WarTalking Arrest

PhotonSphere writes "Having helped organize HoustonWireless.org, this really caught my attention! A Houston computer security analyst has been charged with 'hacking' after demonstrating the insecurity of a court's wireless LAN! This happened Wednesday and is only now getting the attention of the wireless community. The Register has the full story."

Comments

Mmhmm.

[Renraku]

We all know that its illegal to teach things to people that could possibly be used for malicious purposes. We also know that pointing out flaws or weaknesses in computer systems is an activity reserved for terrorists and other 'undesirables'.

Re:Mmhmm.

[gad_zuki!]

Heaven forbid he goes through proper government channels or sues for various violations of privacy laws if they have open access to private data. What he did was stupid and no one should be that naive today, especially someone in IT.

Re:Mmhmm.

[wandernotlost]

> If you want to make a point make it the legal way like the rest of us.

Hmmm...so notifying a public official is illegal now? *sigh* One more thing I'll have to remember, I guess. Just out of curiosity, what would you have done upon finding that peoples' -- possibly your own -- private information were being sent through the air, open to anyone with a network card? Ignored it? Well, that would make you a good little citizen, wouldn't it. Certainly better than actually doing something useful. Better yet, you could have dropped a few grand on a lawyer to sue them for privacy violations. That would be truly American!

There's no evidence here that this man was acting with any malicious intent or action. Why would you be so quick to label it "breaking in," when we're talking about a network broadcast over public spectrum. Hardly like throwing a rock through a window. A little bit more like watching TV, perhaps.

Deserved it.

[Jonny 290]

Unless he was hired for the job, he deserves it.

Just because you *can* do something doesn't mean you *should*.

Tired of having all these people act like "well, it's not secure, so I should poke around."

Re:Deserved it.

[rdean400]

Whether he deserved it or not depends totally on the context. If he brought it to their attention "as a concerned citizen", knowing that insecurities of wireless networks can be exploited intentionally or accidentally, then they should have heard him out and then fixed it. However, if he brought it to their attention in more of a "look what I can do" fashion, then he deserved what he got.

Re:Deserved it.

[Khazunga]

It just depends on *how* insecure it really was. If it was really bad, driving around with a wireless-enabled laptop running XP could result in a five-year jail sentence. With XP's automatic wireless lan setup and all.

His biggest error probably was talking about it. He should have sold the info to some mobster gang. They'd probably be much more gratefull.

Re:Deserved it.

[Jay L]

If he brought it to their attention as a concerned citizen, he wouldn't have brought the reporter. He wanted to get in the papers.

Re:Deserved it.

[wandernotlost]

> Unless he was hired for the job, he deserves it.

That's absolutely absurd. The man simply brought to the attention of the clerk the fact that its network was insecure. That a person is prosecuted for trying to point out a potentially dangerous security flaw shows the extent to which this country has fallen into a legal and intellectual paralysis. He should be hailed as a good samaritan looking out for the safety of the county's information!

From the original article:

District Clerk Charles Bacarisse said no files were compromised, but the county had to shut down the wireless system about a month after it was set up.

It appears that there was no malicious action or intent on the part of Mr. Puffer, but rather that the clerk's office is upset because someone discovered its incompetence. What would have happened if someone truly malicious had stumbled upon this network? To what ends could he or she have used the information found?

If you broadcast your network all over your block unprotected, you shouldn't be surprised when someone discovers it and pokes around. Plain and simple. What about those that willingly open their networks to the public? Should we make free public access illegal, so that fools like this can remain under their rocks and pretend that no one can see their secrets?

Re:Deserved it.

[WEFUNK]

Based on the account in the article your response is simply ridiculous. Although the story is brief and somewhat biased ("Ethical Hacker" etc.) NOWHERE does it indicate that he *poked* around or otherwise exploited the security gap.

Even if he had, there are many who would argue that a little poking around is natural and innocent when someone discovers such a thing (and one might not even know that they have stumbled into a restricted space without a little exploring).

You may disagree that intentional hacking can fall into such a grey area, sometimes described as analogous to checking the locks and then walking into an unlocked house. Fair enough. However, unless you have some additional facts to the contrary, the events in the article are more akin to walking by and noticing someone's door is wide open with the keys left in the lock. Any snooping might have been equivalent to peering inside as you walk by. You might even have ethical obligation to report it to a neighbour or the police and perhaps even take them the keys for safe keeping.

Finally, does anyone have any idea how we can educate the public and the law that pointing out a flaw or security issue is NOT the same as causing damage? He is being charged with forcing their system down and costing $5000 to install a secure system. Why is this the standard in the computing, but not in the real world?

Re:Deserved it.

[flonker]

In related news, a local terrorist was arrested today, after he pointed out to the bank that their safe had a huge gaping hole leading to a back alley. He is charged with causing $50,000 worth of damage, the cost of repairing the hole.

Re:Deserved it.

[nehril]

from time to time my company offers security scanning and consulting services. before doing ANYTHING to a system we get extensive permission from top management (NOT just the IT monkey) and we notify their ISP.

"free security scans" are NOT welcome by anyone. Management types (IT and non-IT) cannot distinguish them from "real" hack attempts. CYA extensively or don't rattle the locks. 'Nuff said.

Re:Deserved it.

[mrzaph0d]

i think its closer to this:

a company develops a new lock that makes it easier for anyone in the house to open the door. instead of using a key they can just wiggle the lock a certain way and they're in. someone notices that all these locks are made the same, and all that is required to get into the house is this same "wiggle". this person notices that these locks are in use at a government building. fearing that any criminal could get in, he rounds up a government official and a reporter and shows them how easy it is for anyone to get in. he then gets arrested for breaking and entering.

Re:Deserved it.

[John Hasler]

And that is breaking and entering.

No it isn't. "Breaking" means exactly what it says. Furthermore, allowing your machine to exchange radio signals with someone else's machine is not "entering" by any stretch of the imagination.

Re:Deserved it.

[uncleFester]

Based on the account in the article your response is simply ridiculous. Although the story is brief and somewhat biased ("Ethical Hacker" etc.) NOWHERE does it indicate that he *poked* around or otherwise exploited the security gap.

from the Houston Chronicle article...

In a Chronicle article about the demonstration, Puffer said he noticed he could access the county network in early March, when he scanned for weaknesses throughout Houston.

He said he could also access numerous home, government, university and business computer systems. ...
County Attorney Mike Stafford said he will resume his investigation into whether the security breach was corrected as promptly as county officials learned of it and the origin of a pornographic picture found on the clerk's office server in March.

Noting a network is open/accessable is one thing.. noting you can access a number of specific systems leans more toward the probing side of things. And, as for the last paragraph, I would suspect either he found that or the subsequent audit after the intrusion.

Overall, the Houston article is rather vague as to his exact actions, so inference on his intent/whatnot is nigh impossible and therefore simple ASSumption.

Re:Deserved it.

[Darth_Burrito]

I walk in my house and leave the keys in the door for a second ... and you're pulling the keys out of my door

From what I understand, the network in this case was completely insecure. There was no lock, there was no key. Meaning a 5 yr old with a laptop could gain access as easily as an IT professional.

you want to report an insecurity, do so with the people that create the operating system or program

The industry standard (many companies) behind the insecure wireless network in question does in fact supply a way of making a wireless network more secure. The county office had not bothered to activate these security features. Reporting them to the manufacturers would be meaningless. As much as we might like to think security is always the manufacturers responsibility, that simply isn't true.

Re:Deserved it.

[GlassUser]

If I were to do something like this, I would want a reporter there. If I didn't have one, I'm sure it would be easy for the government to sweep something under the table. Either the issue, just ignoring me, or me entirely. I'd want a third party with an inclination to make everything public.

As I heard this morning, they arrested him because they found a single pr0n file on the server that they think was planted by him.

Re:Deserved it.

[John Hasler]

You may disagree that intentional hacking can
fall into such a grey area, sometimes described
as analogous to checking the locks and then
walking into an unlocked house.

Which is trespass, which is not generally a felony.

Why is this the standard in the computing, but
not in the real world?

Because the legislators and judged haven't a fscking clue about what computers and networks are or how they work. And they aren't interested in learning.

Re:Deserved it.

[overunderunderdone]

Well going around wiggling peoples door handles checking to see which ones are unlocked is usually frowned upon too. I'm sure crappy locks DO exist but we still don't expect locksiths to wander around our neighborhood performing such unsolicited "security checks." Nor do we expect car mechanics to perform "security checks" of every car in a parking lot. Arresting such "security experts" for "wiggling the locks" in the physical realm would be uncontroversial, and is after all one component of assuring the security of homes and cars.

That being said, it seems that the court is being obnoxious considering the fact that he did demo the security flaws to a court official and a local reporter. But the article seemed to indicate that that demo was NOT the occurance he was being charged with. It was the breach of security that happened before, when he first "wiggled the lock". If this is the case, and they were able to track him down without the evidence he provided during his demo, well he can console himself with the thought that his arrest and jail time is a more complete test of the courts security system which includes not only usernames and passwords but social restraints like laws & prison time. As a concerned security expert he will be happy that although one aspect of their security was weak (the wireless LAN) his test revealed that initial failure was somwhat compensated for by those other methods.

Re:Deserved it.

