Slashdot Mirror
University Brings Charges Against White Hat Hacker
aqui writes "A university student at Carleton is learning that no good deed goes unpunished. After hacking into what was probably a not-so-secure university network, this guy took the time to write a 16-page paper on his methods and sent it to the system admins. Sounds like White Hat behavior to me. Yes, he should have asked permission before trying, but throwing the book at the guy and wrecking his life with criminal charges (which stick for a long time) seems a little excessive. The university should spend money on hiring some admins with better computer skills and teaching skills rather than paying lawyers. In the Engineering department at my old university, the unofficial policy was that when you broke in, didn't damage anything, and reported the problem and how you broke in, they didn't charge you (if you maliciously caused damage, you usually faced academic sanctions). In some cases, the students were hired or they 'volunteered' for the summer to help secure the servers or fix the hole they found. The result was that Engineering ended up with one of the most secure systems in the university."
Read on for the rest of aqui's comments.
aqui continues:
"The truth is, some university students are going to have the desire to hack something, and not all of them have the judgment to stay out of trouble. If you acknowledge that and catch them inside the university, you can straighten them out before they wreck their lives, and teach them to be white hats. Rather than creating a hostile environment where people may become black hats, you create an environment where you guide them in the right direction to being good computer security professionals. For every hacker they catch, there's probably at least one that they don't know about. I can imagine that a number of those hackers at Carleton are now seeing the university as the enemy for burning 'one of their own,' and some of them may become malicious to get even. If the student's intentions were good - which they appear to be - I can't help but feel sorry for the guy."
this guy took the time to write a 16-page paper on his methods and sent it to the system admins. Sounds like White Hat behavior to me. Yes, he should have asked permission before trying, but throwing the book at the guy and wrecking his life with criminal charges (which stick for a long time) seems a little excessive.
So, I agree with you. Someone who took the time to show flaws in the system should not be punished (at least not to this extent).
However, here's probably what happened.
1. Someone received the 16 page write-up. They took it to the sys admins.
2. The system administrators, WHO WANT TO KEEP THEIR JOB, are going to go into a tirade of how he subverted their systems and purposely used "nefarious methods" to break system security, etc, etc. Basically, it's politics here - they don't want to look bad and/or lose their job so they will do everything in their power to make him look like a bad guy (which, to some extent, he is).
3. So, sys admins may have suggested some legal action to protect the school and make an example of him. (Or someone higher up may have.) The reason someone higher up may have done this is because they want to protect the school's image. Knowing that their system was weak could really hurt a school which is a business.
Basically, all of this is politics. All of it. Technically, the kid did the right thing by reporting what he found (although, quite honestly, he probably shouldn't have been there in the first place without asking permission). But, he didn't think through how other people were going to see his actions. You *always* have to think about the politics.
Yes, anyone should be able to break the law and then get off scot-free by claiming it was in the public best interest. Nevermind the cost of the sudden campus-wide security lockdown, nevermind that IT staff may have lost their jobs, nevermind the people now losing sleep because they don't know how to handle things. Nevermind the risk incurred in that if he caused outages he could have disrupted phenomenally expensive research projects. Nevermind that most whitehats leave doors open behind them.
He meant well.
He deserves what he got. Quit trying to make heroes out of everyone looking at jail time. Jesus.
StoneCypher is Full of BS
What he did was gray hat and not white hat.
If he had gotten the permission of the school to do security testing first then he would be a white hat. He had good intentions, but by breaking into a system he didn't own without the owners permission he broke the law.
-Jim Bastard
No, technically he did the wrong thing by breaking into the network. This isn't complicated. If he technically did the right thing, he wouldn't be technically looking at jail time. This isn't a pity party. He did a bad thing and he's getting punished. Simple as pie.
If some asshat broke into one of my servers then told me how, I'd send his ass to jail too. If he contacted me and said "I would like to break into your server then I'll tell you how", I'd pay him to do it under controlled circumstances. However, if he just up and did it one day, it would cost me tens of thousands of dollars in cleanup.
I can't imagine why you think this was in any way a good idea.
StoneCypher is Full of BS
No, breaking in via a keylogger and a magstripe reader is the same as stealing your neighbor's keys, making a copy, poking around his house while he's out, and then telling him that he needs better security.
