Romanian Accused of Breaking Into NASA

← Back to Stories (view on slashdot.org)

Romanian Accused of Breaking Into NASA

Posted by Unknown on Wednesday November 16, 2011 @03:13AM from the zero-cool-strikes-again dept.

alphadogg writes "Romanian authorities have arrested a 26-year old hacker who is accused of breaking into multiple NASA servers and causing $500,000 in damages to the U.S. space agency's systems. Robert Butyka, 26, was arrested on Tuesday in Western Romania following an investigation by the Romanian Directorate for Investigating Organized Crime and Terrorism. According to local reports, the hacker used the online moniker of 'Iceman.' He does not have a higher education or an occupation, a DIICOT spokeswoman said."

169 comments

Min score:

Reason:

Sort:

In soviet russia ... by Anonymous Coward · 2011-11-16 03:15 · Score: 0

NASA hacks you ...
1. Re:In soviet russia ... by Anonymous Coward · 2011-11-16 05:56 · Score: 0
  
  Your ignorance of geography and history makes the joke absurd.
2. Re:In soviet russia ... by Anonymous Coward · 2011-11-16 20:07 · Score: 0
  
  Romaina's capital is Rome yeah?
Bill Gates by Anonymous Coward · 2011-11-16 03:17 · Score: 0

I remember when Gates wrote that he used to do the same thing as a teenager, hack into corporate computer centers via a dialup connection and try to crash their systems (which he bragged he succeeded in doing more than once). And of course Steve Jobs was a phone phreak.
1. Re:Bill Gates by Kraftwerk · 2011-11-16 03:42 · Score: 1
  
  Woz was the phreak, Jobs may have been around but I don't think it was his cup of tea.
2. Re:Bill Gates by Riceballsan · 2011-11-16 03:42 · Score: 1
  
  Well that case, it even is still directly doing damage (crashing the server, downtime = lost sales/productivity). Compared to several other hackers that get in comparable trouble for literally just connecting and reading the content. Companies/government tend to want to hold the hackers liable when they connect/access, without actually causing any downtime. Time spent applying security updates for a flaw that should have been fixed before, is not downtime caused by the hacker that is downtime caused by the security team not having done it right the first time. Unless trade secretes were sold to a competitor, or downtime/data loss was caused, there are no "damages". In the same way that trespassing is not by definition theft.
3. Re:Bill Gates by Anonymous Coward · 2011-11-16 03:45 · Score: 3, Informative
  
  Woz was the phone phreak, true. Jobs was the one who wanted to commercialize the device to do the phreaking. Woz was one guy making free calls. Jobs wanted to make money off of selling "free call devices" to others.
4. Re:Bill Gates by Kraftwerk · 2011-11-16 03:49 · Score: 0
  
  As punishment, they should have this young man sit down to a meal masticated by John Draper.
5. Re:Bill Gates by SuricouRaven · 2011-11-16 03:50 · Score: 2
  
  Common, I'd imagine. A hacker has to hack - if someone of technological talent isn't directed into a productive use of their skill, they'll likely end up using it to play around just because it's fun. I know when I was a pupil in school I used to frequently hack their primative network security, and had much fun in the dialup days port scanning and poking at whatever I found. A lot of experts today probably got started with some explorations of dubious legality.
6. Re:Bill Gates by ackthpt · 2011-11-16 04:25 · Score: 2
  
  Well that case, it even is still directly doing damage (crashing the server, downtime = lost sales/productivity). Compared to several other hackers that get in comparable trouble for literally just connecting and reading the content. Companies/government tend to want to hold the hackers liable when they connect/access, without actually causing any downtime. Time spent applying security updates for a flaw that should have been fixed before, is not downtime caused by the hacker that is downtime caused by the security team not having done it right the first time. Unless trade secretes were sold to a competitor, or downtime/data loss was caused, there are no "damages". In the same way that trespassing is not by definition theft.
  I took over security when I started my first job as a programmer. I already had tried out code for various spoofs and what not. Never did anything nefarious with it (the worst thing I did was bring one system to its knees with a program to compute pi to some large number of places) I knew the weaknesses (those idiots in Milwaukee were only using standard passwords on DEC systems used by Field Service .. password to [1,2] was SYSTEM, password to [1,1] was DECSER or DEC[Month abbreviation]) I developed honey pots and left them around the system where people could find them. Great way to alert me what people were up to. I key scanned and logged everything of known miscreants and methods. It was fun, but too easy. Most attackers were of limited education and vision. Breaking into a system to crash it was idiotic. Breaking into a system to learn was what separated the men from the boys.
  
  --
  
  A feeling of having made the same mistake before: Deja Foobar
7. Re:Bill Gates by Anonymous Coward · 2011-11-16 04:49 · Score: 0
  
  Breaking into a system to crash it was idiotic. Breaking into a system to learn was what separated the men from the boys.
  When I took over the company web site in 1996 I found that the server had been hacked and was being used by the Tamil Tigers to post to Usenet without revealing their true IP. So that's another reason.
8. Re:Bill Gates by cavreader · 2011-11-16 05:32 · Score: 1
  
  A lot of guys are just attracted to the challenge. But in today's world it is becoming dangerous to take on new challenges even when no harm is intended. You also need to be good enough to recognize the potential damage you might inadvertently cause. The worm Morris unleashed back in the early 90's was not intended to do what it did. He missed a a pretty simple error in one of the loop events which caused unrestrained replication which eventually brought down a lot of systems.
9. Re:Bill Gates by SuricouRaven · 2011-11-16 06:59 · Score: 1
  
  There does seem to be a change in the way hacking is handled. The old way was just to identify the source machine, block it, tidy up and secure holes. If some exploring hacker managed to take your site down for a while, it happened. Now that there is a lot more money involved in IT, companies are much more eager to send out the lawyers - which makes the internet more dangerous for the developing hackers. A problem looming, because today's script-kiddie playing around from home is tomorrow's sysadmin or programmer once they mature. The current approach to handling internet crime is like throwing people in jail for littering - it'll certainly keep the streets clean, but at the cost of ruining a lot of lives, many of them people who would grow out of it anyway.
10. Re:Bill Gates by cavreader · 2011-11-16 08:42 · Score: 1
  
  I have been at this game for 26 years and it does not surprise me a bit when I hear of new security threats and exploits being used for fun or criminal purposes. The architecture and technology the entire Internet depends on changes and mutates at a furious rate. What was secure yesterday can be insecure today. How much time are you willing to invest in building and securing an OS or application? It seems like new exploits are being discovered every day on both Windows and Linux based platforms. If these systems were not released until they were certified 100% exploit free would the Internet even exist? OS and application releases would probably be a 5 year cycle. How do you coordinate OS, application, and hardware changes made by multiple vendors and developers to avoid accidently creating exploits when changes are made? Some say that Standards are the key but Standards can also take forever to create and end up adding more time to development and deployment time frames. Standards also have the habit of becoming obsolete as the underlying technology changes. The majority of script kiddie level attacks rely on poor system administration practices and negligent web application developers. The only really good thing about these sorts of problems is the job security it creates. The Un-employment rate may be floating around 9% overall but IT specific unemployment is sitting around 3% and those 3% are probably not even looking for a job.
11. Re:Bill Gates by tehcyder · 2011-11-16 23:20 · Score: 1
  
  Unless trade secretes were sold to a competitor, or downtime/data loss was caused, there are no "damages". In the same way that trespassing is not by definition theft.
  If someone trespassed on their physical premises, an organisation like NASA would have to waste a lot of time (and therefore money) checking whether anything had been tampered with, even if nothing was stolen.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
12. Re:Bill Gates by tehcyder · 2011-11-16 23:35 · Score: 1
  
  A lot of guys are just attracted to the challenge.
  Well, I'm quite interested in the challenge of performing the perfect bank robbery, but if I get caught waving a shotgun in a cashier's face, I'm still going to prison for armed robbery.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
13. Re:Bill Gates by cavreader · 2011-11-17 02:25 · Score: 1
  
  I wasn't justifying the action I was just pointing out that not ever one interested in probing for weaknesses and exploits are criminals looking to cause damage or engage in theft.
Education by Anonymous Coward · 2011-11-16 03:20 · Score: -1

Well he had enough education to hack your shit.......
Perhaps you're not all as smart as you think because you sat through some classes and regurgitated some shit.
(successful six figure earning high school drop out)
I refused to let my schooling interfere with my education.
1. Re:Education by ByOhTek · 2011-11-16 03:27 · Score: 5, Insightful
  
  How much you make doesn't indicate how much you know.
  I have a friend who is a complete idiot in the functional aspect of doing his job, lacking the background education, but he's good with people and instead delegates most of the functional work to others (basically acting like a manager, though he isn't), and makes a huge salary.
  And I've another friend, who also lacks the background education, but is very competent, and makes a huge salary.
  i.e. Salary does not indicate competence and qualification, sadly this seems to be especially true when you get to managerial and executive level positions, which half the time simply need a warm body to fill a chair and occasionally point in a (hopefully good) direction.
  Likewise, Education (or lack thereof) does not indicate competence or qualification.
  In general there are trends towards better education meaning more competence, and more competence correlating to higher salary, but they are by no means tight or without exception.
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
2. Re:Education by trum4n · 2011-11-16 03:36 · Score: 4, Funny
  
  Being smart and poor ain't something to brag about. I'd know.
3. Re:Education by roman_mir · 2011-11-16 03:53 · Score: 1
  
  It's universal that majority of people who make the most money in the world are the most connected people in the world.
  The way to be the most connected is either by being born into the right family or by attending the right schools (which is similar to being born into the right family). It's good to become a member of some exclusive elite club while at school.
  OTOH it's possible to make a lot of money while not having almost any formal education (Steve Jobs or what's his name Zuckerberg).
  
