3 ms·
Did Andrew try to sell the data for profit? He took a sample of the output to a journalist at Gawker and notified AT&T [0]. Why would one do that if he wants to
by denzil_correa 14y ago
Did Andrew try to sell the data for profit? He took a sample of the output to a journalist at Gawker and notified AT&T [0]. Why would one do that if he wants to sell data? However, what worries me is that in the same article it is mentioned that
Since a member of the group tells us the script was
shared with third-parties prior to AT&T closing the
security hole, it's not known exactly whose hands the
exploit fell into and what those people did with the
names they obtained.
It's pretty hard to know what really happened. I don't understand Auernheimer's actions at all - on one hand he informs AT&T/Gawker and on the other he sends the script to third parties. Even if his intentions were not malicious, Auernheimer acted immaturely. The lengthy blog post he wrote explaining his actions is no longer available and here's a cached version [1]. Some of the points directly contradict with the earlier Gawker article.
The only person to receive the dataset was Gawker
journalist Ryan Tate who responsibly redacted it.
So, does this mean he didn't reveal the dataset but revealed the script?
[0] http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400...
[1] http://webcache.googleusercontent.com/search?q=cache:PChrEDRqtCwJ:security.goatse.fr/on-disclosure-ethics+&cd=2&hl=en&ct=clnk&gl=in http://webcache.googleusercontent.com/search?q=cache:PChrEDR...
- Cushman 14y agoJust to be clear, by "script" here do we mean "Dude, check this out, you can just change /accounts?id=12345 to /accounts?id=12346"?
- denzil_correa 14y agoGood point. The question I would ask is - Should he be doing even that given the fact he is in complete knowledge of the situation?
- deleted 14y ago[deleted]
- duskwuff 14y agoBy "script", we mean a program written in PHP* which would generate plausible iPad ICC-IDs, run them by AT&T's web site, and save any ICC-IDs and email addresses it ended up with. *: per the Gawker article, http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400...
- dmix 14y agoThere's also an article he wrote in Wired debating the philosophy of what to do after finding an exploit: http://www.wired.com/opinion/2012/11/hacking-choice-and-disclosure/ http://www.wired.com/opinion/2012/11/hacking-choice-and-disc... It doesn't quite answer your question on what he did in this case, but it shows his perspective on it. He is correct that the end result of disclosure is shades of gray - not black and white, as we've seen recently with the student in Montreal who was suspended.
- denzil_correa 14y agoI am still intrigued as to what happened because it has ramifications. Did Gawker report something which did not happen? OR Did Andrew indeed play mischief? Off topic - > He is correct that the end result of disclosure is shades of gray - not black and white, as we've seen recently with the student in Montreal who was suspended. Well, the Montreal youth seems to be offered a job from the same part time company which led to his expulsion [0]. I kind of predicted this on HN 2 days back [1]. :-D [0] http://news.ycombinator.com/item?id=5106329 http://news.ycombinator.com/item?id=5106329 [1] http://news.ycombinator.com/item?id=5090108 http://news.ycombinator.com/item?id=5090108
- dmix 14y agoWell I personally trust markets to accurately appreciate security talent (and accurately evaluate the damages of a hacking case) but not government legislators.
- deleted 14y ago[deleted]
- SoftwareMaven 14y agoIs immaturity with no actual harm done by him worth five or ten years of his life?
- denzil_correa 14y ago> Is immaturity with no actual harm done This itself is a contentious point. I have already placed all facts which are out in the public domain. Any help to reach a concrete conclusion would be appreciated.