Exactly, if the law were balanced in this area the case will probably be thrown out (if it even reached court) and the student let-off. I bet he gets a prison sentence, or harsh fine and community service. Worst of all he'll have a criminal record, meaning he might not be able to get a job. Is one other person on the dole -- when their crime is nothing more than curiosity and a desire to help -- useful to society?
It's not just the university admins who have a bad attitude, it's all society that have been conditioned to believe the hacking == terrrism meme.
I would suggest that any prospective students reading this politely contact this university and explain why you will not be choosing them. Same for any parents who's kids might be thinking of going to Carleton.
Do have some pity for those admins though: they're probably just MCSE's.
I'm going to transform myself into a mighty hawk. Either that or I'll just go and work at Dixons, haven't decided yet.
He should have just submitted the 16 page paper anonymously. If he was truly trying to do a purely good deed so there shouldn't have been any need for his name to appear on it for the purposes of fame or positive retribution.
Given the number of previous incidents similar to this, one would have thought he'd have been aware that this is almost always the outcome. Try entering into a store after hours (when closed) without due permission, without stealing anything and reporting how you did it. Compare the outcome.
The student almost certainly signed an agreement stating the terms of use for the university network. And he almost certainly broke that agreement. If that's the case, then I don't see how the university's response is wrong.
Not only did he break rules but he did it maliciously (no grey area here) when he used keyloggers. I can see what would happen if I did the same thing where I work - they'd fire me, throw my ass in a federal pound me in the ass prison and generally my life would be ruined
What we have here is a not a hacker, not a white hat or a black hat hacker. We have a script kiddie. Sadly most of the posters before you seem to have already started making a hero out of this "vigilante".
Ya know, if he saw a flaw (and obviously there was something wrong since he installed a keylogger on at least one university computer) he should have reported it to the IT department. He decided to act and break the law so he should man up and face the consequences.
At the absolute most, he should have stopped after installing the keylogger and reported that to the IT department. He could have even reported it anonymously. The fact that he then took account information and accessed people's accounts goes way over the line.
"The truth is, some university students are going to have the desire to hack something."
The truth is, some university students are going to have the desire to light things on fire, too. How many buildings do we let them practice on before we arrest him?
The truth is, the kid broke the law, and it is nearly inconceivable that he didn't know it at the time he did it. For every hacker they know about, there may well be at least one more they don't know about. But for every hacker they crucify, there will be dozens who think twice before breaking the law.
We need more information. If, for instance, even looked at another student's Family Educational Rights and Privacy Act (FERPA) protected information, then the school must, by law, prosecute him. Uncle Sam doesn't mess around when it comes to assessing penalties - schools with violations can lose federal funding (including grants).
If he was poking around in an area that made any student information not considered "directory information" (address, campus box, telephone, degree, or e-mail address) accessible, then they had no choice. And ignorance is no excuse - they shove FERPA down the kiddies' throats when they arrive, just to make sure they know that mommy and daddy can't meet with professors.
"Those who believe in telekinetics, raise my hand" - Kurt Vonnegut, Jr.
Someone equally or more competent than your own staff tested your infrastructure, found its flaws, and gave you a free report on it, and you're going to beat them over the head.
This "law uber alles" authoritarian streak is what causes most companies to become plagued with "upward failure". The truly competent don't dare to speak inconvenient truths, and the incompetent are given free reign to take advantage.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
it's not surprising that those in charge reacted strongly and sharply. We had recurrent incidents on campus last year with sexual assault and they had to lock down all the residences and the labs, and as such, they took great pains to inform the students who had access cards for the suite residences that they would not, in fact, be in danger, be it financial or otherwise.
you have to love an administration which cares more about their ego than the rape targets they were trying to help.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
FE-what? Uncle who? I think you're talking about another country..
Mr. Johnson was recently arrested after finding Mr. Smith's front door unlocked.
Mr. Johnson snuck into Mr. Smith's home and watched Mr. Smith sleeping for several hours.
Afterwards Mr. Johnson provided a detailed account of how Mr. Smith had left his front door insecure and ways to better secure the front door.
Mr. Smith wasn't amused by the report and had Mr. Johnson arrested for tresspassing and breaking and entering.
Mr Johnson's defense is grounded in the fact he was helping Mr. Smith become a better home owner by sneaking into Mr. Smith's house.