  --
  You can't handle the truth.
4. Re:Education by roman_mir · 2011-11-16 03:55 · Score: 1
  
  Oh, also it's good to be a KGB agent and to be in the right place at the right time in history and to be absolutely willing and able to deal with the most shady elements of society to bring any attempt at a democracy to its knees.
  It helps when you are a dictator, you can steal a lot of money, especially if the country is resource rich.
  
  --
  You can't handle the truth.
5. Re:Education by roman_mir · 2011-11-16 03:57 · Score: 0
  
  (looks like his agents have preemptively modified my previous comment, so it wouldn't link to the story correctly. I am taking another risk here, I don't particularly enjoy polonium 210).
  --
  Oh, also it's good to be a KGB agent and to be in the right place at the right time in history and to be absolutely willing and able to deal with the most shady elements of society to bring any attempt at a democracy to its knees.
  It helps when you are a dictator, you can steal a lot of money, especially if the country is resource rich.
  
  --
  You can't handle the truth.
6. Re:Education by dkleinsc · 2011-11-16 03:57 · Score: 1
  
  How much you make doesn't indicate how much you know.
  Sure it does, just not in the way you expect: Power = Work / Time. Knowledge=Power. Time=Money. Thus Money = Work / Knowledge. QED.
  
  --
  I am officially gone from /. Long live http://www.soylentnews.com/
7. Re:Education by ByOhTek · 2011-11-16 04:20 · Score: 0
  
  Hmmm.
  I believe it was Forbes that said the average CEO worked about 80 hours a year on the position (not counting schmoozing events).
  That must mean these people are real vegetables to get so much money with so little work.
  "Damn. I lost another chess match with that rutabaga, maybe I should just give up and compete against the celery instead."
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
8. Re:Education by 0-until-pink · 2011-11-16 04:27 · Score: 5, Insightful
  
  This reminds me of the Kurt Vonnegut bit in Slaughterhouse Five about Americans attitude towards esteem and money.
  "America is the wealthiest nation on Earth, but its people are mainly poor, and poor Americans are urged to hate themselves. To quote the American humorist Kin Hubbard, “It ain’t no disgrace to be poor, but it might as well be.” It is in fact a crime for an American to be poor, even though America is a nation of poor. Every other nation has folk traditions of men who were poor but extremely wise and virtuous, and therefore more estimable than anyone with power and gold. No such tales are told by the American poor. They mock themselves and glorify their betters. The meanest eating or drinking establishment, owned by a man who is himself poor, is very likely to have a sign on its wall asking this cruel question: “if you’re so smart, why ain’t you rich?” There will also be an American flag no larger than a child’s hand – glued to a lollipop stick and flying from the cash register."
9. Re:Education by ackthpt · 2011-11-16 04:29 · Score: 1
  
  Being smart and poor ain't something to brag about. I'd know.
  Ruthless people make the money. Intelligent and ruthless people keep it
  
  --
  
  A feeling of having made the same mistake before: Deja Foobar
10. Re:Education by trum4n · 2011-11-16 04:39 · Score: 2
  
  When I'm a full time project engineer and can't afford to move out of my mom's basement, It's pretty bad. Renting an apartment costs nearly twice what a house costs to buy, per month. And because i have student loans, my credit is so bad i cant get a mortgage, despite having perfect credit otherwise. Being poor sucks.
11. Re:Education by trum4n · 2011-11-16 04:41 · Score: 2
  
  I've noticed. I'm wondering why i obey laws at all. I'm about to just file a patent for "the use of a road with wheels somehow involved" and bribe the patent office. Then ill just sue everyone. Seems to work for apple, ibm, microsoft, and trolls everywhere.
12. Re:Education by smooth+wombat · 2011-11-16 05:28 · Score: 1
  
  I'll agree with your assessment. I'm trying to move from a general IT position to a project management job and the salaries I see, considering the experience they want, are generally shit.
  On rare occasions, when they want at least ten years hardcore experience, you might find a few jobs over $80K, but most are in the $50K - $60K range, even with the experience.
  Granted, I'm only looking on the east coast so maybe the midwest, south and west coast are different.
  
  --
  We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
13. Re:Education by trum4n · 2011-11-16 05:41 · Score: 1
  
  yea, im in WV, where the median income is 37K. While i'm making $35K fresh out of college, it am stuck here, and slipping. There is not advancement in this arrangement. Sure i could work my way up to 55K, but that still wont mean shit. Hopefully i can trick the government into letting me build electric cars. All i need is to finish the suspension/body design and some venture capital. i even have a long list of people who want to work for me.
14. Re:Education by LateArthurDent · 2011-11-16 07:45 · Score: 1
  
  When I'm a full time project engineer and can't afford to move out of my mom's basement, It's pretty bad. Renting an apartment costs nearly twice what a house costs to buy, per month. And because i have student loans, my credit is so bad i cant get a mortgage, despite having perfect credit otherwise. Being poor sucks.
  Assuming you're making your student loan payments on time (and since you say you have perfect credit otherwise, I assume you are), that really shouldn't affect your credit like that. I just bought a house, and I have student loans to pay the total of which exceed my annual salary. My credit score was 820 and the loan process went off without a hitch (although it was still a ridiculous pain in the ass, they were still getting information from my employers the day before closing day. I understand that they'd call to simply ask, "has anything changed since we've spoken with you last month?" but I don't understand why they'd be trying to get anything new from them at that stage of the game).
  Most people that haven't been delinquent in their bill payments but still have credit problems have it because their credit history isn't long enough. Keep in mind that they only count *currently open credit accounts* for credit history. The other problem is that their available credit to amount owed ratio is too low, so focus on paying off any credit card debt you have as soon as it's feasible (If you have any accumulated debt, I know that's easier said than done, but it should be a priority even if you don't care about your credit score).
  I got my first credit card when I was 18, and it absolutely sucked. I have a better credit card now, but I do not dare cancel the other card because it's my longest piece of credit history, and it would kill my credit score. I just don't use it, and in fact I don't keep any balances on any credit card. My only debt were the student loans. I suspect your problem is that you closed some of your older credit card accounts because you got better cards. If that's the case, just remember not to do that again, it's one of the most important parts of your credit score, second only to actually paying your bills.
  Either that or the amount you have to pay every month on your student loan debt is too high relative to how much you get paid per month. That's not a credit issue though, so I assume your problem is the length of credit history.
15. Re:Education by chimpo13 · 2011-11-16 20:16 · Score: 1
  
  You should buy something small on that card and pay it off because they might cancel it since you don't use it. Small like a book or magazine or bottle of beer. I lost my oldest credit card for never using it.
  
  --
  riding round the world on an old motorcycle
16. Re:Education by tehcyder · 2011-11-16 23:43 · Score: 1
  
  (successful six figure earning high school drop out)
  Big deal, there are plenty of stupid rich people around.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
17. Re:Education by tehcyder · 2011-11-16 23:46 · Score: 1
  
  Being smart and poor ain't something to brag about. I'd know.
  It's still better than being dumb and rich. Having lots of money proves that you are good at getting lots of money, nothing more.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
Fry Him! by Anonymous Coward · 2011-11-16 03:20 · Score: 0

He's gonna get the chair... after all, it looks bad on us if an uneducated person from Romania can break into multiple "secure" Government systems.
1. Re:Fry Him! by JonahsDad · 2011-11-16 03:49 · Score: 1
  
  Well, either that or Facebook will hire him.
Pictures of his house during arrest by dev234 · 2011-11-16 03:21 · Score: -1, Troll

This is his picture
1. Re:Pictures of his house during arrest by Anonymous Coward · 2011-11-16 03:23 · Score: -1
  
  don't click that link
2. Re:Pictures of his house during arrest by Rootkit · 2011-11-16 03:23 · Score: 2
  
  Goatse, don't click.
3. Re:Pictures of his house during arrest by Anonymous Coward · 2011-11-16 03:25 · Score: 0
  
  To late...
  and the captcha word was "wisdom"...
4. Re:Pictures of his house during arrest by Anonymous Coward · 2011-11-16 03:27 · Score: 0
  
  goatse... who the hell still does this.
  Apparently there is a part of the world that just now starts receiving internet jokes from the last decade.
5. Re:Pictures of his house during arrest by Anonymous Coward · 2011-11-16 03:34 · Score: 0
  
  That's a thorough police search and no mistake.
6. Re:Pictures of his house during arrest by ByOhTek · 2011-11-16 03:34 · Score: 2
  
  who the hell still falls for this? I just assume any link in the comments is to goatse...
  