[Wakko Warner]

this person notices that these locks are in use at a government building. fearing that any criminal could get in, he rounds up a government official and a reporter and shows them how easy it is for anyone to get in. he then gets arrested for breaking and entering.

I don't have a problem with this. Why do you?

- A.P.

Re:Deserved it.

[overunderunderdone]

No it isn't. "Breaking" means exactly what it says. Furthermore, allowing your machine to exchange radio signals with someone else's machine is not "entering" by any stretch of the imagination.

Come on we have to be consistent. Whenever the congress wants to make new laws regarding "computer crime" we say NO, the existing laws sufficiently cover the new situation. If that is the case we have to apply it consistently. The article does not go into enough depth for us to really know exactly what he did. I'm not willing to judge whether he is guilty or innocent on the slender story that was posted. In general though "no security" may be a good defense on the electronic equivalent of "breaking and entering" the online equivelent to an open door posted "come on in." and that only because that is essentially how the network responds to his querry.

But "bad security" no matter how woefully insufficient is sufficient to let someone know they are not welcome and that any intrusion is illegal. Entering the system in that case is and should be illegal no matter how noble your professed intentions. The article does not have enough info to let us know which is the case here. Computer "security experts" that access networks that have ANY level of security, even security that is laughably easy to bypass, should be treated by the law exactly how it would treat a car mechanic checking for and entering unlocked cars in the mall parking lot. The situation is EXACTLY equivalent. A computer experts professional curiosity is no more defense than a locksmiths or mechanics professional curiosity. "I just wanted to see how it works" would be no defense in any field other than computers and it is really no defense in our field either.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Ignorance is bliss.

[papasui]

He went about this wrong, he should have mentioned that he believed it was insecure and then with explict permission demonstrated why he believes this is the case. If I walked up to a cop and said "This pop machine is insecure" and proceeded to kick it and then drink the soda that fell out do you think the cop would be happy I showed him that?

Re:Ignorance is bliss.

[gilroy]

Blockquoth the poster:

If I walked up to a cop and said "This pop machine is insecure" and proceeded to kick it and then drink the soda that fell out do you think the cop would be happy I showed him that?

If I go up to a soda-machine owner and say, "This machine gives out free Cokes", then press a button and watch a Coke drop, should I expect to go to jail?? Maybe I'm old fashioned, but I would expect the soda-machine owner to be grateful that someone pointed out the flaw, so that it could be fixed.

But of course, in this case, it would require the government to admit that there had been a mistake, that confidential data conceivably might have gotten out without them knowing it, and that they weren't competent enough to detect the hole themselves. And that's why, instead, he's being charged.

Re:Ignorance is bliss.

[clifyt]

"If I go up to a soda-machine owner and say, "This machine gives out free Cokes", then press a button and watch a Coke drop, should I expect to go to jail??"

Well, he didn't just pull up an iBook and yoink the network was free to access if I get what is being said.

This is more like putting saltwater down the coin dispenser of the coke machine and telling the owner it was insecure and anyone dumping a bucket of the stuff could clean the thing out.

I 'heard' this hack worked back with I was in college...but I would never be stupid enough to try it (and if I ever did, I'd never be stupid enough to admit to it).

Re:Ignorance is bliss.

[isomeme]

Yep. One would think Randal Schwartz's similar experience at Intel would have left all of us a lot more cautious about how we report vs. demonstrate security weaknesses.

Re:Ignorance is bliss.

[gvonk]

This is more like putting saltwater down the coin dispenser of the coke machine and telling the owner it was insecure and anyone dumping a bucket of the stuff could clean the thing out.

How is this considered even a remotely cogent analogy?
Salt water destroys (or used to) parts of said machines. Accessing a network destroys it how?

Re:Ignorance is bliss.

[Pig Hogger]

If I go up to a soda-machine owner and say, This machine gives out free Cokes, then press a button and watch a Coke drop, should I expect to go to jail?? Maybe I'm old fashioned, but I would expect the soda-machine owner to be grateful that someone pointed out the flaw, so that it could be fixed.

At least, you ougha keep the Coke...

But, nowadays, you'd be perhaps labelled as a terrorist.

Re:Ignorance is bliss.

[John Hasler]

Most people don't need their egos fed 24/7 and
are able to take a dose of humility just fine
thanks. Those who can't... well... they're the
stuff assholes are made of.

They are also the stuff politicians are made of.

Could be a screwed situation

[bastard01]

This is a very interesting case, a guy that was showing a newspaper, and someone working for the county how easy it would be for a hacker to break into the court's system. Then he gets arrested for the act. And this is because they had to take the thing down for a month because of there being a break. I would say with that kind of security, it should have never been brought up in the first place. Also I would say that it was better that they found out that the system could be broken before the network was actually used for a critical task, and could get hacked during a court proceeding, that could be a very embarrassing thing for a court to have to face. Being the ones that where hacked into while court was in session. Hopefully, at least they learned from what he did and at least secured the thing. Although since he is being possibly jailed for it, perhaps he should have told his superiors about how shoddy the security was before he did a demonstration.

Re:Could be a screwed situation

[rusty0101]

Actually it took them a month to take the system down, and it will remain down until they can find a way to secure that network.

-Rusty

Re:Could be a screwed situation

[DavidTC]

I was posting a way to tell them without worrying about it, but, you know what? Fuck them, you're right. It's not worth it. I'll just tell everyone anonymously how to do it, it should get fixed soon then.

Are you listening, government and businesses? Shoot the messanger enough time, and people stop sending you messages.

Hmmm.

[NoMoreNicksLeft]

Maybe they should upgrade the charges to treason and sedition. Hacking is terrorism, after all, and this was rather insulting to the court.

Once again....security through obscurity...

[GuNgA-DiN]

If we all pretend the problem doesn't exist... maybe it will go away on its own? We'll just prosecute anyone who points out that we have a problem. Then, everything will be fine. I swear -- the intelligence in this country has gone right down the shitter in the last 25 years. We used to respect and honor knowledge. Now me simply make a mockery of it. I weep for my generation.

Re:Once again....security through obscurity...

[loraksus]

weep for the next one, at least we sorta know how to deal with what is going on around us. . .
I of course, have to point out that this is Texas, not that my home state isn't full of redneck hicks either.

Another 'example' will be made...

[Cruciform]

It's funny, already I'm seeing people saying this guy deserves what he gets... but if I was sitting on a bench in front of the courthouse with my laptop and found that I could access the network with little or no problem, I'd walk straight in there myself and let them know. I worked as a contractor at the Ministry of Health in Ontario for a bit, and you want to talk shoddy administration. It was hideous. And they have information like registries of people suffering from AIDS, or who is getting drug benefits and what claims they're making. Sure he might just be trying to drum up business, but if the end result is that it closes a serious security hole, more power to him.
Or do you really want your next door neighbor's son finding out about that fraternity prank that had you arrested for stealing a minivan full of sheep in your boxers or some other weird crime?

My questions

[nuggz]

He did access their network without permission.
Did they create a public network? Public as in accessible to the public without any reasonable indication or security that it is indeed a private network.

I think broadcasting a private network and letting people on it is akin to making a public network.

It isn't this guys fault they had to shut down their network, it is the people who set up the insecure network in the first case.

Re:My questions

[GryMor]

Doesn't matter, he had permission:

The decision was made Tuesday, after a computer security analyst demonstrated to Steve Jennings, head of the county's Central Technology Department, and the Houston Chronicle how the system could be compromised

Jennings said he was concerned that the system could be accessed from the outside and that he wanted to learn more about the problem before alerting Bacarisse

Burn the observatory, so this never happens again!

[Jeremi]

On March 18, Puffer demonstrated to a county official and a Chronicle reporter how easy it was to gain access to the court's system using only a laptop computer and a wireless LAN card.

This is his crime?

I'm glad they've taken prompt measures to make sure nobody else every reports a security hole to them!

No need for free security consultants

[gad_zuki!]

Why should I even care? A part of me wants to get all loud and stupid about this but Puffer had no permission to start cracking keys and browsing the microsoft shares (or whatever he did). Let them get burned on their own or if they're government go through the usual channels. No need to be 'Captain Wireless.'

Worst of all, for all we know he did not do this to demonstrate anything. The last time slashdot got up in arms about some supposed 'white hat' hacker it ended up being an excuse. In my experience it usually is an excuse. "Dude, I'm totally looking out for you when I hack your stuff!" No one should be that naive anymore.

Re:No need for free security consultants

[corby]

Puffer had no permission to start cracking keys and browsing the microsoft shares (or whatever he did).

This is true. So why doesn't Harris County prosecute the case on these grounds? They seem to feel that their case is not strong enough without conjuring ludicrous claims that Mr. Puffer caused $5,000 in damages.

The claim of $5,000 arises entirely from the cost of taking down the network to secure it, not from any actual damage caused by Mr. Puffer. To say that Mr. Puffer caused $5,000 damages is to say that if it wasn't for him the Civil Courts Building could have left their 802.11 free and unsecured forever.

Worst of all, for all we know he did not do this to demonstrate anything.

You go, man! You're not afraid to tell it like it is! Now read the article. He accessed the network in a prearranged meeting with a newspaper reporter and a county official in the room. It's pretty safe to say he was taking part in a demonstration.

It's obvious that an indictment was not sought because of actual damages caused by the defendant. This case went to a grand jury because officials didn't want a newspaper story about how the Civil Courts Building decided to open their computer network to the whole world.

