? Or is it really difficult to craft laws that actually do criminalize "bad" activity, without also technically criminalizing innocent activity? What can be done?
- rayiner 14y ago
  The problem is that there is little consensus on what the boundaries in digital space should mean. Law makers, not without a certain logic, approach things from the principles of private property. Is changing a public URL considered "conspiracy to access a computer without authorization?" Well why would you do it, intentionally? Would you jiggle my door handle to see if that would unlock it? And if it was a crappy lock and jiggling it did unlock it, would it be unauthorized access to my property if you then walked in the door? There is a line of thinking in the tech community that accessing data you're not supposed to access is only "bad" if you do something "bad" with it. But in meat space, we enforce fences in their own right, whether or not there is any other criminal activity involved. Arguably, doing so makes the larger problem of ensuring that their isn't associated criminal activity more tractable. Actually, real world example: over the weekend someone stole my phone out of my (unlocked) car while it was parked in my apartment building's garage. Now, let's say he hadn't stolen the phone. Just rifled through the glove box and center console. No harm no foul, right? Of course not. We presume there is no good reason to be looking through someone else's car, even if you fully intend not to take anything. Now, that doesn't mean we should treat digital boundaries the same as physical ones, but I don't think it's as obvious as some people in the tech community make it out to be that there shouldn't be penalties (of some sort--the magnitude of such penalties is a whole another debate) for intentionally violating digital boundaries, regardless of how well they are protected.
Empro 14y ago
This is one side of the story. I'm not going to form an opinion, and then criticize the US government, weev, or AT&T, without seeing the other side.
- monochromatic 14y ago
  Good call. http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
  - DoubleMalt 14y ago
    Ars Technica lost a lot of respect with me yesterday when they stated in the analysis of Mega's security that symmetric encryption is inherently less safe than asymmetric. Also the quoted article does not appear to show considerable insight on internet security. Sheer directory traversal should never be considered a criminal act. Of course if they had followed through with the stock manipulation, this would warrant criminal punishment. Although of course stock manipulation is only punishable if you're not a bank or hedgefund which is sad.
    - lawnchair_larry 14y ago
      In the actual chat logs (which Ars ignores), another chatter brings up shorting the stock, weev explicitly says shorting the stock would be illegal and that if someone wants to do that, not to involve him. Aside from the fact that no one did it and this was obviously silly chat room banter to begin with, weev is actually showing intent of not running afoul of the law. Later in the chat, another user says that weev should post the leaked data to a public mailing list, and weev says no because that could potentially be criminal.
grappler 14y ago
As long as the court of public opinion is in session here, who is this guy? What other good/bad stuff has he done, outside this case?
- i386 14y ago
  http://en.wikipedia.org/wiki/Weev http://en.wikipedia.org/wiki/Weev
ericHosick 14y ago
The internet was created by "hackers" and is kept running by "hackers". The only way to make the internet more secure is through "hackers". Government, and the laws that are drafted, will not make the internet more secure. My general feeling is that laws against hacking will only result in a less secure internet. This, in turn, will lead to more laws against hacking. And so on...
miw-sec-work 14y ago
weev still thinks that AT&T 'published' this information. AT&T had no intention on 'publishing' this information, he abused their system in order to obtain it, then he leaked it. No weev, you found a bug in their web app, then _YOU_ willfully published other peoples personally identifying information for your own fame and glory. Unfortunately, someone who's name and details you leaked didn't like that, and called in a favor. The DoJ came after you hard. Your little tech crunch article chooses to omit crucial facts, and you are riding on the back of AAron Swartz again. You are nothing like AAron.
- guard-of-terra 14y ago
  Okay, when I find a bug in your web app I will publish it anonymously, widely and embarrassingly for you. That's because you didn't want to be friendly. You wanted to be hard. You wanted DoJ. Now you will be forced to want class action suit from your customers and bankrupcy.
  - miw-sec-work 14y ago
    Responsible disclosure to the vendor is one thing. Taking the fruits of your exploits and publishing it for glory and a "I leaked all that information because you wouldn't fix it" attitude is quite another. I would hope that if you discovered a vulnerability in one of my web applications you would contact me first and allow it to be resolved. Might even be lucrative for you. If you used that vulnerability to steal my database and publish it to the public domain -- when it has no place in the public domain, i would expect the DoJ to hunt you down. I never said anything about not being friendly. But if you are playing with peoples identities, their lives, this is not friendly at all.
    - guard-of-terra 14y ago
      As we saw from many and many articles, vendor disclosure often ends with threats, intimidation, your business interaction with them being canceled, and forcing you to sign a NDA on hostile terms. Once you contacted vendor it's not safe to go the pastebin route. So it becomes an unfeasible solution. On the other hand, try to "hunt down" a pastebin post original author. It would be the last of your worries.
slevin063 14y ago
