Slashdot Mirror
Job Seeking Hacker Gets 30 Months In Prison
wiredmikey writes "A hacker who tried to land an IT job at Marriott by hacking into the company's computer systems, and then unwisely extorting the company into hiring him, has been sentenced to 30 months in prison. The hacker started his malicious quest to land a job at Marriott by sending an email to Marriott containing documents taken after hacking into Marriott servers to prove his claim. He then threatened to reveal confidential information he obtained if Marriott did not give him a job in the company's IT department. He was granted a job interview, but little did he know, Marriott worked with the U.S. Secret Service to create a fictitious Marriott employee for use by the Secret Service in an undercover operation to communicate with the hacker. He then was flown in for a face-to-face 'interview' where he admitted more and shared details of how he hacked in. He was then arrested and he pleaded guilty back in November 2011. Marriott claims the incident cost the company between $400,000 and $1 million in salaries, consultant expenses and other costs."
Blackmail is blackmail whatever method is used to carry it out. Thinking that you're some sort of "lee7" hacker doesn't change the rules. Besides which, this guy comes off as an arrogant moron anyway.
I mean, if he had access to their network and wanted a job, he should have forged interview and approval emails.
Think outside the box, man.
Weaselmancer
rediculous.
So how much of that $1 million in salaries was spent repairing the security holes, which they should have done anyway?
Why the Secret Service? Since when is the computer infrastructure of a private corporation a matter of national security?
or perhaps I'm just too used to seeing monetary estimates by the Movie and Music industries. For example, the jobs counted as being affected by the entertainment industry as part of the SOPA/PIPA debate included all the employees of the Department of Engraving and Printing. Why you ask? Because they make the $100 bills that the movie and music execs use to snort coke while coming up with the estimates of jobs affected by the movie and music industry. Perfectly logical right?
Any insufficiently advanced magic is indistinguishable from technology.
While he was wrong (and a total fu*king idiot) to try to blackmail them into hiring him, I'm so tired of seeing these ridiculous and obviously made-up damages.
It seems like every time a cracker gets into *any* system, they always have so stupidly high number in damages.... unless they didn't know about it beforehand or the person isn't found. Then, the damages just happen to be next to nothing (usually)
..and that stupid otherwise? The right move was to arrange an IT job interview with Marriott, and claim good security skills.
"I found a security hole in your systems and may help you to improve this, and your systems globally".
Slashdot, fix the reply notifications... You won't get away with it...
The general public thinks of "hackers" as super geniuses. This gives actual smart people a bad reputation. We need more stories like this to show that the average computer cracker is at least as stupid as the average Joe.
Honestly, any janitor could tell you instantly why this plan is idiotic.
I'm currently working a contract with Darden Restaurants, the largest full service retaurant company in the world, and as you can imagine they are very serious about security. During the meet and greet the head developer asked me if I had left any back doors at my previous contracts. I looked at him strange because the thought never even crossed my mind which is the difference between a hack and a professional.
After I replied, he told me a story about a programmer interviewing for a position at Darden who had very good qualifications. He was asked the same question and immediately said, "Let me show you my back door", and proceeded to log into a company web site and pull up their web site administration page. The programmer actually seemed shocked when told that there is no way Darden could hire him.
There is a fine line between genius and insanity but stupid is all by itself.
This guy got it all wrong. There is no such thing as capture the flag hacks leading to jobs. Who gave him the idea that this would work out in his favor? Tech smarts was there, but no sign of the minimal business smarts it takes to hold a job was there.
"hi, i'm arnold, i stole your tv. would you like to hire me to put a lock on the bathroom window i broke into?"
i'm trying to put myself in the thinking here, and no... i just can't understand. i've reached my stupidity simulation threshold. i simply cannot understand a person this dumb
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
30 months? It is a good thing he didn't pirate some MP3s. Then they would really be mad at him.
On one hand it would make sense for him to release it out of spite or whatever. On the other hand, they did technically hire him, so...
A unique way to learn a language: http://languageloom.com
Hacking is alot like sex, you go in and out and hope you don't leave anything that can be traced back to. Hes done half of that joke, now hes in prison he'll probably experience the second half to. Dont drop the SOAP.
