Slashdot Mirror
Security Researchers Submit Brief For Andrew "Weev" Auernheimer
USSJoin writes "Andrew Auernheimer (or Weev, as he's often better known) is serving a 41-month sentence under the Computer Fraud and Abuse Act. The case is currently on appeal to the Third Circuit Court of Appeals; his lawyer filed the appellate brief last week. Now, a group of 13 security researchers, led by Meredith Patterson, and including include Peiter "Mudge" Zatko, Space Rogue, Jericho, Shane MacDougall, and Dan Kaminsky, are making their own thoughts heard by the court. They are submitting a brief to the Third Circuit Court of Appeals that argues that not only is Weev's conviction bad law, but if upheld, it will destroy independent security research, and perhaps the rest of consumer safety research as well."
It may have been pertinent to briefly explain what he actually did in the summary - he was the guy who got hold of 114,000 AT&T customer email addresses. Beyond that I don't know much, except that there is some argument over whether what he did was any kind of "hack" - he may have just navigated some exposed folders. Either way, you still probably get less than 41 months for kicking a puppy to death.
systemd is Roko's Basilisk.
At the light of recent events, we are sure the STASI also owns some favors to AT&T....
So independent researchers talk about their work in ways such as:
Auernheimer: this could be like, a future massive phishing operation serious like this is valuable data we have a list a potential complete list of AT&T iphone subscriber emails
Auernheimer: well i will say this it would be against the law for ME to short the att stock but if you want to do it go nuts
Auernheimer: lets not like do anything else we fucking win and i get to like spin us as a legitimate security organization
Yeah, he surely was working to only help those customers...
What Weev did was spoof his Browser headers and then send a bogus ID to AT&T's webserver. The dumbasses who wrote and reviewed the code on AT&T's backend were negligent in that they blindly trusted the user input and spit out private information as a result. If that's what the Spec said was supposed to happen, then start climbing the ladder and find out who authorized customer info to be so accessible.
In my mind, the people in charge of code review at AT&T need to be in court answering questions as to what other code they have facing the internet which could be circumvented in a similar way giving away customer info to anyone who can use a common browser plugin and simply change a form variable. This is a clear case of glaring corporate negligence being covered with the Computer Fraud and Abuse Act.
I'm not even sure what the CFAA is supposed to protect, but if it's primary use is to keep people from asking questions about how their private info is stored, and who has access to it, then get rid of it. The only people winning from legislation like that are the ones who would otherwise be sued for negligence.
Join the Slashcott! Feb 10 thru Feb 17!
Yeah, I'm pretty sure that's the point. What in the world makes them think the government and the mega corps that they've merged with wouldn't want to "destroy independent security research" and "consumer safety research"? You think those federal-corporate cockroaches want you shining a light on their clandestine behind-the-fridge data gorging?
Hollywood, Television, has become the dream machine. We need to take that back; each of us is a Dream Machine
may have been pertinent to briefly explain what he actually did in the summary
Auernheimer didn't just violate the law, he intentionally did it on such a scale as to bring attention to himself. He was saying to the authorities as well as those on his side, look, you can't ignore what I just did. So they didn't.
In reality this is a just a case of the following:
Researcher finds that Joe Blow has gone out of town and left the door to his house unlocked and open. Researcher publishes this information in a blog along with the address to the house. House gets robbed. Police hold Researcher responsible. Researcher insists it's not his fault that the house got robbed.
Yes it really is that simple.
that none know nor care about "Weev"; weev got our own lives to live.
AlphaFalfa
...will be the first pwned in a cyberwar because fear will have kept their system from ever being tested.
I'm finding trouble having sympathy for this guy.
He manipulated URLs to access areas that were not publicly visible. The information that he gleaned by manipulating these URLs was information that any reasonable person would deduce as information AT&T did not intent to make public. Rather than informing AT&T about the vulnerability, he went to Gawker and leaked the information that he gained, victimizing all of those people in the process. Just because someone leaves a door unlocked or open does not give you the right to go in and steal stuff and this is no different. Mens rea is *everything* here; if he had just gone to AT&T or acted responsibly in the disclosure, rather than trolling, he would most likely have never been charged.