Re:No need for free security consultants

[gad_zuki!]

>The claim of $5,000 arises entirely from the cost of >taking down the network to secure it, not from any >actual damage caused by Mr. Puffer.

Legal cases in general inflate the damage and/or include all damages associated with the action. I'm sure this will be an issue in court.

>You go, man! You're not afraid to tell it like it >is! Now read the article

No, you read the article. He first broke in on March 8th then arranged his big expose on the 18th. Ten days of silence. I'm not suggesting he broke in purpose but it is a possibility. Did he really expect the government to say 'good job citizen' and pin a medal on him. Imagine the precedent that would set. Kiddies would be pouding networks right and left for the good of the nation and expecting to be written up in the paper as local heroes.

It can't be stressed enough that he did this in the stupidest manner possible. He could have taken this to a City Council meeting, started a class-action suit against the county for violating privacy laws, etc. Instead he supposedly went for the glory that the supposed white hat hacker seeks. Naive and stupid. Hopefully, the court will see his supposed true intentions and not lock him up.

Re:No need for free security consultants

[startled]

"No, you read the article. He first broke in on March 8th then arranged his big expose on the 18th. Ten days of silence."

Ten days? Seems sinister. Could that possibly be roughly the amount of time it takes to get an appointment with the appropriate county employee?

Re:No need for free security consultants

[gad_zuki!]

Finish the next sentence.

" He first broke in on March 8th then arranged his big expose on the 18th. Ten days of silence. I'm not suggesting he broke in [on] purpose but it is a possibility. "

Serious Consequences fo InfoSec People

[Inexile2002]

This is something that many people in the InfoSec industry are worried about and more so in the current political environment. EVERY seminar, conference or training event I've been too, there has been someone standing there for twenty minutes lecturing everyone on covering your ass.

What bothers me is that the reason things like this happen is ignorance of non-techies and refusal to see things in a reasonable light. If you were in a bank with a locksmith, and he showed the bank manager that the locks they were using were insecure, the manager would thank the locksmith and change the locks. Show a business manager the exact same thing with their network and they might decide to have you arrested.

Whenever I'm going to show a client ANYTHING I get full written approval ahead of time to discuss or test their security, and I get written approval to discuss my findings. There have been times when I've found vulnerabilities and not said a damn word because the client refused to sign off.

It's sad, there are people out there - and I've worked for and with them often - who really believe in security through anonymity and believe they are acting in their best interests by alienating and prosecuting the people who can really protect their networks.

What I will admit however is that part of the problem rests with people who try to look smart and show off the security vulnerabilities in a smart-assed kind of way. As annoying as it sometimes is, you need to manage people's expectations, fears and prejudices.

Re:Serious Consequences fo InfoSec People

[ErfC]

If you were in a bank with a locksmith, and he showed the bank manager that the locks they were using were insecure, the manager would thank the locksmith and change the locks.

If you're Richard Feynmann and you go up to the general in charge of the Los Alamos nuclear bomb research stuff and tell him (and indeed show him) that the safes all the top secret research is in are insecure and can be picked if you can get at it with the door open (which was relatively easy to do), the general would (did) order that all safes be kept closed when Feynmann is in the room...

Not everybody in power appreciates weaknesses being shown; nor do they always get the point you're trying to make when you demonstrate the weaknesses. This applies to any field.

Damning evidence?

[balthan]

At first I thought they were being a bit harsh until I took a closer look at the dates. He's accused of breaking into the network on the 8th, but not reporting it until the 18th. Now maybe he was unable to get an appoitment to see anyone, or maybe he took 10 days to poke around in the network and see what was there. He should have reported the insecurity immediately. The fact that he didn't is suspicious.

Re:Damning evidence?

[GSloop]

More to the point, it appears as though it was a wireless network WITHOUT WEP turned on. (not that WEP does anything of much use anyway, but at least that way, you could attempt to show that the network was not intended to be for public use!)

As far as I am concerned, that is a PUBLIC network. It would be like stringing Cat5 to a power/light pole outside my house, and outside my property, and then claiming tresspass should anyone plug into that network connection!

Wireless ethernet doesn't require any "authentication." This sounds like a situation that someone got caught out, and now wants a pound of flesh to make themselves look better.

I'd be likely to counter-sue claiming malicious prosecution.

Cheers!

Re:Damning evidence?

[geoswan]

At first I thought they were being a bit harsh until I took a closer look at the dates. He's accused of breaking into the network on the 8th, but not reporting it until the 18th.

I read the July 24th Houston Chronicle article and the March 21st article too. The Cheif County Clerk seems to be saying that one (1) pornographic picture found on one (1) of his department's poorly secured computers was the sole damage found. He claims it cost $5,000 to fix the damage he accuses Puffer (the whistleblower) of causing.

With a network as poorly secured as his practically anyone with a wifi card could have uploaded that picture.

If any repercussions should come anyone's way over this incident I don't understand why the first candidate isn't Charles Bacarisse, the County's District Clerk. Bacarisse claims that none of the computers under his administration could have been seriously damaged by the penetration of war-drivers. Okay, but am I mis-reading the Chronicles quotes from him? Doesn't he seem to have been completely oblivious to the vulnerability his insecure testing was opening to the rest of the computers on the County's system?

We have seen this before, with Randal Schwartz's ordeal at Intel. This comp.security article contains a contemporary account of his "crimes".

The lesson seems to be that no matter how well intentioned you are, the only safe way to report a security vulnerability is if you can find a way to do so anonymously.

Re:where do they get these numbers??

[gilroy]

Blockquoth the poster:

he alleged intrusion eventually resulted in the county closing its wireless LAN only a month after it was activated

the associated cost of dismantling the service is going to add up to at least five grand. I'm surprised it's not more

So, because the county installed a stupid system and was forced to shut it down, this guy is liable? There doesn't seem to be any accusation that he made the system (more) insecure. They just seem peeved that he actually demonstrated an existing insecurity, that mandated a reversal of policy. Shoot enough messengers and soon no one will bother you with news about bad things. And of course that means bad things will cease to exist.

Easy problem to solve!!!

[NoFX]

So, just break back in, and erase the record of the charge.. duh..

System backups?

[TibbonZero]

Well, if they know the date that he went in... why don't they juse restore the system from daily backups, and keep the current database, and user home directories???? Sounds like a really simple solution, if they don't believe him. And why can't their IS people verify what was happening in their own network... What were they doing? Eating donuts

Re:System backups?

[TibbonZero]

5 grand?
It probably takes, what one day to restore that stuff at the most? If you are running redundant systems, then it should be a seemless swap, while you work on one set of systems, the others are still running, so you don't have any downtime.
If it takes you one day, and you are getting paid (or costing) 5K a day... I guess you make about what... (260 working days * 5K) = 1.3 million a year doing IT grunt work? What county do you work for again, I want to work there too...

Anyways, I hear of places all the time claiming anywhere from 5K to 250K in damages, for simple things that in no way cost that. Look at what they said that Kevin Mitnick cost the Telcos...
It's all BS, it doesn't cost that much. Anyway, what I think of is odd, is that they are charging for under 10K in damages. Normally the Police, or FBI won't even listen to you, if you aren't claiming some huge amount of damages, let alone actually go charge someone.

Re:System backups?

[Pig Hogger]

And why can't their IS people verify what was happening in their own network... What were they doing? Eating donuts

Since when the police is in charge of networking???

Re:where do they get these numbers??

[belroth]

From the Article:

District Clerk Charles Bacarisse told the paper that no confidential information was disclosed but the alleged intrusion eventually resulted in the county closing its wireless LAN only a month after it was activated.

But is the prosecution a case of shooting the messenger?

On March 18, Puffer demonstrated to a county official and a Chronicle reporter how easy it was to gain access to the court's system using only a laptop computer and a wireless LAN card.

So he stole NO information - he performed a demonstration in front of a county official.

That's hardly the "full story"

[God! Awful]

Some details would be nice. Did the LAN have no password, was the password easy to crack, or was there some other kind of security flaw? If he went all around the city, trying to brute force the password on every wireless LAN he could find, then I doubt he has a legal leg to stand on. If he simply powered on his laptop and noticed he had link, that's different.

-a

Go to jail for helping out!

[Maul]

Remember, never point out someone's security holes so they can fix things before real damage is done. If you do these things, you are nothing more than an evil terrorist! And according to Gestapo... err Attorney General John Ashcroft, you must be an Al Qaeda operative deserving of the death penalty!!

People are afraid of being proven wrong

[Ride-My-Rocket]

What is it going to take for people to realize that they need to lock down their systems -- the digital equivalent of 9/11? Honestly, it seems the government can't accept any criticism of its systems, or act on the information at all........ and instead of fixing the problem, they decide to prosecute instead.

Pretty deranged, IMHO.

Re:People are afraid of being proven wrong

[Nicolas MONNET]

Is it a crime for me to open the door in order to show you it's not locked?

Your analogy is flawed -- he did'nt steal anything, just showed it was open.

Besides, being a local government facility, hence funded with taxpayer/citizen's money, citizens have a right to know about how fucked up it is. Looks to me like the security consultant was doing a perfectly fine watchdog job.

Re:People are afraid of being proven wrong

[kmellis]

"Is it a crime for me to open the door in order to show you it's not locked?"

