Man Mines Facebook For Security Questions, Nabs Nude Photos From Email

itwbennett writes "George Bronk, 23, has pleaded guilty to charges that he broke into the e-mail accounts of thousands of women, scouring them for nude photos that he then posted to the Internet. How he did it: He searched his victims' Facebook pages for answers to common security questions and then logged in to their e-mail accounts. In one case he persuaded a victim to send him even more explicit photographs by threatening to post the ones he'd stolen if she didn't. Bronk faces 6 years in prison on felony hacking, child pornography and identity theft charges."

Comments

Obligatory

[Anonymous Coward]

Pics or it didn't happen

Re:Obligatory

[ian_from_brisbane]

Pics or it didn't happen

Here you go... http://www.msnbc.msn.com/id/41082627/ns/technology_and_science-security/

Re:Obligatory

[macraig]

Not THAT one! My eyes, my EYES!

All I can say is

[drinkypoo]

Torrent?

(ObDisclaimer: No, I don't want to receive child porn.)

Think of the children too

[Anonymous Coward]

Well, I sure hope all of the girls who took pictures of themselves got child pornography charges against them too.

Re:Think of the children too

[crow_t_robot]

No, because producing child pornography and distributing it on the internet is producing child pornography and distributing it on the internet. If a 16 year old girl sends a picture of her tits to your phone you are now in possession of child pornography and in direct danger of having your life destroyed and everyone you know hating you.

This is akin to weaponry. This shit needs to stop.

Re:Think of the children too

[CAIMLAS]

You have very little imagination.

Girls have boyfriends. They also have female friends. They are not solely keeping these pictures on their hard drives and cameras for personal use (more than likely).

Funny thing about pictures on the Internet: they're trivially copied. Boyfriend copies the picture to his friends (or just one friend), or posts it to a forum: the picture is out, and will live forever on hundreds of 'porn agregators' (lacking a better term), presuming the girl isn't a skag. Likewise, girls are/can be catty: what's stopping them from spreading the nude pictures in a bitter attempt at becoming more popular themselves (thinking it would ridicule the origin)? We're talking about virally social teens, here, not top secret data on government networks: there's literally a thousand and one ways for such pictures to spread to the Internet At Large.

So, in short: it's entirely possible that hundreds of thousands of men and women have viewed, downloaded, etc. child porn and not even be aware of the fact that it is child porn, simply on the basis of "some women look like children and some girls look like women". I recall a couple girls in high school who looked significantly older than 16-18 - and no, I'm not just talking about curves (though that applies too).

It's just like "honest, I thought she was 18, officer!" scenario, except the evidence never disappears and the so-called 'victim' can never grant consent. I would not be surprised if there is legal child porn floating about the internet right now, on "valid" sites which the US federal law enforcement agencies knows about, but allow to exist -so that they can use it as an added charge for someone down the line, if they ned something to vilify them further/want to make sure the charges stick.

Re:Think of the children too

[Dunbal]

No I think OP was referring to the notion of a fair and balanced justice system that applied the law to everyone instead of the one we have now which consists of "lets throw everything we can dream up at the guy and see what sticks".

After all, it wouldn't be the first time a teenage girl was accused of child pornography for taking pictures of herself and posting them online. Not that I agree with THAT one, either.

Re:Think of the children too

[Anonymous Coward]

Pictures of naked people should not be classified as porn simply because of the lack of clothes.

Re:Think of the children too

[Starfleet Command]

>>>they took pictures of themselves in an illegal manor Perhaps if they had photographed themselves in a chalet, or perhaps even a brownstone walk-up?

Re:Think of the children too

[Anonymous Coward]

16 year olds are not children. That is the most insane part of all of this. Naked pictures of 6 year olds on your phone, sure, those are children at least. A 16 year old is most definitely not a child though.

Re:Think of the children too

[Pharmboy]

Pictures of naked people should not be classified as porn simply because of the lack of clothes.

If God® wanted you naked, he would have made you born that way.

Re:Think of the children too

[Shikaku]

What happens when you turn 18 that magically makes you an adult?

