10 ms·

There are some really strange ideas here - > "He was accused of stealing the International Space Station’s source code controlling critical life-sustaining ele

There are some really strange ideas here - > "He was accused of stealing the International Space Station’s source code controlling critical life-sustaining elements worth $ 1.7 million." This makes for an exciting sentence, but doesn't make sense - as far as I can tell he didn't deprive them of their $1.7 million dollar code (I assume he just made a copy), and there is absolutely no opportunity cost here - it's not like he had a space station or was going to give it to someone else with a space station, stopping NASA getting revenue that they may had... I find it very hard to see any way that that could be called 'stealing' or why the $1.7 million figure is relevant at all... That doesn't excuse messing around in other people's systems of course. > "His actions put NASA on hold for three weeks, costing them $41,000 because they had to check and of course fix the system." Surely it was NASA's bad security practices that cost them $41,000 - do they really think if he hadn't found the problem, they wouldn't ever have had to fix their insecure systems?

rayiner 11y ago
> Surely it was NASA's bad security practices that cost them $41,000 - do they really think if he hadn't found the problem, they wouldn't ever have had to fix their insecure Why is blaming the victim so uniquely acceptable when we're talking about hackers?
- delinka 11y ago
  Even if some "hacker" hadn't located the security issues, but some employee from NASA had located the security issues, it still costs NASA money to fix the code. Also read "That doesn't excuse messing around in other people's systems of course." stephen_g isn't blaming the victim. But blaming the intruder as if he created the lack of security is just as disingenuous. Imagine a business that's generally open to the public at specific hours. The owner installs the doors himself without any consideration for locks. When reviewing security camera footage from non-business hours, he discovers someone open the door, walk in, look around, and leave. Sure, this person is indeed trespassing. But blaming the trespasser for the cost of putting locks on the door is asinine.
  - csandreasen 11y ago
    From another article[1]: > By entering through a router in Dulles, Va., and installing a back door for access, he intercepted DTRA e-mail, 19 user names and passwords of employees, including 10 on military computers. If the security issue was found internally, you can just patch it, do a cursory check to see if there is evidence of intrusion, and go on your way. When you find the security issue as a result of being hacked, now you not only have to patch to flaw but also investigate what was compromised, but may have been modified, etc. That would entail taking down all of the potentially affected systems for evaluation, which means a big hit to productive work while the investigation is underway. [1] http://abcnews.go.com/Technology/story?id=119423 http://abcnews.go.com/Technology/story?id=119423
    - delinka 11y ago
      Valid point. I did miss the installed backdoor. But I disagree about the "cursory check" - at the point of finding a vulnerability on a production system, one must assume compromise and be exhaustive. And that means it's costly, regardless of who found it first.
      - csandreasen 11y ago
        "Cursory" was perhaps the wrong word. In any case, taking down your company's network for forensic investigation is extremely costly - it's not something you'd do unless there was evidence of an intrusion. It would have been a whole lot cheaper to take care of this incident if the problem was found internally, rather than performing damage assessment and control after the fact.
        AnthonyMouse 11y ago
        > In any case, taking down your company's network for forensic investigation is extremely costly - it's not something you'd do unless there was evidence of an intrusion. It's not something you would do even if there was. The sensible first response when you find a vulnerability is take a snapshot of the existing system -- you want to do this before patching the vulnerability in any event, in case the patch causes serious problems and has to be rolled back. Then you can conduct your investigation against the snapshot without having to disable the production systems. Which is why I think you're making a very strong argument for why attributing "mitigation costs" is a farce. Because you could easily find a company who would take down their network and incur very high costs unnecessarily. The overreaction is not the fault of nor is it under the control of the attacker.
- penprogg 11y ago
  Oh those poor government agencies with their millions of dollars in funding. Who will defend them from those teenage hackers that are causing them "trillions" in damages tm.
