Slashdot Mirror
WarTalking Arrest
PhotonSphere writes "Having helped organize HoustonWireless.org, this really caught my attention! A Houston computer security analyst has been charged with 'hacking' after demonstrating the insecurity of a court's wireless LAN! This happened Wednesday and is only now getting the attention of the wireless community. The Register has the full story."
We all know that its illegal to teach things to people that could possibly be used for malicious purposes. We also know that pointing out flaws or weaknesses in computer systems is an activity reserved for terrorists and other 'undesirables'.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
Unless he was hired for the job, he deserves it.
Just because you *can* do something doesn't mean you *should*.
Tired of having all these people act like "well, it's not secure, so I should poke around."
Hey Taco! Looks like you're using the "infinite monkeys and typewriters" scheme to generate Ask Slashdots again...
He went about this wrong, he should have mentioned that he believed it was insecure and then with explict permission demonstrated why he believes this is the case. If I walked up to a cop and said "This pop machine is insecure" and proceeded to kick it and then drink the soda that fell out do you think the cop would be happy I showed him that?
This is a very interesting case, a guy that was showing a newspaper, and someone working for the county how easy it would be for a hacker to break into the court's system. Then he gets arrested for the act. And this is because they had to take the thing down for a month because of there being a break. I would say with that kind of security, it should have never been brought up in the first place. Also I would say that it was better that they found out that the system could be broken before the network was actually used for a critical task, and could get hacked during a court proceeding, that could be a very embarrassing thing for a court to have to face. Being the ones that where hacked into while court was in session. Hopefully, at least they learned from what he did and at least secured the thing. Although since he is being possibly jailed for it, perhaps he should have told his superiors about how shoddy the security was before he did a demonstration.
If we all pretend the problem doesn't exist... maybe it will go away on its own? We'll just prosecute anyone who points out that we have a problem. Then, everything will be fine. I swear -- the intelligence in this country has gone right down the shitter in the last 25 years. We used to respect and honor knowledge. Now me simply make a mockery of it. I weep for my generation.
He did access their network without permission.
Did they create a public network? Public as in accessible to the public without any reasonable indication or security that it is indeed a private network.
I think broadcasting a private network and letting people on it is akin to making a public network.
It isn't this guys fault they had to shut down their network, it is the people who set up the insecure network in the first case.
Why should I even care? A part of me wants to get all loud and stupid about this but Puffer had no permission to start cracking keys and browsing the microsoft shares (or whatever he did). Let them get burned on their own or if they're government go through the usual channels. No need to be 'Captain Wireless.'
Worst of all, for all we know he did not do this to demonstrate anything. The last time slashdot got up in arms about some supposed 'white hat' hacker it ended up being an excuse. In my experience it usually is an excuse. "Dude, I'm totally looking out for you when I hack your stuff!" No one should be that naive anymore.
This is something that many people in the InfoSec industry are worried about and more so in the current political environment. EVERY seminar, conference or training event I've been too, there has been someone standing there for twenty minutes lecturing everyone on covering your ass.
What bothers me is that the reason things like this happen is ignorance of non-techies and refusal to see things in a reasonable light. If you were in a bank with a locksmith, and he showed the bank manager that the locks they were using were insecure, the manager would thank the locksmith and change the locks. Show a business manager the exact same thing with their network and they might decide to have you arrested.
Whenever I'm going to show a client ANYTHING I get full written approval ahead of time to discuss or test their security, and I get written approval to discuss my findings. There have been times when I've found vulnerabilities and not said a damn word because the client refused to sign off.
It's sad, there are people out there - and I've worked for and with them often - who really believe in security through anonymity and believe they are acting in their best interests by alienating and prosecuting the people who can really protect their networks.
What I will admit however is that part of the problem rests with people who try to look smart and show off the security vulnerabilities in a smart-assed kind of way. As annoying as it sometimes is, you need to manage people's expectations, fears and prejudices.
At first I thought they were being a bit harsh until I took a closer look at the dates. He's accused of breaking into the network on the 8th, but not reporting it until the 18th. Now maybe he was unable to get an appoitment to see anyone, or maybe he took 10 days to poke around in the network and see what was there. He should have reported the insecurity immediately. The fact that he didn't is suspicious.
The Mongrel Dogs Who Teach
What is it going to take for people to realize that they need to lock down their systems -- the digital equivalent of 9/11? Honestly, it seems the government can't accept any criticism of its systems, or act on the information at all........ and instead of fixing the problem, they decide to prosecute instead.
Pretty deranged, IMHO.
The person charged was not acting maliciously, did not cause any damage (what is claimed is bogus), and his actions were willfully disclosed in good faith. He got the raw deal...
SIG: HUP
Embarrassment is what it comes down to. When the courthouses pretty new wireless system, which they paid a good amount for, is found to be vulnurable to an attack they blame the one who found it instead of the admin who put the package together.
I'd say its more analagous to an open window of the courthouse spewing court documents out onto the street. This guy unfortunately stooped down and picked one up.
Not only that, he had the gall to go to a local official, and show it to them! And they had to get someone to close the window. It took about 30 minutes to get in touch with the judge who had left his window open. That's... $100 of damage, assuming, on a wild guess, the judge costs taxpayers $200/hour.
I think a more applicable analogy is as follows:
Person A: Your house is vulnerable. Somebody could break in anytime he/she wants.
Person B: Is not!
Person A: Yes, it is. And I suggest you get it fixed before somebody takes advantage of it.
Person B: Proove it!
Person A: Puts hand on front door's doorknob, turns doorknob, pushes door open. See?
Person B: Dials 911 on his cell phone. Hello, I'd like to report that "Person A" just broke into my house, and I want to press charges.
Time flies like an arrow. Fruit flies like a banana.
He sounds like a "security professional" who "demonstrates a flaw in the system" to a potential client. This is not the smartest way to win clients. It is embarassing.
Had he called their IT director, described the flaw to him in private, he chose to take it to the press first. He might actually have won business from the IT director had he been a little more professional about it.
Unfortunately, he chose to try and shock not only them, but the public as well.
He pulled an incredibly stupid stunt: did something illegal and told people about it. Don't you think he should've been arrested, too?
- A.P.
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
Here is a quote from the Harris County DC's Office I found on their site. This was from a news release about a service they call e-DOCS which allows people to get court documents over the Internet. "He (Bacarisse) stressed that Family Court orders, many of which contain sensitive, intimate information, will not be available to the public via the Internet. (Family Court documents that are not sealed are available to the public, as always, if ordered in person. Juvenile Court documents are sealed by law.)" "Charles Bacarisse is in his second term as the District Clerk of Harris County - an office that acts as record-keeper for 74 courts while also charged with managing one of the nation's largest Jury systems and a $1-million-per-day Child Support Division. " Does anyone still think Mr. Puffer should not have said anything? As a registered voter in Harris County, Mr Bacarisse will not be getting my vote since it's obvious to me he thinks his reputation is more important than safeguarding court documents and jury information.