-----
You now realize how stupid you sound when you defend someone under these circumstances. This whole White Hat nonsense is about as intelligent a the statement, "Well your honor his front door was unlocked, and obviously I should be allowed to go in there as long as I don't break anything, afterall if he didn't want people in there he should have locked his door at the very least..."
Put him in jail and maybe these adult children will grow up.
-=[ Who Is John Galt? ]=-
I've noticed that generally, if the admins are worth their salt, you don't need to detail every single step to produce an exploit. Just provide enough information to walk them up to the open door, and let THEM walk through it. In fact, writing 16 pages detailing every step of the way makes them question WHY you were so thorough. It also makes them look bad to their higher-ups because some "punk kid" figured out something they didn't.
I speak as someone who had a run-in with both high school admins and university network admins. Two distinct cases, but with very different results.
In HS, a friend installed a homebrew backdoor onto every computer in the HS computer lab. It permitted basic keylogging functions, as well as partial remote control (mostly just starting programs remotely). I just de-backdoored the computer I used for class and let others fend for themselves. When he reinstalled the backdoor on my computer the following week, I turned around and killed the backdoor on every system (it supported a room-wide purge in the event that it needed to be removed quickly). Unfortunately, stopping it also caused an error pop-up on every screen in the lab.. at which point everyone knew something was up (but no one knew it was me who stopped it).
After class, I went to the admins to report exactly how my friend performed the attack, how my friend installed the backdoor, how I stopped it, etc. I figured I was in the clear because I responded as soon as the problem became visible. The following day, I was called into the principles office and threatened with expulsion for "hacking the network". I couldn't convince him that I didn't "hack the network", and it didn't matter that I *STOPPED* the hack; I was in trouble because I drew lots of attention to the problem and proved the admin to be an incompetent moron (the backdoor only existed because the admin's password was his userid+1). My friend was never called into the office, nor given any punishment.
Fast-forward to college: Through a series of (individually) harmless actions, I discovered that one could elevate their user access from "student" to "full time employee" and gain access to a handful of otherwise inaccessible directories (including source for various university projects). As soon as I realized the problem, I went to the admins and e-mailed them personally with a much vaguer description of the problem. I also couched it with terminology that suggested that I didn't know what I was doing ("I think there might be a bug somewhere in X because when I did X a bunch of directories became accessible that weren't before. It also gave me access to what might be the source code for project Y, but I didn't touch it because I don't think I'm supposed to see it. But I think you guys should know that there might be a problem.")
The admins thanked me, said they'd look into it, and a day or two later the hole was patched. I never had any problems with them, and continued on my merry way through college.
Bottom line: it's only White Hat if the "target" asks you to perform the security audit. Pure and simple. Anything else is at best Grey Hat, and that gets you subject to prosecution at the target's discretion. Period.
This kind of stuff is in a completely different category than analyzing the theoretical weaknesses of a system. Or even cracking software/etc on your personal equipment. Or demonstrating faulty design in a [ahem] subway system WITHOUT HAVING TO SCREW WITH THE SYSTEM. Once you start abusing other people's stuff without permission, I couldn't care less if you were Mary Poppins. IT AIN'T YOURS, SO KEEP YOUR FINGERS OFF IT.
This isn't Investigative Journalism. Which at least has standards of ethics and conduct.
People, quit glorifying these idiots.
There are always four sides to every story: your side, their side, the truth, and what really happened.
We had recurrent incidents on campus last year with sexual assault and they had to lock down all the residences and the labs, and as such, they took great pains to inform the students who had access cards for the suite residences that they would not, in fact, be in danger, be it financial or otherwise.
If your school is locking everything down thanks to sexual assault, because of the nature of the crime, they're obviously not thinking straight. That is a reactive measure and only instills panic. In the case of a shooting however, that can be a proactive measure to ensure that more people aren't harmed.
The game.
Typical black hat hacking? Like bringing all the servers down, or taking private information for criminal use? Seriously?
Student looks around in his universities network. Goes past poorly implemented safeguards, writes about how it can be improved.
Sounds like an extra credit assignment to me.
