Hacker Behind Leaked Nude Celebrity Photos Gets 10 Years

wiredmikey writes "A U.S. judge sentenced a computer hacker to 10 years in prison on Monday for breaking into the email accounts of celebrities and stealing private photos. The hacker accessed the personal email accounts and devices of stars including Scarlett Johansson, Christina Aguilera and Renee Olstead, among dozens of other people he hacked. The hackers arrest in October 2011 stemmed from an 11-month investigation into the hacking of over 50 entertainment industry names, many of them young female stars. Hacked pictures of Johansson showed her in a state of undress in a domestic setting. Aguilera's computer was hacked in December 2010, when racy photos of her also hit the Internet. Mila Kunis' cell phone was hacked in September that year with photos of her, including one in a bathtub, spread online. According to the FBI, the hacker used open-source, public information to try to guess a celebrity's email password, and then would breach the account."

Comments

Open Source information?

[suso]

What is Open Source information? The OSI foundation doesn't seem to be doing a good job of enforcing the trademark of the term Open Source. I hear and see it used in many ways in which it should not be and the term has been grossly eroded in meaning over the past decade.

Re:Open Source information?

[Anonymous Coward]

Pretty standard term.

http://en.wikipedia.org/wiki/Open-source_intelligence

Re:Open Source information?

[bsDaemon]

Trademarks are domain-specific, like how actual windows can still be called windows and Microsoft can't sue over Windows. The use of the term "open source" for intelligence information (OSINT) is as old as dirt and is used to differentiate between sources such as news papers/party organs/etc and information attained through clandestine means, either human intelligence (HUMINT) or signals intelligence (SIGINT). Nothing to get upset about. It's not like the article said he used "the well known, open-source hacker tool Linux..."

Re:Open Source information?

[ShanghaiBill]

What is Open Source information? The OSI foundation doesn't seem to be doing a good job of enforcing the trademark of the term Open Source

"Open source" simply means something that was openly published and available to the public. The term has been in use for at least a century. The OSI foundation has no trademark on the term.

That fact that this guy got the info from open sources doesn't make it okay. If I find your key under your doormat, that was stupid of you, but it doesn't make it okay for me to rob you. This jerk got what he deserves.

Re:Open Source information?

[suso]

Ok, thanks for the explanation and wasn't aware that the term open source information had such a long history. Still, the term open source gets used in ways that it probably shouldn't be in relation to software.

Re:Open Source information?

[bsDaemon]

Davis W. Moore, "Open Sources on Soviet Military Affairs," Studies in Intelligence (Summer 1963-declassified article)

Herman L. Croom, "The Exploitation of Foreign Open Sources," Studies in Intelligence (Summer 1969-declassified article)

So, the term as applied goes back at least to the 60s. It has just become more common in the last 10-15 years or so.

Re:Open Source information?

[nschubach]

I'm sure you'd still be in court for calling your new deodorant "Mountain Dew"

Re:Open Source information?

[Forty Two Tenfold]

Well, the term "hacker" is also misused.

Re:Open Source information?

[Synerg1y]

Agreed, it's w/e knowledge is available in the public domain that you can use to gather intelligence with, I've heard of people tracing spam emails back to origin and accumulating information on the spammer with OSI. There's a lot of grey here too like sites that offer you lookup information for a fee, but are available to anyone.

One thing I can't seem to wrap my head around is how did he figure out passwords from the public domain? So say I'm known by syn, but I set my password to syn24, OSI has nothing to let you guess that, those must've either been some very weak passwords, or he was trying a very large # of accounts with all sorts of semi-relative password and these victims had the weakest passwords.

Doesn't matter though, what he did is plain out wrong on all levels, I wonder if he went far enough down the rabbit hole to not even realize it, and that he was affecting real people, but the DOJ is not one to care. A very similar case not too long ago had a teenage girl committing suicide over such things, so the potential consequences of the actions he took are very real.

Re:Open Source information?

[disambiguated]

They didnt. they define "Open Source". Caps have a purpose, you know.

There are a handful of case-sensitive words in English. "Open Source" isn't one of them.

Really?

[Anonymous Coward]

Pics or it didn't happen.

Re:Really?

[TWX]

Sure. Let's joke about posting personal pictures of a non-consenting party.