I thought the Secret Service protected diplomats and US currency. Why were they getting involved with a security breach at a hotel? Unless the documents he had were for the concierge arranging hookers for visiting politicians.
The title and summary seem to convey different things. "Job Seeking Hacker Gets 30 Months In Prison" sounds like a hacker was trying to get a hacking job somewhere, while the summary makes it clear that he hacked his way into getting said job. Just saying.
Nonetheless, blackmail is blackmail. Malicious hacking involving the exposure of private data to unwarranted eyes ought to be punished.
The more you know, the more you have to say and the more you should listen.
Would've been cheaper to hire him.
"If any question why we died, Tell them because our fathers lied."
If you're trying to appeal to someone, the point is to show them your skills are useful and/or indispensable to their company...not that you're a loose cannon that will resort to illegal methods to get your point across. Someone had mentioned previously that his actions were arrogant, but it's not just that...he was using a brilliant skill to do something stupid and poorly-thought-out. It was a masochistic feat so dramatic that it should have a place in the record books for its sheer idiocy. That being said, doesn't his desperation in trying to land a job say something about the state of the country. As a whole, some changes need to be made or this will likely only be the first of these types of actions on the part of the unemployed. --And who could blame them? When you're grasping at nothing trying to feed your family when there are no jobs to be had or none that can even pay you enough to get by, what do you expect? The country needs to take care of its citizens. Those at the top may well be important but a country's citizens are its foundation. If their well-being is so thoroughly lacking, essentially, the very foundation of the country is in a state of rot. In all cases, no structure -- however grand -- can possibly stand without its foundation. Food for thought.
Hi, I'm Steve B., You may know me from youtube videos of my rousing speaches at Microsoft developer conferences.
I didn't invent your android phone or any of the software on it, but I have found a flaw in the system that I can exploit. Its a flaw in the legal system but that's not important.
If you don't want me to activate this exploit, you need to pay me $30.00 for every phone you sell.
The whole damage cost estimate is bull but the hacker got what he deserved as blackmail is definitely a crime.
Now, though still with some risks, he could have just "informed" them of the security vulnerabilities he "discovered" and imply at most that he was seeking employment or working as a possible security contractor. Make yourself look as a security researcher while not actually threatening them. Of course most companies gives 2 shits about security so the chances of someone like him getting hired is slim to begin with. If it fails anyways, do like most researchers and publish it after a period of time to add to your portfolio for the next job hunt.
Do you see what happens when you fuck a stranger in the ass?
"Blah blah blah." - [citation needed]
Do you apply this logic to your own network? Actually let me rephrase that. Do you apply this logic to your own possessions, property and family? Do you believe burglary victims should share part of the blame because they didn't reinforce the glass windows(security flaws) in their homes?
Let's call a horse a horse here. This man was a criminal. He deserved what he got.
If they spent anywhere near what they claim, investors should have the heads of everyone at Marriott. (unfortunately management at Marriott is ensconced) You want to know why America is going down the drain, it's spending a million dollars to catch a crook who literally presented himself to them gift-wrapped.
I find it odd that he hacked a network, blackmailed them into an interview and he only gets 30 months? If he was caught pirating a movie he would get 5 years and owe some 200k? This seems like justice to me.
I do agree he should have just created an account on the payroll and sat at home getting paid every month.
Actually, it was Reagan's people who came up with the idea of lowering unemployment by not counting the unemployed.
And this is one of those times.
"An unarmed man can only flee from evil, and evil is not overcome by fleeing from it." Col. Jeff Cooper
No, no, no, you should have hacked in to change things so that your post would have been backdated to be first. Then we'd have hired you to get you to show us how you did it. Newbie!
Space game using normal deck of cards: http://BattleCards.org
...wouldn't it be easier to hack in and put your self in the employee database, set up payroll or send an email from the proper account to the payroll section to sort it and then just turn up on Monday? Or better yet not and get paid anyway.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
If what they say about this guy's extortion is true, he shouldn't have done it and should pay the consequences.