  --
  Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
7. Re:Pictures of his house during arrest by Jeng · 2011-11-16 03:57 · Score: 1
  
  Any link that goes to evenweb.com is goatse.
  Well, the most current links going to goatse over the past month or two have been from evenweb.com
  
  --
  Don't know something? Look it up. Still don't know? Then ask.
8. Re:Pictures of his house during arrest by Anonymous Coward · 2011-11-16 06:07 · Score: -1
  
  I'm 12 years old and what is this??
9. Re:Pictures of his house during arrest by tehcyder · 2011-11-16 23:50 · Score: 1
  
  I'm 12 years old and what is this??
  Your dad.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
whata mistakea to makea ... by armandoxxx · 2011-11-16 03:23 · Score: 0

Well another government mistake ... just hire the guy as a security advisor ...
...not to endorse his actions by Anonymous Coward · 2011-11-16 03:24 · Score: 5, Insightful

...but why aren't IT admins being held accountable for the lax security on their servers? And no, I don't buy the "if I leave my door unlocked, it's not an invitation to break in", since it's a paid position. If a cop fails to prevent a crime due to neglicence, the city can be sued. Most of these break-ins are due to IT negligence, not hacker genius.
1. Re:...not to endorse his actions by bberens · 2011-11-16 03:44 · Score: 3, Interesting
  
  Where do you live that a cop failing to prevent a crime can lead to the city getting sued?
  
  --
  Check out my lame java blog at www.javachopshop.com
2. Re:...not to endorse his actions by Anrego · 2011-11-16 04:02 · Score: 1
  
  Probably money.
  As a programmer, while I like to think I'm diligent when it comes to security, if I could find myself in prison for introducing a security bug .. I'd be wanting a hell of a lot more money for accepting that risk.
  Ultimately you'd probably just end up with the equivilant of medical malpractice insurance .. occasional screwups would be spread out and become a "cost of business", and we'd just be back to square one.
3. Re:...not to endorse his actions by timeOday · 2011-11-16 04:04 · Score: 3, Insightful
  
  Most of these break-ins are due to IT negligence, not hacker genius.
  
  I think negligence would be *very* hard to establish. First, most computer bugs, including vulnerabilities, are very obvious - in retrospect. Finding the needle in the haystack is easy after somebody points it out to you. That's entirely different than integrating hundreds of software components without creating any "obvious" holes.
  Second, how many sysadmins are given all the resources they would like to do their jobs? Security is cost/benefit, like anything else, you devote enough resources to make the pain tolerable, and no more. That means most admins have far more responsibilities than they can cover 100%.
4. Re:...not to endorse his actions by bws111 · 2011-11-16 04:13 · Score: 3
  
  How do you know the admin was not held responsible? He could have been fired, demoted, etc.
  If you mean why isn't the admin held responsible by the legal system, what law would allow him to be held responsible? IT admins are not sworn to duty (like police) or licensed (like professional engineers).
  Your example of the city being sued does not work here. The person suing the city would be the person who was harmed by the negligence. Who, other than NASA, would have standing to sue in this case? Who would they sue, themselves?
5. Re:...not to endorse his actions by Anonymous Coward · 2011-11-16 04:27 · Score: 0
  
  From my personal experience a lot of the time the IT admins are not given the budgets needed to implement all required security. The phrase "just make it work" gets thrown around a lot. All the while expecting it to be done in a fraction of the time it would take under normal circumstances. Let alone after half the department has been laid off.
6. Re:...not to endorse his actions by Anonymous Coward · 2011-11-16 04:58 · Score: 0
  
  If a cop fails to prevent a crime due to neglicence
  Don't don't fail to "prevent crime." They only deal with crime AFTER it happens. Furthermore, cops have absolutely no legal obligation to prevent crime nor are the obligated to save you from anything if its a question of their own safety.
7. Re:...not to endorse his actions by pr0fessor · 2011-11-16 05:37 · Score: 1
  
  Hold up. Do you not have a Information Security depart (in my case a cissp) that does intrusion detection and checks patch levels on a monthly basis. That implements policies to keep people from creating insecure passwords be it an average user or Admin. Do they not do daily, weekly, monthly audits that fill your inbox with response required. Do user's not come to you constantly asking why they can't have or do something with which you must reply ask Information Security. More than one Admin must have dropped the ball.
8. Re:...not to endorse his actions by Anonymous Coward · 2011-11-16 05:38 · Score: 0
  
  That depends on the situation. If the cop is standing there as a place is being robbed, he's going to have a LOT of explaining to do. If he wasn't doing something sensitive (meeting undercover or something) he and the city are in deep...
  Having said that, someone probably got in trouble in NASA too, but the media usually doesn't cover firings by rank-and-file employees. Besides, it also depends on how good the hacker is or where the security breach was. If it was the usual and they got in through an idiot employee remember that a lot of people who work on computers are lousy at doing even simple things. They don't know the finer points of rootkits or XSS attacks. Sure, you could not give them network access but isn't connecting employees of an organization part of the reason networks were made in the first place?
9. Re:...not to endorse his actions by mikael · 2011-11-16 06:00 · Score: 1
  
  Usually it seems to be the configuration scripts of the system that is the problem. There isn't any need to bury bugs in source code. Think of every network based application a system may have and how many configuration files each of these has; ssh, sftp, mail-servers/clients, file-sharers, networked file systems. It only takes one to have an easy to guess password and user account or open permissions.
  You just need to sugarspeak dangerous safety options in the official (or unofficial) webpage.
  "If you want to access your files, movies or TV recordings from anywhere in the world without the hassle of having to enter a password, just set the default directory to /, and set read permissions to everyone. Now you can access your files any time you like. No need to send usernames or passwords across the network". If you want to upload files as well, set permissions to read and write."
  
  --
  Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
10. Re:...not to endorse his actions by cusco · 2011-11-16 08:46 · Score: 2
  
  I rather doubt that NASA has an Information Security department, they're squeezing blood out of turnips just to keep the existing systems functioning. It doesn't help when they have lawyers and MBAs telling them "You have to build the infrastructure to send men to Mars, but we're not going to give you any money or manpower to do it with."
  
  --
  "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
11. Re:...not to endorse his actions by Anonymous Coward · 2011-11-16 09:35 · Score: 0
  
  Congress could act, but they don't need to sue.
  They just hold a hearing, get a few sound-bites, then move on.
12. Re:...not to endorse his actions by pr0fessor · 2011-11-16 11:25 · Score: 1
  
  yes and very unfortunate. I'm just tired of hearing Blame the Admins.
13. Re:...not to endorse his actions by tehcyder · 2011-11-16 23:52 · Score: 1
  
  Oh look, it's a slight variation on the ever-popular libertarian anti-government line "the police can't be sued if they don't prevent a crime, therefore crime prevention is impossible, therefore all we should do is arm everyone so they can shoot criminals after the event". Twat.
  
  --
  To have a right to do a thing is not at all the same as to be right in doing it
Damages by AdamJS · 2011-11-16 03:24 · Score: 3, Interesting

I'm betting the damages are formulated entirely from the cost of them having to do PR (they got hacked by a NEET after all) and 'fix' the security hole (because face it, they'll probably introduce 10 more flaws when fixing one).
1. Re:Damages by HopefulIntern · 2011-11-16 03:32 · Score: 1
  
  I was just about to ask, how do you quantify "damage" within software (or otherwise intangible things), when I guess what they mean is reputation damage.
2. Re:Damages by bberens · 2011-11-16 03:45 · Score: 4, Insightful
  
  You get a few senior level IT people in a room and a single meeting can easily cost $1k. Total time to figure out what happened, track the guy down, etc. could easily cost $500k.
  
