3 ms·

Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief expla

Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs."

jacquesm 12y ago
That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, immediately alert amazon to lock the account completely? So many questions. Anyway, they'll be updating this sooner or later, I just can't help but feel a bit weirded out by some of the things in there (and things that should be in there that are not). This is most likely just my professional paranoia acting up. And of course it is easy enough to be back-seat driver here, I'd hate to be in their shoes, no matter how they got there.
- tzs 12y ago
  > How could this mysterious hacker have known they had no other backups? I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled customers who leave, a few more disgruntled customers they have to placate with freebies, and making them more likely to pay next time an extortionist comes around. I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up. For instance, here are some examples for 18 USC 1030(a)(5), which covers causing damage or loss on a computer via unauthorized access, assuming no other factors that increase the sentence: LOSS MONTHS FINE $10k 0-6 $ 1k - 10k $30k 6-12 $ 2k - 20k $70k 10-16 $ 3k - 30k $120k 15-21 $ 4k - 40k $200k 21-27 $ 5k - 50k $400k 27-33 $ 6k - 60k $1,000k 33-41 $ 7.5k- 75k $2,500k 41-51 $ 7.5k- 75k $7,000k 51-63 $10k - 100k $20,000k 63-78 $12.5k-125k $50,000k 78-97 $12.5k-125k $100,000k 97-121 $15k - 150k $200,000k 121-151 $17.5- 175k $400,000k 151-188 $17.5- 175k above that 188-235 $20k - 200k Trying to cost someone a few thousand dollars worth of damage and instead killing their $10 million dollar company, for instance, changes it from 6 months tops to 5 years minimum. Ouch.
  - jacquesm 12y ago
    > I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. > He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up. That's plausible. It makes some sense that if you destroy something that you should be responsible for that. At the same time, even for a hacker the assumption that there would be back-ups would be a fairly logical one, though I'd hate to be in a position of fielding that defense.
    - danielweber 12y ago
      If I throw a rock into your garage, and knock over your precariously balanced anvil onto a Lamborghini, that's 100% on me. http://en.wikipedia.org/wiki/Eggshell_skull http://en.wikipedia.org/wiki/Eggshell_skull

jacquesm 12y ago

That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, immediately alert amazon to lock the account completely? So many questions. Anyway, they'll be updating this sooner or later, I just can't help but feel a bit weirded out by some of the things in there (and things that should be in there that are not). This is most likely just my professional paranoia acting up. And of course it is easy enough to be back-seat driver here, I'd hate to be in their shoes, no matter how they got there.

tzs 12y ago
> How could this mysterious hacker have known they had no other backups? I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled customers who leave, a few more disgruntled customers they have to placate with freebies, and making them more likely to pay next time an extortionist comes around. I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up. For instance, here are some examples for 18 USC 1030(a)(5), which covers causing damage or loss on a computer via unauthorized access, assuming no other factors that increase the sentence: LOSS MONTHS FINE $10k 0-6 $ 1k - 10k $30k 6-12 $ 2k - 20k $70k 10-16 $ 3k - 30k $120k 15-21 $ 4k - 40k $200k 21-27 $ 5k - 50k $400k 27-33 $ 6k - 60k $1,000k 33-41 $ 7.5k- 75k $2,500k 41-51 $ 7.5k- 75k $7,000k 51-63 $10k - 100k $20,000k 63-78 $12.5k-125k $50,000k 78-97 $12.5k-125k $100,000k 97-121 $15k - 150k $200,000k 121-151 $17.5- 175k $400,000k 151-188 $17.5- 175k above that 188-235 $20k - 200k Trying to cost someone a few thousand dollars worth of damage and instead killing their $10 million dollar company, for instance, changes it from 6 months tops to 5 years minimum. Ouch.
- jacquesm 12y ago
  > I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. > He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up. That's plausible. It makes some sense that if you destroy something that you should be responsible for that. At the same time, even for a hacker the assumption that there would be back-ups would be a fairly logical one, though I'd hate to be in a position of fielding that defense.
  - danielweber 12y ago
    If I throw a rock into your garage, and knock over your precariously balanced anvil onto a Lamborghini, that's 100% on me. http://en.wikipedia.org/wiki/Eggshell_skull http://en.wikipedia.org/wiki/Eggshell_skull