Yes, unless I gave you persmission to do so beforehand. You don't get to open my car door without my permission. Period.

The details of the network configuration are not clear from the article, so it's hard to ascertain what, if anything, this guy did wrong. Note that it may not even be the case that the clerk that he demonstrated this to might have had the standing to give him permission to do so. Even so, it's clear that he connected to the network earlier. But what does that mean?

Using an analogy from cable modems/dsl and windows networking; if I go into Network Neighborhood on my 98 box and see thirty other machines (as was the case three years ago when I first got my cable modem connection), that's not hacking. The connection was not voluntary, so to speak, and I didn't make an active connection to any of them. If, however, I double-clicked on one of them and looked at the unsecured network shares, I was illegally trespassing on that computer. That's the difference between noticing an unlocked door to someone else's property, and opening the door and walking in.

I've seen reports of people's laptops automatically connecting to badly configured wireless networks. I don't think that's trespassing. But using the connection is. That's a choice you actually have to make. Yes, it seems like a natural thing to do, perhaps just to have a quick look because "the door was wide open". But that still doesn't make it right or legal. Partly this is the case because a) there's a violation of someone's property in any event; and b) it's impossible to be able to determine someone's motives. As someone else posted earlier, thieves caught just as they enter someone's house could claim that the door was left open and they were only investigating it before they alerted someone. Yeah, sure.

Re:People are afraid of being proven wrong

[Sabriel]

Using an analogy from cable modems/dsl and windows networking; if I go into Network Neighborhood on my 98 box and see thirty other machines (as was the case three years ago when I first got my cable modem connection), that's not hacking. The connection was not voluntary, so to speak, and I didn't make an active connection to any of them. If, however, I double-clicked on one of them and looked at the unsecured network shares, I was illegally trespassing on that computer.

That definition would make use of any such network (one that communicates access ability only upon attempt) illegal. If the only way to determine whether the other side of a door is public or restricted space is to open the door, then making it illegal to open a door to a restricted place is essentially guilt by random lottery.

Likewise, if a premise is broadcasting an unsecured network on public spectrum but not providing any indication that it is illegal to access it, then the only way you'll know it's a crime is to be accused of committing it!

Somehow I was under the impression that wasn't how the U.S. justice system was supposed to work.

Re:People are afraid of being proven wrong

[kmellis]

"If the only way to determine whether the other side of a door is public or restricted space is to open the door, then making it illegal to open a door to a restricted place is essentially guilt by random lottery."

No, because the assumption is that a building is private unless explicitly marked "public". There are far more private buildings in the world than public, and the private buildings are not required to have warnings announcing that they are private and unauthorized use is trespassing. So, you don't have the option of walking into a building to "verify" that it's public or private -- you are expected to assume that it's private unless told otherwise.

It is the same thing with computing networks. You are expected to assume that a network is private unless told otherwise. Thus, you can connect insofar as you're "walking" up to the front door -- but you can't go in unless unvited.

Running an unsecured wireless network is no more an indication that it's open to the public than is leaving open the front door to your house. A passerby can notice that the door is open without entering the building. Likewise, a passerby can connect to a wireless, unsecured network without doing anything else. Browsing file shares, even utilizing network resources to access the internet, is rightly considered trespassing.

Re:People are afraid of being proven wrong

[kmellis]

Moron. Period.

No, you'd be the moron if you tried this in real life. The cops, the prosecuter, and the jury aren't going to give a damn about why you claim you opened my car door. It's not your car. You don't get to open the door unless you have my permission. If you don't understand this simple rule, "moron" might even be an overestimate of your mental capacity.

Re:People are afraid of being proven wrong

[Sabriel]

Please re-read my post. Where in it did I say you could see the building?

It is the same thing with computing networks. You are expected to assume that a network is private unless told otherwise. Thus, you can connect insofar as you're "walking" up to the front door -- but you can't go in unless unvited.

So when I connect to the front page of a website on the internet, and I see a bunch of links leader deeper into the website, I'm expected to assume they are private and not even try clicking on them?

So when I connect to an FTP site, and I see a login request, I'm expected to assume it is private and not even try entering 'anonymous'?

Private buildings are not required to have warnings because it is OBVIOUS that X is a private building (hey, that looks like a house) and Y is a public building (hey, that looks like a mall).

On an open network on public spectrum with nothing obvious to say "you shouldn't be here", how I am supposed to know whether I'm allowed to do something or not except by trying?

Or do you think that if humans were meant to fly we'd have been given wings and trying to fly without them is immoral?

Re:Burn the observatory, so this never happens aga

[ragnarok]

no, This is his crime:

He's accused of accessing the system March 8 in an alleged intrusion that cost the county a reported $5,000 to clean up.

Texas Computer Crime

[Nick Driver]

FYI: Texas Computer Crime Law

TEXAS PENAL CODE TITLE 7. OFFENSES AGAINST PROPERTY
CHAPTER 33. COMPUTER CRIMES
33.01. Definitions
In this chapter:
(1) "Access" means to approach, instruct, communicate with, store data in, retrieve or intercept data from, alter data or computer
software in, or otherwise make use of any resource of a computer,computer system, or computer network.

(2) "Communications common carrier" means a person who owns or operates a telephone system in this state that includes equipment or facilities for the conveyance, transmission, or reception of
communications and who receives compensation from persons who use that system.

(3) "Computer" means an electronic, magnetic, optical,
electrochemical, or other high-speed data processing device that
performs logical, arithmetic, or memory functions by the
manipulations of electronic or magnetic impulses and includes all
input, output, processing, storage, or communication facilities
that are connected or related to the device.

(4) "Computer network" means the interconnection of two or more
computers or computer systems by satellite, microwave, line, or
other communication medium with the capability to transmit
information among the computers.

(5) "Computer program" means an ordered set of data representing coded
instructions or statements that when executed by a computer cause
the computer to process data or perform specific functions.

(6) "Computer security system" means the design, procedures, or other
measures that the person responsible for the operation and use of
a computer employs to restrict the use of the computer to
particular persons or uses or that the owner or licensee of data
stored or maintained by a computer in which the owner or licensee
is entitled to store or maintain the data employs to restrict
access to the data.

(7) "Computer services" means the product of the use of a computer,
the information stored in the computer, or the personnel
supporting the computer, including computer time, data processing,
and storage functions.

(8) "Computer system" means any combination of a computer or computer
network with the documentation, computer software, or physical
facilities supporting the computer or computer network.

(9) "Computer software" means a set of computer programs, procedures,
and associated documentation related to the operation of a
computer, computer system, or computer network.

(10) "Computer virus" means an unwanted computer program or other set
of instructions inserted into a computer's memory, operating
system, or program that is specifically constructed with the
ability to replicate itself or to affect the other programs or
files in the computer by attaching a copy of the unwanted program
or other set of instructions to one or more computer programs or
files.

(11) "Data" means a representation of information, knowledge, facts,
concepts, or instructions that is being prepared or has been
prepared in a formalized manner and is intended to be stored or
processed, is being stored or processed, or has been stored or
processed in a computer. Data may be embodied in any form,
including but not limited to computer printouts, magnetic storage
media, laser storage media, and punchcards, or may be stored
internally in the memory of the computer.

(12) "Effective consent" includes consent by a person legally
authorized to act for the owner. Consent is not effective if:

(A) induced by deception, as defined by Section 31.01, or induced
by coercion;

(B) given by a person the actor knows is not legally authorized to
act for the owner;

(C) given by a person who by reason of youth, mental disease or
defect, or intoxication is known by the actor to be unable to
make reasonable property dispositions;

(D) given solely to detect the commission of an offense; or

(E) used for a purpose other than that for which the consent was
given.

(13) "Electric utility" has the meaning assigned by Subsection (c),
Section 3, Public Utility Regulatory Act (Article 1446c, Vernon's
Texas Civil Statutes).

(14) "Harm" includes partial or total alteration, damage, or erasure
of stored data, interruption of computer services, introduction of
a computer virus, or any other loss, disadvantage, or injury that
might reasonably be suffered as a result of the actor's conduct.

(15) "Owner" means a person who:

(A) has title to the property, possession of the property, whether
lawful or not, or a greater right to possession of the
property than the actor;

(B) has the right to restrict access to the property; or

(C) is the licensee of data or computer software.

(16) "Property" means:

(A) tangible or intangible personal property including a computer,
computer system, computer network, computer software, or data;
or

(B) the use of a computer, computer system, computer network,
computer software, or data.

33.02. Breach of Computer Security

(a) A person commits an offense if the person knowingly accesses a
computer, computer network, or computer system without the
effective consent of the owner.

(b) A person commits an offense if the person intentionally or
knowingly gives a password, identifying code, personal
identification number, debit card number, bank account number, or
other confidential information about a computer security system to
another person without the effective consent of the person
employing the computer security system to restrict access to a
computer, computer network, computer system, or data.

(c) An offense under this section is a Class A misdemeanor unless the
actor's intent is to obtain a benefit or defraud or harm another,
in which event the offense is:

(1) a state jail felony if the value of the benefit or the amount
of the loss or harm is less than $20,000; or

(2) a felony of the third degree if the value of the benefit or
the amount of the loss or harm is $20,000 or more.

(d) A person who is subject to prosecution under this section and any
other section of this code may be prosecuted under either or both
sections.