Re:Think of the children too

[Eightbitgnosis]

Ummm, blackmailing a 15 year old for pictures of her bush is in no way equal to her taking those pictures of her own free will

Re:Think of the children too

[rwa2]

Um, you have to register with the selective service so they can decide to throw your ass in a war? Something like that.

You're innocent until you're old enough to vote and (legally) kill people.

Re:Think of the children too

[Grimbleton]

Only if you have a penis.

Re:Think of the children too

[milkmage]

same thing that makes you a responsible drinker at 21

Re:Think of the children too

[Schadrach]

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale. That removes the "weaponry" portion of child porn (if I send you a CP picture, you have committed a crime is a *bad* thing) and makes those who receive such pictures accidentally (mislabeled P2P files, for example) or against their will (as in the sending a picture to your phone example) more willing to openly provide them to authorities as a way to help the producers get caught, as well as making being involved in the financial promotion of the production of child pornography still a crime.

Re:Think of the children too

[Schadrach]

Interestingly enough, I've actually met a "slutty little girl" as you described it. She was a friend of one of my nieces several years ago. Girl was ~10, and was....precocious and direct. Very, very, direct regarding what men she found attractive and exactly what she wanted from them (or more specifically wanted them to do to her). It was actually really creepy. She moved a couple months after her and my niece started hanging out though, so I don't know what happened to her in the long run, or any real details as to her background.

I'd never found a girl coming on to someone quite so disturbing though, before or since.

Re:Think of the children too

[witherstaff]

They're children unless they're being prosecuted, then they're usually adults. I don't get that double standard.

Re:Think of the children too

[Lord Kano]

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale. That removes the "weaponry" portion of child porn (if I send you a CP picture, you have committed a crime is a *bad* thing) and makes those who receive such pictures accidentally (mislabeled P2P files, for example) or against their will (as in the sending a picture to your phone example) more willing to openly provide them to authorities as a way to help the producers get caught, as well as making being involved in the financial promotion of the production of child pornography still a crime.

Back in the early 90s, before the explosion of the web, I used to use AOL. I used to trade in pictures of naked women. Some guys used to send out pictures of their wives. I was 18-19 years old and had no interest in 35-40 year old housewives. I asked one guy if he had anything of someone "younger". Apparently that's a keyword for child porn. Next thing I knew I was getting inboxes full of the stuff, this was also back in the days before broadband so I had some people that I used to automatically share anything I got with before I downloaded it myself. On the first inboxing, I forwarded all of the contents to some of my trading partners. And THEN I downloaded the pictures and saw things that no normal person should ever have to see.

I deleted the jpgs and gifs from my computer, deleted the emails from my inbox, and at that time AOL allowed you to unsend an email if it had not been read. I believe that I was able to unsend them all, but if I hadn't been, I shudder to think of the things I could have been charged with. All because I wanted to see naked 18-24 year old girls...

LK

Re:Think of the children too

[Anonymous Coward]

It's a US thing. Over there:
- You're presumed innocent until proven guilty. Except for terrorism, in which case the rule is "If you were innocent, you wouldn't be a suspect".
- Sexual assault is a horrendous crime. Except if the perpetrator is wearing a TSA uniform.
- The Constitution stops the government from abusing it's authority and power. But only as long as the government agrees.
- Infringing copyright on music steals copyright holders of thousands of dollars. Except for the music industry, they only steal 60 cents per song from artists.
- Child Porn is illegal in order to protect victims of child abuse. Unless if children willingly make and send pictures of themselves, in this case they're not victims but vicious pedophiles. So vicious, they abuse themselves!
- You're too young to drink beer at 21 but you're old enough to die for your country.

Re:Think of the children too

[JWSmythe]

    Depending on the level of detailed dialogue you are describing, she may have been a victim of sexual abuse. They may have rationalized that the sexual abuse has positive results. For example, a bad adult does sexual acts, and then rewards the child. The child may associate the act with the result, and try to initiate the act with others for similar rewards.