whatever his intention was, data was publicly available in one way it is no different than AT&T posting all the emails in a public webpage! I think AT&T must be sued for poor security
droithomme 14y ago
Twelve months ago on this very site it was discussed how a private company named Path was, without permission and certainly illegally, stealing the entire address books of users and uploading it to their own servers. The CEO of that company appeared right here on this board personally (not surprising he follows this board as he has invested in YCombinator projects [http://www.forbes.com/sites/nicoleperlroth/2011/08/25/yc-combinator-start-ups-guess-which-will-be-worth-a-billion/ http://www.forbes.com/sites/nicoleperlroth/2011/08/25/yc-com...] ) and not only defended his actions but justified them, proud of the fine work of data theft he engaged in. [https://news.ycombinator.com/item?id=3563368 https://news.ycombinator.com/item?id=3563368] He also said in a comment on his blog that these actions of stealing entire address books was a common practice in industry: "This is currently the industry best practice" [https://news.ycombinator.com/item?id=3563639 https://news.ycombinator.com/item?id=3563639]. And in fact it turned out that companies as large as Twitter were also engaging in the same type and manner of data theft [http://articles.latimes.com/2012/feb/14/business/la-fi-tn-twitter-contacts-20120214 http://articles.latimes.com/2012/feb/14/business/la-fi-tn-tw...]. At that time some HN members, possibly some of the same ones here attacking this hacker (perhaps with good reason), defended the data-theft-for-profit actions of these companies. These two positions are not consistent. People may wish to pick a side of this issue and stick to their position if they wish to be taken seriously, or frame a coherent argument why it is acceptable for corporations to engage in data theft from individuals but the reverse should be severely punished with prison time and other penalties. Those who genuinely believe that weev should be prosecuted and imprisoned for his actions may wish to consider if the same call should be made for criminal proceedings against the larger scale and more clearly profit driven data theft actions taken by large and well funded companies such as Twitter, Path, Facebook, Apple, and many others.
- pragma 14y ago
  Oh my God. Did you really just write a holier-than-thou post comparing Dave Morin to weev? Have you even bothered READING anything weev wrote? A lot of people will never speak out against weev because of his scorched earth tactics. His list of enemies is a lot longer than a few Feds.
  - 14y ago
pprd 14y ago
I'm sure this is common knowledge. But this is his "troll" organization - http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Ameri...
sdoering 14y ago
Can someone clarify something for me? As I am no American, I try to understand, if making public the email-addresses of the iPad-owners was anything remotely illegal (AT&T wise). If so, why didn't weev just show law-enforcement - maybe with press present? Why not stage it so, that it is a deal between you and a press-outlet, a live showing of the problem, with a DA (or police/FBI, what ever) present? I know, it only works, if the API, making personal-email-addresses public was illegal. But if so, he would have shamed AT&T, he would have "normal" people caring, not only the internet-bubble and he would be relatively save in terms of legality. Or wouldn't he?
efdee 14y ago
"I did this because I despised people I think are unjustly wealthy and wanted to embarass them." -- This is what makes weev "not Aaron". Aaron wanted to further the human race, not embarass people just for the sake of it.
- lessnonymous 14y ago
  "Different from Aaron" isn't a legal defense. This guy is an ass, but he's not a criminal.
gambiting 14y ago
As a person coming from a former Soviet satellite republic, I must say, that the more I read,the less and less difference I see between the countries that are well known for disregarding human rights and the "land of freedom" - the US. The only difference I can think of is that they probably won't shoot you in the broad daylight, like it happens in Russia. But other than that, the image is complete - if you do something the government doesn't like,they can absolutely destroy you. They can put you in prison without a court order, freeze your assets for indefinite amount of time, spy on you, send agents to follow you, deny you the information why they are doing this, and they do threaten journalists to not write about some cases or risk prosecution for violating "national security". I am honestly sorry for people who live in the US and happen to do something that their government perceives as wrong.
smsm42 14y ago
Despite how similar cases of Swartz and Auernheimer seem, and despite later's appeal to social justice and freedom causes, I must admit I still have a hard time mustering sympathy for him. At least not even close to the sympathy I have to Swartz. I know justice has to be blind, but I'm not in the jury, so I have the luxury not to be. For me, the difference in approaches is striking. On one side, we have somebody who contributed to RSS and Reddit - I am not a big fan of Reddit, but one doesn't have do be a fan to recognize it's a major establishment in the Internet society - and on the other side, we have what? GNAA? I can't read minds, but to me, it just seems that while Swartz was moved by genuine concern and willing to overstep some boundaries, for Auernheimer it was much more about overstepping bounderies, creating mayhem and pissing people off, and the cause came just as a convenient channel to direct his destructive energies. That doesn't mean that I wish ill to Auernheimer - I wish that his sentence would be light and involve as little jail time as possible (by now realistically it looks like there would be some) - but I must say if we want to change public opinion about overprosecuting computer crimes, guys like Auernheimer don't exactly help the cause.

