UK Student Jailed For Facebook Hack Despite 'Ethical Hacking' Defense

Diamonddavej writes "The BBC reports that software development student Glenn Mangham, a 26-year-old from the UK, was jailed 17 February 2012 for eight months for computer misuse, after he discovered serious Facebook security vulnerabilities. Hacking from his bedroom, Mangham gained access to three of Facebook's servers and was able to download to an external hard drive the social network's 'invaluable' intellectual property (source code). Mangham's defense lawyer, Mr. Ventham, pointed out that Mangham is an 'ethical hacker' and runs a tax registered security company. The court heard Mangham previously breached Yahoo's security, compiled a vulnerability report and passed on to Yahoo. He was paid '$7000 for this achievement,' and claims he was merely trying to repeat the same routine with Facebook. But in passing sentence, Judge Alistair McCreath said despite the fact he did not intend to pass on the information gathered, his actions were not harmless and had 'real consequences and very serious potential consequences' for Facebook. The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.'"

Comments

Uhh

[The MAZZTer]

This guy had no business doing what he did. AFAIK you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.

Re:Uhh

[Jah-Wren Ryel]

This guy had no business doing what he did. AFAIK you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.

While that may be true, that doesn't appear to be the judge's rational for convicting the kid.

It sure sounds like the judge is rationalizing the ostrich strategy when he says that the kid's actions had 'real consequences and very serious potential consequences' for Facebook. Those consequences existed not because of the kid's actions but because of facebook's security failings. Even if the kid had done nothing, those vulnerabilities would still be there and facebook (and more importantly facebook's users) would have faced just as much, if not more, risk than they did if the kid had done nothing.

Re:Uhh

[rgbrenner]

The lock on your bedroom window is crap. I broke it last night, and then rifled through all of your stuff. Did the same to 2 of your neighbors also.. ya know, just to show it wasn't a fluke.

Your welcome.

I would like my reward now.

Re:Uhh

[russotto]

The lock on your bedroom window is crap. I broke it last night, and then rifled through all of your stuff. Did the same to 2 of your neighbors also.. ya know, just to show it wasn't a fluke.

Your welcome.

I would like my reward now.

OK, we'll sentence you based on the potential damage you might have done -- to wit, you could have accidentally burned the entire house down while you were there, and the fire could have spread to the entire neighborhood and killed a bunch of people.

Sentence the man for what he did: breaking into the computers. Not based on crap like "Potentially what you did could have been utterly disastrous to Facebook"

Re:Uhh

[poity]

There is a common sentiment on Slashdot that whatever good intentions a company may have, its gathering of data without permission constitutes both a violation and a risk. That risk being the potential for the data in their hands to be compromised by yet another party. Can this logic not also apply to this Glenn and his company as well?

Re:Uhh

[Dahamma]

While that may be true, that doesn't appear to be the judge's rational for convicting the kid.

Why does everyone keep calling him "the kid"? He's 26 years old. Just because he's a student doesn't make him some naive, innocent minor - he clearly knew what he was doing...

Re:Uhh

[Nadaka]

Its a lot closer to this situation:

You walk into the gaping hole in the wall of a casino or bank, walk up to the dude behind the counter and say "dude behind the counter, you got a giant gaping hole in your wall, maybe you should do something about that". And then you get arrested for the $200 dollars of damage that they have to repair now that they are aware of the giant gaping hole in the wall.

Re:Uhh

[moderatorrater]

No it's not. He didn't stumble on the access, he chained exploits, went through employee accounts, and ran arbitrary code. It's not a giant hole behind the casino door, it's picking a few locks, rifling through an employee's desk, breaking a few locks, and then telling the security guards they should be grateful. There were holes in facebook's security, and that's their own damn fault, but he pulled off some pretty serious attacks against one of the biggest players on the internet.

There are no words to describe how stupid this kid is. Anyone with half a brain who's followed the news for longer than 2 weeks knows that you don't hack first and communicate later.