As far as the prison sentence goes, he brought that on himself as well. It is *beyond* stupid to swear at a federal judge and call her a "mean bitch" when she is the one that is sentencing you. It is *beyond* stupid to go on a public forum and post that you intent to commit the same crimes again once you get out of prison. Do not complain when you get the book thrown at you after you try to turn the courtroom and the trial into a three-ring circus. Trolling a federal judge is never a good idea.
There is also the matter of his past history. I have not forgotten about what he did to Kathy Sierra or the other women that he made rape threats against. Or the "GNAA". His entire life has been dedicated to griefing people and generally being an asshole and yeah, the judge is going to look at that.
Weev's conviction bad law, but if upheld, it will destroy independent security research, and perhaps the rest of consumer safety research as well.
Good. If we have safe secure products, the terrorists win!
Is a judge really going to read an amicus curiae brief from someone named "Space Rogue"?
RESPONSIBLE DISCLOSURE! RESPONSIBLE DISCLOSURE! RESPONSIBLE DISCLOSURE!
We need a law that states what is legally protected responsible vulnerability disclosure. Something that says "If you do it this way you are not a criminal." Something like:
1) Notify the responsible organization.
2) Give them X days.
3) After that, you may optionally notify a responsible government agency or industry organization like CERT.
4) Give them X days.
5) After that, you may go public with the information.
etc.
Anyone in the security industry should already know to do this, but a law would make it clear.
Just take a look at position papers like this one (fulltext PDF) and you'll see that while the average length of a computer-related conviction sentence may be somewhere around three years, they're calling for more. And all we have is the EFF standing between us and going to jail forever.
The posters who show examples of more serious crimes like arson, rape and bloody murder that received short sentences is an argument for increasing those sentences not shortening Mr. Auernheimer's
The brief describes how a web request is like asking a librarian for a book.
If the book is non-public she then asks for credentials and if they are ok gives you the book.
Since the ATT's web server didn't ask for credentials, the web pages were fair game.
This misses another use case.
It is also possible to include your credentials with the request for the book.
A librarian would respond to this request for private data just like a request for public data.
The included credentials could be a big, secure random number, or an obvious small number like the record number.
In some cases a web site uses a simple record number for public data so that a user can access it by providing the record number.
In this case AT&T used a simple record number for private data which they did not want accessed.
One could argue that they 'locked' the data, but with a cheap lock.
The thing is, one can recognize a physical lock and know to respect it.
In this case the web server provided no indication that the data was private.
In fact, as the brief outlines, it indicated the reverse.
From their reactions, both AT&T and the security guy knew the information contained in the data should not have been public
The security guy did not benefit for the data, but rather published the problem so it would get fixed
(Without this, good guys might have walked by this 'lock' but how many bad guys quietly didn't?)
AT&T reacted to 'kill the messenger' by declaring after the fact that the data was private.
It doesn't seem good law to allow this to stand.
1) It removes the feedback which closed the security hole.
2) It allows the server owner to escape responsibility for a poor (perhaps dangerous) design.
3) It makes it impossible to draw the line for 'normal' versus 'criminal' web browsing for us all.
4) It leaves a generally harmless guy in jail for violating an after the fact business rule.
ehm ... why not send ~100k emails with spoofed sender address (from:pissed-off-att-customer@example.com) ...
to AT&T complaining about how they're giving away their email addresses thru a leaky website?
i would personally like to know how the effected email-address-owners think about this
"thou shalt not inconvenience anyone with more power than you" is the whole of the law
if you break that law then the powerful people will make you suffer
in our civilized society the powerful people don't get their hands dirty personally so they hire goons to enforce their will
the goons wear uniforms and carry badges to symbolize how they are the extensions of the will of the powerful people, if a goon is useful and vicious enough he can join the ranks of the powerful himself
once you realize how the "law" works then everything else makes sense
If we consider the url trick to be operation that normal people would not do. Further, after url trick, he got access to someone elses account details. It's pretty similar to normal hacking operations -- find gaps in the protection of the data, and once found, utilize the gaps to cause damage. He bypasses security measures by skipping the authentication mechanisms and accessing someone elses account. In this case, every AT&T customer's account details. Once he saw the unauthorized account details, he didn't stop there, but created software to fetch all the data he can find. By this operation, he upgraded himself from normal web user to a software expert, and software experts are supposed to know that unauthorized access to someone elses data is not allowed. Convicting this guy no way changes the status of normal web users as amici thinks, but changes the status of software experts. Experts now need to be more careful about how they publish data. Software experts anyway need to be very careful what data to publish. Giving account details of someone else fetched from AT&T's servers to the press is just very stupid operation for a software expert. I say this is unauthorised access of AT&T's servers, recardless of what response the server is giving. The server configuration just doesn't matter. He bypassed the authentication mechanisms to access accounts of AT&T's customers. Jump from software expert to security researcher is tricky one. As software expert he's clearly breaking publishing rules. If he cannot make the jump from software expert to security researcher, then the conviction is just ok. Not all software experts need to be security researchers.