    Most 10 year olds can't carry on an unsupported dialogue of sexual matters. For most (and yes, the average have has been growing younger), they simply have no interest. For others, they've had no exposure. Most (but not all) parents keep their children away from what they perceive as dangers for the childs development, which includes movie violence and sexuality. If the dialogue was beyond what you may see in a R or NC17 movie, you should consider that there is something pretty serious going on. Talk to a professional about it. Ask the simple questions, "This happened. Should I notify someone?" If you have school age children, a call to the schools child psychologist may be helpful, or your local child protective services. The child protective services call may start unwanted actions, but if there is something bad going on, they should definitely be involved.

    Most importantly, don't be involved. It's not up to you to investigate such things. Besides tainting evidence, being too involved can be bad for your health (i.e., the bad adult may seek to silence you). Leave investigations up to the experts. For the sake of your safety and mental health, it's better to give the anonymous tip, than to become a witness. If you get too involved, you may become a suspect, rather than just a witness.

Re:Think of the children too

[tragedy]

And there's absolutely nothing new about this behavior, it's as old as taboos against nudity. I'll show you mine if you show me yours. The difference now is that it's being done more and more via electronic devices with the bizarre consequence that acts which would otherwise be perfectly legal without the electronic image producing middleman become life-destroying felonies.

Re:Think of the children too

[bennomatic]

Of course, sometimes things can be misinterpreted. When I was in college, my girlfriend and I took a day off to help out her mother, who was a kindergarten teacher. We spent the morning reading to and playing with the little ones, and during the art part of the day, one little girl decided to confide in me that she and her father "do a secret dance when mommy goes to work."

As you suggest above, I knew it wasn't my place to investigate, but that sounded pretty serious, so I told my GF's mother, who immediately went to the principal and school counselor, and they took the girl out to question her right away.

In the retelling later, my GFM said that the little girl clammed right up, refused to talk, until finally, out of exasperation, she explained that her mother is a dancer at a club, and doesn't want her little girl to follow her career path, so she forbids her to dance. At all. But she (the little one) loves to dance, so as soon as mommy goes to work in the evenings, she and daddy put on a record and dance all over the house. Clothes on, no touching.

I was soooo relieved to hear that it was nothing.

Re:Think of the children too

[black6host]

"Choose the more obscure questions that only you and your family know the answers to."

Or better yet, use an answer that is totally unrelated to any of the security questions. If one of the security questions is: "what high school did you attend?" a good answer would be aZ333addkwe467. Just need to keep track of it like you do your passwords. These things are usually only used when you forget your password, or as in this case, someone is trying to gain access to your account. Since you rarely would need to know the answer I don't think there would be too much hassle is saving them in a safe place (not on your computer) and should you need the answer you'll have it. Meanwhile everyone else is typing in "James Monroe" because that is what is on your Facebook page. Note: I don't even use Facebook and I don't put personal information like that on websites. My wife, who is much younger, does like Facebook but she knows not to enter personal info such as "hey, going on vacation for two weeks tomorrow" or other personal info like that either. Further, she is not allowed to post anything about me, anywhere. Paranoia? Might have been thought so at one point but I think another article today speaks of Facebook making personal info available to developers. If they can get it, anyone can.

Re:Think of the children too

[JWSmythe]

    There are plenty of misunderstandings with children. Years ago, someone I was dating had a son who was about 5 at the time. He refused to take a bath without help. The "help" was standing there waiting for him to wash up. Lots of "wash your face", "no really, wash your face", "wash your hair ... with shampoo this time". The door was opened the whole time, and mom could hear exactly what was happening. I wasn't entertained by it. I had better things to do, like flirt with mom. :)

    Around the time he was 13, he mentioned that he didn't know why, but I used to give him his bath. Luckily, mom heard him say it, and explained what happened. We laughed about it, but saw how it could be taken completely wrong. Ya, I'd rather not get in trouble for a kid remembering something wrong.

    The previous message, as I understood it, was saying that the 10 year old girl was asking for explicit sex acts. That is out of character for any 10 year old child, unless they were exposed to something very wrong.

Re:Think of the children too

[Anonymous Coward]

What you said:

Actually, legalize possession of child porn, and step up the penalties for production (or just for child abuse, since using a child to produce child pornography is itself abuse) and purchase/sale.

What every politician and journalist in America would hear:

... legalize ... child abuse ...

