10 ms·

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the art

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly relevant, it's an important technical detail. Sure he could have sat and put each string in in a long laborious process, but they circumvented that and went straight to the faster option. Once they'd established there was a hole they could have stopped rather than going for the motherlode. - `if there’s no technical barrier...`, there was a technical barrier, it was just very, very small. Don't misunderstand me, AT&T are massive idiots for letting a security violation on that scale leak out into the wild, and they should't have been surprised for it to be discovered, but if you're doing live security research and find a hole is taking 114k email addresses a particularly good way to report it? He certainly didn't deserve the ridiculous amount of time that he got, but he's not an innocent in this example by any stretch of the imagination.

sneak 13y ago
It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the sim serial (ICCID), and ATT sends the HTML form with the email address already filled in, so all the user has to do is enter the password. As it turns out, ICCIDs are sequential integers. It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. Weev knew that the greater the number of records he got, the worse it would reflect upon ATT, and rightfully so.
- res0nat0r 13y ago
  >It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.
  - sneak 13y ago
    You're right, the law can't. That's why we should let the final verdict for authorized/unauthorized lie IN THE CODE DEPLOYED BY THE OWNER, not the law (or the owner's retroactive statements). It's pretty simple, really. This would be a non-issue if you programmed your cyborg to go pick up milk from the store and it started handing out $20s to strangers in the dairy aisle. Obviously that's no fault but your own. Why is it different for a webserver? It is massively unfair to expect someone to make assumptions about the intent of a remote system, programmed, configured, and deployed by people they have never met or communicated with, in order to avoid criminal liability. I'm not sure what the problem is here. It seems like simple common sense to me.
    - thenmar 13y ago
      So if a bank accidentally deposits $1bn in your account, that becomes yours? You're looking for a simple answer to a nuanced issue where one just doesn't exist.
      - crymer11 13y ago
        That example is not at all the same as what's being discussed. The issue at hand is whether access to a public URL is authorized and who is responsible for determining that authorization.
        ds9 13y ago
        Actually the analogy is OK, the interpretation is wrong. If you disagree with sneak you're saying the account holder should be prosecuted! Claiming ownership of the money would be like weev selling the email list to spammers, which he didn't. What he did was reveal the defect - like the acoount-holder reporting the mis-deposit.
- vertex-four 13y ago
  So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems? It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system. Simplifying things a little, there was an API, which looked somewhat like this: GET http://example.com/get-email?device-id=123456 > example@example.com Now, if we replaced that with some sort of bespoke raw socket interface that somebody would have to reverse-engineer: CONNECT example.com:4567 > <somemessage>123456<somemessage> < <someresponse>example@example.com<someresponse> Would you still be arguing "it's on the web"? What if I added a field named "password" which always had to be the same value, which was distributed to all devices? What if it wasn't email addresses, but instead credit card data, or sensitive data such as your race, religion, sexuality, political leanings, medical information...? I'm not attacking you, simply stating that in my opinion, it's not as simple as "if you can access it, it's public". There's an expectation of privacy for many types of data, especially when the data owner is not explicitly intending to publish the data.
  - sneak 13y ago
    Just because there's an expectation of privacy doesn't mean that such an expectation is reasonable. It is not reasonable to have an expectation of privacy if your root password is "password" and you have ssh open to the world, no.
    - walid 13y ago
      False. There is an expectation of privacy in a public bathroom even if it doesn't specify that cameras are not allowed.
  - sneak 13y ago
    Also, both SSH and HTTP have defined authentication mechanisms built into the protocol. The HTTP spec has a response code, 403, for indicating that a request (potentially without authentication information) is unauthorized. SSH has a similar defined response. If there's _no authentication around it_, I would argue that it's published to the public web, regardless of the protocol in use to deliver it.
- nicholassmith 13y ago
  "It should always be perfectly legal to access a remote computer system via a publicly accessible interface.", no it shouldn't, no more than it should be legal for me to walk into your house if you've not locked the door. The system worked exactly as AT&T intended, in circumstances they'd clearly not planned for. If they'd bothered doing a risk assessment they'd have spotted it, they took the lazy option and it didn't work.
  - sneak 13y ago
    Please stop with the physical analogies. Locks and doors and physical space have well defined ways of indicating "authorized" and "unauthorized". We also have a social contract about entering spaces of others, even if there are no locks at all. The social contract of the web is that "you can send a request to any webserver on the internet without permission". That's how the web _works_. It's up to that server, and nothing else, to be the final arbiter of authorized/unauthorized. You don't get to move the goalposts after the fact, saying "oh, well we didn't INTEND for you to use it that way". That's putting the burden to avoid jail on to the requester, who is now responsible for making assumptions and inferring the intent of programmers/admins they've never met or communicated with. It's lunacy.
    - nicholassmith 13y ago
      "Please stop with the physical analogies.", weev relied on one during his defence, so they're fair game. The social contract of the web is usurped by the legal contract of society, whether or not the way the legal framework is being applied in a just and fair manner is certainly up for debate. And honestly can you say, hand on heart, that the intention of the AT&T developers was to purposefully leave that hole there? That'd be lunacy. Clearly it's a mistake, an 'oh crap, we didn't think of that'.
      - sneak 13y ago
        It was expressly to support autocomplete. Upon going to the wireless account management webpage on the iPad, it would already have the email address last associated with that ICCID (sim card) filled in in the form input element, so that the user would only have to type in their password, and not the email address as well. It was an express design decision to reduce the number of steps taken by a user to reactivate service. They explicitly chose to weaken the authentication system to increase convenience, and didn't want to do credential management, so they just used the sequential integer ICCID to fetch the email address last associated with that SIM. Afterward, they said "oh, well, we didn't INTEND for you to use it that way", despite the fact that this is very obviously gross negligence. It's not a hole - it's a feature they chose to implement. The bad law that lets anyone, retroactively, define "unauthorized access" by their own attitudes and whims, is the problem here.
