5 ms·

Ok so wait, in response to getting scammed you hacked into this guys accounts to gather information? And then admit to it publicly? And then dox the guy? Unprof

Ok so wait, in response to getting scammed you hacked into this guys accounts to gather information? And then admit to it publicly? And then dox the guy? Unprofessional doesn't even begin...

josefresco 11y ago
I don't see any admission or indication of "hacking". Unprofessional? - if "professional" means keeping quiet, reporting it authorities (who don't care and can't do anything about it) and riding quietly into the sunset call me unprofessional any day.
- TheCapn 11y ago
  Hacking is what a person does in violation of Computer Fraud and Abuse Act of 1986[1]. Which doesn't discuss needing to actively try to break encryption or exploit a security vulnerability but rather talks about accessing something to which you do not have permission. [1] http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
  - josefresco 11y ago
    I stand corrected - although my comment was tailored for a community (HN) that usually get's all worked up about the use of the term "hacking" (and others) when it comes to computer crime. If this was an article about the US Government convicting or charging people for "hacking" we'd most likely see numerous comments and complaints here about the improper use of the word.
- apalmer 11y ago
  Please take this in the spirit it is intended: I would never under any circumstances ever share personal information with a company that behaved as you have documented. You believe this guy has scammed you so you went through his personal artifacts and shared communications to get vigilante justice. Fair enough as a person I dont blame you and find it funny, as a business you just cannot be trusted with personal information. In the grand scheme of things, all you really illustrated is that for 25K empireflippers is willing to 'hack' someone who as you say yourself hasnt been established guilty beyond a reasonable doubt, but who you have 'good enough' info on. 'Professional' means operating by a business driven code of behavior. You let this issue become 'Personal', and as such took steps to get 'revenge'. You literally committed crimes during the course of getting revenge, and you 'transparently' confessed to these crimes in writing on a public forum that is tied to your 'professional' endeavor. You should have consulted a lawyer both before you took these steps, and before you confessed to taking this steps.
  - josefresco 11y ago
    I'm not the author of the post, only defending it (somewhat).
  - justincooke 11y ago
    I can appreciate where you're coming from here, I really can. I will say that we did consult our lawyer before writing this post, actually. Additionally - business is done on trust. Some will read this and (like you) not trust us and won't do business with us. Others will appreciate it and do business with us. No worries either way.
    - ryanlol 11y ago
      Did your lawyer seriously say that posting this is OK? I'm having really hard time believing that.
      - justincooke 11y ago
        Keep in mind he didn't vet the ACTUAL post before I pushed it live. In reading it back, I wouldn't say he was enthusiastically pushing it or anything: "I think you guys have your minds made up. The reality is the risk is probably low. Truth is an absolute defense to defamation. It's unlikely a couple Russians would try to sue you, but you never know. My boring attorney answer is try not to go too far to minimize any risk. Stick to the verifiable facts."
        ryanlol 11y ago
        Honestly, you might seriously want to consider getting a new lawyer. No good lawyer would ever tell you that it's ok to publicly admit to a felony just because it's unlikely that you'll get sued.
TheSisb2 11y ago
To be honest, if this stops these guys from scamming someone else I'd call it a win. The internet is still a bit of a wild wild west, especially when dealing with people from foreign countries. If someone robs you or breaks into your house, you have the right to defend yourself.
- random28345 11y ago
  > If someone robs you or breaks into your house, you have the right to defend yourself. Yes, that's why in the non-internet world, when someone breaks into my house, I now have the right to commit identity fraud, make false statements, and commit arson of their neighbor's property.
at-fates-hands 11y ago
>>> in response to getting scammed you hacked into this guys accounts to gather information? Not really hacking when they gave you the passwords already. That's like me accusing you of breaking into my house after I gave you a key to the lock. >>>> And then admit to it publicly? I agree this probably isn't the best thing, but considering the targets are in eastern Europe, and they are criminals, I doubt they're going to press charges. >>>> And then dox the guy? This is their own fault for having poor opsec. The fact he got busted and now his information is public is not the responsibility of those he scammed. IF they didn't want their shit exposed and on the internet, they should have done a better job of covering their tracks.
