6-Month Sentence for NASA Cracker

lunartik noted an AP story running on a 6-month sentence given to Gregory Aaron Herns for cracking into the computer system at NASA's Goddard Space Flight Center. 'Herns told federal agents he was looking for computer space to store movies he'd downloaded. It took hours for technicians to find the problem, fix it and patch the system's security holes.'"

Comments

With the direction Slashdot has been going lately,

[Chess_the_cat]

I'm surprised this wasn't posted under YRO.

I'd love to see a breakdown of the damages

[Nine Tenths of The W]

NASA are claiming it was $200k. It'd be nice to see how much of that was spent on fixing the security holes he uncovered.

Re:I'd love to see a breakdown of the damages

[Richard_at_work]

He said he broke in to use storage space. Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in? Or are you going to forever view that system as 'dirty', with the costs associated with replacing that system and the data on it? This isnt a simple case of 'change the locks, add more CCTV', as you would with a physical wharehouse, you cant 'distrust' a physical building, there is a lot more he could do with a compromised computer system, including hiding unwanted code.

Re:I'd love to see a breakdown of the damages

[NoOneInParticular]

The more apt analogy would be a world where warehouses are used by burglers both for storing stuff and for putting poison in the stored food. When you find someone storing warez in such a house, are you still going to sell the crackers?

Re:I'd love to see a breakdown of the damages

[More Trouble]

Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in?

Am I a competent sysadmin in this scenario? If "yes," then I guess I'm probably running a tripwire of some sort. So I boot from CD, take a look at what's been changed, and fix it. If I'm really on the ball, I'm using something like radmind, in which case I still boot from CD, but I let radmind reverse any damage that had been done.

:w

Re:I'd love to see a breakdown of the damages

[Twanfox]

The safest and most reliable way to 100% be assured that you have wiped all trace of actions done is to roll back to a prior backup. While yes, Tripwire is a great program and yes, while using it myself I conceed that it does in fact trap file alterations well, I seem to recall there was a story not too long ago about generating two files of the same MD5 hash. If that is even remotely possible, then you cannot trust life and death situations and billions of dollars to a system that can still be compromised just because you didn't want to take the time to roll back the system to a known 'sane' version.

It's just a matter of principle in high value systems. What happens if he replaced the policy and key files for tripwire, masking his trail? What happens if he knew the passphrase to use the local and site keys? Even if you know he could not, it just isn't worth the risk. Either take your time to drill down and dig out the pieces, or take the same time to wipe and reinstall. For my money, I feel more secure about wiping and reinstalling.

Re:I'd love to see a breakdown of the damages

[_Sprocket_]

A few years ago, I was sitting in on a meeting for Infosec activities at a NASA Center. One of the first presentations was a rather nicely done outline of recent vulnerabilities and exploits admins should be taking action on. A look around the room saw a vast majority of glazed-over gazes. The next presentation was from our local FBI agent who discussed a recent compromise and the actions being taken to apprehend the perpetrator. The room was alive.

There was much appreciation for the progress being made on the case. Apparently, the FBI had their suspect and were busy building an air-tight case for prosecution. There was a general air of victory. But what many failed to realize was the whole exercise was a signal of defeat. The incident represented potential compromise of data. It involved considerable man hours spent on investigation and recovery of the system. It also represented loss of equipment removed from the budget-strapped lab to support forensics activities.

This represents a couple different problems with the common view of information security at NASA.

It shows a lack of understanding of infosec issues. Instead of approaching infosec as a technical problem, the issue often gets far more attention as a legal / law enforcement issue. This is attitude calls for action after the damage has been done.

It shows a inappropriate focus on funding. All IT budgets are stressed. NASA is no different, and perhapses even more thinly spread than others. That means infosec activities tend to get cut in favor of other IT activities. Yet there is no perceived issue in later spending considerable resources to prosecute each infosec incident.