- lolcraft 13y ago
  Even if you left the door of your house open, it wouldn't be legal for me to go inside and take your TV in protest. Frankly, you're just torturing some unclearly defined terms ("Information Published on the Web", or "Expressly Designed Feature", or "it's up to a Remote System to respond appropiately") to make a point. Thing is, most of those terms are not legal, well defined terms; and when they are, your interpretation is lacking. You'd have a hard time convincing any judge that a company expressly desired to publish email directions of all of their customers, via some opaque and undocumented URL manipulation. Disclaimer: I don't agree with weev's conviction, and some of its aspects are outrageous ("conspiracy to access a computer without authorization"?). But this "it was public information" angle is just bullshit. It's just badly reasoned.
  - sneak 13y ago
    > But this "it was public information" angle is just bullshit. It's just badly reasoned. AT&T admitted in court during the trial that they had published the email addresses on the web. That's what "publishing" is, these days: putting stuff on a webserver without authentication in front of it.
- tptacek 13y ago
  That first sentence doesn't make sense. If a merchant screws up and manages to post a flat ASCII text file of credit card accounts with CVV numbers on a URL in a directory with an Apache index enabled, your argument says "well, sucks for the merchant and all their customers". There are clearly cases where the mere fact that someone has left something somehow exposed to a web browser does not connote authorization to access it. Those are the cases where a reasonable person, seeing what the data is after stumbling across it, would understand the exposure to have been a mistake, and not an authorization.
  - walid 13y ago
    True when you say that there can be data left out in public by mistake without public access authorization. However it is not the responsibility of the accessing entity to preserve this data private. An analogy is if your bank left your money easily accessible on a table in front of the bank without security. We are used to the idea of ownership, but this issue is a matter of blame. Here AT&T is the one to blame for the lack of security, not someone who saw that AT&T lacks security. Back to the bank analogy, it is not the public's duty to guard your money for the bank. Nor should someone else be jailed for money literally left outside on the table.
    - tptacek 13y ago
      This is, literally, an argument that if you stumble across a text file full of credit card numbers, expiration dates, and CVV codes, it should be lawful for you to put it up on Pastebin.
      - rhizome 13y ago
        What law would cover that, some implied duty to help protect something that could be intended to be kept secret? I'm pretty sure that duty doesn't exist.
        m0nastic 13y ago
        Wire fraud, for one. That's pretty much a textbook example of it.
- smsm42 13y ago
  >>> It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. By this logic, any information stored on any computer accessible via the Internet is published, so no unauthorized access to any data not behind an air gap is illegal. Including breaking into your private mailbox or your online banking account. I don't think I'd be ready to accept this. Are you?
  - martinlandau 13y ago
    The NSA palantir types sure seem to think anything on any computer is free game - LOL! Email, phones, banks yah? Shouldn't things be just the opposite of how they are according to the founding fathers, the government types that hack us should be held to a FAR HIGHER standard than some arkansas boy like WEEV, yet they do worse, and get hookers in south america and lots of parties, while weev rots in jail for 4 years, something doesn't seem right to me about that situation.
solaris999 13y ago
There's certainly a fairly well culturally established method of dealing with holes in corporate internet security which Weev did not follow in this case. However as a third person it's also useful for me to know the scope of this hole and how liable my own information was. Weev here is guilty of exactly the same reasoning that AT&T realised in court which is that a message is irrelevant without impact. And which has more impact: an article about how a vulnerability in AT&T security could have resulted in some leaked emails or an article about 114 000 potentially leaked email addresses?
pi18n 13y ago
If he were guessing passwords jail time might be appropriate. It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?
- walid 13y ago
  Mostly. Seems like AT&T is operating like http://www.mailinator.com/ http://www.mailinator.com/ where you can access anything using an ID without a password.
Fuxy 13y ago
The question is after hearing AT&T prosecute Spitler for discovering such a simple security hole (it could have been a lot more complex) would you feel safe disclosing any security hole even with the best intentions? The answer is obviously no and if you can't make it public without risking being sent to prison the only option is selling it to some shady spammers. Which would you prefer happened? From my point of view what they are doing is basically pushing the hackers to the "dark side". If we disclose it we get arrested if we sell it we might get caught and arrested or make a lot of money. I'll take option 2.
- nicholassmith 13y ago
  Yes I would, but I'd follow the standard responsible disclosure rules that are fairly common place. As far as the information that's been presented makes out, there was no responsible disclosure. In fact, weev attempted to say they were going down that route whilst at the same time discussing on irc how they could use the information for fairly black hat purposes. I think the industry basically needs to take the informal responsible disclosure rules and try and get them made a bit more formal, for everyones benefit.
  - phaus 13y ago
    One of the ongoing issues in the security industry is that there is no standardized form of disclosure. There are frameworks that have been put together, but only some companies embrace them. Other companies are openly hostile towards any solution that doesn't leave the power entirely in their own hands. Basically, many large companies feel that the public should remain uninformed, which then leaves the company free to keep producing insecure software.
    - nicholassmith 13y ago
      Which is why I think there should be some attempt at a formal body, the EFF is in the right place to spearhead an attempt at implementing something along those lines.
      - 13y ago
antitrust 13y ago
Looks like proof of concept to me. The test in my mind is what gets done with those 114k addresses. Did they get leaked? No -- and the company was notified of the breech? No harm, no foul.

