Slashdot Mirror
UK Student Jailed For Facebook Hack Despite 'Ethical Hacking' Defense
Diamonddavej writes "The BBC reports that software development student Glenn Mangham, a 26-year-old from the UK, was jailed 17 February 2012 for eight months for computer misuse, after he discovered serious Facebook security vulnerabilities. Hacking from his bedroom, Mangham gained access to three of Facebook's servers and was able to download to an external hard drive the social network's 'invaluable' intellectual property (source code). Mangham's defense lawyer, Mr. Ventham, pointed out that Mangham is an 'ethical hacker' and runs a tax registered security company. The court heard Mangham previously breached Yahoo's security, compiled a vulnerability report and passed on to Yahoo. He was paid '$7000 for this achievement,' and claims he was merely trying to repeat the same routine with Facebook. But in passing sentence, Judge Alistair McCreath said despite the fact he did not intend to pass on the information gathered, his actions were not harmless and had 'real consequences and very serious potential consequences' for Facebook. The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.'"
This guy had no business doing what he did. AFAIK you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.
So Zuckerberg had to go to his wallet instead of pulling change from his pants pocket, maybe the hacker should have been less ethical and just sold the code.
"If any question why we died, Tell them because our fathers lied."
In the case of companies like Yahoo, you can do this. But in the case of Facebook, it's better to sell any uncovered flaws to interested parties other than Facebook or to simply release the information anonymously to the public.
These "damages" are the lawyer's fees associated with making claims against the "criminal" and the programmers needed to correct the vulnerability... (which are probably the same programmers whose code was vulnerable in the first place.)
Facebook, you just set the tone for how security researchers will reveal your vulnerabilities in the future. You just made a very uncomfortable bed for yourself to lie in.
Who says he doesn't understand the issue? What this kid did was illegal and wrong, regardless of his "ethical" motivations for doing it. If you suspect that there's a security vulnerability somewhere, then you can notify the owner of the systems in question about it. If they feel inclined, they might ask you to do some penetration testing for them. If you just go ahead and do it without permission, though, you're illegally accessing someone else's systems without their consent, and by all means you should be convicted and sentenced for it. If I forget to lock my door on my way out of my house one day and come home to find an "ethical" thief in my home waiting to educate me on the importance of locking my doors, you can bet that I'll be calling the police.
...but a breach into any company is a break-in-and-entering if you haven't been assigned to do so for testing the security vulnerabilities by the company itself.
It's kind of like catching a thief without any goods, but inside of your home. Uhm...I'm just testing your security system, now you know you have a weak system, thank you - I'll mail you the bill.
What this world is coming to - is for you and me to decide.
I call bullshit. He "runs a tax registered security company," which means his motivation was largely if not entirely monetary. Hardly ethical.
ooo, that's got to hurt.
Can we use the cost of having to install locks and security systems in homes to deal with theft to increase the punishment of the thieves?
It seems you're writing this with the assumption that this guy is being fined $200k. He isn't. Facebook can choose to pursue damages in civil courts, just as a burglarized home owner can. But that's not what's happening yet and your post kind of jumps the gun with that assumption.
your thin skin doesn't make me a troll
Considering that most of the judge from the 21st century are, at most, 12, and not even lawyers, let alone judges, yet kinda makes this tough.
Chas - The one, the only.
THANK GOD!!!
So you're walking through the business district of a city and just jiggling door knobs to see if anyone left anything unlocked.
Why? Because you're a "white hat".
That's the FIRST issue that you have to get through to the judge.
Once you find an open door, you go inside and take some important stuff out. So that you can prove to the company that you were inside.
That's the SECOND issue you have to get through to the judge.
Then, you call the company and tell them that door X is unlocked and you can prove it because you have property Y.
The company (being unenlightened and still thinking in physical world terms) calls the cops and you are arrested. Even though you intended to give property Y back to the company.
It makes sense that way.
So, do NOT freelance. If you do NOT have a signed contract with the company you CAN be prosecuted. You have to put in the EXTRA EFFORT to distinguish your actions from the actions of the bad guys. A signed contract does that.