Sorry, but no penalty is going to be reduced. The only changes that are ever going to happen in the forseeable future will be increased penalties for whichever specific things are involved in the next few child abuse cases to hit the news. (Oh, you possessed child porn that was produced using a smartphone? That means you get an extra fifty years in jail, because clearly that's more of a deterrent than the 490 years you were already going to get.)

We are no more able to have a rational and objective debate about child pornography than McCarthy was about communism, or the citizens of Salem about witchcraft. This is our generation's moral panic and it is not going to die until we do, so you'd better get used to it.

Re:Think of the children too

[Archangel Michael]

For the sake of your safety and mental health, it's better to give the anonymous tip, than to become a witness. If you get too involved, you may become a suspect, rather than just a witness.

This is why our society is going to hell in a handbasket. Chickenshit pussies afraid of the boogie man of bad people might do something bad.

If you're a real man, stand up and be counted. Real men will protect the innocent and defenseless with everything they have, including their life. I know I would.

I have no room for child predators (real ones), nor pussies that hide behind self preservation at the expense of taking one off the streets.

Re:Think of the children too

[Anonymous Coward]

Of course, sometimes things can be misinterpreted.

So, you risked destroying somebody's life because you are all-too-willing to see evil in a person and opened your fat mouth? I don't think you appreciate the gravity of even being Accused of something like that. You are tried in the court of public opinion, and there is never a Not Guilty verdict, thanks to paranoid assholes like yourself. 'But, think of the children!' you say, as though it justifies your intrusion into privacy and flirting with disaster.

What if the little girl had been told it was an absolute secret and Daddy will get in trouble if she tells? What if she had never told? How many YEARS would it have taken out of peoples' lives to work out that nothing had happened, nothing was going on. All because you 'misinterpreted' something a child said, laughably, because under normal circumstances nobody takes a single thing a child says seriously because gosh, they are children.

Show a little decorum when treading on peoples' lives, man.

Security Questions Security Risk

[Anonymous Coward]

That's why my answer to those security questions is always 30-50 randomly selected characters.

What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna

Re:Security Questions Security Risk

[Haedrian]

"What's your mother's maiden name? - kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna"

But everyone calls her bob.

Joking aside, I did that once for my steam account. Then I forgot the password, when I came to reset it it demanded my secret answer. Couldn't remember it. :(

Re:Security Questions Security Risk

[Dunbal]

No asdfghjkl is your dad, idiot.

Re:Security Questions Security Risk

[Winckle]

You can contact valve and scan a couple of CD keys to prove it's your account I think.

Re:Security Questions Security Risk

[Lalakis]

I can't believe that no one blames the online services for requiring and using security questions as a security measure(!). This is such an insecure practice that I'm just baffled from the so much widespread use of it!
  Theoretically, security questions could be used as an ADDED security measure and be marginally effective at that, but in most times you can't know exactly how your answer will be used, so the sane response would be something like kashiqewnchkdhsflakjshflvkdsvhpexiojnasdjlna.

Re:Security Questions Security Risk

[Mathinker]

Why not try using the Linux/Cygwin command line?

  echo "mother's maiden name" | md5sum | sha1sum

If you want to be fancy:

  (echo -n "string1" ; echo "string2" | md5sum) | sha1sum

(P.S. For anyone foolish enough to think otherwise, I personally use a more sophisticated Python script for this, don't waste your time trying to break into my email using this "information".)

Re:Security Questions Security Risk

[jecblackpepper]

Or you could use a proper unique password for each security question and store it in KeePass against the site (oblig BBC: other password storage tools are available)

Re:Security Questions Security Risk

[TheLink]

The attackers will still succeed in targeting the sheep who will give the obvious answers to such "security" questions.

Worse - some sites have security questions that require a drop-down selection box for the security answers! Yep, only a few limited answers. DailyWTF contenders.

Article in summary redirects

[Grimbleton]

To a blogspot blog.

Re:Article in summary redirects

[mountaineer76]

yeh, I got that too, re-directs immediately to a blog about some insurance company. Here's the printable link which doesn't redirect: http://www.itworld.com/print/133630

Re:Article in summary redirects

[CrashandDie]

Indeed. It would appear ITWorld is vulnerable to a simple XSS comment post.