- AnthonyMouse 11y ago
  > Why is blaming the victim so uniquely acceptable when we're talking about hackers? "Don't blame the victim" comes from the context of sexual assault. Blaming the victim for dressing provocatively is unjustifiable because dressing provocatively is not misconduct. Maintaining insecure internet-facing servers is professional misconduct. Someone else's wrong doesn't retroactively make your wrong right.
  - csandreasen 11y ago
    But it doesn't absolve the attacker of any responsibility for damages caused, either.
    - davorak 11y ago
      > But it doesn't absolve the attacker of any responsibility for damages caused, either. stephen_g was questioning the assumption that he caused any damage at all. > Surely it was NASA's bad security practices that cost them $41,000 - do they really think if he hadn't found the problem, they wouldn't ever have had to fix their insecure systems? I don't think anyone was taking about absolution only weather or not the article was misleading.
  - rayiner 11y ago
    I left my car door unlocked once in my apartment's parking garage, and someone stole my iPhone out of it. Am I engaging in professional misconduct? Maybe the garage is, for failing to take adequate security precautions, but not me.
    - dctoedt 11y ago
      > Am I engaging in professional misconduct? Maybe the garage is, for failing to take adequate security precautions, but not me. Depends on what you mean by "professional misconduct." For lawyers like you (and me) the analysis by a bar-association ethics committee might be fairly strict. A lawyer's smartphone likely contains non-public client information such as contact info and perhaps even documents. In that case, leaving the phone (or worse, a laptop) in an unlocked car might be regarded as a failure to take prudent precautions to protect client confidences. That in turn could mean exposure for the lawyer, even though the thief was clearly the most-culpable. ADDED: The same, negligence-based analysis might apply to security professionals as well: Even though others might be equally- or more-culpable, a failure to take prudent measures in accordance with "industry standards" (a vague term that would have to be [expensively] litigated) might lead to civil liability. See, e.g., The T.J. Hooper, a 1932 case in which the court held that a tugboat's failure to have reliable radios on board was negligent, even though that was not the prevailing practice among other tug operators [1]. It's a case with which all first-year law students (presumably) become familiar. [1]http://itlaw.wikia.com/wiki/T.J._Hooper http://itlaw.wikia.com/wiki/T.J._Hooper
- revelation 11y ago
  Blaming the victim is perfectly fine if the "victim" is a government agency.
- tptacek 11y ago
  The problem is that this situation sometimes (not always) demands that we apportion blame to both the perpetrator and the victim. The perpetrator is always to blame, and their blame is obviously not mitigated by anything the victim does. If the victim has a duty to protect the information lost, and the victim is negligent, they have an orthogonal culpability as well. On message boards, it really seems like people have trouble holding these two thoughts together in their head at the same time. Of course, nerds like us on message boards have a cluster-headache of a persecution complex as well, which is ironic given that we're all making bank making everyone else's jobs disappear.
CyberDildonics 11y ago
Interesting you can steal something that was payed for with public money.
- jjaredsimpson 11y ago
  You know this is a bad argument. Being a taxpayer doesn't convey some superior status. You are a member of the collective with restrictions on your behavior. You can't dig up roads, take library books, or drive cop cars.
  - CyberDildonics 11y ago
    Copying source code destroys it for everyone else?
    - jjaredsimpson 11y ago
      Are you suggesting if I copied all your bank records I haven't done any harm because you still retain the originals? Destruction isn't the point. The point is that something paid with public money isn't available for the public's use. You have no rights to any object just because you pay taxes. A government levies taxes and through appropriation spends that money. If a park is built, then fine use it. If a tank is built, then too bad that's not your tank.
      - CyberDildonics 11y ago
        I thought we were talking about source code by an entity funded by tax payers. Is that the same as a person's private bank records? Your argument doesn't make sense for source code created by a tax funded entity. It makes sense for private information, or a publicly funded physical object, but this not either of those. I have a hard time believing you don't realize this, why even argue the point? Do you really think someone shouldn't have access to source code payed for by their own taxes?
        jjaredsimpson 11y ago