It may be worth stressing that this meeting happened several years ago. And there have been changes in how NASA, and the US Government in general, now perceive information security. So my observations do not represent an all-inclusive view of infosec at NASA (and those observations are my opinion and not policy of my employers). None the less, these observations are still applicable today.

One side observation to anyone considering taking a stab at *.nasa.gov space. Historical statistics show that you'll find suitable targets and manage to compromise a system. But keep in mind, for the US Government that is just the beginning. The FBI views a case as making progress over several years of investigation and finally prosecution. So the compromise of a system that takes minutes, and the abuse of that system over a period of weeks or months may mean that years later you'll find yourself in court.

Wow...

[Flaming_cows]

6 months in prison because he was too cheap to buy a hard drive...

Re:Wow...

[mirko]

It should at least have been 6 months of collectivity-related work.
If the guy was technically decent, it's a shame he'd be sent to a federal fuckodrome... :(

Great idea

[Anonymous Coward]

Let's just download some movies. Oh wait, I've run out of space.

LETS HACK NASA!

Step 1: Download movies.
Step 2: ???
Step 3: HACK NASA!

Re:Great idea

[TFGeditor]

But where's the Profit? There's gotta be Profit. You can't have a 3-step program without Profit. Profit makes the world go 'round. We like Profit...oh, wait...

Re:Great idea

[knipknap]

Who has more expierience solving space problems than the NASA?

Mmm. No.

[Ligur]

"It would be like clearing a sidewalk full of spectators with a fire hose so you can walk through it," said Assistant U.S. Attorney Greg Nyhus.
More like breaking into a bank vault to store the bicycle you just stole.

Re:Mmm. No.

[djdavetrouble]

yeah, yours is better and funnier. He should step down immediately !

****FOR IMMEDIATE RELEASE****

Longtime Slashdot.org member Ligur (453963) has been selected to replace Assistant U.S. Attorneey Greg Nyhus. Nyhus, although promising, proved unable to form relevent analogies in meetings with the press. Ligur, although not formally trained in law (a condition known as IANAL) is highly knowledgeable in general subjects, has excellent karma, and is frequently moderated to +5 funny.

crackers

[Anonymous Coward]

"It took hours for technicians to find the problem, fix it and patch the system's security holes'"

That's so obviously the cracker's fault...

This is a good thing

[lorcha]

He was a cracker. He cracked and abused a system. He was convicted, and was given a reasonable and appropriate punishment.

This is how the system is supposed to work.

Put these morons to use

[Timesprout]

NASA should be allowed use these idiots in their experiments. I'm thinking 'Effects on subject A when parachutes fail to deploy on capsule dropped from 50,000 feet' or 'Impact determination of Subject A foolishly slashing open his space suit in LEO" sort of stuff.

NASA could get valuable data, some small furry woonland creatures would be saved this fate and the world would have a few idiots less. Win all round scenario.

Re:Makes perfect sense!?!

[Anita Coney]

Could you please post your address, I'd like to show you how clever I could be at breaking into your house.

Policing our own

[TFGeditor]

Tacit approval of this sort of thing (cracking) paints us all with the same unsavory brush. If we do not start policing our own, the "geek/nerd" stigma will deepen. We are professionals, let's act like it.

Huh?

[Pheonix5000]

"It's not like firing up your Macintosh or your Apple where you push a button and wait six minutes for the thing to boot."

He must be talking about Windows ;)

Re:Hacking Vs Cracking

[MikeyVB]

Oh boy, this one again!

I disagree.

Cracking == Breaking or "cracking" any type of computer security, weather it be software or a server.

Hacking == Programing.

Re:Hacking Vs Cracking

[Flaming_cows]

Actually, that's not it at all. According to 'purists', hacking is a term used to denote someone who programs (e.g. hacking code is programming) whereas cracking is breaking into a system with malicious intent, although the term hacker has been demonized by the media and government (e.g. Kevin Mitnick's story).

Yes, your honor ...

