5 ms·

A "security researcher" posted a video with compromised accounts claiming to have deleted all the data after reporting the bugs to Apple: http://www.youtube.com

A "security researcher" posted a video with compromised accounts claiming to have deleted all the data after reporting the bugs to Apple: http://www.youtube.com/watch?v=q000_EOWy80 http://www.youtube.com/watch?v=q000_EOWy80 It is really unfortunate and irresponsible that data in the video is not obscured.

Subuatai 13y ago
How is this legal? Seems like someone should be facing charges for this...
- kingkilr 13y ago
  The Computer Fraud and Abuses Act is incredibly broad, it's basically impossible to prove a vulnerability like this exists without violating it.
- chmars 13y ago
  It's of course NOT legal … I've just reported the video to Google.
  - Subuatai 13y ago
    I've just reported the video to Google sounds like a dirty, dirty euphemism
  - draugadrotten 13y ago
    It's amusing (and sad) that while the NSA monitors all emails and every single phone calls of all Americans, but still fails to detect and prevent a computer intrusion of this magnitude into Americas largest company.
grey-area 13y ago
There was no need to take all that data at all. If he was interested in security he could just set up a test account, test the vuln with that account only, and send Apple the results. Job done. I doubt Apple would bother to prosecute for that, they might even thank him. Do they pay bounties for reports on security vulnerabilities? If not they should. Taking all the data and publishing it, and then bragging about it on youtube (!) just leaves him open to prosecution, and I imagine Apple will go after him now for publishing the data of their developers. I'm not sure I understand the logic of publishing this, but there seems to be a mentality of braggadocio among wannabe security researchers - 1. Hack high profile website and publicise it 2. ????? 3. Profit! I'm not sure what step 2 is.
- krelian 13y ago
  I don't really understand the amazement of everyone after looking at this video. He's Turkish (I think), not bound by U.S law and published this video as some kind of demonstration of his capabilities as a security consultant hoping to secure a nice gig or two. Not the brightest idea he had there but neither are the responses here auto-assuming that if the video is in English then that person must be bound by U.S law.
  - alayne 13y ago
    He's bound by any U.S. law covered in the U.S./Turkey extradition treaty.
    - ptwiggens 13y ago
      Generally speaking countries don't extradite their own citizens.
  - famblycat 13y ago
    The article below says he's UK based. http://mashable.com/2013/07/22/security-researcher-apple-hack/ http://mashable.com/2013/07/22/security-researcher-apple-hac...
zapu 13y ago
Wow. I'm speechless. This guy is really stupid or doesn't care. He can (or rather "will") get into serious legal troubles.
- dubcanada 13y ago
  I'm not 100% sure, because he didn't even blank out the emails.
- chiph 13y ago
  Agreed. What he did might have worked in 2004. But these days he's just going to end up in serious legal hot water.
rdl 13y ago
I wonder how much of the problem is due to him being foreign (Turkish?) and neither speaking English as a first language nor necessarily being immersed in the technical/legal culture of the US. There might be a use for some kind of legal/PR advisory organization for people who want to do "aggressive disclosure" or "full disclosure" instead of "responsible disclosure", while not being proper blackhats with anonymity and lulzery.
seany 13y ago
The video got taken down, is there a mirror anywhere?

Subuatai 13y ago

How is this legal? Seems like someone should be facing charges for this...

kingkilr 13y ago
The Computer Fraud and Abuses Act is incredibly broad, it's basically impossible to prove a vulnerability like this exists without violating it.
chmars 13y ago
It's of course NOT legal … I've just reported the video to Google.
- Subuatai 13y ago
  I've just reported the video to Google sounds like a dirty, dirty euphemism
- draugadrotten 13y ago
  It's amusing (and sad) that while the NSA monitors all emails and every single phone calls of all Americans, but still fails to detect and prevent a computer intrusion of this magnitude into Americas largest company.

grey-area 13y ago

There was no need to take all that data at all. If he was interested in security he could just set up a test account, test the vuln with that account only, and send Apple the results. Job done. I doubt Apple would bother to prosecute for that, they might even thank him. Do they pay bounties for reports on security vulnerabilities? If not they should. Taking all the data and publishing it, and then bragging about it on youtube (!) just leaves him open to prosecution, and I imagine Apple will go after him now for publishing the data of their developers. I'm not sure I understand the logic of publishing this, but there seems to be a mentality of braggadocio among wannabe security researchers - 1. Hack high profile website and publicise it 2. ????? 3. Profit! I'm not sure what step 2 is.

krelian 13y ago
I don't really understand the amazement of everyone after looking at this video. He's Turkish (I think), not bound by U.S law and published this video as some kind of demonstration of his capabilities as a security consultant hoping to secure a nice gig or two. Not the brightest idea he had there but neither are the responses here auto-assuming that if the video is in English then that person must be bound by U.S law.
- alayne 13y ago
  He's bound by any U.S. law covered in the U.S./Turkey extradition treaty.
  - ptwiggens 13y ago
    Generally speaking countries don't extradite their own citizens.
- famblycat 13y ago
  The article below says he's UK based. http://mashable.com/2013/07/22/security-researcher-apple-hack/ http://mashable.com/2013/07/22/security-researcher-apple-hac...

zapu 13y ago

Wow. I'm speechless. This guy is really stupid or doesn't care. He can (or rather "will") get into serious legal troubles.

dubcanada 13y ago
I'm not 100% sure, because he didn't even blank out the emails.
chiph 13y ago
Agreed. What he did might have worked in 2004. But these days he's just going to end up in serious legal hot water.

rdl 13y ago

I wonder how much of the problem is due to him being foreign (Turkish?) and neither speaking English as a first language nor necessarily being immersed in the technical/legal culture of the US. There might be a use for some kind of legal/PR advisory organization for people who want to do "aggressive disclosure" or "full disclosure" instead of "responsible disclosure", while not being proper blackhats with anonymity and lulzery.

seany 13y ago

The video got taken down, is there a mirror anywhere?