Re:Uhh

[rohan972]

Sentence the man for what he did: breaking into the computers. Not based on crap like "Potentially what you did could have been utterly disastrous to Facebook"

Creating a hazard can be illegal, eg: you can be booked for reckless driving even if no other cars are around at the time. Leaving aside the question of whether it was he or Facebook that created the hazard, or what proportion of culpability should be shared, the sentence is based not on what he did, but who he did it to (from the first link in the summary) :

"You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance,"

So to answer rgbrenner's "lock on your bedroom window is crap", argument, the judge's response is "You broke the bedroom lock on a rich man's house, it's not like you broke into the house of normal people".

You don't have to be sympathetic to this guy to find this court judgement reprehensible.

Let this be a lesson to all

[erroneus]

In the case of companies like Yahoo, you can do this. But in the case of Facebook, it's better to sell any uncovered flaws to interested parties other than Facebook or to simply release the information anonymously to the public.

These "damages" are the lawyer's fees associated with making claims against the "criminal" and the programmers needed to correct the vulnerability... (which are probably the same programmers whose code was vulnerable in the first place.)

Facebook, you just set the tone for how security researchers will reveal your vulnerabilities in the future. You just made a very uncomfortable bed for yourself to lie in.

Re:Let this be a lesson to all

[davecb]

A new way to profit: leave the holes in place, and charge anyone who discovers them. If the person is stupid enough, he or she will do more than notify you. If they exceed what a random uninterested person would do with the the hole, they've just self-identified as a criminal. You can therefor recover enough money from them to pay for fixing the holes.

This creates a whole new meaning for "honeypot" (;-))

--dave

Re:Judges from the 20th century have to go

[bieber]

Who says he doesn't understand the issue? What this kid did was illegal and wrong, regardless of his "ethical" motivations for doing it. If you suspect that there's a security vulnerability somewhere, then you can notify the owner of the systems in question about it. If they feel inclined, they might ask you to do some penetration testing for them. If you just go ahead and do it without permission, though, you're illegally accessing someone else's systems without their consent, and by all means you should be convicted and sentenced for it. If I forget to lock my door on my way out of my house one day and come home to find an "ethical" thief in my home waiting to educate me on the importance of locking my doors, you can bet that I'll be calling the police.

Sugarcoat it all you want...

[MindPrison]

...but a breach into any company is a break-in-and-entering if you haven't been assigned to do so for testing the security vulnerabilities by the company itself.

It's kind of like catching a thief without any goods, but inside of your home. Uhm...I'm just testing your security system, now you know you have a weak system, thank you - I'll mail you the bill.

Poor Yahoo

[Dr. Evil]

"You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance," he said.

ooo, that's got to hurt.

Re:Judges from the 20th century have to go

[Chas]

Considering that most of the judge from the 21st century are, at most, 12, and not even lawyers, let alone judges, yet kinda makes this tough.

Re:Judges from the 20th century have to go

[korean.ian]

Also as to the judge's understanding:
"'You and others who attempt to hack really must understand how serious this is, the creation of that risk the extent of that risk and the cost of putting things right.' "

As others have said - the risk was there whether or not the kid hacked in. He didn't create the risk.

Re:"Damage"

[spire3661]

Causing a full security review after a known penetration costs REAL WORLD MONEY. You have to pay people for the expense of figuring out what happened. It is interesting that you disregard this aspect of the problem entirely. He had no business being there, flat out. There is no inherent right to crack other people's property. I find nothing wrong in the law saying 'thou shalt not penetrate others network without explicit permission or authority.' This person had neither.

Re:"Damage"

[rgbrenner]

Not just the review..

He impersonated a Facebook employee who was on vacation, hacked into the servers, tried to cover his tracks by deleting evidence he was there, downloaded facebook source code, then hid.

Facebook discovered on their own that he hacked in, and they had to work with the FBI to find out who this guy was. They had to do a real investigation.

THEN when the FBI knocks on his door, he says: I'm an ethical hacker trying to HELP facebook.

Seriously.. this guy is nothing more than a common criminal.