But there is something in that summary that reflects very poorly on Marriott's attitude toward security.
Marriott claims the incident cost the company between $400,000 and $1 million in salaries, consultant expenses and other costs.
Come again? I read that as "we spent $400,000 to $1 million fixing the problem". The implication being, they would not have spent this money fixing the problem if this guy had not reported it. So the problem would still exist.
The guy did not cost you the money. This is the money you spent fixing your own mistakes. You should pay it and quit whining, and be thankful that the issues are fixed. If the hacker had been benevolent instead of extortionate, with this attitude I get the impression they'd try to have him arrested anyway.
Marriott claims the incident cost the company between $400,000 and $1 million in salaries, consultant expenses and other costs
Reminds me of Kevin Mitnick. He was convicted for stealing a manual (that could be purchased for a few hundred dollars) AND for the costs to plug all the holes he found.
The difference here is that the hacker in this case seems to be outright guilty of extortion. Why not bust him for that out of the gate?
Making license plates.
He deserves it.
There you are, staring at me again.
This guys must have some sort of brain malfunction. I mean doing what he did is so immensly stupid and he should have known this would get him into trouble sooner or later. This is a classic case of being your own worst enemy. What he did should obviously have been punished, although by my Norwegian eyes 30 months seems quite excessive. Most violent crime will get you less time here. After all this guy didn't physically hurt anybody and he didn't do anything which seems to have promised significant financial gain for himself. Getting a job doesn't seem like a huge financial gain to me.
Why didnt he just hire himself? I'm sure there are 100s if not 1000s of people all over the world working jobs they invented themselves by hacking personnel records. The trick is to make sure the office and the accountant are in different cities, preferably different continents, and that the job is so low-key it sits under a bigger hierarchy and therefore any news of audits will filter down with sufficient warning. Ie. DONT make yourself a managing director, not unless its for a purpose that only has to last 24 hours or less!
Dutch Police just held a CTF to gain interest of white hat hackers to work for them. They are growing their "high tech crime unit" and need skilled people for that. Even though the prizes weren't directly job contracts, the first ten to finish, are invited for "a visit" and a tour.
I was promised a flying car. Where is my flying car?
this fool deserves whatever he gets. How can you possibly expect to extort a company into HIRING YOU and not be arrested and go to jail instead?
Clearly delusional.
Dude watched too many hacker movies. You can only get away with crap like that if you look like Sandra Bullock or Anna Chapman.
Ultimately it might have been cheaper just to give the guy a job.
The economy put him into a state of desperation. It's political policies which ultimately provoked him into breaking the law.
The question no one is willing to ask is why is it that some of the most skilled or talented computer geniuses are unable to find jobs?
Secondly the fact that he now has a criminal record could keep him from ever finding a job and set him back even more. So while it does act as a deterrent to these sort of hacks it deters in the exact wrong way. The next hacker wont be asking for a job but instead will simply go right after whatever is profitable. This hacker in this instance was naive and had good intentions and thats precisely why he was awarded with 30 months in prison.
Honestly he'd have got the same time if he would have hacked for money. The fact is he didn't know how to properly hack for money and he didn't have the political connections to be a pen-tester. He had the right intentions but went about it the wrong way.
The real question is why are so many people so desperate to find a job that they are beginning to resort to blackmail?
And how often is blackmail being used or perhaps other means like quid pro quo to decide who gets hired and fired?
In some ways what he did wasn't stupid, it was just inappropriate.
It's actually fairly common among hackers.
Marriott claims the incident cost the company between $400,000 and $1 million in salaries .... to fix the problems that existed regardles of whether or not the hacker told them about it or got arrested.
I remember this guy, he was a total moron. A total moron who committed a crime went to prison. Seems fair.
"When information is power, privacy is freedom" - Jah-Wren Ryel
what did he really think was going to happen. A bit arrogant to expect any sort of co-operation from a company you just BLACKMAILED. Why in hell would they want someone like this to work for them. Definition of DOING IT WRONG.
What visa did he get to enter US?
Casteism