33.03. Defenses

It is an affirmative defense to prosecution under Section 33.02 that
the actor was an officer, employee, or agent of a communications
common carrier or electric utility and committed the proscribed act or
acts in the course of employment while engaged in an activity that is
a necessary incident to the rendition of service or to the protection
of the rights or property of the communications common carrier or
electric utility.

33.04. Assistance by Attorney General

The attorney general, if requested to do so by a prosecuting attorney,
may assist the prosecuting attorney in the investigation or
prosecution of an offense under this chapter or of any other offense
involving the use of a computer.

--

Looks like Mr. Puffer clearly committed the offense described in 33.02(a)

Now is Harris Country guilty of negligence in adequatelely protecting their computer networks? I'd have to argue that yes, in my opinion they probably are. Anyone who'd carelessly run wide open unprotected wireless ethernet in a local government agency is not only a moron, but also a very poor steward of public records, which is a job taken *very* seriously in Texas.

Re:Texas Computer Crime

[autocracy]

Here's the strange thing - according to the register article, he was charged with 2 counts of fraud !

Re:Texas Computer Crime

[VivianC]

33.02. Breach of Computer Security

(a) A person commits an offense if the person knowingly accesses a
computer, computer network, or computer system without the
effective consent of the owner.

He may not have violated this law. Is there a machanism in place that identifies that this is a private network and that no access is allowed? I don't know about Texas, but here in Illinois the courts ruled the the phrase 'Please Enter Password' was an open invitation to enter the system if there is no admonition appearing previously that the system is for use by authorized parties only.

For example, if you leave a computer in a public area unsecured and unmonitored, any person can walk by and use it without it being a crime. For it to be a crime, there must be some measure of control exerted.

Try this, mark a $20 bill and leave it on a bench in a mall. Watch to see who picks it up and try and get the cops to arrest this person. Heck, even try to get your $20 back! It's a fun way to waste time at Woodfield until the cops get pissed and kick you out. Let me know if you have better results without lying.

From an underworld IT worker in San Jose

[Anonymous Coward]

They also have more secure networks.

Bullshit

[autocracy]

Mr. Puffer (?) should never have been charged with this crime. The suits at the courthouse are mad because their fancy new wireless network they built to keep up the with the times wasn't taken care of properly and possibly isn't suitable for them. How it cost them $5k to "clean it up" is beyond me. Of course it costs more money to do it right - but how do you expect to claim that as "cleanup?"

The person charged was not acting maliciously, did not cause any damage (what is claimed is bogus), and his actions were willfully disclosed in good faith. He got the raw deal...

Re:Bullshit

[Jester99]

How it cost them $5k to "clean it up" is beyond me

Your outsourced tech support staff of 5 people who bill at $125/hr spend a single 8 hour day working on it. That's how. Money adds up fast in the business world.

Re:Bullshit

[antirename]

Yeah, but that's just doing work that they should have done in the first goddamn place. They did the job, they fucked it up, and then they get paid to do it again correctly. I wish I got paid on those terms. (Assuming they were contract labor... even if they were salaried employees, the point is the same).

Re:Bullshit

[autocracy]

A cost that should have been paid in the first place then. This man did not cause that cost - he simply brough to attention a flaw that was under-appreciated and expensive to fix.

Re:Bullshit

[GSloop]

Even at $1000 per hour, I could fix it for less than $5.

It should take about 5 seconds to walk over and pull the power plug for the WAP.

Vulnerability fixed.

For an extra $3.33, I would be glad to turn around and tell the man in charge that he is fired for being such a stupid ass.

There, for less than $7.00 we've solved the security problem (symptom), and also fixed the root problem - a clueless dolt.

Cheers!

Informative

[nuggz]

Quite informative, I see your point.

I would argue that 33.02(a) Effective consent was given in that it the network was publicly broadcast.

Television broadcasts are free to view, radio free to listen. This is implied in that they are publicly broadcast to any recipient.

Blame Game

[Ashcrow]

Embarrassment is what it comes down to. When the courthouses pretty new wireless system, which they paid a good amount for, is found to be vulnurable to an attack they blame the one who found it instead of the admin who put the package together.

Criminal Intent

[nuggz]

Good point, what are the laws in Texas on Criminal Intent.

You don't get a B&E for pulling someone out of a burning building.

Re:Headline is Wrong - Not White Hat

[GigsVT]

That's like seeing a wide open door to the court house in the middle of the night. What business do you have looking at the court house at night!?

Of course, I don't know how much this guy poked around before he decided to tell them, so I really can't judge this one.

Re:A previous demonstration?

[TheMidget]

Or, more to the point, the clerk probably found a welcome excuse to explain the presence of this picture on his PC to his boss...

A different perspective:

[mcrbids]

A Houston home security analyst has been charged with breaking and entering after demonstrating the insecurity of a county court office.

Stefan Puffer, 33, was indicted by a Grand Jury on Wednesday with two counts of burglary for allegedly breaking into Harris County district clerk's offices. It's believed to be the first case of its kind in the US.

Puffer, who was employed briefly by the county's security department in 1999, could get five years in jail and faces a $250,000 fine on each count if convicted, the Houston Chronicle reports.

He's accused of accessing the offices March 8 in an alleged intrusion that cost the county a reported $5,000 to clean up.

District Clerk Charles Bacarisse told the paper that no confidential paperwork was disclosed but the alleged intrusion eventually resulted in the county closing its new offices only a month after they were opened.

But is the prosecution a case of shooting the messenger?

On March 18, Puffer demonstrated to a county official and a Chronicle reporter how easy it was to gain access to the court's offices using only a hammer and paperclip. Puffer first noticed the problem while scanning for insecure homes and offices throughout Houston earlier that month, around the time that the alleged offence took place.

Would you be upset at the above news story?

Really folks, with a $4 hammer, you'd be surprised at how "insecure" most homes are! Have you ever heard of a "white hat" burglar?

Re:A different perspective:

[flonker]

I'd say its more analagous to an open window of the courthouse spewing court documents out onto the street. This guy unfortunately stooped down and picked one up.

Not only that, he had the gall to go to a local official, and show it to them! And they had to get someone to close the window. It took about 30 minutes to get in touch with the judge who had left his window open. That's... $100 of damage, assuming, on a wild guess, the judge costs taxpayers $200/hour.

Re:A different perspective:

[GutBomb]

almost correct. he used a machine that helps him detect open windows spewing documents out

Re:A different perspective:

[Pig Hogger]

I'd say its more analagous to an open window of the courthouse spewing court documents out onto the street.

Once more, again, it's Microsoft's fault...

website of the county clerk?

[kevin lyda]

apparently this is the website of the county clerk quoted in the houston cronicle story. since /. failed to get info from him, perhaps we could each drop him an email to find out the other side of the story.

however, i do note that the county attorney seems a little selective in what laws he wants enforced.

Balmer Steals Access and Brags About It

[lincomatic]

The network was totally wide open - no WEP and DHCP on ... anyone w/ an XP computer and built-in WiFi who turned their computer on would have automatically associated to the network, so what is Puffer's "crime?" He was demoing to a county official, don't forget. Meanwhile, Steve Balmer brags about stealing bandwidth with Bill Gates and gets applauded:

http://www.infoworld.com/articles/op/xml/02/07/2 2/ 020722opcurve.xml

"For all his success at bringing Microsoft's warring constituencies together, there are still things beyond Bill and Steve's control. "I was in a hotel in Sun Valley last week that was not wired," Ballmer recalls. "So I turned on my PC, and XP tells me there is a wireless network available. So I connect to something called Mountaineer.

"Well, I don't know what that is. But I VPN into Microsoft. It worked! I don't know whose broadband I used," he chuckles. "I didn't see it in Bill's room. I called him up and said, 'Hey, come over to my room.' So soon everyone is there and connecting to the Internet through my room."

Chalk up another good day for Steve Ballmer, CEO. Bill Gates may be the chief software architect, but as Microsoft matures in the Ballmer era innovation in software shares the spotlight with teamwork.
"

I am incredibly torn on this...

[tlambert]

On one hand, they are trying to charge him for what it cost them the insecure system, now that they've had to discontinue it. That's really assinine. It's like buying a Corvair, and then suing Ralph Nader after he publishes "Unsafe At Any Speed".

On the other hand, it sets a nice precedent for when the cable companies come snooping around, trying to enforce against "connection sharing" when people set up unsecured wireless access points on the end of a cable modem connection.

AT&T: We're disconnecting you for running an insecure access point.

Customer: I'm suing you for proving my network is insecure; thanks, Stefan Puffer!

-- Terry

I'm interested.

[DarkHelmet]

Whatever hole he found, I'd be willing to buy it from him. There are a couple speeding tickets I need cleared.

Damnit, my license is at stake here!

More info

[Bistronaut]

The Register is cool and all, but why not just link the Houston Chronicle article that they got it from? Their article is much better.

Re:More info

[Bistronaut]

thanks

What's the reporter doing there?

[Restil]

He was demonstrating to a county official AND a reporter. That somewhat implies that this wasn't a behind closed doors, tiger team type evaluation on the network. This wasn't just a "hey, I accidently noticed you left your network wide open. Might wanna fix that". If there was a reporter there, someone's toes were probably getting stepped on. The security analyst doesn't deserve to get charges pressed against him, but he should have gotten something in writing from the officials BEFORE demonstrating illegal activity.