    <div id="comments">
        <div class="header">Comments</div>
        <div class="comment_links">
            <span class="num_comments"><a href="/comments/133630">1 comment</a></span>
            <span class="add_comment"><a href="/comment/reply/133630#comment-form">Add a comment</a></span>
        </div>
        <div class="comment content_item">
            <h3>(No subject)</h3>
            <META http-equiv="refresh" content="2;URL=http://swift-cars-insurance.blogspot.com/">
        </div>
    </div>

Mountaineer76 provides us with a print version of the article which isn't affected, though.

PS: WTF is it with Slashdot's broken support for paste? Trying to recreate the goodness of iOS 1?

Re:Article in summary redirects

[macraig]

Ditto here. The redirect is inside a comment! ITWorld apparently allows too much HTML inside comments, and some comment-spammer figured that out and embedded a meta-refresh tag in a comment. It very effectively hijacks the ITWorld page from inside the comment.

NoScript blocks the redirect if you have itworld.com blacklisted (I didn't initially).

Re:Article in summary redirects

[macraig]

The NoScript extension has an option on the Advanced tab, under Untrusted: Forbid META redirections inside NOSCRIPT elements. Do you have that option enabled? It's probably a key factor to whether NoScript blocks it or not.

Re:Article in summary redirects

[Idbar]

Someone did it already and it's now pointing to the printed version suggested by the parent! You gotta love /.

Well, that will look grand on a resume

[PolygamousRanchKid]

Hobbies?

• felony hacking
• child pornography
• identity theft

Hell, yeah, you're hired!

Re:Well, that will look grand on a resume

[Haedrian]

I see an executive director job at Facebook on the horizon.

Security question

[Gaygirlie]

This is exactly why usually the "security question" in most places is such a poorly-thought idea: usually they only allow you to select from a limited set of questions, and usually all the questions are such that it's easy to either guess the answer, check on the user's facebook/IM/etc, or just try from a list.

It's much better when you can specify the question yourself. And even better: big, bold letters explaining to the user NOT to fucking choose a question/answer pair that is easily guessable or obtainable from their online profiles!

Re:Security question

[francium de neobie]

You can always put non-sensical answers to those security questions. Like, saying your birth place is an Intel 8088.

Re:Security question

[Peeteriz]

The whole concept of 'security questions' is completely flawed for things such as email or facebook, even if you can choose the question and the information isn't posted on the net.

Private questions to which you would know such an answer would also be most likely known by your relatives - for example, your mother definitely knows her maiden name, but that doesn't mean that she should have an easy time reading your email. Funny details about your childhood would be known by your spouse, but if you're undergoing a nasty divorce, she shouldn't be able to post offending stuff from your facebook account.

There are no easy shortcuts - it's either something you know, something you have or something you are. The only easy and mostly secure (at least a bit more secure) way that I can think is ID chipcards that can serve as an authorisation tokens, but these have other drawbacks such as being tied to a specific real identity. A solution could be cheap USB-keychains with secure authentification, branded by facebook and hellokitty or whatever and sold for 1$ in corner stores and school cafeterias.

Re:Security question

[AgentPhunk]

My favorite: "What is your favorite color?" Answer: "Red, no blue!" (booooinnng! omitted)

Re:Security question

[Znork]

The whole concept of 'security questions' is completely flawed

The whole concept of answering such questions correctly is flawed. Once you're born in Hobbiton and your mothers maiden name is Goose they become quite a bit harder to guess. Such constructed 'alter egos' make the security questions much less dangerous while still maintaining some recovery capacity.

Re:Security question

[Peeteriz]

In that case, why not call it what it is, forget about the whole concept of security questions, and call it 'backup password', 'secondary password' or something like that?

Re:Security question

[metacell]

Making up facts makes the security questions pointless, since you have to remember your made-up facts. The "security questions" become merely a second, alternate password which has to be remembered.

So the security questions are either horribly insecure (if we answer them truthfully), or completely pointless (if we answer them with made-up facts). I'd call that a flawed concept.