  --
  Check out my lame java blog at www.javachopshop.com
3. Re:Damages by Anonymous Coward · 2011-11-16 04:31 · Score: 0
  
  This.... this is exactly what many middle managers don't get! e.g. "lets have an hour meeting with a dozen developers" actually *does* cost the company about a thousand dollars of usually non-revenue generating activity.
  Once we had a company-wide get-together, that cost ~$60k to book (rent out a hotel, and a buncha conference rooms for two days). When someone brought up that "this is a lot of money to spend on two days"... it was quickly pointed out that the company is actually spending 20x as much on the salaries of all the people who are there...
4. Re:Damages by Anonymous Coward · 2011-11-16 04:48 · Score: 2, Informative
  
  As someone who worked at NASA during a hacker break-in, I am frankly surprised that the damages are that small. All of the machines were taken offline for a couple of days. All of the IT people worked round the clock to restore the servers to a previous state and try and fix the exploit. All kinds of onerous policies for the users are put in place that lasted for a month. Several new onerous policies persisted longer. Work productivity was definitely lost by all of the users (scientists) of all of the computer systems. Accusing the IT folks of being lapse is totally ignorant as well. Some of the finest IT people work for NASA. NASA's problem instead is the rule from the top. Administrators with basically no science or IT experience enact policies that those people need to follow which are stupid. Many of the IT people know it but they are stuck with the administrators' or even government mandates as to how these systems need to be operated. I remember several of the IT people during the incident that occurred while I was there complaining that they were not as yet allowed to move the systems into virtualization where far less damage occurs with exploits.
5. Re:Damages by Anonymous Coward · 2011-11-16 04:53 · Score: 0
  
  NEET -> status zero
  iceman -> sub zero
  http://en.wikipedia.org/wiki/NEET
6. Re:Damages by DigiShaman · 2011-11-16 05:16 · Score: 1
  
  Meetings are important so long as they help set the agenda and ensure everyone attending is on the same page with regards to workflow and trending issues seen out in the field (campus). Simply put, it's about collaboration in areas that are meaningful and constructive.
  Now, 60k for a one-time meeting in meat-space is a waste of money IMHO. In a scenario where you have managers in multiple locations, it would server better to have many reoccurring scheduled teleconferences vs. one rare expensive meeting.
  
  --
  Life is not for the lazy.
7. Re:Damages by Dr.Dubious+DDQ · 2011-11-16 06:11 · Score: 1
  
  Isn't that their job anyway, though? Estimating the costs this way sounds a bit like Apple saying that Google cost them millions of dollars because they had to have meetings about competing with Android (for example).
  
  --
  Hacker Public Radio is our Friend
8. Re:Damages by bberens · 2011-11-16 06:37 · Score: 1
  
  Theoretically those people would've been doing productive work. Now, instead of completing productive work, they've spent probably thousands of hours dealing with this. So the nominal cost isn't very high, but the productivity cost is high.. and I presume that some other project(s) will be late due to it.
  
  --
  Check out my lame java blog at www.javachopshop.com
How much? by Coisiche · 2011-11-16 03:27 · Score: 2

I can maybe understand if a figure like that is reached via physical proximity and a sledgehammer.
But an unauthorised intrusion?
Even a complete restore from backup can't possibly cost that much in lost time for employees.
1. Re:How much? by jackbird · 2011-11-16 03:29 · Score: 1
  
  I could see the audit process to determine what, if anything, was downloaded/altered costing a pretty good chunk of that. Especially when you start getting lawyers involved over possible ITAR issues if someone on the inside was negligent or actively aiding the intrusion.
2. Re:How much? by moogied · 2011-11-16 03:41 · Score: 3, Insightful
  
  Its not just a restore. There was an investigation, then an audit process for the proposed change, then you have the CAB meetings, the testing in dev, then in stage, then finally the push to production environment. Then you have possible hardware changes(depending on mode of access), and additionally you need to sanitize the environment to be 100% sure nothing was left behind. Thats easily a few hundred man hours . 500k may be a tad high(depending on a lot of things), but its not unreasonable.
  
  --
  So basically, -1 troll/offtopic is really slashdots way of saying "I hate that you thought of something before me."
3. Re:How much? by gl4ss · 2011-11-16 03:48 · Score: 1
  
  the costs come from noticing and investigating.
  in other words, there would have been no monetary damages if they hadn't pursued the culprit.
  funny, eh? the damages are thus made up from thin air.
  
  --
  world was created 5 seconds before this post as it is.
4. Re:How much? by gl4ss · 2011-11-16 04:04 · Score: 1
  
  actually all that work would have been necessary regardless of the intrusion.
  
  --
  world was created 5 seconds before this post as it is.
5. Re:How much? by Anonymous Coward · 2011-11-16 04:34 · Score: 0
  
  Considering that my company is paying $1000/day for my services. Nasa has 18,000 employees. If you need to do a complete restore from backup, losing 2 days of work, then that alone would cost... $1000*2*18000=$36,000,000. So yes, it would be far in excess of $500k. More if you need to restore from further back depending on how quickly they were able to detect the intrusion, and confirm that no intrusions happened prior to 2 days ago.
No education or occupation by roman_mir · 2011-11-16 03:27 · Score: 4, Insightful

According to local reports, the hacker used the online moniker of "Iceman." He does not have a higher education or an occupation, a DIICOT spokeswoman said.

No education and no occupation, ha?
So who is working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems?

Butyka is accused of hacking into several NASA servers over a period of time that started on Dec. 12, 2010. The authorities claim that the hacker destroyed protected data and restricted access to it. The charges brought against Butyka include obtaining unauthorized access and causing severe disruptions to a computer system, modifying, damaging and restricting access to data without authorization and possession of hacking programs.
He possess hacking programs, that means he is a terrorist. What kind of 'severe disruptions' did he cause that cost 500,000 USD?

Romanian authorities have arrested a 26-year old hacker who is accused of breaking into multiple NASA servers and causing $500,000 in damages to the U.S. space agency's systems.

- this is a bunch of nonsense.
He cost an admin a few hours of time and maybe a reinstall and reconfigure. Even at 1000USD / hour no way somebody spent 500 hours on it (that's 20.8 24 hour days) or 12.5 40 hour weeks.
This is more government nonsense.

--
You can't handle the truth.
1. Re:No education or occupation by GameboyRMH · 2011-11-16 03:33 · Score: 3, Interesting
  
  Possession of "hacking programs" is a crime? I think all my computers except my gaming PC have "hacking programs" on them, good thing I don't travel to the states these days.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:No education or occupation by roman_mir · 2011-11-16 03:39 · Score: 4, Funny
  
  well, he also owns a computer, this is almost a 100% indication that he is a pedophile-terrorist, or a pedo-rist.
  This is what government is for - making sure that the right people are always punished for their transgressions. That's why Jon Corzine is in charge normally, of some government and/or economic function somehow and disgusting people like Ron Paul are blacked out by the media because they challenge the status-quo.
  Also USA is sending troops to Australia. You know, in case pro-Chinese Kangaroos join Al-Qaeda.
  
  --
  You can't handle the truth.
3. Re:No education or occupation by TommyGunnRX · 2011-11-16 03:44 · Score: 2
  
  ... good thing I don't travel to the states these days.
  Not sure what the laws are in the 'states' regarding hacking programs, but the article clearly states he was arrested in Romania... Does this mean residents of Romania are restricted from accessing BackTrack and BackBox linux distros?
4. Re:No education or occupation by Pi1grim · 2011-11-16 03:50 · Score: 2
  
  Now that I think of it, the government own quite a number of computers
5. Re:No education or occupation by Sarten-X · 2011-11-16 03:53 · Score: 2
  
  Reinstalling and reconfiguring every system the hacker may have touched is impractical, and would take far more time than NASA can spare. Calling in auditors to make sure there were no rootkits, backdoors, or other bad stuff on any other systems is expensive. Deleting the results (and backups) of the latest experiments means months or years of work has to be redone.
  $500,000 actually strikes me as a pretty reasonable estimate.
  
  --
  You do not have a moral or legal right to do absolutely anything you want.
6. Re:No education or occupation by roman_mir · 2011-11-16 03:59 · Score: 1
  
  Yes, and I am sure that some of those computers will be "inadvertently" found to be in possession of some of those Australian kangaroos. And Ron Paul.
  
  --
  You can't handle the truth.
7. Re:No education or occupation by roman_mir · 2011-11-16 04:05 · Score: 2
  
  That's just nonsense. A large organization can re-image large numbers of machines automatically, but more importantly is that in large organizations the Internet connection is normally done through one or a few systems, not every computer has its own external IP address and ports are restricted on the exit nodes. Watching and restricting the Internet-to-internal machine traffic on ports is part of what admins are for in the first place.
  Fix the problem even if it means a reinstall of the exit nodes, patch the hole, change the passwords and keep watching the traffic, fixing whatever happens internally if it happens. But that's routine work for a network admin.
  