[dhilvert]

... after the accused stole my $3.59 flowerpot, I had to spend hundreds of dollars putting locks on all of my doors.

Re:Maybe he hadnt checked pricewatch recently

[saider]

Because this happened 4 years ago when a typical hard drive could only store a dozen movies or so. And a 17 year old is unlikely to be able to afford a large drive (I don't know if he was working or not).

Restricted access to computers -- has to change

[ckedge]

.
Herns was ordered to pay restitution for the damage he caused and will have limited access to computers for the next three years. After the judge outlined the terms of Herns' restricted computer use, Levine pointed out how hard those conditions will be for a man who does everything online, including paying his bills.

"He's going to get to learn," Brown said. "There are other ways to live."

The Canadian government has declared internet connectivity to be (I forget the exact term) a "necessity" or something.

If you rob a bank, do they forbid you from walking into any type of business establishment for the entire duration of your parole? No! It would be idiotic - everyone needs a bank account or groceries in today's society, and there are already tons of other perfectly good laws to deal with the individual should they commit a crime in a bank or other "place of business" again.

If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.

Judges are going to eventually have to stop throwing out blanket "computer bans" as minor parole conditions - and realize that they have to handle it differently. PCs may/can be the basis of entire home entertainment centers, your library, your photo album, your telephone, etc etc.

What they should do (and what would be more effective) is to ban the user from say spending more than 30 minutes at a time on a PC, or making an IP connection to a class of third parties, or posessing any tools or software that could be used for illicit purposes - and then have the parole officers make unannounced audits and/or taps.

This goes along the lines of what kind of an effect would it have on you and your life if the police seized your computer in the midst of an investigation (not even an investigation into you, say your webcam caught some images of a crime). My PC is all of the things I listed above and more. And remember, saying "make backups" doesn't cut it, they always take your backups too and withholding those could get you in even worse trouble.

To put it another way - the police need to develop methods that don't "deny you use of your entire house just to check the window for fingerprints".

If they want to ghost the drive and look at the inside of the system before they leave, that's fine. But taking the entire thing for an indefinite period - unacceptable. (I'm talking about when I'm not the suspected murder or something :| )

This just doesn't make sense

[WidescreenFreak]

I don't buy for a second that he was doing it to find space for movies. It just makes no sense at all.

Let's assume for a moment that all of his movies were DivX-encoded at 650 MB each, just for the sake of argument.

* Hard drives four years ago were still relatively inexpensive. By working at McDonald's part-time for three weeks or so he could have had a new hard drive.

* Even if he had so many movies that he required an additional hard drive, why could these movies not have been burned to CD-R instead? CD writers were available for less than $100 and CD-Rs could have been found for less than 50 cents a piece. He could have had virtually unlimited space as long as he purchased a new spindle now and then. (See afformentioned McDonald's reference.)

* Most importantly, what did he expect to do with those movies? Unless he had a T3 or something equivalent to his house, he would have had to wait hours to both upload for storage and download to view. I've had 1.5 Mb/sec DSL for four years, so I know that it would have been feasible back then, but it still would have been far less effort to burn them to CD-R. And at least then they would have been portable, far more so than a hard drive.

* Assuming 1.5 Mb/sec broadband, it would have taken almost an hour just to download one movie. So, he would have taken an hour to download, an hour to upload (at the VERY least since most broadband companies don't use the same upload/download speed), and another hour to download when he wants to watch it? Was he planning on installing a streaming media server as well?

* Why NASA? Why not find some schlep on his ISP who wasn't running a firewall, had lots of space, and store the data there? A Joe-Clueless-User would have been far less able to determine who was storing data on his system than NASA.

I'm sorry, but I just dont buy the "he was looking for computer space to store movies he'd downloaded" line. It makes absolutely no sense whatsoever. Sounds more to me like he was doing something nefarious and was hiding it or he was just looking for ego points and got nabbed in the process.

Re:This just doesn't make sense

[Grey_14]

Ok, Lesse here....