I don't have a problem with the jokes. And honestly while I don't agree with the illegal methods of obtaining the data that the hacker used, I also do not consider his data breach any worse than any other random data breach. Fact is, those who take naked pictures of themselves or allow naked pictures to be taken of them must accept that it's possible that others will see them. That held true for the girl who sent cheesecake-style pinup photos of herself to her soldier-boyfriend who would probably show the picture to his buddies, held true for the Polaroid revolution, held true for the 8mm camera era, held true for the videotape era, and holds true for the digital camera era.

Simply, if one doesn't want naked pictures of one's self to be seen, one should not take or allow taken, naked pictures of one's self. Literally that's it. Don't do it if you don't want them seen. The only reason for a picture to exist is for it to be seen, and the large number of prurient people in this world will be happy to look. If one never takes or allows these kinds of pictures to be taken then there will never be a chance of them being shared, leaked, or stolen.

This comment wouldn't even come up if it was a man whose pictures were taken.

You've never been around women gossiping that don't know that a man can hear them, have you?

Re:Really?

[trev.norris]

I've very curious as to what the sentence would have been if hypothetically he was paparazzi who took photos though a window or such while they were naked, then released those onto the internet.

In my mind there should have been two different cases. One for the data breach, and one for the release of personal information. While I don't agree with what he did, 10 years seems excessive.

Re:Really?

[Americano]

If they didn't want these pictures out there then they shouldn't have had them taken.

"Why would you protest the Patriot Act or warrantless wiretapping? If you've done nothing wrong, then you have nothing to fear, citizen!" Or, for that matter... "Why would you protest Facebook & Instagram's use of your photos in any way they deem financially useful? Its your own fault if you don't keep the photos under strict lock and key in an electromagnetically-shielded, hermetically sealed lockbox!"

Say what you really mean:

"But I liked seeing Scarlett Johannson's boobies, and don't think anybody should be punished for having helped me achieve that dream!"

Re:Really?

[farble1670]

this was time used to find someone who was breaking into other peoples account and services. So, money well spent.

time spent investigating this is time not spent investigating other things.

when's the last time you've had to interact with the police concerning a crime against you? for pretty much everything, they take your name and do nothing. there's no investigation at all. but they spend 11 month tracking down this guy? let christina aguilera hire a private investigator.

Re:Really?

[chrismcb]

If they didn't want these pictures out there then they shouldn't have had them taken. They shouldn't have kept them in an electronic form or on any item connected to the internet. It is their own fault.

You probably believe its the women's fault when she is raped?
If I take a private picture of me or my girlfriend. I expect it to remain private. Period. It might be a different matter if I let someone else (such as a professional photographer) take pictures. But if I take pictures, and leave them on my phone, or personal computer. I have every right to expect them to remain private. Even if I am a public figure.Claiming it is their fault that they let these even exist is moronic. Thats almost like saying "if they don't want to me seen naked, they should never get naked, even in the privacy of their own homes"

Wake up call

[davydagger]

"According to the FBI, the hacker used open-source, public information to try to guess a celebrity's email password, and then would breach the account."

Further proof celebs are fucking dumb. This guy wasn't a "real hacker".

I don't know what is more disgusting, celebrities themselves, or psycho brand of psychonphants they attract.

Re:Wake up call

[dav1dc]

I agree - is it still considered a "hack" when all the attacker did was guess the password from common (public domain) knowledge??

I don't think it changes the degree of wrong in his actions - but in this light we shouldn't revel in the miraculous technical innovations used to snipe some celeb p0Rn.

Re:Wake up call

[seepho]

is it still considered a "hack" when all the attacker did was guess the password from common (public domain) knowledge??

Yes, much like a golf cart is still considered a vehicle.

Re:Wake up call

[SternisheFan]

Further proof celebs are fucking dumb. This guy wasn't a "real hacker".

Well, he'll be going to a real prison with real criminals -- Slashdot's whinging about what is a hacker, a cracker, or a script kiddie is irrelevant.

He's hardly a criminal mastermind, but what he did was still illegal.

As illegal as breaking and entering into someone's home and stealing photos from a bedroom safe. Good to hear that the court system sees hacking for the serious crime it really is. Someone with a talent for computing shouldn't be given free license to break into someone elses devices and steal, and then provide some lame 'War Games' "it was just some innocent hacking" defense. 10 years will give him time to wonder if maybe he shouldn't play like some kind of untouchable omnipotent God at a keyboard. I look forward to hearing of more tough sentences in the future.