- notahacker 11y ago
  >> Not really hacking when they gave you the passwords already. That's like me accusing you of breaking into my house after I gave you a key to the lock. If you lend me keys to your house for a specific purpose, am I also legally entitled to rifle through your drawers until I've found your car keys and then have a drive around in that? They used the word "password hacking" in the email, and using a password somebody has stupidly shared with you for a specific purpose to also access their email accounts and eBay, Namecheap is undisputably hacking of the illegal variety, even if the targets in this instance are particularly obnoxious criminals themselves as well as incredibly slack when it comes to security. I can understand why someone might feel entitled to abuse the password they'd been given in order to see whether it helps them to recover their property, but to then boast about the felony they've committed on a corporate blog?
  - at-fates-hands 11y ago
    >> but to then boast about the felony they've committed on a corporate blog? You must have missed the part in my original post where I said bragging about it probably isn't the best thing they did. It also means as a hacker, if you fuck with someone's business, be advised, you might end up getting the horns. I think to a degree, it helps put people on notice these guys don't take this stuff lying down and if you commit fraud on their watch, they're not just going to write it off. It probably also helps potential clients feel safer, knowing they don't just write off their losses, they actually do something about it - regardless of how the general public interpret it. Also, by your standards, then do you believe what Andrew "weev" Auernheimer did was illegal as well? Just curious. . .
guntars 11y ago
It might be unprofessional, but considering their options in this situation, I'd say it was a good call. Hopefully it can help someone else down the road.
TwiztidK 11y ago
Someone stole a laptop from me a few years ago and gave/sold it to someone else. I ssh'd into it, installed keyloggers and screen capture programs so I could figure out who they were. I was able to get their email, Facebook, and eBay passwords which I used to find out who they were and where they were staying so I could give that info to the police. Unfortunately, I still didn't get my computer back.
bduerst 11y ago
Yeah, I'm not entirely sure the ends justify the means here. Considering it's international in nature, did they have any other option or recourse?
- justincooke 11y ago
  Not really. We definitely discussed with our attorney but, due to the small amount of money in the fraud ($25K) it wasn't worth the hassle of litigation. Someone else mentioned we should go after them in Russia but, even if we won, I doubt it would be worth the hassle or distraction.
danbruc 11y ago
Exactly this. I reply here because it applies to most of the other replies so far. Breaking the law is not justified even if you »only« affect someone who also broke the law and affected you with that. In the real world as on the internet. Period. Sometimes the world is unfair, suck it up, but don't become criminal yourself.
- deleted 11y ago
  [deleted]
- thieving_magpie 11y ago
  The only thing I'd do differently is I probably wouldn't write a blog about it. This idealist world you're living in sounds lovely but I'm not going to sit and risk my livelihood by "sucking it up" and accepting "the world is unfair". If you want to base your moral code on laws made by old white guys, go for it. I'm going to live my life based on what I believe to be just. That's really how change comes about, challenging legal authority. Think about the historical figures you respect - rosa parks, mlk, snowden (maybe?). The world would be a worst place if they didn't break the law. To me that is contributing to the good of the world.
  - danbruc 11y ago
    I'm going to live my life based on what I believe to be just. Exactly this is the problem. There is nothing fundamentally wrong with frontier justice, the only problem is that people don't act rationally in general. What if it is not some lost money but if someone got badly hurt, raped or killed? Can you hold back your emotions? Make sure that you are not targeting the wrong person? And even in the case of this story, what if those two guys are themselves just victims of the real scammer hiding behind their identities? You just publicly stigmatized two innocent people as scammers.
    - thieving_magpie 11y ago
      Again, I do not think it was right to air any of this publicly. I get what you're saying, but I still do not agree that I should never disobey the law when I feel it is morally justified.