  --
  You can't handle the truth.
8. Re:No education or occupation by timeOday · 2011-11-16 04:06 · Score: 3, Insightful
  
  So who is working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems?
  So anybody who can smash a car window and steal a stereo is smarter than the guys who design cars? That is not a logical conclusion.
9. Re:No education or occupation by roman_mir · 2011-11-16 04:09 · Score: 1
  
  If that's your metaphor for an unpatched system or a system with some weak passwords in it, then I can't help you.
  The work of an admin is not to leave an 'unsecured car' without supervision. If the 'windows can be smashed', it means the admin is not doing his job.
  Actually it's more like having a tank with a hutch opened, and somebody throwing a hand grenade into it.
  
  --
  You can't handle the truth.
10. Re:No education or occupation by nigral · 2011-11-16 04:15 · Score: 1
  
  good thing I don't travel to the states these days.
  Does it sound like he did?
11. Re:No education or occupation by Hentes · 2011-11-16 04:16 · Score: 1
  
  No education and no occupation, ha?
  So who is working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems?
  This is Eastern Europe. He might have a job and just evading taxes.
12. Re:No education or occupation by roman_mir · 2011-11-16 04:18 · Score: 1
  
  Evading taxes? Oh crap, don't tell that to the prosecutors. Like the guy doesn't have enough problems on his plate already. Shush.
  
  --
  You can't handle the truth.
13. Re:No education or occupation by Anonymous Coward · 2011-11-16 04:34 · Score: 0
  
  He possess hacking programs, that means he is a terrorist. What kind of 'severe disruptions' did he cause that cost 500,000 USD?
  
  Romanian authorities have arrested a 26-year old hacker who is accused of breaking into multiple NASA servers and causing $500,000 in damages to the U.S. space agency's systems.
  - this is a bunch of nonsense.
  He cost an admin a few hours of time and maybe a reinstall and reconfigure. Even at 1000USD / hour no way somebody spent 500 hours on it (that's 20.8 24 hour days) or 12.5 40 hour weeks.
  This is more government nonsense.
  No, the real cost is that their systems needed to have their security upgraded to where they should have been in the first place.
14. Re:No education or occupation by Sarten-X · 2011-11-16 04:39 · Score: 5, Informative
  
  I take it you've never actually worked on a high-security system. Here's what I remember of the procedure at the last high-security place I worked:
  In the event that a machine (including a gateway) is compromised, any machine it can access is considered threatened, and must be thoroughly checked. No, NAT does not help, because once someone has control over the bridge, they can send data to any machine they want, even those without an external IP address. If any router, switch, or machine shows any slightly-suspicious activity (even as benign as an unscheduled database login), that machine gets an even more thorough examination to find out whether the activity was actually related to the hack, and what resources the hacker may have gained access to. If there's any indication that the hacker had shell access or retrieved data, the machine is considered compromised. If the machine stored any sensitive data, that data is reviewed to see if it could allow access to other systems (such as challenge questions & answers for resetting passwords). This investigation, which often involves the use of outside consultants (because there may have been inside help) continues throughout the whole network until the full extent of the breach is known. Being a government agency, the breach will likely involve a several-hundred-page report covering every detail. Somebody has to write that.
  The cost is already in the hundreds of thousands of dollars, and only then can the repairs start. It's often not as simple as just restoring a backup, either. Sure, the operating system can usually be done quickly (including fixes for the responsible security holes), but if there's any indication of data being touched (which, in this case, there was), that has to be addressed, too. Backups are usually old. In an ideal world we'd be making hourly backups stored offsite in an everything-proof vault, but that's never really the case. If an admin's lucky, he has a backup that's less than a week old - or it was when the breach occurred. Somehow (best described as "magically"), the admin has to figure out what changes were intentional (like experiment results, or customer orders, or whatever) and what was the result of the breach, then piece together the data to get something reasonably complete and up-to-date. Finally, after days, weeks, or months of reconstruction (most vital systems first, of course), the system is declared clean. Until then, projects get postponed, and other employees are being paid to play solitaire until their real work can continue.
  Then there's the "let's not do this again" phase, where employees change passwords, get lectured on security practices, sit through seminars on how to properly encrypt data, and so forth, all of which costs even more money. There's probably still an ongoing investigation as to whether anyone inside the organization helped the hacker, likely being run by consultants.
  Then there's the damages caused by any delays, which may involve contractual obligations. That's more money.
  It's not as simple as just re-imaging and assuming that everything's fine. Sure, that works on workstations, but it's unlikely that a workstation was all that was damaged. Once a server gets touched, the costs rise dramatically.
  
  --
  You do not have a moral or legal right to do absolutely anything you want.
15. Re:No education or occupation by roman_mir · 2011-11-16 05:00 · Score: 0
  
  More nonsense. This is not CIA, it's NASA. Yes, I worked in banks and telcos, and sometimes viruses were found in the systems (email is the usual culprit, or maybe somebody's flash card or some disk). Normally the the work stations are NOT re-imaged or anything, but they can be cleaned by an admin, either over the network or even coming physically to a machine with a piece of software.
  All this other stuff, the gateway, the routers, the servers, etc.etc., it's all admin's responsibility on day to day basis, and it's just BS that all machines become magically compromised just because somebody penetrated an Internet facing server. Sure, you can't be totally certain, but it's an internal network. Fix the gateway and watch the traffic inside.
  All these numbers (500K) are artificial nonsense.
  
  --
  You can't handle the truth.
16. Re:No education or occupation by cachimaster · 2011-11-16 05:00 · Score: 1
  
  No education and no occupation, ha?
  So who is working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems?
  A virus can break into your huge, complex and perfectly evolved human immune system, while being the simplest lifeform.
  Defending is a much harder problem than attacking.
17. Re:No education or occupation by Creepy · 2011-11-16 05:03 · Score: 1
  
  This easily falls under the CFAA in the United States, but so does practically anything, like, say lying about your weight on a dating site (seriously - there was an article about it on the Register yesterday as of this writing). I'm sure hacking programs are also covered in an over broad way on that law.
  And of course United States laws apply to everyone... but I can see Romanian authorities bowing to the whims of the United States - if the US has a friend in Europe, it is Romania. When I was there about the only anti-US thing I saw was a little kid with a CCCP T-shirt. Aside from that, I saw a lot of EU and US help, and well needed at that - the Soviet era road system was in a pretty bad state, and it was easy to tell the old trains from the new. Not sure how much has changed since then.
18. Re:No education or occupation by roman_mir · 2011-11-16 05:04 · Score: 1
  
  A virus can break into your huge, complex and perfectly evolved human immune system, while being the simplest lifeform.
  - I don't think viruses are 'simplest lifeforms' or even 'lifeforms', and I certainly don't think that I have an immune system that is that perfect at all. It's not that wonderful and also if it's not a virus but a brick thrown into the head, then it's pretty much useless!
  
  --
  You can't handle the truth.
19. Re:No education or occupation by sgt+scrub · 2011-11-16 05:10 · Score: 1
  
  So who is working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems?
  So who was working for NASA then, that this 'no-education and no-occupation' individual is able to break into their systems? FTFY
  What kind of 'severe disruptions' did he cause that cost 500,000 USD?
  It costs money to replace your entire IT department.
  
  --
  Having to work for a living is the root of all evil.
20. Re:No education or occupation by sgt+scrub · 2011-11-16 05:11 · Score: 1
  
  You have vi on all but one of your machines? You damned criminal types! :P
  
  --
  Having to work for a living is the root of all evil.
21. Re:No education or occupation by roman_mir · 2011-11-16 05:16 · Score: 1
  
  so your contention is that NASA's IT dep't must be fired?
  Aren't you this guy? You didn't answer the question yet.
  For a guy who is for burning people if they don't hire some folks above the rate, that would make them actually profitable to a company, you are quick to assume people should be fired for whatever mistake. Interesting.
  
  --
  You can't handle the truth.
22. Re:No education or occupation by Sarten-X · 2011-11-16 05:23 · Score: 1
  
  So let me get this straight... If a workstation is compromised, it's cleaned, but there's no need to bother reimaging. If a server is compromised, and data is lost/damaged, it doesn't matter because it was already the admin's job to fix it, so it doesn't cost anything? And the lost productivity due to countless meetings to review doesn't cost anything? And the projects that get delayed don't cost anything, regardless of being under contracts? And the resulting investigation, likely involving travel to foreign countries, doesn't cost anything?
  That is what I call nonsense.
  But hey... I guess you know your stuff. After all, banks are very secure.
  