Except he didn't "alert his neighbor". He opened the door (which he has no business even trying to do in the first place), and then riffled through the neighbors desk, refrigerator, garage, and basement. Before leaving he made a copy of the front door key, installed taps on the phones, a webcam in the bathroom. Then he told the neighbor that his door was unlocked, his checkbook needed balancing, his taste in soda abominable, his garage was a mess, and the furnace filters needed cleaning.
Arggg, its this type of politics bullshit that is holding america back in any technology field that not cutting edge and pure ideas and rather requires a diverse industry. (ie cell phones) American cant just look at facts and look forward and rather like harmful trenches and politics. If someone broke into the network and could write a 16 page report on it it the system admins should be forced to quickly implement it (hiring the guy if they need to) or loose their jobs.
No amount of the blame game will change the fact that their system is insecure and securing it is in everybody's interest and is really the only thing that matters.
The submitters policy is exactly what should be used, it reflects real life -- look at the that Switzerland man that got hundreds millions and a new identity from the USA IRS and Germany for his supposedly black-hat acquired data that uncovered millions in tax fraud.
Not all black hat work is always bad, however it is on the black-hat himself to both make prove this in his case and minimize his damage. This is simply reality.
Today's black hats do not make noise. Their work does not show up. If you are hacked you probably do not know, and most certainly will not if these type of guys are in charge.
It is not long till people realize that their personal data has long been available on the market due to bad practices like this and organizations get back lashed against. Sadly for both consumers and these organizations, and even the IT guys they are going to take the childish way out and wait for this to come to them.
I kinda went off topic, but its a fundamental thing. **playing this blame game destroys everybody, can makes white-hats turn black in disgust with the politics, and will eventually hurt both the general public and the industry greatly**
Yes, but the difference is that it was the university's own department. It's not just any organization. Students, by definition, are going to make some bad decisions along the way, and one of a university's jobs is to minimize the damage of those decisions so that a student can benefit from learning from their mistakes.
It's one of the reasons colleges like to have "campus police" rather than real police: keep everything "in the family" and out of the "rap sheets" where possible.
Academic sanctions, sure. But involving law enforcement where no significant damages have occurred shows a serious lack of judgment somewhere in the administration. I would emphatically not recommend attending any school which prefers to make an example of someone over protecting their students from making life-altering mistakes.
Can you be Even More Awesome?!
I would agree with you had he not used a keylogger and a mag-stripe card reader. Those two just cross the line as far as any real white/gray hat hacking (ANY hacking for that matter) is concerned. Neither take much knowledge or intelligence to operate, and they both require high permissions from the start (access to hardware). If he was finding an SQL injection vuln, an RFI, or software on a listening port that he can crawl through, then I think the situation would be much different, and your opinion would be correct.
OK, so he fucked up. Still, it takes one event like this, and about 100 potential white hats are going to decide that disclosure is a mugs game. Better to break in and steal stuff, or don't bother about security at all. Too few programmers / admins learn security, because it practically makes you a criminal. So who will bother apart from a diminishing number of professional white hats, and an increasing number of professional criminals?
The real meaning of punishment here, from the University's perspective, is that "don't mess with our systems, or they'll be consequences". It's a punishment to discourage others, who may not be that good, to attempt hacking.
obviously there was something wrong since he installed a keylogger on at least one university computer
Some people around here apparently haven't been to a college in a long time. Colleges are environments for learning and research. Computer systems in colleges are tuned to that purpose, not security. What this guy did was wrong for numerous reasons, but one that I immediately thought of is: "Great, now they're going to lock down their systems even more and make them less useful." College system admins are enablers, not preventers.
woke him up, and told him, "See what your lack of security has done?". Then I went out into the street, and let everyone in the neighborhood know, so they could all see how it's a bad refection on the community, and weakens all their positions, since what he does affects them all. When the police finally arrived, I pointed out that I hadn't actually taken anything or hurt anyone. And I berated the police, their lax response endangers everyone, and emboldens REAL criminals. At my trial, I took the issue all the way to the US Supreme Court, and got a Constitutional Amendment passed, because the inherent weakness in the system simply had to be addressed, thanks to me. All this happened, and I was of course, never shot at by anyone -- homeowner, neighbors, police -- because I was doing what was right.
OK. On some levels, the previous diatribe is a false analogy. But I would like to point out that the whole "white hat hacker" meme is, at least a little bit, phony.