sneak 13y ago

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the sim serial (ICCID), and ATT sends the HTML form with the email address already filled in, so all the user has to do is enter the password. As it turns out, ICCIDs are sequential integers. It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. Weev knew that the greater the number of records he got, the worse it would reflect upon ATT, and rightfully so.

res0nat0r 13y ago
>It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.
- sneak 13y ago
  You're right, the law can't. That's why we should let the final verdict for authorized/unauthorized lie IN THE CODE DEPLOYED BY THE OWNER, not the law (or the owner's retroactive statements). It's pretty simple, really. This would be a non-issue if you programmed your cyborg to go pick up milk from the store and it started handing out $20s to strangers in the dairy aisle. Obviously that's no fault but your own. Why is it different for a webserver? It is massively unfair to expect someone to make assumptions about the intent of a remote system, programmed, configured, and deployed by people they have never met or communicated with, in order to avoid criminal liability. I'm not sure what the problem is here. It seems like simple common sense to me.
  - thenmar 13y ago
    So if a bank accidentally deposits $1bn in your account, that becomes yours? You're looking for a simple answer to a nuanced issue where one just doesn't exist.
    - crymer11 13y ago
      That example is not at all the same as what's being discussed. The issue at hand is whether access to a public URL is authorized and who is responsible for determining that authorization.
      - ds9 13y ago
        Actually the analogy is OK, the interpretation is wrong. If you disagree with sneak you're saying the account holder should be prosecuted! Claiming ownership of the money would be like weev selling the email list to spammers, which he didn't. What he did was reveal the defect - like the acoount-holder reporting the mis-deposit.
vertex-four 13y ago
So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems? It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system. Simplifying things a little, there was an API, which looked somewhat like this: GET http://example.com/get-email?device-id=123456 > example@example.com Now, if we replaced that with some sort of bespoke raw socket interface that somebody would have to reverse-engineer: CONNECT example.com:4567 > <somemessage>123456<somemessage> < <someresponse>example@example.com<someresponse> Would you still be arguing "it's on the web"? What if I added a field named "password" which always had to be the same value, which was distributed to all devices? What if it wasn't email addresses, but instead credit card data, or sensitive data such as your race, religion, sexuality, political leanings, medical information...? I'm not attacking you, simply stating that in my opinion, it's not as simple as "if you can access it, it's public". There's an expectation of privacy for many types of data, especially when the data owner is not explicitly intending to publish the data.
- sneak 13y ago
  Just because there's an expectation of privacy doesn't mean that such an expectation is reasonable. It is not reasonable to have an expectation of privacy if your root password is "password" and you have ssh open to the world, no.
  - walid 13y ago
    False. There is an expectation of privacy in a public bathroom even if it doesn't specify that cameras are not allowed.
- sneak 13y ago
  Also, both SSH and HTTP have defined authentication mechanisms built into the protocol. The HTTP spec has a response code, 403, for indicating that a request (potentially without authentication information) is unauthorized. SSH has a similar defined response. If there's _no authentication around it_, I would argue that it's published to the public web, regardless of the protocol in use to deliver it.
nicholassmith 13y ago
"It should always be perfectly legal to access a remote computer system via a publicly accessible interface.", no it shouldn't, no more than it should be legal for me to walk into your house if you've not locked the door. The system worked exactly as AT&T intended, in circumstances they'd clearly not planned for. If they'd bothered doing a risk assessment they'd have spotted it, they took the lazy option and it didn't work.
- sneak 13y ago
  Please stop with the physical analogies. Locks and doors and physical space have well defined ways of indicating "authorized" and "unauthorized". We also have a social contract about entering spaces of others, even if there are no locks at all. The social contract of the web is that "you can send a request to any webserver on the internet without permission". That's how the web _works_. It's up to that server, and nothing else, to be the final arbiter of authorized/unauthorized. You don't get to move the goalposts after the fact, saying "oh, well we didn't INTEND for you to use it that way". That's putting the burden to avoid jail on to the requester, who is now responsible for making assumptions and inferring the intent of programmers/admins they've never met or communicated with. It's lunacy.
  - nicholassmith 13y ago