Re:Wake up call

[WD]

I don't think the quote is right. The technique used to gain access is not to guess the password, but to guess the answers to the password recovery questions. The password itself can be strong, but when you've got a site that provides recovery questions like "Where were you born?", what are we to do? The clever approach would be to have an answer scheme that isn't guessable via public knowledge, but also something you can remember if you need to use it. There's a difference between "fucking dumb" and not being aware of weaknesses in web service authentication schemes.

Re:Wake up call

[pclminion]

Further proof celebs are fucking dumb. This guy wasn't a "real hacker".

On the contrary, guessing a password is a truly classic hack. What is more of a "real hack" from your perspective? Downloading and running a cracking script? To guess a person's password from information publicly available about them is a prime example of security-oriented thinking.

The best hacks are tailored precisely to the circumstances.

Re:Wake up call

[stdarg]

As illegal as breaking and entering into someone's home and stealing photos from a bedroom safe

I don't think it's as illegal as that. If someone breaks into your home and goes into your bedroom, that's scary not just because they stole your photos or money, but they could have easily run into someone and had to decide -- do I attack this person, do I turn this burglary into a rape, do I leave witnesses, etc.

I just looked up common sentences for burglary, and found an article that discusses burglary laws in New York (http://criminal.findlaw.com/criminal-charges/burglary-penalties-and-sentencing.html ). As I suspected, the main differences between degrees of burglary are whether it was a dwelling where someone lives and whether a weapon was involved. Both combined is first degree. One or the other is second degree. Neither (breaking into a store for instance) is third degree with a maximum sentence of 7 years. Hacking a phone should be the LEAST serious of any of those, really a fourth degree.

The reality is that hacking isn't that bad.

Re:Wake up call

[Anonymous Coward]

"Illegal wiretapping gave Mr. Chaney access to every email sent to more than four dozen victims, and allowed him to view their most personal information," said US Attorney Andre Birotte Jr.

Gosh that sounds a lot like, "Illegal wiretapping gave the federal government access to every email sent to more than forty million victims, and allowed them to view their most personal information." Nobody went down for that one, though.

Re:Wake up call

[rk]

I have a made-up narrative for an alter ego where I know all the answers to those questions (e.g., what's your mother's maiden name?) and I use those answers instead of the real ones. So you can do all the research you want on me, and you'll get wrong answers for those questions. But I'm weird that way... :-)

Re:Wake up call

[DrgnDancer]

You are correct. The article states that he could have gotten 121 years if he'd been convicted on all 26 counts he was indited for. Real world third degree burglary adds up too when you've broken into a couple dozen stores. If the information in the article is correct, it looks like the average maximum sentence for each indictment is around 4.5 years, so 2.5 years less than you say for third degree burglary. It's just that he did it lots and lots of times. Sounds like he got off pretty easy, about 3 months per count.

Re:Wake up call

[bill_mcgonigle]

I admire your creativity, but for normal mortals:

Q: What's your mother's maiden name?
A: qU$%3HHr28k4

OK, that makes me somewhat dependant on LastPass, but that's a somewhat smaller risk than outlined in TFS.

Re:Wake up call

[TheCarp]

Yes but.... if he broke into her home, stole physical photos, and released them.... most people would easily consider it as much, if not more, of a violation.... but would he ever face nearly the jail time for that as he did for this? I doubt it strongly.

Now, that isn't condoning what he did, clearly he was wrong, hell, I even called into question whether that FBI dad who tracked down the pedophile principal had overstepped ethical bounds by reading the reports in the first place. However, the punishment, if there is to be one, should not be out of proportion with the crime....

This puts him away not just longer than someone who commited a nearly identical crime by different means, it puts him away longer than many violent criminals who actually physically harmed people.

Hell, he will likely do more time than Whitey.

Re:Wake up call

[Tsingi]

Yes but.... if he broke into her home, stole physical photos, and released them.... most people would easily consider it as much, if not more, of a violation.... but would he ever face nearly the jail time for that as he did for this? I doubt it strongly.

10 years is a fucking joke. Bankers destroyed the world economy and no one, except Iceland, charged any of them. There is no justice.

Re:Wake up call

[Alphadecay27]

The article states that he stalked two non-celebrities for more than 10 years. It's a lot more creepy than just some guy wanting to see celebrity boobies.

Re:Wake up call

[chargersfan420]

Yes, exactly. We can't compare this to breaking into someone's "home". In the case of Mila Kunis and her cellphone, maybe. But if you're breaking into, say, hotmail servers by guessing a password, that is more apt to trying to pick a lock on a locker in a public place, like a train station. It's still theft, but it sounds much less serious than actually breaking into a residence.