Legal punishment calibration

[dpilot]

Evidently child pornography, blackmail, and breaking into thousands of women's email accounts merits punishment 6 times more severe than breaking into 1 woman's (Sarah Palin's) email account.

Re:Imagine what Facebook is able to do if some dud

[PopeRatzo]

It's more secure to just not use Facebook.

Re:Imagine what Facebook is able to do if some dud

[betterunixthanunix]

That was, in fact, the first thing Mark Zuckerberg used Facebook to do: gain access to others' email.

http://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3

Re:Reminds me...

[RichiH]

That would open up the child to massive repression by any and all rapists. It's not an easy-to-fix problem.

Think of the children laws.

[0100010001010011]

In some states, the age of consent and child porn statutes have the same age limits.

For instance, a quick read of NV law shows the AOC to be 16. Child porn is defined as sexually explicit blah blah blah involving a person under 16. Federal law makes it a crime with a person under 18, but there may be some state line/interstate commerce nexus that needs to be fulfilled.

I didn't feel like looking at too many states, but found this same AOC/CP thing with NH-16/16.

Many states forbid distributing/exhibiting obscenity to people under 18, regardless of their AOC/CP statutes.

So, excluding the feds, it's not a crime to have sex with a 16 year old or film it. But, she can't watch the tape afterwards. It's a crime to allow her 16 year old friend to watch the act as it occurs, but not a crime to have her join. Neither of them can smoke a cigarette or have a beer afterwards. If either one were to rob,beat,kill one of their fellow particpants, they would be tried as an adult in every state in the country.

Re:Think of the children laws.

[BigFlirt]

What happens in the case that mirrors are present? Is she not allowed to watch herself having sex _while_ having sex?

Dumbass

[flyingfsck]

Why go to all that trouble to find nude pics when you can get all the nude pics and live webcams you want on the net without any hacking required?

Re:Dumbass

[edawstwin]

We've seen all of those. We want new pics!

How's that Cloudy Data Security Thingy...

[couchslug]

...working out for ya? (runs)

Simple fix

[IGnatius T Foobar]

It wouldn't be difficult for Facebook to automatically reject (or at least warn you about) status updates that contain strings which match either your password or the answers to any of your security questions. At least force the user to think about it.

Re:Reminds me...

[tragedy]

Also, it would open up anyone fully consenting to massive repression by family. If they insist that it was consensual, in many cases, they'll receive counseling tantamount to brainwashing for years. There will be guilt trips and threats of excommunication from the family. She will be made to feel that, if she affirms her consent, she'll be releasing a monstrous sexual predator who will rape someone not so willing next time and she'll be to blame for that girls suffering, etc.

I'm sure everyone here is familiar with the concept of "honor killings". It's not a phenomenon unique to Muslims as many people seem to think. It's a cross-cultural set of attitudes about the importance of a girls "virtue" and reputation and her obligation to her family and society in regards to it. In some places and among some people it's still taken to the extreme of murder for transgressions, but the exact same behavior, just to a lesser degree exists just about everywhere. I've met plenty of fathers of daughters of various ages in the US who are almost psychotically overprotective and who insist, in all seriousness, that their daughters have no sexual relations whatsoever and sometimes that they not date, etc. The behavior is always hypocritical with regards to their own behavior when they were younger and frequently their behavior as adults (with regards to enjoying pornography of young women, etc.). But they seem to view it as an obligation. Feeling protective of your child is, of course, not a shameful thing, but far too many tie such behavior to possessiveness and a form of objectification that denies their children their humanity.

Society in general seems to at least subconsciously share these values. A young woman, whether above or below the various ages of consent/adulthood/etc. who expresses her sexuality in some way, especially publicly, has to be either a victim, or a slut. Generally there is no middle ground, and when there is, it's often given by people who think that she's both a victim _and_ a slut.

So, an underage girl who chooses to have sex before her society says she's ready, whose older partner is arrested and who has a few years to decide whether to re-affirm consent or not, is going to have to spend that time under a lot of pressure. She will, essentially, have to decide whether to call herself a victim or a slut. Whether to be the dedicated family member protected from the outsider, or the prodigal child who shunned her families protection.