  --
  You do not have a moral or legal right to do absolutely anything you want.
23. Re:No education or occupation by DeltaVelocity · 2011-11-16 05:27 · Score: 2
  
  ... good thing I don't travel to the states these days.
  Uhm, hello??? He was arrested in Romania by Romanian authorities and is being charged under Romanian laws in the Romanian court system. It's not illegal to have "hacking programs" in the States.
24. Re:No education or occupation by DriedClexler · 2011-11-16 05:30 · Score: 1
  
  ... and quite a number of hacking programs, for that matter!
  
  --
  Information theory is life. The rest is just the KL divergence.
25. Re:No education or occupation by roman_mir · 2011-11-16 05:34 · Score: 1
  
  Yeah, all those banks had problems with debit cards. There are even cases when banks are compromised internally.
  Banks take their security seriously enough, it's part of their jobs and it's their money on line (well, or the Federal money, which of-course means - who cares).
  Yes, most of the time workstations are not reimaged anywhere even if a virus or a trojan was found. Normally a patch and some clean up is done automatically. This may shock you, but that's how they NORMALLY operate, so saying somebody spent 500,000 on this sounds ridiculous, because it's not their normal operating procedure.
  
  --
  You can't handle the truth.
26. Re:No education or occupation by DriedClexler · 2011-11-16 05:38 · Score: 2
  
  No, but a guy who figured out how to throw a pebble in *just* the right way to allow access to a locked car (and drive it) without setting off the car alarm or giving much evidence of intrusion is smarter than the guy who designed the car's security measures.
  
  --
  Information theory is life. The rest is just the KL divergence.
27. Re:No education or occupation by Anonymous Coward · 2011-11-16 06:21 · Score: 0
  
  roman_mir - You sound like someone who has never worked in the Real World. Sarten-X is absolutely right on the cost calculations for damages. Damages may not be "things that were broken" but they may indicate "things we need to do to make sure things aren't broken." There are huge costs to doing that.
28. Re:No education or occupation by ThatsNotPudding · 2011-11-16 06:25 · Score: 1
  
  I'm now fairly certain Ron Paul is the reincarnation of Ann Rynd.
29. Re:No education or occupation by roman_mir · 2011-11-16 06:28 · Score: 1
  
  No, it's sartenx and you sound like you have never worked in the real world.
  In the real world it's very very rare to see any action like that described by sartenx take place. It never happens. It's not the standard procedure.
  It is your imagination. You THINK it works that way, because you think you know what is the right thing to do. Well, it's not what actually happens, it is NOT what actually happens in real world.
  It's like that xkcd cartoon about the strong passwords and how in the real world they are quickly extracted by applying a 5 dollar hammer to the knees.
  
  --
  You can't handle the truth.
30. Re:No education or occupation by Anonymous Coward · 2011-11-16 06:41 · Score: 0
  
  This is still the Admin's job to do. There is nothing you posted that goes beyond that realm.
31. Re:No education or occupation by royallthefourth · 2011-11-16 06:42 · Score: 1
  
  Q: What's a libertarian's favorite snack?
  A: Pyrk rands.
32. Re:No education or occupation by Anonymous Coward · 2011-11-16 06:48 · Score: 0
  
  This is Eastern Europe. He might have a job and just evading taxes.
  This is Eastern Europe. He might have a job and the employer is just evading taxes.
  There. Fixed that for you. In reality it's the employer suggesting to pay the employees on the black market. Salaries often being at the limit people accept anything for the extra cash. The company usually pays more taxes for an employee than the employee himself.
  And I know this because I live in Eastern Europe.
33. Re:No education or occupation by roman_mir · 2011-11-16 06:48 · Score: 1
  
  I'm now fairly certain Ron Paul is the reincarnation of Ann Rynd.
  First: it's Rand (or Alisa Rosenbaum).
  Second: that would be a neat trick. Ron Paul was born in 1935 and she died in 82.
  
  --
  You can't handle the truth.
34. Re:No education or occupation by Rich0 · 2011-11-16 07:15 · Score: 1
  
  I work in a large company (not government/CIA) and if we had some kind of break-in with our systems we'd be going through all the sorts of things you suggest. And we care about turning a profit so it isn't like we just spend money for the sake of doing so. The CIO would be ticked, but he'd be brining in those consultants pronto because with something like this you have to do it right.
  I'm sure some data would be lower risk than others and might not get as much scrutiny, but just determining what is important and what isn't costs money. You find a server that you think might be at risk, then you look up the contact for that server, then you trigger a 30-email conversation (for one server) as they track down the people who are REALLY responsible and have the authority to speak for it, and then you send them the 14-question survey and put the score on the big list.
  Oh, and if any of the data in those systems is subject to regulation (EVERY big company is regulated in some way) you get the lawyer-types asking "what if" questions and you end up assessing more than you probably need to anyway.
  As you indicated you can't just roll back production systems a few weeks once you realize the exploit is that old. Does amazon.com just forget about every order they took in the last month that they billed but didn't ship? Do they just reset their inventory to what it was a few weeks ago (an eternity in the just-in-time world)? Do they bill and re-ship orders they already filled? Do they forget about pre-orders and lose business and frustrate customers who wanted their widget on day one at the same time?
  And even if you trust that it isn't an inside job you still need the army of consultants. Companies don't staff to just absorb these kinds of distractions - they run their staff at 120% on an average day. You need an army of consultants just to make sure this stuff all gets done reasonably quickly.
  Then there is the distraction factor as everybody is busy doing risk assessments and reviewing data when they'd normally be doing something that actually makes the company money (ostensibly the reason they have jobs in the first place).
  Yup, a breach like this is simple in the same way that backing up your computers is simple, or buying a hard drive at 0.1 cents/GB is simple. It is all simple until you have a bazillion of them, and your job is on the line.
35. Re:No education or occupation by Anonymous Coward · 2011-11-16 07:21 · Score: 0
  
  Well, just looking at wiki, Paul left politics for a while after 1984.
  *gasp* after Rand died in 82, she possessed Paul which led to his departure! The short break was to let the two libertarian minds to meld into one powerful ULTRA libertarian!
36. Re:No education or occupation by iamlucky13 · 2011-11-16 08:11 · Score: 1
  
  He possess hacking programs, that means he is a terrorist. What kind of 'severe disruptions' did he cause that cost 500,000 USD?
  If he disrupted servers used by NASA to provide data to their employees, it could easily reach that. For example, the Planetary Data System servers are the normal point of access for thousands of researchers around the country working with raw data from NASA space probes. Take that off line for a day and you've disrupted quite a lot of work. Similar if you take down a technical data server that suppliers need to access detailed requirements or coordinated design data like CAD models of a system a supplier needs to make a subsystem interface with.
37. Re:No education or occupation by roman_mir · 2011-11-16 08:42 · Score: 1
  
  Rand wasn't a libertarian. She called herself an 'objectivist'.
  
  --
  You can't handle the truth.
38. Re:No education or occupation by timeOday · 2011-11-16 09:02 · Score: 1
  
  Do we have some reason to think the intruder in this case built his own toolkit or devised his own methods?
39. Re:No education or occupation by sgt+scrub · 2011-11-16 13:50 · Score: 1
  
  so your contention is that NASA's IT dep't must be fired?
  Yes. If someone with no education or experience can infiltrate your network, your IT department is non-existing. It needs to be replaced. Are you suggesting equal opportunity can not co-exist with the right to replace someone incompetent?
  Aren't you this [slashdot.org] guy [slashdot.org]?
  Yes.
  You didn't answer [slashdot.org] the question [slashdot.org] yet.
  It was not a question. It was a troll. A question is, "How do all AAA nations have profitable businesses when they have a minimum wage. Another example of a question is, "How does a AA nation like the U.S. have profitable businesses when it has a minimum wage".
  
  --
  Having to work for a living is the root of all evil.
40. Re:No education or occupation by rim_namor · 2011-11-16 14:27 · Score: 0
  
  Oh, it was a troll? Wasn't your premise a troll, that people who don't hire others for less than their worth deserve to be BURNED with 'tires over their heads'? I think somebody protests too much of being the real troll.
41. Re:No education or occupation by cusco · 2011-11-16 15:40 · Score: 1
  
  He cost an admin a few hours of time and maybe a reinstall and reconfigure.
  
  This is not your home media server with your pirated music and downloaded porn, these are thousands of servers worldwide running one-of-a-kind custom written software and mission critical systems. After finding which exploits were used they need to find which systems could have been affected. The need to know which systems can be taken off the network in what time frame, and what needs to be done to each. Apply the wrong patch to some of them and you'll lose communication with Voyager or be unable to model the next week's journey for the Mars rovers.
  
  Don't worry, some day if you apply yourself they'll let you come work with the big boys.
  