    "Please stop with the physical analogies.", weev relied on one during his defence, so they're fair game. The social contract of the web is usurped by the legal contract of society, whether or not the way the legal framework is being applied in a just and fair manner is certainly up for debate. And honestly can you say, hand on heart, that the intention of the AT&T developers was to purposefully leave that hole there? That'd be lunacy. Clearly it's a mistake, an 'oh crap, we didn't think of that'.
    - sneak 13y ago
      It was expressly to support autocomplete. Upon going to the wireless account management webpage on the iPad, it would already have the email address last associated with that ICCID (sim card) filled in in the form input element, so that the user would only have to type in their password, and not the email address as well. It was an express design decision to reduce the number of steps taken by a user to reactivate service. They explicitly chose to weaken the authentication system to increase convenience, and didn't want to do credential management, so they just used the sequential integer ICCID to fetch the email address last associated with that SIM. Afterward, they said "oh, well, we didn't INTEND for you to use it that way", despite the fact that this is very obviously gross negligence. It's not a hole - it's a feature they chose to implement. The bad law that lets anyone, retroactively, define "unauthorized access" by their own attitudes and whims, is the problem here.
lolcraft 13y ago
Even if you left the door of your house open, it wouldn't be legal for me to go inside and take your TV in protest. Frankly, you're just torturing some unclearly defined terms ("Information Published on the Web", or "Expressly Designed Feature", or "it's up to a Remote System to respond appropiately") to make a point. Thing is, most of those terms are not legal, well defined terms; and when they are, your interpretation is lacking. You'd have a hard time convincing any judge that a company expressly desired to publish email directions of all of their customers, via some opaque and undocumented URL manipulation. Disclaimer: I don't agree with weev's conviction, and some of its aspects are outrageous ("conspiracy to access a computer without authorization"?). But this "it was public information" angle is just bullshit. It's just badly reasoned.
- sneak 13y ago
  > But this "it was public information" angle is just bullshit. It's just badly reasoned. AT&T admitted in court during the trial that they had published the email addresses on the web. That's what "publishing" is, these days: putting stuff on a webserver without authentication in front of it.
tptacek 13y ago
That first sentence doesn't make sense. If a merchant screws up and manages to post a flat ASCII text file of credit card accounts with CVV numbers on a URL in a directory with an Apache index enabled, your argument says "well, sucks for the merchant and all their customers". There are clearly cases where the mere fact that someone has left something somehow exposed to a web browser does not connote authorization to access it. Those are the cases where a reasonable person, seeing what the data is after stumbling across it, would understand the exposure to have been a mistake, and not an authorization.
- walid 13y ago
  True when you say that there can be data left out in public by mistake without public access authorization. However it is not the responsibility of the accessing entity to preserve this data private. An analogy is if your bank left your money easily accessible on a table in front of the bank without security. We are used to the idea of ownership, but this issue is a matter of blame. Here AT&T is the one to blame for the lack of security, not someone who saw that AT&T lacks security. Back to the bank analogy, it is not the public's duty to guard your money for the bank. Nor should someone else be jailed for money literally left outside on the table.
  - tptacek 13y ago
    This is, literally, an argument that if you stumble across a text file full of credit card numbers, expiration dates, and CVV codes, it should be lawful for you to put it up on Pastebin.
    - rhizome 13y ago
      What law would cover that, some implied duty to help protect something that could be intended to be kept secret? I'm pretty sure that duty doesn't exist.
      - m0nastic 13y ago
        Wire fraud, for one. That's pretty much a textbook example of it.
smsm42 13y ago
>>> It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. By this logic, any information stored on any computer accessible via the Internet is published, so no unauthorized access to any data not behind an air gap is illegal. Including breaking into your private mailbox or your online banking account. I don't think I'd be ready to accept this. Are you?
- martinlandau 13y ago
  The NSA palantir types sure seem to think anything on any computer is free game - LOL! Email, phones, banks yah? Shouldn't things be just the opposite of how they are according to the founding fathers, the government types that hack us should be held to a FAR HIGHER standard than some arkansas boy like WEEV, yet they do worse, and get hookers in south america and lots of parties, while weev rots in jail for 4 years, something doesn't seem right to me about that situation.