202 points by acremades 14y ago

AmVess 14y ago

Pardon my language, but what the fuck happened to this country.

monochromatic 14y ago
People started believing everything they come across that happens to fit in with a narrative they've accepted.
- weareconvo 14y ago
  What else is new?
driverdan 14y ago
What do you mean? This is how hackers have been treated since the creation of the computer. This is nothing new.

ghshephard 14y ago

I wasn't sure whether this is a spoof or not. Is he serious when he writes - "I did this because I despised people I think are unjustly wealthy and wanted to embarass them. " That was his admitted rationale - that he was seeking to embarrass people he despised because they were "unjustly wealthy?"

webXL 14y ago
There are plenty of ways to embarrass people that are legal, and possibly moral. The question is: was this one of them?
- jbigelow76 14y ago
  Another question would be is: does harvesting emails embarrass the, in his words, the "unjustly wealthy"? Is it the CEO or one of the board members that is responsible for web server configurations? Obviously pure speculation (mixed with cynicism) recalling this story of the email harvesting I have no problems imagining a conversation like this occurred: PR Flack: "Sir, we had a little PR snafu today and millions of email addresses of paying customers were exposed." CEO: "So what?" PR Flack: "Well it looks bad sir." CEO: "Fine, shitcan some 50K a year nerd in one of data centers and then issue a press release indicating how seriously we take customer privacy".
mootothemax 14y ago
I'm presuming that was satire, although why he'd write something so easy for a trial prosecution to jump on is beyond me.

DigitalSea 14y ago

When you hear of horrible stores like that of Aaron Swartz and the author of this insightful article Andrew Auernheimer it really paints a picture of just how afraid the US government is of the Internet. People lament China for their great firewall and control over its people and yet the US is starting to look more and more like China everyday. This is how revolts against governments start, absurd laws and persecution of innocent people which eventually pushes people over the edge and if they don't kill themselves they uprise and society gets thrown into disarray which only results in more oppressive laws and absurd persecution, it's a horrible cycle. All this guy did was exploit publicly available information. It seems the US is now sending people to jail for pointing out other peoples stupidity. Sure he probably went too far with the whole, "I want to embarrass AT&T thing" but trolling is not hacking and it's not like Andrew had to bypass any form of security to get the info in the first place. Anyone would swear this guy found a way to steal credit card details...