At first I was sympathetic ... but a moments' thinking changed my mind. The guy deserves a criminal record, and to be expelled.
Thnk about it for a second. You don't install a keylogger on a server and then capture logins from students from remote machines ... the keyloggers were installed on the students' laptops. This is NOT "hacking" or "cracking" the university's computers. He installed keyloggers on up to 37 other students' laptops to capture their login info.
How would you react if someone installed a keylogger on YOUR laptop? And dozens of others? Whether he tookThis isn't Soviet Russia - laptops don't (or shouldn't) log YOU!
If he had physically assaulted 37 students, rather than compromising their laptops and account info, he'd be in jail. Ditto if he had vandalized their cars, instead of their laptops. But looking at the comments, it's okay to screw with other people's property if you want to look 1337 to your peers.
Expulsion is the least the university can (and should) do, as well as pursuing criminal charges.
University is for learning and documenting what you know for others to use, not for fearing that you might anger some incompetent sysadmin.
From TFA: This is the second time Carleton has dealt with hackers in recent months. In late July, a hacker broke into the e-mail system.
Let us agree on the incompetence. This is their second incident in 3 months.
Reply to That ||
Do you know that no significant damages have occurred? If I were one of the 32 students whose personal information he e-mailed to 37 other students plus sent to a secretary and God knows who else, I would be pressing charges against him. Just because he didn't damage the infrastructure doesn't mean that no one else he shared the information with didn't abuse it to access educational records, email accounts, or to buy things on campus pretending to be a different student.
If a corporation, let's say a large store, had this happen to 32 of its customers, and the guy who did it e-mailed the personal account information of those customers (which provided access to their store credit card information, personal address and contact information, and credit history) to a bunch of other people, would we not all expect him to be charged with a crime? I sure as hell would.
If you reveal personal information protected by law, expect to be charged.
and found a 16 page write-up about how a guy broke into your house, disabled the motion detector
I agree this would be disturbing, but I hear these analogies to people's homes all the time and I've always been a little uncomfortable with them, and I think I've figured out why.
One of the key problems with a home invasion is that it's pretty reasonable to assume it threatens your personal safety. There are other places to threaten someone's personal safety, but it's one of the few places where just by dint of being there, it's reasonable to assume someone constitutes some kind of threat to you.
I think a better analogy would be some kind of storage unit or a locker. If you had stuff in this protected by a certain kind of lock, and somebody broke into your place and left a note that said "Dude. These locks are defective. They're easy to open by using this technique. Your stuff will be safer if you get something else!" and didn't take anything, that'd be closer to what happens when a system is compromised. You might be likely to be a bit surprised and perhaps wary, but it's not the place where you sleep.
Tweet, tweet.
"No officer I didn't go into that burning house to save that child. That would have been breaking and entering and kidnapping!" Justice should be blind, but it doesn't have to deaf, dumb and have no sensory nerve endings.
Slashdot, where armchair scientists get shouted down and armchair theologians get modded up.
As far as I'm concerned, the student did a few things right but two things wrong. First, the good:
1. He thought about security. We should all do this.
2. He told the university when he found a flaw.
But he did two things wrong:
1. He installed a keylogger. Maybe this is just my moral code, but the right way to hack is to find a real vulnerability. Taking advantage of the physical insecurity of the university machines to install a keylogger is not cool. Besides, *of course* they're vulnerable to that. Similarly, if they use magnetic strips, grabbing other people's cards and cloning them is possible. Maybe they should use secure smartcards, but there's no need to clone a magstripe just to prove it possible.
2. He email 37 students in addition to the administration. Did he email them a list of passwords, too?
For comparison, I hacked my (top-tier CS) university's systems back in the day. Specifically, I found a vulnerability in the network authentication system that everyone knew existed in theory but thought was essentially unexploitable in practice and used it to read my roommate's email. But I got my roommate's permission first, and I took the exploit description and sample code directly to the IT people. I didn't disclose it to the rest of the world immediately, or, in fact, at all.
Not surprisingly, the IT department was happy, they fixed the problem, and they even wrote me a check as a thank you. But I bet they would've been pissed off if I'd emailed 37 people a detailed description before they had a chance to fix the problem.
The lesson: if you want to do some unsolicited white-hat hacking, don't be a dick about it.