solaris999 13y ago

There's certainly a fairly well culturally established method of dealing with holes in corporate internet security which Weev did not follow in this case. However as a third person it's also useful for me to know the scope of this hole and how liable my own information was. Weev here is guilty of exactly the same reasoning that AT&T realised in court which is that a message is irrelevant without impact. And which has more impact: an article about how a vulnerability in AT&T security could have resulted in some leaked emails or an article about 114 000 potentially leaked email addresses?

pi18n 13y ago

If he were guessing passwords jail time might be appropriate. It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?

walid 13y ago
Mostly. Seems like AT&T is operating like http://www.mailinator.com/ http://www.mailinator.com/ where you can access anything using an ID without a password.

Fuxy 13y ago

The question is after hearing AT&T prosecute Spitler for discovering such a simple security hole (it could have been a lot more complex) would you feel safe disclosing any security hole even with the best intentions? The answer is obviously no and if you can't make it public without risking being sent to prison the only option is selling it to some shady spammers. Which would you prefer happened? From my point of view what they are doing is basically pushing the hackers to the "dark side". If we disclose it we get arrested if we sell it we might get caught and arrested or make a lot of money. I'll take option 2.

nicholassmith 13y ago
Yes I would, but I'd follow the standard responsible disclosure rules that are fairly common place. As far as the information that's been presented makes out, there was no responsible disclosure. In fact, weev attempted to say they were going down that route whilst at the same time discussing on irc how they could use the information for fairly black hat purposes. I think the industry basically needs to take the informal responsible disclosure rules and try and get them made a bit more formal, for everyones benefit.
- phaus 13y ago
  One of the ongoing issues in the security industry is that there is no standardized form of disclosure. There are frameworks that have been put together, but only some companies embrace them. Other companies are openly hostile towards any solution that doesn't leave the power entirely in their own hands. Basically, many large companies feel that the public should remain uninformed, which then leaves the company free to keep producing insecure software.
  - nicholassmith 13y ago
    Which is why I think there should be some attempt at a formal body, the EFF is in the right place to spearhead an attempt at implementing something along those lines.
    - 13y ago

antitrust 13y ago

Looks like proof of concept to me. The test in my mind is what gets done with those 114k addresses. Did they get leaked? No -- and the company was notified of the breech? No harm, no foul.