Although the metaphors aren't identical, if I reported to the police, or a homeowner that they've been leaving their doors unlocked, someone at some point will probably ask me how I know that. Computer security is taken rather seriously these days. There seems to be no effort in making sure there is any, but they sure like to rake you over the coals for any alleged violation of it. When the "victim" happens to be the government, especially the court system, that will just up the stakes even more.

Its unfortunate that this has to happen. But if your less than legitimate activities happen to result in useful information for somebody, don't think that the simple act of good faith by handing that information over will clear the slate for you. Either do it anonymously or get immunity first. Or just keep your mouth shut.

-Restil

Re:He should go down for this

[Qrlx]

The fact that he showed it to a newspaper reporter indicates there was *no* goodwill involved.

So, we should do it the Microsoft way? Tell the company about a flaw in their system and let them spend months to fix it, leaving countless unaware individuals completely vulnerable while the "proper authorities" formulate a cost-benefit analysis and figure out where the bug fix lives on the Gantt chart?

Why do you think we *have* news?? You would prefer to get all your news from press releases and government propaganda, it seems.

First of all, the county's IT department was negligent, possibly to the point of criminality, in providing WiFi access to the LAN without any security measures. Would Puffer be looking at five years of jail time if he plugged his laptop into a jack in the hall and found he had LAN access? Maybe. But isn't the County office, by definition, public property? He wasn't tresspassing.

It's like if the government was sending secret information unencrypted on 95.5 FM. You tuned in, told a govt agent and a reporter about it, and now you're the one who did something wrong? This makes sense to anyone here?

The person who really made out in this gig is the "Security Consultant" who charged $5,000 to "solve" this problem. Setting up a VPN for your WiFi clients takes what, about 20 minutes? But clearly the County was so alarmed about the Terrorist Hackers out there that they decided they needed a big expensive solutions. These are serious problems, you know, and they will probably get some of that Anti-Terrorism money from the Feds to pay for Hardening their System against FutureTerrorist Attacks.

By the way, I deal with confidential medical data as part of my job. There's this law called HIPAA. If I were to set up an open WiFi access point on my LAN, *I* could be jailed and fined up to $25,000. *NOT* the guy who is nice enough to tell us (but kind of a dick for telling the local paper.)

What's next? Are we gonna go after Richard Feynman for pointing out that frozen O-Rings make the Shuttle blow up? Mabye I should get hauled off for mentioning that you can punch through the hull of a pressurized aircraft while it's in flight with a big enough screwdriver!

Don't worry about me, though. When I get hauled off into the black Fed car, I'll just yell "Hack the Planet" to the kids on the street and next thing you know, the Slashdot Activist Justice League will rally to my defense!

One omission in the articles...

[D'Arque Bishop]

This isn't the first time the Houston Chronicle (which the Register references) has reported on this story. What they're leaving out in this article is that the county official that Puffer demonstrated the breakin to was, in fact, the equivalent of the head of IT for the county. So, one wonders if indeed that could be counted as having permission...

(I don't remember what his exact title was, and I don't remember the links offhand, but the official was definitely the head of the county's equivalent of an IT department.)

Just my $.02...

Re:One omission in the articles...

[D'Arque Bishop]

(I don't remember what his exact title was, and I don't remember the links offhand, but the official was definitely the head of the county's equivalent of an IT department.)

I just found an older link. It was Steve Jennings, head of the County Technology Department. Also, the article shows just exactly how badly Bacarisse reacted, inclusing saying "hackers, terrorists or anyone else intending harm would be detected long before they could do any damage or use the system illegally."

You can read the rest for yourself here.

Just my $.02...

Re:One omission in the articles...

[_Sprocket_]

This is quite facinating. There are a couple really important statements made in that article:

The network had not yet been set up, they said, and neither Puffer nor anyone else could have done any damage.
...
But because the county's main system and the independent one run by Bacarisse are connected, Puffer was able to show Jennings that he could get information about the county computer network.
...
Bacarisse said his staff found a pornographic picture on one of its servers Tuesday that he suspected was planted by Puffer. He said he would refer the incident to the District Attorney's Office.
...
Bacarisse accused Jennings of giving Puffer information to help him access the system and hinted that Jennings was trying to use the demonstration to increase his authority over systems that he didn't control.

Jennings and Puffer vehemently denied that.

These quotes lead to a lot of questions. If this was a test network that couldn't present any threat to the government's network... how come Puffer was able to access the County network? Furthermore, why is Puffer being convicted? And how would he have been able to post a pornographic photograph?

This has all the markings of beurocratic infighting. A techie quiting after a short, stormy tenure. A beucrocrat implementing an insecure network and assuring that it was no threat... and then convicting on charges of altering government systems. And that same beurocrat accusing another government worker of moving in on his personal feifdom.

The only thing I'm suprised is that after having seen the insides of all this, Puffer was stupid enough to make his name known. Big hint to whistle-blowers: use the press and insist on being anonymous.

Re:Burn the observatory, so this never happens aga

[Jonny 290]

Look, the days of the whiz-kid cracking into systems and then getting hired by the same company as a result is long over. There are professional security consultants that do this sort of thing and if the agency didn't hire them beforehand, well, then, they deserved to get fucked. But it was neither this man's job, his obligation, nor his civic duty to prove to them this fact.

The fact that this guy called the media out to witness this will damn him in court. He's watched _Sneakers_ too many times. The age of the geeky computer hacker is long gone; if you know a lot about computers these days, you're either a communist, terrorist or both. Ask any ordinary USian. They're *TERRIFIED* of computers. They refuse to give credit cards to my company because "we might be hacked". They constantly think that somebody stole our /etc/passwd because they're getting spam and "they had to get those addresses somehow."

Ignorance is the key matter at hand. The laws today are ignorant of the 'intent' of the accused, and for good reason. Every computer cracker ever caught has pulled the "i just wanted to show them how insecure their system was" line, and they're sick and tired of letting kids trash networks and getting probation for it.

Turn this around

[SeanTobin]

What if I were to get a directional antenna, and beam my wireless network in the general direction of the court building? And of course, setup a dhcp server and use no encryption and all the default workgroups. Could I then charge them for breaking into my wireless network?

Same question goes with a neighbor? Can I charge my neighbor for hacking into my network? Is it my responsibility to line my walls with aluminum foil so my signal doesn't go out? Or is it his responsibility to line his walls so he doesn't accidently hack into someone elses network?

Re:where do they get these numbers??

[GutBomb]

I took the $5000 figure to mean that the original wireless network equipment cost them $5000 and since they had to take it down because of the intrusion, it was $5000 down the drain. now that is a bullshit claim, but it wouldn't surprise me if that is exactly what that figure represents.

Re:Headline is Wrong - Not White Hat

[GutBomb]

actively attempting to gain access to a computer system you are not authorized to access is illegal

As I understand it....

[pclinger]

I read the articles about this yesterday, and as I understand it there was a breach of their wireless lan (they don't specify what happened in the breach, but it sounded like someone did something malicious). This breach happened around a time that the person who is being charged was scanning for insecure wireless networks. If he didn't do anything malicious I don't think he has anything to worry about.

Cyberphobia strikes again

[stinky wizzleteats]

So, let me get this straight. You happy people (non-tech) will put us in jail for attempting to help you use technology in a secure way, because you hate and fear us so much. You actually are prepared to alienate all of us (and imprison some of us) rather than deal with the embarassment of your own inability to use technology, and to willingly make it impossible for anyone to conduct IT security work in good faith. You want to make enemies of all of us, do you?

...dusts off black hat...

Have it your way.

Re:Cyberphobia strikes again

[Spackler]

You happy people (non-tech) will put us in jail for attempting to help you use technology in a secure way, because you hate and fear us so much.

And how is this different from when they beat the crap out of us in high school? The situation may be new, but the people are the same (except that we run the economy now. BWAHAHAHAA).

Re:Cyberphobia strikes again

[hklingon]

I want to go to lawschool for this very reason. I had an interesting debate a few months ago, which has expanded onto several threads of thought. Consider the following:
1. Is it legal if someone hires you to kill them?
2. Is it legal if someone hires you to destroy some of their property?
3. If someone hires you to simply annoy them, what then? (i.e. a "crime" that does no measurable damages)
4. What happens if observe that a crime could easily be commited, and yet you do nothing?
5. What if you have advance knowledge of a crime, and do nothing?

There are two things working against techies: 1. Social engineering (direct or indirect) works on law enforcement with reguard to technology issues because they simply aren't trained. If the head of IT for a city or other "important" person calls and tells the law to arrest someone based on some obscure log printout, the law will probably be able to do so. 2. No one understands technology, except you, and well, no one will listen to you when you stand accused. Unlike other scuffles, the cops can't examine the situation and determine for themselves the severity and how to handle it.*

Clearly, #1 is illegal. Based on many cases in CA, VA it would seem that even if you have papers signed by the CTO and CEO , and you do a full security audit you can still be arrested. (Remember the case in CA where the guy did social engineering and took pictures of the server room -- thats it. He's serving a 1 year prison sentence. The board of directors and the President of the company sent him up -- the CTO and CEO resigned.) "Breaking the law is still breaking the law, irregardless of intent..." is what the prosecution successfully ordered. But whats the analogy for wireless? An english school boy standing on your lawn with a bell yelling about how you never lock your house when you leave that only some people can hear? Or is the better analogy like going up to someone's door, rattling it, then discovering that there is no lock? Its all a matter of politics and twisted truths -- not really the crucible that should burn all that away.