*Hard Drives Are Cheap* - Sure, but so are most University Students,

*Burning to CD-R* - No, Means the movies are inaccessable from anywhere else, CD-R's rot, and you are assuming they are 650MB DivX's, what if they were not? What if, (God forbid) he wanted a little quality in his movies?

*What to do with them?* You get a little confusing here, and are mixing points, (Connection speed vs portability), Whats more portable than a server online? with basically assured 24/7 uptime?, As well, assuming he's getting these movies still, and they are not JUST things he has, there are warez sites/irc groups with T3's out there.

*Why Nasa? Why not Joe Schmoe?* Because Joe Schmoe is slower, and likely to get taken out by a virus any given day of the week,

And yeah, I admit, He made a stupid choice going with nasa, he would have been better to take on a web hosting company or something, even a university, NASA is a little too high profile, so I'd say he was going for ego points.

Oh cry me a river.

[EvilStein]

I guess he should have thought about that before HACKING A BOX AT *NASA* for pete's sake - and to do what, use it for Divx movies?

This guy was an idiot and got what he deserved. Sorry. Perhaps he should have though first before compromising a piece of United States Government property.

Re:Yeah - let's give the CS student a computer ban

[Jozer99]

They didn't have any chairs to sit on in the server room while they fixed security holes, so they made a big pile of money and sat on that, and it worked almost as well. After the whole fiasco NASA is now researching a new more expensive type of money that is more easily convertable to a sitting appliance.

Re:SELinux

[david duncan scott]

No, SELinux is NSA's baby.

Cracking into NASA is one thing. You're up against propellor-heads and zoomies, nice people who think space is neat. Cracking into the NSA is a whole 'nother ballgame. Those folks are professional paranoids, and while they don't kill people, they certainly know people who do.

when you know there is a bug...

[Fortun L'Escrot]

say a vulnerability is posted on the web and it happens to affect your systems. how much does it cost you to get your IT department to locate, fix, and patch the problem?

let's further assume that the party that posted the vulnerability is being purposefully uncooperative. but they agreed to get the vulnerability tested independently by a third party who also happens to be uncooperative. how much does it cost your IT department?

i havent got a clue. but 200k seems like a lot. it would seem that keeping a network secure is very expensive business. and i agree that this is true for physical installations, but digital? i mean seriously. unless of course you are over working your staff who also answer all the phones for tech support in-house making it impossible to manage their time or actually do the work they were hired for in the first place. but 200k for a bug? jesus.

i feel really bad for nasa. no matter what system you use there will be bugs and even when that is not the case a system can be badly configured. if each of these issues costs on average 100k (just a guess) to "locate, fix, and patch" can you imagine how much money is going into IT departments right now? or how much money is going into the IT industry? its like paying the plumber 4 times (just a guess) more than his already expensive rates (apparently there is a shortage of plumbers) and honestly believing that this is the way the world should work.

for crying out loud people. what exactly did this kid do? "shutdown -h now"? and it takes 15minutes to boot up? i mean sorry guys, but maybe you should be protecting your system a little better. i always tell myself. if a teenager can pull a prank like this one there are two things you should do. punish the teenager the way we punish any teenager for a prank like this (which they have sort of done). secondly, get some help securing your systems because a foreign nation will not be looking for space to store movies. they will be out there looking to cripple your systems and not necessarily permanently, 30mins could be critical for a crack squad tectical unit and if it is as easy as just shutting down a server......

ps. to be fair, it could be that restarting the system as part of their "locate, fix, and patch" program takes a lot of time (more than 10 minutes?). there again my friends i would suggest a better system to reduce your costs. this has nothing to do with me believing you shouldnt punish this guy. but quit posting damages that could have been avoided if you spent a little more time designing a better system that met your needs. if google can do it i am sure you can too.
if it takes so long to restart your system even during normal maintenance then build redudancy for your production environment. if this is really just about your personal inconvience then remember you are a plumber and that crap cloggin the pipe is your job.