Slashdot Mirror
Confessed Botnet Master Is a Security Professional
An anonymous reader writes "John Schiefer, the Los Angeles security consultant who in last 2007 admitted wielding a 250,000-node botnet to steal bank passwords, sometimes from work, says he's spent the past 15 months working as a professional in the security scene while awaiting sentencing. Prosecutors are pushing for a five-year sentence, noting the exceptional threat he represented to society."
Not everyone can create a botnet. There's some skill involved and you have to know details about vulnerabilities and how to exploit them.
Did you expect him to be a shoe salesman?
This is like that guy from the Gaming Control board that was cheating slots.
While I'm not surprised that it was someone heavily involved in the field, as a future security professional myself, I'm rather ashamed that this man's greed won out over his ethics.
Their culprit would turn out to be a pimple-faced highschool kid dialing in with his VIC-Modem and Commodore 64, and then he'd maybe even get a drudging job offer. Nowadays the job offer part comes first.
2007 BCE?
Riiight, because most victims of sexual abuse go and create botnets to steal bank passwords. Disingenuous much?
to make sure the grammar is correct and the submissions lack certain unpleasantries such as run-on sentences.
Is it just me, or does 5 years seem kinda low for someone who has infiltrated 250,000 computers and has been stealing bank account passwords??
I think the surprise doesn't come from the fact it was a security guy, but the idea that someone like a lot of slashdotters is that capable of hurting others. Outside of the money and women, part of what we do as IT is helping and protecting people in the wild west that is networks. The fact a "good guy" could be bad is an extra sucker punch because a lot of folks here deep down probably wouldn't do that, and would have a tough time associating with the reasons why.
Idealistic, eh? Still, sucks when John Wayne saves the girl only to go rob the bank one town over.
-Matt
--- Need web hosting?
That's the sound of 30,000 other security professionals simultaneously saying "no shit!"
Depends on who you ask. If you're asking a socially conservative, self-righteous "virtuous" woman, she might say "yes", it's the girl fault. We know there are countries where people are like that. On Slashdot, if you ask a bunch of condescending techies about being a victim of a cyber crime, there's a good possibility that some of the people will blame the victim. I'm not saying that they're right but simply their perspective is narrower and maybe even biased. Personally, counting on people for reasonable, correct behavior is a fool's hope and failing to account for people's tendency to act less than reasonable is a weakness in any security system or protocol.
EvilCON - Made Famous by
discover a security exploit and alert everyone: should get hero's reward
discover a security exploit and uses it, to harmless effect: should get thanks for discovery, a frown, and no reward
discover a security exploit and use it to, well, exploit: throw the book at him
unfortunately, it seems that all three classes of white, gray, and black hats get the same treatment
i'm not bringing the three classes up to argue leniency for the reprobate who made the botnet, i'm bringing up the fact that this guy is an example of someone who really should get punished severely, in contrast to gray and white hats who serve society and are unfortunately treated as the same class of criminal, when they are clearly not
this guy is the contrasting example of what a gray and white hat could have done with their knowledge, but chose not to. people need to be more aware of the valuable service gray and white hats provide
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Read the article, not the summary.
-mkb
Well he's already on path for the 8th or 9th circle of hell.
8th Circle:
Bolgia 8: Fraudulent advisors are encased in individual flames.
9th Circle:
Round 2: Antenora is named for Antenor of Troy, who according to medieval tradition betrayed his city to the Greeks. Traitors to political entities, such as party, city, or country, are located here.
The closes I can get to a rape analogy is that a woman seeks out a man, asks him for sex, does the deed, and then the next morning decides he wasn't the guy she was looking for. He was supposed to be a pretty screensaver, and instead turned out to be a spambot. There he is, in her bedroom, writing letters and taking stamps out of her desk.
No, the anology here would be: A woman asks out what seems to be a nice man for dinner. At dinner he slips a roofy into her drink, drags her back to the car and rapes her. The next morning she knows that something is wrong, but can't remember a thing and so doesn't properly report it or deal with the consequences.
The only person that can be blamed is him. Not his parents, not the school, not society.
No one put a gun to his head and made him hack. Take some responsibility.
Ridiculous.
Gone!
You're making the assumption that the "glaring grammatical errors" are obvious to those individuals making such "glaring grammatical errors."
Fail!
Personally, counting on people for reasonable, correct behavior is a fool's hope and failing to account for people's tendency to act less than reasonable is a weakness in any security system or protocol.
The difference between meatspace crimes and internet crimes is the level of risk.
You can get away with less security in the real world,
because the level of risk to commit crimes is much higher.
Online, the risk is lower and in response, your level of security should be much higher.
[Fuck Beta]
o0t!
If I had to points I'd mod you insightful.
It's more like the rapists would always target the skirt wearers over the pants wearers because of the relative lower barrier to entry and the pants wearers would try to convert their skirt wearing sisters from their erroneous ways by calling them little sluts and being condescending.
What the pants wearers don't realize is that it takes a significant investment of time and effort to learn how to slip into a pair of pants for people who don't sew pants for a living. Thus, the skirt wearers would rather spend extra money on mace or pepper spray that they can operate with a push of a button in times of emergency.
Thing is, the pepper sprays leak into their skirts and whatever garments they are wearing underneath and leave them with a burning sensation and even then the skirt wearers would rather burn their coochies than learn how to slip into a pair of pants.
From TFA:
From your comment:
In all seriousness, it's a really bad idea to suggest that being capable of something, or representing a threat, is enough to punish someone for. Yes, this guy has probably caused a lot of damage. Should we convict him on the "probably"? No. Get some real, hard evidence, then do something. Preferably, do something useful, like show him how much damage he caused, and introduce him to the people who's lives he messed up, rather than just taking revenge on him. People who do that (namely, most of the so-called justice system) are part of the problem that makes this a dog-eat-dog world, not part of the solution.
If my alt had mod points, I'd mod you both insightful.
And the lenient sentencing is because he ultimately did not cause much damage.
What? Have you not heeded the cries of your fellow Slashdotters!? Lynch him! Draw him! Quarter him! Then hang his quarters separately!! Stealing bank passwords is so much worse than murder, rape or treason!
You just got troll'd!