est 14y ago
China is not naturally terrible, China is just in that kind of shithole phase which any country might get into. It's the wrong direction a civilization evolves into.
warmwaffles 14y ago
eh, this article doesn't paint the whole story.
- DigitalSea 14y ago
  It doesn't need to paint the whole story. If the dude committed any overly serious crime, he'd still be in custody right now awaiting sentencing. They don't let you out on bail if you're a serious offender. I'm sure there is more than meets the eye here, but given the the spotlight being shined upon hacking cases like this of late, it's not hard to believe that what this guy says isn't what went down. Andrew was obviously a troll in every sense of the word, reckless and irresponsible but by no means did he have to bypass any security measures to get the email addresses. I would argue it's the equivalent of a bank leaving it's doors unlocked, alarm systems deactivated and lights on and someone walking in and taking money, then the bank complaining they got robbed, but this situation is blown way out of proportion and a metaphor like that would be over the top. What he did is no different to someone writing a script that scours the web looking for email addresses (a tactic spammers have used and gotten away with for years), except no trickery was required to get the addresses AT&T were handing them over unknowingly without recourse. This can't even be considered a hack, more of an exploit if anything. The stupidity of wanting to embarrass was no doubt a really stupid move to make, but definitely not some security defying hack. People shouldn't be jailed for acting like idiots, AT&T should be the ones being scalded for allowing this to happen in the first place. A company has a responsibility to keep customer data safe, AT&T should be no exception to that rule.

zmanji 14y ago

If anyone thinks weev deserves any sympathy, you don't know the full story. weev had malicious intent and wanted to harm AT&T by exposing users data. Instead of doing anything remotely rational he took all the data and wanted to sell it. Laws take into account indent (mens rea) and there is a lot of evidence in his indictment that he wanted to profit off this act. He shouldn't be compared to Aaron Swartz

runn1ng 14y ago
More information about the case from ars technica, that supports your story http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
- greenyoda 14y ago
  I don't approve of his motives or actions either, but still, it seems that spending years in jail is a disproportionate punishment for the amount of harm he may have caused AT&T or its customers. This article says that they had second thoughts about how smart their plans actually were and ended up deleting the data rather than selling it to anybody. And it's doubtful that their actions had any lasting effect on the stock price of AT&T - data leaks are a fairly frequent occurrence among large corporations.
pprd 14y ago
People that describe themselves as trolls are generally bigoted idiots and I feel no sympathy. I'm sorry if that's a stereotype but I can't help myself, the internet hasn't been nice to me.
- Centigonal 14y ago
  Whether they're bigoted or idiotic shouldn't affect how the law affects them, though. If the person committing this crime was a nice, inoffensive guy, would the law remain justified?

crazygringo 14y ago

From Wikipedia: "On 20 November 2012, Auernheimer was found guilty of one count of identity fraud and one count of conspiracy to access a computer without authorization. Auernheimer tweeted that he would appeal the ruling." Is the problem that the laws themselves are terrible, or that the laws are being misused by overzealous prosecutors? I mean, if changing a public URL is considered "conspiracy to access a computer without authorization"... Or is this just not the full story, and he really was trying to do some "bad" stuff? But if not: what can be done to change the law? Is appearing "soft on hacking" such a bad idea that politicians just won't support something better? Or is it really difficult to craft laws that actually do criminalize "bad" activity, without also technically criminalizing innocent activity? What can be done?

rayiner 14y ago
The problem is that there is little consensus on what the boundaries in digital space should mean. Law makers, not without a certain logic, approach things from the principles of private property. Is changing a public URL considered "conspiracy to access a computer without authorization?" Well why would you do it, intentionally? Would you jiggle my door handle to see if that would unlock it? And if it was a crappy lock and jiggling it did unlock it, would it be unauthorized access to my property if you then walked in the door? There is a line of thinking in the tech community that accessing data you're not supposed to access is only "bad" if you do something "bad" with it. But in meat space, we enforce fences in their own right, whether or not there is any other criminal activity involved. Arguably, doing so makes the larger problem of ensuring that their isn't associated criminal activity more tractable. Actually, real world example: over the weekend someone stole my phone out of my (unlocked) car while it was parked in my apartment building's garage. Now, let's say he hadn't stolen the phone. Just rifled through the glove box and center console. No harm no foul, right? Of course not. We presume there is no good reason to be looking through someone else's car, even if you fully intend not to take anything. Now, that doesn't mean we should treat digital boundaries the same as physical ones, but I don't think it's as obvious as some people in the tech community make it out to be that there shouldn't be penalties (of some sort--the magnitude of such penalties is a whole another debate) for intentionally violating digital boundaries, regardless of how well they are protected.