  --
  "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
42. Re:No education or occupation by sgt+scrub · 2011-11-17 03:31 · Score: 1
  
  the fact that you were trolling for personal information makes it a troll. http://developers.slashdot.org/comments.pl?sid=2521666&cid=38038114
  
  --
  Having to work for a living is the root of all evil.
43. Re:No education or occupation by roman_mir · 2011-11-17 08:04 · Score: 1
  
  How many jobs have you created? You are claiming people should be burned with tires on their heads if they don't create unprofitable 'jobs' (whatever that means), so how many jobs have you created, because you need to undergo your owned prescribed treatment if you are not creating any.
  
  --
  You can't handle the truth.
44. Re:No education or occupation by sgt+scrub · 2011-11-17 08:42 · Score: 1
  
  You are claiming people should be burned with tires on their heads if they don't create unprofitable 'jobs'
  I made that claim? Are you sure you are not just repeating it in hopes that someone believes you?
  How many jobs have you created?
  I don't respond to trolls. However, If you want an answer regarding the possibility of a successful business model in an economy with minimum wage you can simply look at the success failure rate of businesses in the U.S., U.K., France, Germany, Australia, Canada and Japan over the last 50 years. They have all had minimum wage over that period of time and have the most successful economies. They have the largest success rate for start up companies and, despite the fact that most fail regardless of the country they start up in, have the lowest failure rate for start up businesses in general.
  http://money.cnn.com/magazines/fortune/fortune500/2011/full_list/
  http://www.moyak.com/papers/business-startups-entrepreneurs.html
  
  --
  Having to work for a living is the root of all evil.
45. Re:No education or occupation by roman_mir · 2011-11-17 08:59 · Score: 1
  
  Again, how many jobs have you created.
  Your precise statement was this (full comment, nothing taken out, and the context is in this thread):
  
  If you don't hire people because you don't want to pay minimum wage you should be jailed for your protection. People not being hired for less than minimum wage should toss a tire around your head and burn you alive.
  Don't tell me somebody else has minimum wage, I know that the countries the world over are screwed up.
  Your words: if you don't hire people because you don't want to pay mnimum wage, tire should be tossed around your head and you should burn alive.
  So tell me, are YOU creating any jobs that are unprofitable? Because if you PERSONALLY aren't creating the jobs that are unprofitable, then you should have your own prescription applied to you.
  Why? Because that quote, that statement was a response to this statement I made.:
  
  No, minimum wage only outlaws some people from working.
  NOBODY can FORCE me to hire someone, who is not producing more than minimum wage worth of value after all of the expenses for a higher than minimum wage salary.
  If you hire a person, that person has to produce enough value to offset the cost of hiring, all of the associated expenses and he has to produce some profit.
  So if somebody produces 6 dollars worth of revenue and he costs say 5 dollars, then the 1 dollar is profit. If the minimum wage is 7.25, then by hiring that person at that wage instead of generating 1 dollar worth of profit you generate 1.25 loss.
  It makes no sense to hire somebody (unless you are a government), who costs your business money and generates a loss (well, there are instances where it may be a strategic hiring, something special, used to create a tax deduction or something).
  But basically by setting minimum wage you outprice some people from the market.
  If the entire world set a minimum wage of say 10 dollars per hour, then the result would be massive unemployment everywhere, as those people who were making under that amount and who are not producing enough revenue to cover and make some profit would all be fired.
  Nobody can FORCE a company to hire somebody and nobody can force a company to hire somebody to make a loss. That's just weird misunderstanding of how economy works and why people start businesses.
  In your world the total unemployment would be on the order of 30% total throughout the entire world.
  That's the entire statement.
  In response to a comment, that states that nobody has any obligation (and indeed would be an idiot), to hire people so that the company would make a LOSS on hiring them, your response was: tire should be put around your head and you should be burnt alive.
  -
  Thus the question is absolutely legitimate: how many jobs have YOU created that are a loss generator? If you are not creating those jobs, then YOU should have a tire on your head burning you alive by YOUR OWN WORDS.
  So come on, fess up.
  EITHER: you are hiring all the people around you and making a loss.
  OR: you should be burnt with a tire around your head.
  OR: you are full of shit.
  
  --
  You can't handle the truth.
46. Re:No education or occupation by sgt+scrub · 2011-11-17 11:53 · Score: 1
  
  Despite the fact that your a fucking troll I will answer this question.
  how many jobs have YOU created that are a loss generator?
  None. I assure you. I have never created a loss generator job.
  
  --
  Having to work for a living is the root of all evil.
47. Re:No education or occupation by roman_mir · 2011-11-17 11:56 · Score: 1
  
  Thus you now have to apply the burning tire to your head or have somebody apply it to you. As to who is a 'troll' here, you should really think about that.
  
  --
  You can't handle the truth.
Pictures of the arrest by dev235 · 2011-11-16 03:27 · Score: -1, Troll

This is his picture
1. Re:Pictures of the arrest by GameboyRMH · 2011-11-16 03:32 · Score: 0
  
  Anyone who clicks on these deserves it. Lazy fucker's using a URL that trolls have been using for at least a year now.
  
  --
  "When information is power, privacy is freedom" - Jah-Wren Ryel
2. Re:Pictures of the arrest by roman_mir · 2011-11-16 03:33 · Score: 1
  
  by the way, based on the previous thread with this same user under dev235, I am just going to assume that the picture he links to is goat love, so unless you are into that kind of shit, you may want to abstain from going there.
  
  --
  You can't handle the truth.
3. Re:Pictures of the arrest by roman_mir · 2011-11-16 03:42 · Score: 0
  
  The above user loves goats.
  
  --
  You can't handle the truth.
4. Re:Pictures of the arrest by Jeng · 2011-11-16 04:00 · Score: 1
  
  Any time it is evenweb.com it is goatse, he uses many different accounts, but only one domain.
  
  --
  Don't know something? Look it up. Still don't know? Then ask.
Alien Secret Documents by Anonymous Coward · 2011-11-16 03:29 · Score: 0

...OK, but did he get to the Secret Documents about the Aliens?
1. Re:Alien Secret Documents by sizzzzlerz · 2011-11-16 03:32 · Score: 2
  
  Or those classified documents of how they faked the moon landings?
The United Federation of Planets must know! by sl4shd0rk · 2011-11-16 03:29 · Score: 2

They are evidently no longer basing operations within the Beta Quadrant!

--
Join the Slashcott! Feb 10 thru Feb 17!
Pictures of the arrest by dev236 · 2011-11-16 03:33 · Score: -1, Troll

This is his picture
So NASA was p0wned by a newb? by Anonymous Coward · 2011-11-16 03:40 · Score: 1

I bet the embarrassment alone was worth $500K and then some.
When this happens... by Anonymous Coward · 2011-11-16 03:40 · Score: 0

You wonder why your security was bad enough that that guy got through it.
$500,000? by JustAnotherIdiot · 2011-11-16 03:54 · Score: 2

This number bothers me, and I find it hard to believe.
Even more so because TFA doesn't ever mention /what/ it was he did.
Sure, he broke in, but what did he do with that access?
Delete files? Rename them? Rearrange them? Simply just shut the servers down? Perhaps a virus or two?
All I can think of that should be possible remotely would just cause an IT admin a headache for a few hours while he fixed the damages.
Unless he found the "self destruct" button, and now NASA is without any equipment.

--
What do I know, I'm just an idiot, right?
1. Re:$500,000? by GodfatherofSoul · 2011-11-16 04:04 · Score: 1
  
  I'm guessing you're a hacker apologist? After an intrusion there are resources that have to be redirected to find out what access the intruder got; there's downtime hardware, there's the cost of the investigation e.g. flying inspectors out to Romania if needed.
  No harm-no foul rules only count on non-critical systems. Most admins don't take intrusions as an "academic act of altruism granted to them by white hats."
  
  --
  I swear to God...I swear to God! That is NOT how you treat your human!
2. Re:$500,000? by JustAnotherIdiot · 2011-11-16 04:09 · Score: 1
  
  Not in the slightest. I was questioning the number, not his punishment.
  
  --
  What do I know, I'm just an idiot, right?
3. Re:$500,000? by Anonymous Coward · 2011-11-16 04:15 · Score: 1
  
  So why are not the people who's application had the hole he used not responsible at all.
  I bet there would be a lot fewer holes to exploit.
  And with all the billion NASA has or can earn if they wont stand behind a NASA used application then NASA should write it themselves. Not let something that critical connect to a public network.
  Not spend my tax dollar finding some guy with no education in Romania how much do you think that cost.
4. Re:$500,000? by Grand+Facade · 2011-11-16 07:49 · Score: 1
  
  "Even more so because TFA doesn't ever mention /what/ it was he did."
  He found the Directors pr0n collection....
  
  --
  Rick B.
5. Re:$500,000? by JustAnotherIdiot · 2011-11-16 08:29 · Score: 1
  
  Hah! That's some pretty expensive porn.
  