Re:Wake up call

[interval1066]

The reality is that hacking isn't that bad.

Hacking isn't bad. Malevolent hacking is bad. When I was growing up my grandmother, bless her saint-like soul, taught me about right and wrong. She used to take me and my sister for walks and point out the various caterpillars and other insects, show us how to tell time by the position of the sun, how to make butter, all that crap. On one walk we happened to see a beautiful custom '71 Camero with the key in the ignition, and no one else around. I said "Geeze g'ma, some one could just drive off with that beautiful car!" and I put my hands on the driver side window and gawked at the situation. And she said while that was true, and the owner was foolish, it was never-the-less not my car and threw my arms off the window. I said "we should find the owner and tell him/her about the key" and she said she liked where my mind was at but we should keep walking as it was none of our business. I thought about that day for years after and come to the realization she was right in many ways. One of the biggest lessons I learned from her was that just because you can do something doesn't mean you should do it. One of the best realizations of adulthood for me was realizing when I should do something and when I shouldn't. Its an inner moral thing. I've been around "adults" who act like when there is an opportunity to act/do something, they should do it. When I witness that stupid shit I just shake my head.

Re:Wake up call

[SternisheFan]

If you can break into my car and make exact copies of the stuff inside without depriving me of those things, and then put the window back exactly as you found it - have at it.

Thanks, where do you park?

I would still be committing the crime of b&e, breaking and entering, for which you would have the legal right to prosecute me for. First I'd need to obtain a notarized statement from you saying you allow me to do these things. Without that statement from you, it'd still be illegal.

And the pics and videos of you and your wife/girlfriend in various stages of undress (performing certain acts) that I copied from your car and posted them on the internet, that's okay with you too, right? Just asking.

Re:Wake up call

[SternisheFan]

Yeah, but this guy did more than even a 'harmless' hack. They got him on wiretap laws, personally calling and harassing the victims... A simple harmless hack wouldn't get you that much time. Not right now, but laws may get changed in the future, and that might make a harmless hack that invades someones expectation of privacy into a felony, if it isn't one now (IANAL).

how many years in prison

[Anonymous Coward]

did Rupert Murdoch and his son get?

Don't put things online you want to keep private

[jdray]

I'm not quite clear why anyone thinks that putting things online in any capacity is safe from prying eyes, particularly if they're a celebrity. I don't defend the actions of these "hackers" (pfft), but the photo owners should be smart enough to take some precautions or find someone that can help them do it.

10 years does not fit the crime

[jdastrup]

10 years is a ridiculous amount of time to be in prison for something like this. Child molesters and murderers get less time.

Re:10 years does not fit the crime

[The Living Fractal]

Ten years seems excessive, yes, but I'm sure he'll get out in a couple years or so if he's a non-violent inmate. Read more about what he did... it's quite a laundry list of abhorrent behavior.

Re:10 years does not fit the crime

[fredprado]

I do agree that 10 years is already too much for the offence, but it is even worse. He pleaded guilty to get only 10 years. He could face 121 years. THAT is absurd.

Re:10 years does not fit the crime

[Sperbels]

Well, you see, Scarlett Johansson's ass is copyrighted. So the MPAA is probably setting the sentence.

Re:10 years does not fit the crime

[denis-The-menace]

Child molesters and murderers will get more time if their victims are famous or rich.

If the victims are not connected or wealthy, then Child molesters and murderers get a slap or are ignored.

Re:10 years does not fit the crime

[TheCarp]

> This is actually a good system, because the headlines show the
> initial (phoney) sentence, which has a deterrent value by scaring
> other potential perps, but we don't actually incur the expense of
> imprisoning them for anywhere near that long.

Hmmm in theory anyway. In practice, there is evidence that harsh sentances do not actually translate into significant deterrance.

A much stronger effect is seen by increasing the percieved likelyhood of gettin caught.

An excellent book that talked of this was "More Sex is Safer Sex", that has a whole chapter on this effect, using LoJack as their example... claiming a 20% drop in car thefts for every 1% increase in cars with LoJack....with no increase in penalties (threatened or otherwise).

People are FAR more afraid of getting caught than the penalty.

Pics

[Anonymous Coward]

or it didn't happen...

Defense rests your honor.

HSBC laundered money, execs lose/reduce bonuses

[RichMan]

Why does it seem there is one set of rules for the little people and another set for big business?

"HSBC executives brushed off complaints from other bank employees, so that the problems persisted for eight years, the report says.