rayiner 11y ago

> Surely it was NASA's bad security practices that cost them $41,000 - do they really think if he hadn't found the problem, they wouldn't ever have had to fix their insecure Why is blaming the victim so uniquely acceptable when we're talking about hackers?

delinka 11y ago
Even if some "hacker" hadn't located the security issues, but some employee from NASA had located the security issues, it still costs NASA money to fix the code. Also read "That doesn't excuse messing around in other people's systems of course." stephen_g isn't blaming the victim. But blaming the intruder as if he created the lack of security is just as disingenuous. Imagine a business that's generally open to the public at specific hours. The owner installs the doors himself without any consideration for locks. When reviewing security camera footage from non-business hours, he discovers someone open the door, walk in, look around, and leave. Sure, this person is indeed trespassing. But blaming the trespasser for the cost of putting locks on the door is asinine.
- csandreasen 11y ago
  From another article[1]: > By entering through a router in Dulles, Va., and installing a back door for access, he intercepted DTRA e-mail, 19 user names and passwords of employees, including 10 on military computers. If the security issue was found internally, you can just patch it, do a cursory check to see if there is evidence of intrusion, and go on your way. When you find the security issue as a result of being hacked, now you not only have to patch to flaw but also investigate what was compromised, but may have been modified, etc. That would entail taking down all of the potentially affected systems for evaluation, which means a big hit to productive work while the investigation is underway. [1] http://abcnews.go.com/Technology/story?id=119423 http://abcnews.go.com/Technology/story?id=119423
  - delinka 11y ago
    Valid point. I did miss the installed backdoor. But I disagree about the "cursory check" - at the point of finding a vulnerability on a production system, one must assume compromise and be exhaustive. And that means it's costly, regardless of who found it first.
    - csandreasen 11y ago
      "Cursory" was perhaps the wrong word. In any case, taking down your company's network for forensic investigation is extremely costly - it's not something you'd do unless there was evidence of an intrusion. It would have been a whole lot cheaper to take care of this incident if the problem was found internally, rather than performing damage assessment and control after the fact.
      - AnthonyMouse 11y ago
        > In any case, taking down your company's network for forensic investigation is extremely costly - it's not something you'd do unless there was evidence of an intrusion. It's not something you would do even if there was. The sensible first response when you find a vulnerability is take a snapshot of the existing system -- you want to do this before patching the vulnerability in any event, in case the patch causes serious problems and has to be rolled back. Then you can conduct your investigation against the snapshot without having to disable the production systems. Which is why I think you're making a very strong argument for why attributing "mitigation costs" is a farce. Because you could easily find a company who would take down their network and incur very high costs unnecessarily. The overreaction is not the fault of nor is it under the control of the attacker.
penprogg 11y ago
Oh those poor government agencies with their millions of dollars in funding. Who will defend them from those teenage hackers that are causing them "trillions" in damages tm.
AnthonyMouse 11y ago
> Why is blaming the victim so uniquely acceptable when we're talking about hackers? "Don't blame the victim" comes from the context of sexual assault. Blaming the victim for dressing provocatively is unjustifiable because dressing provocatively is not misconduct. Maintaining insecure internet-facing servers is professional misconduct. Someone else's wrong doesn't retroactively make your wrong right.
- csandreasen 11y ago
  But it doesn't absolve the attacker of any responsibility for damages caused, either.
  - davorak 11y ago
    > But it doesn't absolve the attacker of any responsibility for damages caused, either. stephen_g was questioning the assumption that he caused any damage at all. > Surely it was NASA's bad security practices that cost them $41,000 - do they really think if he hadn't found the problem, they wouldn't ever have had to fix their insecure systems? I don't think anyone was taking about absolution only weather or not the article was misleading.
- rayiner 11y ago
  I left my car door unlocked once in my apartment's parking garage, and someone stole my iPhone out of it. Am I engaging in professional misconduct? Maybe the garage is, for failing to take adequate security precautions, but not me.
  - dctoedt 11y ago
    > Am I engaging in professional misconduct? Maybe the garage is, for failing to take adequate security precautions, but not me. Depends on what you mean by "professional misconduct." For lawyers like you (and me) the analysis by a bar-association ethics committee might be fairly strict. A lawyer's smartphone likely contains non-public client information such as contact info and perhaps even documents. In that case, leaving the phone (or worse, a laptop) in an unlocked car might be regarded as a failure to take prudent precautions to protect client confidences. That in turn could mean exposure for the lawyer, even though the thief was clearly the most-culpable. ADDED: The same, negligence-based analysis might apply to security professionals as well: Even though others might be equally- or more-culpable, a failure to take prudent measures in accordance with "industry standards" (a vague term that would have to be [expensively] litigated) might lead to civil liability. See, e.g., The T.J. Hooper, a 1932 case in which the court held that a tugboat's failure to have reliable radios on board was negligent, even though that was not the prevailing practice among other tug operators [1]. It's a case with which all first-year law students (presumably) become familiar. [1]http://itlaw.wikia.com/wiki/T.J._Hooper http://itlaw.wikia.com/wiki/T.J._Hooper
revelation 11y ago
Blaming the victim is perfectly fine if the "victim" is a government agency.
tptacek 11y ago
The problem is that this situation sometimes (not always) demands that we apportion blame to both the perpetrator and the victim. The perpetrator is always to blame, and their blame is obviously not mitigated by anything the victim does. If the victim has a duty to protect the information lost, and the victim is negligent, they have an orthogonal culpability as well. On message boards, it really seems like people have trouble holding these two thoughts together in their head at the same time. Of course, nerds like us on message boards have a cluster-headache of a persecution complex as well, which is ironic given that we're all making bank making everyone else's jobs disappear.

CyberDildonics 11y ago

Interesting you can steal something that was payed for with public money.

jjaredsimpson 11y ago
You know this is a bad argument. Being a taxpayer doesn't convey some superior status. You are a member of the collective with restrictions on your behavior. You can't dig up roads, take library books, or drive cop cars.
- CyberDildonics 11y ago
  Copying source code destroys it for everyone else?
  - jjaredsimpson 11y ago
    Are you suggesting if I copied all your bank records I haven't done any harm because you still retain the originals? Destruction isn't the point. The point is that something paid with public money isn't available for the public's use. You have no rights to any object just because you pay taxes. A government levies taxes and through appropriation spends that money. If a park is built, then fine use it. If a tank is built, then too bad that's not your tank.
    - CyberDildonics 11y ago
      I thought we were talking about source code by an entity funded by tax payers. Is that the same as a person's private bank records? Your argument doesn't make sense for source code created by a tax funded entity. It makes sense for private information, or a publicly funded physical object, but this not either of those. I have a hard time believing you don't realize this, why even argue the point? Do you really think someone shouldn't have access to source code payed for by their own taxes?
      - jjaredsimpson 11y ago