Empro 14y ago

This is one side of the story. I'm not going to form an opinion, and then criticize the US government, weev, or AT&T, without seeing the other side.

monochromatic 14y ago
Good call. http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
- DoubleMalt 14y ago
  Ars Technica lost a lot of respect with me yesterday when they stated in the analysis of Mega's security that symmetric encryption is inherently less safe than asymmetric. Also the quoted article does not appear to show considerable insight on internet security. Sheer directory traversal should never be considered a criminal act. Of course if they had followed through with the stock manipulation, this would warrant criminal punishment. Although of course stock manipulation is only punishable if you're not a bank or hedgefund which is sad.
  - lawnchair_larry 14y ago
    In the actual chat logs (which Ars ignores), another chatter brings up shorting the stock, weev explicitly says shorting the stock would be illegal and that if someone wants to do that, not to involve him. Aside from the fact that no one did it and this was obviously silly chat room banter to begin with, weev is actually showing intent of not running afoul of the law. Later in the chat, another user says that weev should post the leaked data to a public mailing list, and weev says no because that could potentially be criminal.

grappler 14y ago

As long as the court of public opinion is in session here, who is this guy? What other good/bad stuff has he done, outside this case?

i386 14y ago
http://en.wikipedia.org/wiki/Weev http://en.wikipedia.org/wiki/Weev

ericHosick 14y ago

The internet was created by "hackers" and is kept running by "hackers". The only way to make the internet more secure is through "hackers". Government, and the laws that are drafted, will not make the internet more secure. My general feeling is that laws against hacking will only result in a less secure internet. This, in turn, will lead to more laws against hacking. And so on...

miw-sec-work 14y ago

weev still thinks that AT&T 'published' this information. AT&T had no intention on 'publishing' this information, he abused their system in order to obtain it, then he leaked it. No weev, you found a bug in their web app, then _YOU_ willfully published other peoples personally identifying information for your own fame and glory. Unfortunately, someone who's name and details you leaked didn't like that, and called in a favor. The DoJ came after you hard. Your little tech crunch article chooses to omit crucial facts, and you are riding on the back of AAron Swartz again. You are nothing like AAron.

guard-of-terra 14y ago
Okay, when I find a bug in your web app I will publish it anonymously, widely and embarrassingly for you. That's because you didn't want to be friendly. You wanted to be hard. You wanted DoJ. Now you will be forced to want class action suit from your customers and bankrupcy.
- miw-sec-work 14y ago
  Responsible disclosure to the vendor is one thing. Taking the fruits of your exploits and publishing it for glory and a "I leaked all that information because you wouldn't fix it" attitude is quite another. I would hope that if you discovered a vulnerability in one of my web applications you would contact me first and allow it to be resolved. Might even be lucrative for you. If you used that vulnerability to steal my database and publish it to the public domain -- when it has no place in the public domain, i would expect the DoJ to hunt you down. I never said anything about not being friendly. But if you are playing with peoples identities, their lives, this is not friendly at all.
  - guard-of-terra 14y ago
    As we saw from many and many articles, vendor disclosure often ends with threats, intimidation, your business interaction with them being canceled, and forcing you to sign a NDA on hostile terms. Once you contacted vendor it's not safe to go the pastebin route. So it becomes an unfeasible solution. On the other hand, try to "hunt down" a pastebin post original author. It would be the last of your worries.

slevin063 14y ago

whatever his intention was, data was publicly available in one way it is no different than AT&T posting all the emails in a public webpage! I think AT&T must be sued for poor security