Let's hope eloh gets his 'za this time around.
Someone remind me to go after this fucker with a baseball bat when he gets out. Let's see how well he hacks and trolls with his hands and arms shattered.
I'm not sure I agree with the path of logic.
"If we consider the url trick to be operation that normal people would not do"
Consider an example of reading a blog where the url contains ?entry=1, ?entry=2,... to access sequential stories.
It seems 'normal' to adjust the URL to access another story if that is more easier.
Using a program to download a whole group of stories seems fair as well.
Even if the program is also finding out which entry numbers work and which don't along the way.
Point is that the access method seems fair.
The issue is the actual data being accessed.
Perhaps calling this unauthorized access sets the bar too low for what is acceptable security for the owner of the server.
Pretty sure Freenode/OFTC are happy with the results as they are. Lilo bicycle havoc and links to Saddam Hussein porn notwithstanding xD
That doesn't hold a candle to truly bad poetry. Allow me to remind you:
And hey, let's not forget that Terran master's work:
Now that's much more delictably terrible, as poetry goes.
"What in the name of Fats Waller is that?"
"A four-foot prune."
AT&T wants us to believe that because their website was so insecure that feeding it sequential data would reveal private customer information, the problem can be solved by throwing the "hacker" -- who notified them immediately and did not leak the customer information -- into jail.
Yeah, right. The overseas hackers aren't going to even care that much. They'll take your information, use it to rob you blind, and presumably AT&T will cover it up, since their response has not been to address the actual problem in this case.
Weev is caught in the crossfire. American industry wants to have government protect it from its own sloppy coding. The truth is that protecting industry encourages more sloppy coding, which then helps the Chinese hackers who are robbing us blind.
FREE WEEV!
Futurist Traditionalism
The penalty in this case was too high, even for a repeat offender.
I read the amicus brief with interest and it first it seemed like they had some good points. After thinking about it, I realized their arguments are kind of silly.
Their argument hinges on the idea that Weev couldn't have known that downloading the personal of hundreds of thousands of people was unauthorized. Seriously? They imply that because Weev COULD access it over the web, he thought he was supposed to. His statements afterwards make it very clear he knew it was unauthorized access and therefore illegal.
They also pretend that they missed Criminal Law 101, where they learned about criminal intent, known as mens rea. They pretend to believe that Consumer Reports testing toasters is the same thing as hacking people's professional information, over 100,000 times, then distributing that personal data. Anyone with a grain of common sense can plainly see they are completely different.
So by your thinking, if you leave your car unlocked, which is a dumb thing to do security-wise, it's okay for someone to steal your stereo?
Sure, a programmer or two at AT&T did something dumb.
That's orthogonal to what Weev did.
In fact, by your logic, if a 16 year old girl walks down a dark street at night (failing to have proper security), the rapist has done nothing wrong. After all, she should have had better security . Perhaps she should have, but that doesn't make it okay to victimize someone.
It would be good for everyone to have it very clear where the line is. I have my name on some CVEs, so I qualify as a "security researcher", I suppose. Also, I'm paid to protect my client's systems, so I understand the costs of criminal hacking. I see both sides and from my perspective it would be good to know that I'm protected from frivolous prosecution if I follow responsible disclosure practices, while not giving a free pass to the criminals attacking us.
We have to be careful though - DMCA was designed to be a balance between creators' need to protect their work and service provider's need to provide hosting etc without undo liability, along with _some_ protection against frivolous claims via counter claims. It works well most of the time, but the lack of penalty for bogus claims means it's also abused too often.