Ok so wait, in response to getting scammed you hacked into this guys accounts to gather information? And then admit to it publicly? And then dox the guy? Unprofessional doesn't even begin...

josefresco 11y ago

I don't see any admission or indication of "hacking". Unprofessional? - if "professional" means keeping quiet, reporting it authorities (who don't care and can't do anything about it) and riding quietly into the sunset call me unprofessional any day.

TheCapn 11y ago
Hacking is what a person does in violation of Computer Fraud and Abuse Act of 1986[1]. Which doesn't discuss needing to actively try to break encryption or exploit a security vulnerability but rather talks about accessing something to which you do not have permission. [1] http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- josefresco 11y ago
  I stand corrected - although my comment was tailored for a community (HN) that usually get's all worked up about the use of the term "hacking" (and others) when it comes to computer crime. If this was an article about the US Government convicting or charging people for "hacking" we'd most likely see numerous comments and complaints here about the improper use of the word.
apalmer 11y ago
Please take this in the spirit it is intended: I would never under any circumstances ever share personal information with a company that behaved as you have documented. You believe this guy has scammed you so you went through his personal artifacts and shared communications to get vigilante justice. Fair enough as a person I dont blame you and find it funny, as a business you just cannot be trusted with personal information. In the grand scheme of things, all you really illustrated is that for 25K empireflippers is willing to 'hack' someone who as you say yourself hasnt been established guilty beyond a reasonable doubt, but who you have 'good enough' info on. 'Professional' means operating by a business driven code of behavior. You let this issue become 'Personal', and as such took steps to get 'revenge'. You literally committed crimes during the course of getting revenge, and you 'transparently' confessed to these crimes in writing on a public forum that is tied to your 'professional' endeavor. You should have consulted a lawyer both before you took these steps, and before you confessed to taking this steps.
- josefresco 11y ago
  I'm not the author of the post, only defending it (somewhat).
- justincooke 11y ago
  I can appreciate where you're coming from here, I really can. I will say that we did consult our lawyer before writing this post, actually. Additionally - business is done on trust. Some will read this and (like you) not trust us and won't do business with us. Others will appreciate it and do business with us. No worries either way.
  - ryanlol 11y ago
    Did your lawyer seriously say that posting this is OK? I'm having really hard time believing that.
    - justincooke 11y ago
      Keep in mind he didn't vet the ACTUAL post before I pushed it live. In reading it back, I wouldn't say he was enthusiastically pushing it or anything: "I think you guys have your minds made up. The reality is the risk is probably low. Truth is an absolute defense to defamation. It's unlikely a couple Russians would try to sue you, but you never know. My boring attorney answer is try not to go too far to minimize any risk. Stick to the verifiable facts."
      - ryanlol 11y ago
        Honestly, you might seriously want to consider getting a new lawyer. No good lawyer would ever tell you that it's ok to publicly admit to a felony just because it's unlikely that you'll get sued.

TheSisb2 11y ago

To be honest, if this stops these guys from scamming someone else I'd call it a win. The internet is still a bit of a wild wild west, especially when dealing with people from foreign countries. If someone robs you or breaks into your house, you have the right to defend yourself.

random28345 11y ago
> If someone robs you or breaks into your house, you have the right to defend yourself. Yes, that's why in the non-internet world, when someone breaks into my house, I now have the right to commit identity fraud, make false statements, and commit arson of their neighbor's property.

at-fates-hands 11y ago

>>> in response to getting scammed you hacked into this guys accounts to gather information? Not really hacking when they gave you the passwords already. That's like me accusing you of breaking into my house after I gave you a key to the lock. >>>> And then admit to it publicly? I agree this probably isn't the best thing, but considering the targets are in eastern Europe, and they are criminals, I doubt they're going to press charges. >>>> And then dox the guy? This is their own fault for having poor opsec. The fact he got busted and now his information is public is not the responsibility of those he scammed. IF they didn't want their shit exposed and on the internet, they should have done a better job of covering their tracks.