droithomme 14y ago

Twelve months ago on this very site it was discussed how a private company named Path was, without permission and certainly illegally, stealing the entire address books of users and uploading it to their own servers. The CEO of that company appeared right here on this board personally (not surprising he follows this board as he has invested in YCombinator projects [http://www.forbes.com/sites/nicoleperlroth/2011/08/25/yc-combinator-start-ups-guess-which-will-be-worth-a-billion/ http://www.forbes.com/sites/nicoleperlroth/2011/08/25/yc-com...] ) and not only defended his actions but justified them, proud of the fine work of data theft he engaged in. [https://news.ycombinator.com/item?id=3563368 https://news.ycombinator.com/item?id=3563368] He also said in a comment on his blog that these actions of stealing entire address books was a common practice in industry: "This is currently the industry best practice" [https://news.ycombinator.com/item?id=3563639 https://news.ycombinator.com/item?id=3563639]. And in fact it turned out that companies as large as Twitter were also engaging in the same type and manner of data theft [http://articles.latimes.com/2012/feb/14/business/la-fi-tn-twitter-contacts-20120214 http://articles.latimes.com/2012/feb/14/business/la-fi-tn-tw...]. At that time some HN members, possibly some of the same ones here attacking this hacker (perhaps with good reason), defended the data-theft-for-profit actions of these companies. These two positions are not consistent. People may wish to pick a side of this issue and stick to their position if they wish to be taken seriously, or frame a coherent argument why it is acceptable for corporations to engage in data theft from individuals but the reverse should be severely punished with prison time and other penalties. Those who genuinely believe that weev should be prosecuted and imprisoned for his actions may wish to consider if the same call should be made for criminal proceedings against the larger scale and more clearly profit driven data theft actions taken by large and well funded companies such as Twitter, Path, Facebook, Apple, and many others.

pragma 14y ago
Oh my God. Did you really just write a holier-than-thou post comparing Dave Morin to weev? Have you even bothered READING anything weev wrote? A lot of people will never speak out against weev because of his scorched earth tactics. His list of enemies is a lot longer than a few Feds.
- 14y ago

pprd 14y ago

I'm sure this is common knowledge. But this is his "troll" organization - http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Ameri...

sdoering 14y ago

Can someone clarify something for me? As I am no American, I try to understand, if making public the email-addresses of the iPad-owners was anything remotely illegal (AT&T wise). If so, why didn't weev just show law-enforcement - maybe with press present? Why not stage it so, that it is a deal between you and a press-outlet, a live showing of the problem, with a DA (or police/FBI, what ever) present? I know, it only works, if the API, making personal-email-addresses public was illegal. But if so, he would have shamed AT&T, he would have "normal" people caring, not only the internet-bubble and he would be relatively save in terms of legality. Or wouldn't he?

efdee 14y ago

"I did this because I despised people I think are unjustly wealthy and wanted to embarass them." -- This is what makes weev "not Aaron". Aaron wanted to further the human race, not embarass people just for the sake of it.

lessnonymous 14y ago
"Different from Aaron" isn't a legal defense. This guy is an ass, but he's not a criminal.

gambiting 14y ago

As a person coming from a former Soviet satellite republic, I must say, that the more I read,the less and less difference I see between the countries that are well known for disregarding human rights and the "land of freedom" - the US. The only difference I can think of is that they probably won't shoot you in the broad daylight, like it happens in Russia. But other than that, the image is complete - if you do something the government doesn't like,they can absolutely destroy you. They can put you in prison without a court order, freeze your assets for indefinite amount of time, spy on you, send agents to follow you, deny you the information why they are doing this, and they do threaten journalists to not write about some cases or risk prosecution for violating "national security". I am honestly sorry for people who live in the US and happen to do something that their government perceives as wrong.

smsm42 14y ago

Despite how similar cases of Swartz and Auernheimer seem, and despite later's appeal to social justice and freedom causes, I must admit I still have a hard time mustering sympathy for him. At least not even close to the sympathy I have to Swartz. I know justice has to be blind, but I'm not in the jury, so I have the luxury not to be. For me, the difference in approaches is striking. On one side, we have somebody who contributed to RSS and Reddit - I am not a big fan of Reddit, but one doesn't have do be a fan to recognize it's a major establishment in the Internet society - and on the other side, we have what? GNAA? I can't read minds, but to me, it just seems that while Swartz was moved by genuine concern and willing to overstep some boundaries, for Auernheimer it was much more about overstepping bounderies, creating mayhem and pissing people off, and the cause came just as a convenient channel to direct his destructive energies. That doesn't mean that I wish ill to Auernheimer - I wish that his sentence would be light and involve as little jail time as possible (by now realistically it looks like there would be some) - but I must say if we want to change public opinion about overprosecuting computer crimes, guys like Auernheimer don't exactly help the cause.