In addition, some HSBC bank affiliates skirted U.S. government bans against financial transactions with Iran and other countries, according to the report. And HSBC’s U.S. division provided money and banking services to some banks in Saudi Arabia and Bangladesh believed to have helped fund Al Qaeda and other terrorist groups, the report said."

http://www.thestar.com/business/article/1227431--hsbc-laundered-billions-of-dollars-for-mexican-drug-cartels-senate-investigation-finds

"The penalty includes a five-year agreement with the US department of justice under which the bank will install an independent monitor to assess reformed internal controls. The bank's top executives will defer part of their bonuses for the whole of the five-year period, while bonuses have been clawed back from a number of former and current executives, including those in the US directly involved at the time."

Re:HSBC laundered money, execs lose/reduce bonuses

[DickBreath]

I think that this article about High Court versus Low Court justice will explain it for you.

information wants to be free!

[larry bagina]

These celebrities should open source their privates and make money by selling support contracts.

U.S. is crazy

[fredprado]

Seriously. The guy did deserve to go to jail, but 121 years?!!! And he pleaded guilty to get "just" 10 years? It is no surprise U.S. prisons are full and U.S. has the highest number of prisoners per capita in the World...

Re:U.S. is crazy

[theNetImp]

Each hack is a different crime. Each crime has a minimum sentence. The rest is math. Most countries are no different.

Re:U.S. is crazy

[fredprado]

Most countries don't add multiple sentences to be served sequentially in this way. Furthermore most countries have a maximum total time for sentences. Here in Brazil, for example, it is 30 years. 121 years in prison is basically a death sentence, and in many ways it is even worse than it.

Re:Don't put things online you want to keep privat

[gfxguy]

Why is it safe to assume they were using webmail? All of my mail accessed on the web through a web interface, but that doesn't mean that's how I access it. The summary clearly states he hacked their phones, and accessed their email and devices.

Like they didnt want it to happen

[JustNiz]

I consider the real sickness here is the wierdness that is the mind of apparently most Hollywood stars.
I mean why do they apparently all carry nude pictures of themselves on their phones? Especially even knowing that phones can be hacked.
I can smell the Paris Hilton effect in action.... There is no such thing as bad publicity.

Re:Don't put things online you want to keep privat

[SternisheFan]

I'm not quite clear why anyone thinks that putting things online in any capacity is safe from prying eyes, particularly if they're a celebrity. I don't defend the actions of these "hackers" (pfft), but the photo owners should be smart enough to take some precautions or find someone that can help them do it.

People who aren't tech-savvy shouldn't get damaged because of it. Would you want your grandmother to have her social security money to get stolen from her, then tell her she deserves what she got? "Shoulda' been bhind a firewall Gramma! That'll learn you!" Sheesh!

Scarlet grainy pics uncensored

[Cito]

most sites have these watermarked or censored with black bars

- REDACTED

Quit blaming the victim

[SirGarlon]

Stop blaming the victim. I've heard this so often, I'm finally going to snap. (Nothing personal.)

Make up your mind whether IT administration is easy or hard.

If it's easy, then the IT profession is perpetrating a massive scam and collecting fat paychecks for what is basically an easy job. I don't believe that, and I do not think you will find many people on Slashdot who support that position.

On the other hand, if IT is hard, then it's not fair to condemn non-professionals from being unable to do it. Rather than calling people "stupid" for not knowing things that we take for granted, we could actually try to promote public awareness and give people constructive advice.

Re:Have we completed the road to serfdom yet?

[DrgnDancer]

Not really true. I know normal people that his sort of thing has happened to and the perpetrators went to jail. Maybe not for ten years, but remember that this guy was charged with 26 counts. He did this to *a lot* of people. Surprisingly enough you go to jail for a longer time when you rob four stores than when you rob one store.

That's because no one wants to see

[Andy Prough]

Justin's bieber.

Do you e-mail around naked photos of yourself?

[pseudorand]

Is it just me, or is it somewhat strange that these celebrities would have naked photos of themselves in their e-mail in the first place? I know I don't have any naked photos of myself in my gmail account, and I'm not even someone everyone wants to see naked. If you were a young, female celebrity who knew everyone wanted to see you naked, wouldn't you think twice before a) taking a naked picture of yourself and b) e-mailing it to anyone.

Or maybe I'm just a prude who doesn't know how to put his cell phone camera to good use.

for bonus LULZ...

[Thud457]

he should have posted them to Instagram. /rimshot

PIC HERE

[davidwr]

617, frame 2.