From the article:
"Judge McCreath told him
'This was not just fiddling about in the business records of some tiny business of no great importance and you acquired a great deal of sensitive and confidential information to which you were simply not entitled.'"
I think we can pretty clearly see where the judge's opinion lies.
The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.'
Mr. Patel? Is that Mr. Synthesizer Patel? I guess he discovered music wasn't paying the bills.
#DeleteChrome
Also as to the judge's understanding:
"'You and others who attempt to hack really must understand how serious this is, the creation of that risk the extent of that risk and the cost of putting things right.' "
As others have said - the risk was there whether or not the kid hacked in. He didn't create the risk.
It usually boils down to all the time spend (thus money) that was needed to reinstall all the servers in the datacenter with a new known good image ?
New things are always on the horizon
You must have missed the part where he downloaded their (trade secret) source code, and could have (may have, for all we know) done whatever he wanted with it.
Considering that most of the judge from the 21st century are, at most, 12, and not even lawyers, let alone judges, yet kinda makes this tough.
I salute you sir; nicely done. Although the disturbing thought did occur to me that perhaps the GP was in fact calling for the reinstatement of nineteenth century judges to adjudicate these newfangled matters.
I'm sympathetic to that argument. Post-intrusion followup, investigation, rootkit removal (read -- bare metal installation after hdd imaging), these are all legitimate expenses incurred even in the case of a white hat.
Fixing the problem they found is not. Conducting an audit to look for similar problems is not.
Related: How's that related to this? https://www.facebook.com/whitehat/ Did he not follow the procedures?
Causing a full security review after a known penetration costs REAL WORLD MONEY. You have to pay people for the expense of figuring out what happened. It is interesting that you disregard this aspect of the problem entirely. He had no business being there, flat out. There is no inherent right to crack other people's property. I find nothing wrong in the law saying 'thou shalt not penetrate others network without explicit permission or authority.' This person had neither.
Good-bye
The risk was when he stole the data, not when he broke in.
There is no inherent right to crack other people's property. I find nothing wrong in the law saying 'thou shalt not penetrate others network without explicit permission or authority.' This person had neither.
I don't condone his actions at all, but I question placing full legal responsibility on him for the cost of security reviews. Surely whatever security reviews the professionals at Facebook had been shown to be inadequate. Was the security of Facebook from other attacks decreased because of changes he made to the system? Did he cause damage or reveal it?
http://marriedmansexlife.com/
So it's okay to hack a small business but not a large international one? The legality of an offence depends on the amount of capital the plaintiff has? The rich now have more rights than the poor?
Not just the review..
He impersonated a Facebook employee who was on vacation, hacked into the servers, tried to cover his tracks by deleting evidence he was there, downloaded facebook source code, then hid.
Facebook discovered on their own that he hacked in, and they had to work with the FBI to find out who this guy was. They had to do a real investigation.
THEN when the FBI knocks on his door, he says: I'm an ethical hacker trying to HELP facebook.
Seriously.. this guy is nothing more than a common criminal.
nah.. you've got it all wrong. You show up at work one day with an alert from your IDS. You look at the server, and see that someone breached the server, downloaded the source code for your software, and tried to clean up their tracks by deleting logs. You report it to senior management. Management calls the FBI, and launches an investigation. Management tells you to go through the logs and the server, and find out anything you can. After two months of investigating, they finally find him, and FBI agents are sent to his house to arrest him. While he's being interrogated, he says he was just trying to help facebook improve their security.
There.. now you have the analogy correct.
If only Harvard had prosecuted Zuckerberg when he hacked Kirkland House's online mailing lists to spam users with links to his Facemash service, Facebook might have never existed and this may have never happened at all.
I'm sympathetic to that argument. Post-intrusion followup, investigation, rootkit removal (read -- bare metal installation after hdd imaging), these are all legitimate expenses incurred even in the case of a white hat.
Fixing the problem they found is not. Conducting an audit to look for similar problems is not.
Related: How's that related to this? https://www.facebook.com/whitehat/ Did he not follow the procedures?
That guy isn't/wasn't a white hat. He broke the law without a signed agreement. Breaking the law to support a corporation is not ethical.