Re:Cyberphobia strikes again

[stinky wizzleteats]

moderators, the previous post deserves some points. mod parent up.

You hit on some of the reasons why I don't do "tiger team" security audits. The only way I'd consider doing it is if a company officer is present AND presses the enter key after I set up the script which breaks into their accounting system.

To broaden upon your very good points, I know from personal experience that retail stores do have loss prevention audits which involve agents actually committing shoplifting in order to test the staff's ability to prevent theft. This would seem to me to be several orders of magnitude more illegal than either the case you described or the article which started this thread.

The thing which keeps me up at night (as someone who does IT security work) is the legal weight of permission from your client do perform what are, in fact, criminal acts. You can waive your legal rights to civil recourse, but can you waive criminal liability in similar fashion? This gets back to your question:

1. Is it legal if someone hires you to kill them?

Despite the intricacies of the Kevorkian debate, I suspect the legal answer to both our questions is no, which brings me to the point in my previous post. If the fear and loathing of general society toward people who possess our skills is so great that we cannot make a legitimate living, then we will be driven underground.

While my "black hat" jab was intended as a joke, there is a very real social problem which this fear poses. There are many organizations in this climate of the beginning of the American police state who would go to almost any length to secure their information from the eyes of those hostile to them. Although I personally would never consider such a career move, it would be a shame if the country's most brilliant security minds were forced to work against the interests of the U.S. government.

Re:Cyberphobia strikes again

[leandrod]

You happy people (non-tech) will put us in jail for attempting to help you use technology in a secure way, because you hate and fear us so much.

This pressuposes ill faith. Never ascribe to malice that which is adequately explained by incompetence (Napoleon Bonaparte). I do think incompetence does become malice when it comes from unrepenteded negligence, and further on when one tries to cover up his mistakes. But malice alone does not explain the origin of the problem.

As I see it, this situation arises because IT practitioners are not adequately instructed on the fundamentals of technology on one hand, and on the other, even when they are, do not have the authority to take decisions based on that.

For example, we should be able to say no to managers when they require us to use substandard technologies. We should have been able to say no to PCs instead of X terminals; to client-server instead of TP monitors or host-terminal; to MS Windows instead of POSIX; to SQL instead of QUEL. And even to say no to implementations: no to insecure 802.11, to unmanaged connection to the Net, to application protocols overloaded on HTTP. But we cannot, either for lack of knowledge, or of authority.

If nothing else, frequently the user himself who may be a director, VP, CEO, CTO or CIO will take it to himself to hire his geek nephew or allocate some time from the nerd subassistant who knows how to use his PC to implement unsafe, unsound and ultimately costly network and PCs.

Re:Headline is Wrong - Not White Hat

[GutBomb]

the point is that he knew he was not authorized to access it. if you open the door to someone else's house and it is unlocked does that mean he can go in, just to see if the door is secure, unless there is a sign saying "no trespassing"?

Re:Burn the observatory, so this never happens aga

[Wateshay]

The article isn't entirely clear, but my take on the "Clean up" costs is that the county spend $5000 putting in a wireless system, and then had to take it down a month later because he showed them it was insecure (thereby making the $5000 a waste of money). Hardly seems like a crime to me.

Re:You Are Correct...

[nomadic]

Because we all know how quickly the issues would have been looked at / fixed if he went thru the "proper"/cover my ass channels...

So? He wasn't an employee, he wasn't responsible for the system, and whether they fixed it or not wouldn't have affected him. That's like me breaking into your house to "prove" how bad your security is, then justifying it by complaining that if you had just told me how bad my locks were I wouldn't have changed them.

This is why you don't tell them

[Trepidity]

You just happily use their network for free access until they figure it out themselves.

Call it evolution in action...

[kcbrown]

No, I'm not talking about what happened to Stefan Puffer, but what Harris County is telling everyone.

In essence, they're telling everyone "don't tell us about any security vulnerabilities we might have. If you do, we'll prosecute you".

Okay, Harris County, have it your way. If you want to live in ignorance, fine. The end result is that your network will end up being hacked by people who really are black hats and who don't give a shit about the integrity of your computer systems or network.

It's unfortunate that other entities that are inclined to be more reasonable will suffer, but so be it. Those that are really enlightened will probably put up a statement on their website saying something like "if you manage to hack into our systems or network and notify us immediately of the fact that you did so and how you did it, and do not make any modifications to our data or copy any of it that isn't already published, we'll not only refrain from suing you, but we'll pay you a reward for your efforts" -- the intent being to make it clear to white hat hackers that they really do want to know about security vulnerabilities.

But the bottom line is that places like Harris County will end up having a lot more problems than more enlightened places. Evolution in action.

I, for one, am not going to tell anyone a damned thing about any security vulnerability of theirs I stumble across unless I happen to work for them and have gotten prior permission to look for security vulnerabilities. And I'll laugh at anyone who behaves the way Harris County did and manages to get hacked later on.

Well, fuck 'em, and plunder is the message I got.

[crovira]

If I ever discover a hole war driving (or war walking.) you can bet your ass I won't tell anybody there about it.

Though I may give my friends the location...

Re:You Are Correct...

[cookd]

I think a more applicable analogy is as follows:

Person A: Your house is vulnerable. Somebody could break in anytime he/she wants.

Person B: Is not!

Person A: Yes, it is. And I suggest you get it fixed before somebody takes advantage of it.

Person B: Proove it!

Person A: Puts hand on front door's doorknob, turns doorknob, pushes door open. See?

Person B: Dials 911 on his cell phone. Hello, I'd like to report that "Person A" just broke into my house, and I want to press charges.

Re:Headline is Wrong - Not White Hat

[Loligo]

>So, it'd be more like a closed, but not locked
>door, and on a hunch the guy went over and
>pushed the latch.

Ehh, maybe if he walked over, pushed the latch, then looked around inside for a while...

Finding an open lock isn't illegal - trespassing as a result of the open lock is.

They don't go into much detail about what he did with the open network during the time he knew about it, but what are the odds that he just ignored it and didn't report it till later cause it was on the back burner?

If they can demonstrate that he poked around, he broke the law.

-l

Re:You Are Correct...

[nomadic]

Only that the "Prove it" part didn't happen. Note he was not being prosecuted for demonstrating to the court official on the 18th, but rather for the initial breakin on the 8th which he did with no prodding.

So, analogy would be:

Person A: Your house is vulnerable. Somebody could break in anytime he/she wants.
Person B: Is not!

Person A: Yes it is. And suggest you get it fixed before somebody takes advantage of it.

Person B: Prove it!

Person A: Puts hand on front door's doorknob, turns doorknob, pushes door open. See?

Person B: Well I'll be. I'm glad you showed me before anyone else broke in.

Person A: No problem. By the way, I did the same thing last week; went into your house, rifled through your papers, drank your beer. No need to thank me.

Person B reaches for the cell phone...

Re:RTFA

[be-fan]

He committed a crime while in the presence of a public official. It DOESN'T FUCKING MATTER what his "intent" was.
>>>>>
Actually, if I run down somebody in the presence of a public official, it matters. If there was intent, its murder (probably first degree because by inviting the official, it was premeditated). In that case, you are looking at the death penalty or life imprisonment. If it was an accident, its vechicular manslaughter, which is a misdemeanor in many places, so its community service and a fine or a short jail term.

Letter of the law?

[be-fan]

Since when did we become slaves to exactly what the law said? The basis of our law system is that laws provide strong guidelines but judges are given a great deal of power exactly so that these kind of idiocies don't happen. The guy pointed out that the system was borked. He didn't do anything wrong in the process. The IT department should thank him for pointing out the flaw, fix it, and move on with their lives. The judge should have thrown out the case after a preliminary hearing because it was stupid. It's incredible that we've gotten to the point where we're intellectualizing these things so much (and both sides are at fault here, both people defending him and opposing him) that we're treating the law like the synactical rules of C++ rather than the very different rules of a human society.

Re:Letter of the law?

[be-fan]

Its classless to respond to your own post, but I'll do it anyway. Anybody who's read the Constitution knows what I'm talking about. The thing is so clear and straightforward. Then, you look at the multi-thousand page laws about how people should wipe their asses, and you wonder how real intellectuals (the founding fathers) got replaced by wanabee's who get off on technical details rather than purity of design.

Re:You think THAT's scary...

[windex]

Don't connect to gnutella either, you might be attempting to break federal trademark laws...

Re:where do they get these numbers??

[geoswan]

Hey, dumbass, he did it in front of a court official

No, he did not perform the demonstration for Charles Bacarisse, who, is the closest thing to a Court official in this story. He performed the demonstration for Jennings the head of the County's Technology department.

Did Jennings have the authority to order Bacarisse to close down or secure his network, because it was putting the rest of the County's systems at risk? I suspect he did not. Or why wouldn't he have done so? Is it possible Jennings agreed to Puffer's demonstration in order to win a turf war with Bacarisse?

Government Mindset

[_Sprocket_]

Note to all ethical hackers, script kiddies, and whistle-blowers: the US Government does not want your help. If you point out insecurities (glaringly obvious or otherwise) in any Government host or network, do not expect thanks. Instead, you should expect to be the subject of investigation.