notahacker 11y ago
>> Not really hacking when they gave you the passwords already. That's like me accusing you of breaking into my house after I gave you a key to the lock. If you lend me keys to your house for a specific purpose, am I also legally entitled to rifle through your drawers until I've found your car keys and then have a drive around in that? They used the word "password hacking" in the email, and using a password somebody has stupidly shared with you for a specific purpose to also access their email accounts and eBay, Namecheap is undisputably hacking of the illegal variety, even if the targets in this instance are particularly obnoxious criminals themselves as well as incredibly slack when it comes to security. I can understand why someone might feel entitled to abuse the password they'd been given in order to see whether it helps them to recover their property, but to then boast about the felony they've committed on a corporate blog?
- at-fates-hands 11y ago
  >> but to then boast about the felony they've committed on a corporate blog? You must have missed the part in my original post where I said bragging about it probably isn't the best thing they did. It also means as a hacker, if you fuck with someone's business, be advised, you might end up getting the horns. I think to a degree, it helps put people on notice these guys don't take this stuff lying down and if you commit fraud on their watch, they're not just going to write it off. It probably also helps potential clients feel safer, knowing they don't just write off their losses, they actually do something about it - regardless of how the general public interpret it. Also, by your standards, then do you believe what Andrew "weev" Auernheimer did was illegal as well? Just curious. . .

guntars 11y ago

It might be unprofessional, but considering their options in this situation, I'd say it was a good call. Hopefully it can help someone else down the road.

TwiztidK 11y ago

Someone stole a laptop from me a few years ago and gave/sold it to someone else. I ssh'd into it, installed keyloggers and screen capture programs so I could figure out who they were. I was able to get their email, Facebook, and eBay passwords which I used to find out who they were and where they were staying so I could give that info to the police. Unfortunately, I still didn't get my computer back.

bduerst 11y ago

Yeah, I'm not entirely sure the ends justify the means here. Considering it's international in nature, did they have any other option or recourse?

justincooke 11y ago
Not really. We definitely discussed with our attorney but, due to the small amount of money in the fraud ($25K) it wasn't worth the hassle of litigation. Someone else mentioned we should go after them in Russia but, even if we won, I doubt it would be worth the hassle or distraction.

danbruc 11y ago

Exactly this. I reply here because it applies to most of the other replies so far. Breaking the law is not justified even if you »only« affect someone who also broke the law and affected you with that. In the real world as on the internet. Period. Sometimes the world is unfair, suck it up, but don't become criminal yourself.

deleted 11y ago
[deleted]
thieving_magpie 11y ago
The only thing I'd do differently is I probably wouldn't write a blog about it. This idealist world you're living in sounds lovely but I'm not going to sit and risk my livelihood by "sucking it up" and accepting "the world is unfair". If you want to base your moral code on laws made by old white guys, go for it. I'm going to live my life based on what I believe to be just. That's really how change comes about, challenging legal authority. Think about the historical figures you respect - rosa parks, mlk, snowden (maybe?). The world would be a worst place if they didn't break the law. To me that is contributing to the good of the world.
- danbruc 11y ago
  I'm going to live my life based on what I believe to be just. Exactly this is the problem. There is nothing fundamentally wrong with frontier justice, the only problem is that people don't act rationally in general. What if it is not some lost money but if someone got badly hurt, raped or killed? Can you hold back your emotions? Make sure that you are not targeting the wrong person? And even in the case of this story, what if those two guys are themselves just victims of the real scammer hiding behind their identities? You just publicly stigmatized two innocent people as scammers.
  - thieving_magpie 11y ago
    Again, I do not think it was right to air any of this publicly. I get what you're saying, but I still do not agree that I should never disobey the law when I feel it is morally justified.