  --
  What do I know, I'm just an idiot, right?
6. Re:$500,000? by Anonymous Coward · 2011-11-17 06:21 · Score: 0
  
  Happened to me a while back.
  Here's the catch: We didn't know what the black hat had done. Some stuff was obvious, like the size changes on /bin/passwd and /bin/su. But we don't know what else he changed. You can't trust anything on the system. You can't boot up and run md5sum on every file as md5sum may be compromised. You can't even trust the kernel. You can't trust anything. Even booting off CD, there are issues of verifying all the rpms that were installed, and finding what is now on disk that didn't come from any known RPMs and has it been compromised? (Or is it a compromise, like an extra "su" command located elsewhere on the common path.)
  As I recall, we gave up, sent the disk out, and had it reimaged. At considerable cost of money and weeks of lost time. But it had a lot of special research software pre-installed that we couldn't otherwise validate.
  And then, IIRC, I "tinkered" with it. And then the project lead called me on the carpet complaining how ftp (or was it telnet) no longer worked, and why do we need a firewall anyway? And I said I'd "look into it" (which translates into geek-speak as "Fix it? I just broke it!"), but in the meantime perhaps he could use scp (or ssh). Especially from unsecured locations. And our system stopped getting broken into so often. *sigh* Bright guy, but no concept of security.
Not in DC by srussia · 2011-11-16 03:58 · Score: 5, Informative

If a cop fails to prevent a crime due to neglicence, the city can be sued.
http://en.wikipedia.org/wiki/Warren_v._District_of_Columbia

--
Set your phasers on "funky"!
1. Re:Not in DC by Anonymous Coward · 2011-11-16 04:18 · Score: 0
  
  That explains why DC is crime free...I know there was a good reason.
2. Re:Not in DC by LateArthurDent · 2011-11-16 07:54 · Score: 1, Offtopic
  
  If a cop fails to prevent a crime due to neglicence, the city can be sued.
  http://en.wikipedia.org/wiki/Warren_v._District_of_Columbia
  From that wikipedia page:
  
  DC's highest court ruled that the police do not have a legal responsibility to provide personal protection to individuals, and absolved the police and the city of any liability
  If the police have no responsibility to provide personal protection to individuals what the hell are they for?
3. Re:Not in DC by Anonymous Coward · 2011-11-16 08:48 · Score: 0
  
  Protecting citizens from each other happens to occasionally be a good way to avoid them becoming angry at the state, but don't let that confuse you as to the police's real purpose: to protect the state from its citizens.
4. Re:Not in DC by Anonymous Coward · 2011-11-16 16:46 · Score: 0
  
  "DC's highest court ruled that the police do not have a legal responsibility to provide personal protection to individuals, and absolved the police and the city of any liability.[2]"
the boss/PHB needs to be accountable they control by Anonymous Coward · 2011-11-16 04:00 · Score: 0

the boss/PHB needs to be accountable they control funds.
It may be like the IT admin needs more man power / new software / severs and they can't get them. Or is NASA and you need LIKE A PHD just for help desk LEVEL 1
wich one? by Anonymous Coward · 2011-11-16 04:21 · Score: 0

is he like val kilmer, ( iceman in topgun ) or did he watch to much '84 movies (there's even a new one coming out soon)
but if he named himself after the iceman (val kilmer in topgun), i'd have a hard time calling the dude a terrorist....
anyhow, if it's only a scriptkiddy (26 is a bit old for that, but then... it's only a term), nasa should be looking at themselves before whoopin his scrony little ass with words like terrorist...
Top Gun References Abound.... by Anonymous Coward · 2011-11-16 04:24 · Score: 0

I feel the need ... the need for speed....
Talk to me Goose.....
You are writing checks your body can't cash!!!
No different than by future+assassin · 2011-11-16 04:31 · Score: 1

the DEA stating that each cannabis plant is equal to a lb of weed, Sure its possbile if you grew it outdoors in Calfornia but 99% of the time people get no where near that. With big plants (6 week veg) they might get 4oz dry off each plant.

--
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Your kidding right, they're the government by Shivetya · 2011-11-16 04:32 · Score: 1

We have the head the of SEC replying when asked "why can't we fire failed regulators" respond by saying that that would harm the agency.
http://www.washingtonpost.com/business/economy/seven-sec-employees-disciplined-on-failure-to-stop-madoff-fraud/2011/11/10/gIQA3kYYCN_story.html
We just had a recent story about how the IRS can't get its act together and I betcha they are not in worry about losing their jobs. We have more government workers making over 100k a year and 900+ over 170k a year. Do you think any are truly accountable now?
We are Greece, we just fail to admit it. When one in seven works for a government agency I think it is a clue. Protect your own is their motto.

--
* Winners compare their achievements to their goals, losers compare theirs to that of others.
this aFP for GNAA? by Anonymous Coward · 2011-11-16 04:33 · Score: -1

ONES IN SOFTWARE a fact: FrreBSD ass of them all, you all is to let 3orporations Chronic abuse of Work that you Fact: *BSD is dying from the FreeBSD market share. Red
1. Re:this aFP for GNAA? by Sarten-X · 2011-11-16 04:51 · Score: 1
  
  Gesundheit.
  
  --
  You do not have a moral or legal right to do absolutely anything you want.
Tmaco by Anonymous Coward · 2011-11-16 05:01 · Score: -1

the project to a fact: FreeBSD 4ppeared...Saying
Romanian Accused of Breaking Into NASA by roman_mir · 2011-11-16 05:09 · Score: 1

I see his problem.
He should have just asked nicely, wouldn't have to break in.
OTOH he IS Romanian... so. that too. Maybe if he was Jamie Dimon then he could just say: well, some money did disappear, but then again, I am just a CEO. What do I know?
Then NASA, CIA and FBI and Fed would just give him a bunch of money and let him continue doing what he does....
But this guy is a nobody, that's his real problem.

--
You can't handle the truth.
The real story here... by DeltaVelocity · 2011-11-16 05:32 · Score: 3, Insightful

...is not that a Romanian hacker got into NASA systems and caused an alleged $500k in damages/remediation expenses. The real story is that the Romanian authorities actually DID something about it.
1. Re:The real story here... by Anonymous Coward · 2011-11-16 12:34 · Score: 0
  
  ...is not that a Romanian hacker got into NASA systems and caused an alleged $500k in damages/remediation expenses. The real story is that the Romanian authorities actually DID something about it.
  And... the actual amount claimed by NASA as damages/remediation was much lower - say, under 10K. The rest was added to the bill by the Romanian authorities.
2. Re:The real story here... by Anonymous Coward · 2011-11-16 14:41 · Score: 0
  
  I was about to say the same thing.
Romulan accused of breaking into NASA by Anonymous Coward · 2011-11-16 05:59 · Score: 0

...is how I read the headline at first glance. Those sneaky bastards!
Damn... by bradorsomething · 2011-11-16 06:59 · Score: 1

So much for getting my astronaut application in ahead of everyone else. I thought he said this was foolproof!
Blaming a Romanian is Sooooooooo 1995 by Anonymous Coward · 2011-11-16 07:14 · Score: 0

This is 2011 - the CHINESE and IRANIANS are the ones we blame for everything now!
Why brag about it? by eminencja · 2011-11-16 08:58 · Score: 1

What a stupid thing to brag about. If they caught him, they could try to make use of his skills an knowledge.
26 + lives in Romania + no college + unemployed by Anonymous Coward · 2011-11-16 09:49 · Score: 0

= SUSPICIOUS.
Seriously... everyone who can afford to, leaves the country as soon as they graduate from high school. Unless they go to college, in which case they leave as soon as they graduate from that (or finish their military service, if they went to military college). Unless they find a good job in Romania which is capable of sustaining them... HAHAHA, just kidding, no such jobs exist in Romania. Well, very few of them, anyway.
Any Romanians care to verify what I just said?
1. Re:26 + lives in Romania + no college + unemployed by Anonymous Coward · 2011-11-16 11:52 · Score: 0
  
  Who says he can afford to leave?
2. Re:26 + lives in Romania + no college + unemployed by Anonymous Coward · 2011-11-17 01:52 · Score: 0
  
  If he can afford to live there, he can afford to leave.
DontStealMe by Anonymous Coward · 2011-11-16 11:29 · Score: 0

I think NASA needs to create a heavily secured network, that contains a single text file called DontStealMe.txt; this file will contain a congratulatory notice to the reader that they have bested the Space Agencies best security measures, and they should feel really good about their diabolical genius. This way, they can steal something worthless and stop causing damage to important science programs.
Yes he does have an occupation by Stan92057 · 2011-11-16 13:14 · Score: 1

Yes he does have an occupation its called "A Criminal" our prisons are full of them and some innocents as well.

--
Jack of all trades,master of none