There are three things one should consider when dealing with the US Government on information security issues. First, the US Government's business is law, not technology - they have much more understanding of the former than latter. Secondly, the US Government tends to not understand information security issues. Their expertise deals with government and Cold War policy - the modern infosec environment has aspects of that era... but it is quite different. Finally, the US Government is not interested in information security issues. Lets address these points.

Before going further on this rant... I'd like to make one qualifying statement. Like all large groups, there are individuals within various Government bureaucracies who are exceptions to these observations. I like to think I was one of them. And I know some excellent people working information security within their departments who defy the norm. But nonetheless, the norm does exist. Despite these excellent few examples, it is the leadership and the vast majority of management in US Government institutions who generate the following attitude.

The business of Government is not information technology, it is law. Any manager within Government is a bureaucrat in one way or another... including IT. One does not gain any such level of trust without understanding the political system in which one operates. This often leads to IT managers who have a limited familiarity with IT systems, but are very comfortable with rules and law. This can work for them if they're forced to fight for their environment's budget. If a Government agency is lucky, they have enough pull to win a decent budget and easily meet their needs. Many agencies are forced to make due on what little IT budget they are able to scrounge. This leads to few resources be it equipment or manpower. With this in mind, the highly skilled IT worker is few and far between within Government. And those few dedicated souls will likely be overworked.

Governmental infosec agents tend to have a physical security / Cold War background. They are used to dealing with entirely different environment than what is commonly found today. This leads to a slew of misconceptions, but we'll focus on a few specifics. They value secrecy over disclosure. They have a hard time accepting hacking (malicious or not) as entertainment / educational. They believe anybody exposing a system's vulnerabilities have only malicious motives.

I'd like to demonstrate these two points with a quick story. I was attending a monthly cross-contract infosec meeting for a large US Government facility. The meeting started with a nice presentation of a recent vulnerability and how to mitigate the threat. There were a few attentive audience members, but the vast majority sat there with a dazed look as the presentation washed over them. Then the local FBI agent stood up to make a presentation on a recent compromise of one of the facility labs. The lab manager was on hand to give testimony on the damage caused to his environment and the loss of resources to the FBI as they confiscated equipment to collect evidence for the future prosecution phase of the case. The room lit up. There were notes being taken, questions being asked and an overall enthusiasm for the process of catching the perpetrators of this damage. The interesting point was that this same manager had told me two months prior that he didn't wish to deal with any of the infosec procedures I had been suggesting as the changes would be "more disruptive than anything those hackers could do." If the audience in that room paid more attention, time, and funds to improving their security stance they would spend MUCH less time and funds in recovering from attacks. The point was always lost on them.

Finally, the Government is not interested in information security. If they were, they would fund it. And they don't. I would constantly hear phrases along the lines of "we would do that if we had the funding, but we can't spend that much time on that kind of activity without specific funding for it... and we've been trying to get funding for infosec, but can't." I always found it ironic when a defaced web page would include instructions from the attacker on how to secure the machine. Its not (always) that the sysadmin was incompetent and needed instruction. Often its that he/she doesn't have the time or permission to deal with it. The sad fact is that compromising .gov IP space is child's play.

So what if you STILL want to blow the whistle? First, make it public and embarassing - nothing gets a beurocracy moving faster than public embarassment. That usually means the press. But the trick is to find a reporter you can trust to keep your identity anonymous. The last thing you want is an embarassed beurocrat trying to cover their tail by shifting the blame on to you.

Shoot the messinger!!!

[Newer Guy]

And maybe he'll turn into a ostrich. Because, after all it no one TELLS you there's a problem then there isn't one. Right??

What he did was stupid.

[Wakko Warner]

He sounds like a "security professional" who "demonstrates a flaw in the system" to a potential client. This is not the smartest way to win clients. It is embarassing.

Had he called their IT director, described the flaw to him in private, he chose to take it to the press first. He might actually have won business from the IT director had he been a little more professional about it.

Unfortunately, he chose to try and shock not only them, but the public as well.

He pulled an incredibly stupid stunt: did something illegal and told people about it. Don't you think he should've been arrested, too?

- A.P.

This Houston Chronicle article...

[freeBill]

...is actually quite funny. The following comes directly from the article.

"The practice, called 'wardriving,' is easier if the victim has not taken the simple step of activating the security features to encrypt the airwaves.

"Essentially, wardrivers use the wireless signals to ride into the computer network, which is what Puffer did to the one being operated by Bacarisse's office."

The fact that this writer could actually talk about "encrypting the airwaves" and "rid[ing] into the network" after researching this story says something. I'm not sure what, but I'm sure it's hysterical. In both senses of "hysterical."

Re:So the best approach is - anonymity

[GlassUser]

Except this is exactly what the guy did, and got arrested for.

It was the pr0n!

[TheSHAD0W]

According to the Houston Chronicle article, it's obvious Puffer did more than benignly access the Courthouse's network. Where else could that pr0n picture on the clerk's office server have come from?

Re:Burn the observatory, so this never happens aga

[loraksus]

I wouldn't be suprised, the "consultants" get most of their pay from whoever made the hardware

So, I heard this a while ago, seems to fit and all

[loraksus]

Good joke, it's relevant, read on. . .

A man is flying in a hot air balloon and realises he is lost. He reduces height and spots a man down below. He lowers the balloon further and shouts:

"Excuse me, can you tell me where I am?"

The man below says: "yes you're in a hot air balloon, hovering 30 feet above this field."

"You must work in I.T." says the balloonist.

"I do" replies the man. "How did you know."

"Well" says the balloonist, "everything you have told me is technically correct, but it's no bloody use to anyone."

The man below says "you must work in business."

"I do" replies the balloonist, "but how did you know?"

"Well", says the man, "you don't know where the hell you are, or where the hell you're going, but you expect me to be able to help. You're in the same position you were before we met, but now it's my fault."

You and many others

[Scratch-O-Matic]

chose an example of crimes for which intent is built into the definition:

If there was intent, its murder...If it was an accident....

For various types of homicide, the crime is determined in part by intent. For illegal entry to a computer system, there is no such differentiation.

Priorities?

[Scratch-O-Matic]

I guess those Houston police shouldn't bother prosecuting anyone who's crime doesn't rise to the level of the Enron looting. Priorities and all, you know.

Re:Headline is Wrong - Not White Hat

[GutBomb]

while wardriving seems like a passive activity, he is actually running an application that alerts him that he has found a network. this makes it active, not passive. if it was simply a passive process, he would be sitting in one spot with his laptop, not ACTIVELY looking for a network to gain access to

Oh well ...

[too_bad]

I guess I was lucky. When I did this exact thing (and maybe a little more fun stuff ;) )
in our harmless local campus network while at school, I got into so much trouble,
you just cannot imagine!

The thing that I learnt very hard and sadly was that people in charge of making
decisions related to the networks hardly know any technical details. And they
always come down hard exactly because of their ignorance.

Anyway, at that point it put a dampener to my enthusiasm to find holes in systems.
And I am sure I will never find myself in the position this man found himself, thanks
to this enlightening experience!

Of course, it would be very nice if someone educated the lawmakers and buerocrats
a little bit more about the systems, security and technology in general.
(sigh)

Re:You Are Correct...

[gaj]

Closer, except ther're no evedence for the "... went into your house, rifled through your papers, drank your beer. No need to thank me." part. In fact, from the pathetic amount of info available, it looks to me more like "... I found several other insecure nets let yours around town as well."

A proper response would have been:

"Bummer. Well, stop war-driving; it could get you in hot water some day. We'll put out a public service anouncement through the local chamber of comerce to give businesses in the area a heads up."

Now you and I know that those businesses' IT folk should bloody well have known how insecure their wireless stuff was, but it is also the case that non-IT people purchase and use equipment that the IT people know nothing about.

What I wanna know is. . .

[PhxBlue]

Why does a court need a wireless LAN, and exactly how much taxpayer money went into installing the LAN in the first place?

Re:Headline is Wrong - Not White Hat

[GutBomb]

try explaining that to a court. the law does not care if the program passively finds connections (or rather connections find it) but the act of war driving is the active component and the court is going to say "the only purpose of wardriving is to find networks to hack into" there is a difference between wardriving and pinging. pinging serves non-hacking purposes, wardriving does not. And to answer your question, I have not wardriven but i would not anyway because i do not wish to have access to anybody else's networks without thier permission, don't want to get arrested for informing them thier networks are open, and i have better things to do with my time (such as posting these stupid arguments on slashdot) than drive around with a laptop trying to find open networks!

So what consitutes "access?"

[Ogerman]

Since the 2.4Ghz. spectrum is unlicensed, just like CB radio or cordless phone bands, how can you possibly charge somebody with illegally receiving or transmitting in this range? Somebody correct me if I'm wrong, but is that not their explicit right so long as they use approved equipment and do not exceed FCC regulations on signal power? It's not like the court had exclusive permission to use this frequency. Similarly, what if this guy had switched off his 802.11 transmitter and just listened instead of actually interacting with the network?

It just seems ridiculous. If we're going to have unlicensed bands on the public airwaves, any expectations of privacy / security must be the burden of people using those bands, not law enforcement. This situation is entirely different than "wiggling door handles" because there is no trespass of private property involved.