Slashdot Mirror
Is Weev Still In Jail Because the Government Doesn't Understand What Hacking Is?
Daniel_Stuckey writes "Last March, weev, the notorious internet troll who seems to be equally celebrated and reviled, was convicted of accessing a computer without authorization and identity fraud, and sentenced to serve 41 months in prison.'He had to decrypt and decode, and do all of these things I don't even understand,' Assistant US Attorney Glenn Moramarco argued. Here, on a Wednesday morning in Philadelphia, before a packed courtroom, the federal prosecution argued that a hacker should spend three and a half years in prison for committing a crime it couldn't fully comprehend. Previously, Orin Kerr, a law professor at George Washington University and weev's defense attorney, had argued first and foremost that there was no criminal hacking to speak of. According to Kerr, what weev and Daniel Spitler (who pleaded guilty to avoid jail time) had done while working as an outfit called Goatse Security was entirely legal, even though it embarrassed public officials and some of the country's biggest corporations."
They totally sound trustworthy.
Troll is not a replacement for I disagree.
...particularly for punishing small fries who get in the way of large corporate interests and other big shots.
Along the same lines, we can ask why 'Bidder 70' went to jail for stopping the illegal sale of public land.
Any public URL that is unencrypted is not a secret. Snooping on plaintext is not snooping at all. And he had no legal requirement to notify AT&T first. Besides, even if he had, they don't care about security until it goes viral. I notified them of a information leak on their iOS translation app that allowed other apps access to your translations and location data. Not only were they unable to figure out who was responsible for the app, they ultimately told me to call Apple. I tried the support for the app as well as customer service. I email their PR rep too. Zero response.
Ah... no. If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not a hack. They made their bathroom walls out of glass and then complained that he was a peeping tom for setting up a webcam from across the street. Scuzzy? yes, but not illegal. The government shouldn't have to protect you from what common sense should.
Further more instead of going to ATT, he went to Gawker first.
This, a thousand times.
When you discover a vulnerability:
* Do not go to the vendor. They will often ignore it or sue.
* Do not go to the school or business. They will ignore it, sue, fire, and expel.
* Do not go to the government. They will imprison.
* Do not go to the Interwebz at large. You get everything above.
Take the exploit and related proof to a trusted, large, well-established security company that accepts anonymous submissions and will publicly disclose the exploit if not addressed within a specific number of days.
//TODO: Think of witty sig statement
And it blows open in the wind, I can just hop on in to your house and nose around?
The answer, in case you are wondering, is no. While you should take precautions to secure your house, your failure to do so is not the same as permission to enter or do as I please.
Can we please stop this foolishness. Now I'm off to reddit where I can enjoy my free time.
Once more in plain English Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
DRM? No thanks, I'll just get it somewhere else...
Can we prosecute the NSA for the same crime? Presumably if the prosecutor doesn't fully understand what NSA actually did then that should be good enough to convict.
Weev is whale turds. He's the lowest of the low, he knows it, and he relishes it. He's like a wolverine, pissing and shitting on the carcass he found, so nobody else will try to eat it, even though he can't stand his own stench.
Which is why it sucks so God Damned much to have to defend his useless ass!
But then, if you can't defend the worst of the worst from clear injustice, then we don't even have the hope of having a republic.
[End Of Line]
Further more instead of going to ATT, he went to Gawker first.
This, a thousand times.
When you discover a vulnerability:
* Do not go to the vendor. They will often ignore it or sue.
* Do not go to the school or business. They will ignore it, sue, fire, and expel.
* Do not go to the government. They will imprison.
* Do not go to the Interwebz at large. You get everything above.
Take the exploit and related proof to a trusted, large, well-established security company that accepts anonymous submissions and will publicly disclose the exploit if not addressed within a specific number of days.
Or you could sell it, and make potentially a lot of money, and not have to deal with any of the above consequences.
I believe this is what is called a perverse incentive.
Fuck that. If disclosing it to these people puts yourself at great risk, it's no wonder it just gets uploaded to the most convenient 0day full disclosure community. Then they HAVE to take it seriously. The broken dynamic is the fault of corporates and governments, not 'hackers.'
It's like walking through a door you know to be private property, you have no right to access, but because it's unlocked, you just walk through and start taking pictures of everything you see.
In reality, this is still trespassing and you're accessing something you have no authorization to access.
Granted, like I said, AT&T isn't off the hook for lousy security, but this doesn't forgive what weev did.
Non impediti ratione cogitationus.
Ah... no. If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not a hack
Too bad that is not what happened. He tried millions of possible IMEIs to get the information. That is not far off from a brute force password attack. That was also where the identity fraud charge came from. The IMEI is used to identify the owner of the phone and by using someone else'es IMEI her was fraudulently acting as the owner of the phone.
Any public URL that is unencrypted is not a secret. Snooping on plaintext is not snooping at all. And he had no legal requirement to notify AT&T first. Besides, even if he had, they don't care about security until it goes viral. I notified them of a information leak on their iOS translation app that allowed other apps access to your translations and location data. Not only were they unable to figure out who was responsible for the app, they ultimately told me to call Apple. I tried the support for the app as well as customer service. I email their PR rep too. Zero response.
I'm really uncomfortable with that logic. First of all saying that if all it takes is typing in a URL, then of course its public belies a level of ignorance just as high as the government in this case. "Just a URL" in the modern internet could be anything. SQL-injection is programmatic hijacking of a database server, but it often requires "just a URL." Buffer overflow attacks require just a URL, many apache worms required just a URL to propagate because of the way URL content can be processed. Just a URL is like saying all programs are just notepad documents. It cannot be the case that "if I can get there, then I get to take whatever I want" is the rule of the internet. I read in another article the analogy that AT&T basically put the material on a library bookshelf for anyone to read. That's not a good analogy: a better analogy is weev went to a public library, found that someone forgot to lock the door to the reserve stacks, and decided to go there and take a bunch of books home with him just because he could.
That is not the person I want to be the flag-bearer for my sense of fairness.
Second, giving anyone who points out a failing in others a free pass to point it out by any means is also something I'm really uncomfortable with. If its okay when done to big companies like AT&T and Apple, then its just as okay to do to smaller organizations like your neighborhood grocery store, or your house.
"Classic works for me, remove the 'beta' stuff from the url."
Be careful, or you'll be tossed in jail for hacking /.
I mean, fair enough. But if you can access every customer's record on a massive nationwide system by incrementing a single digit? That strikes me as "basically public". I sometimes exploit the same "hacking" to find the page of a webcomic I want to read if I forget the bookmark.
As the article says: Does he deserve to go to jail? Probably. For this? No.
... people can claim that they did not know how to do witchcraft, but they could point out to the judge which person were witches which were not.
In the 21st century, people can claim that they do not know how to hack, but they can tell the court who are the hackers and who are not.
As if people never learned any lesson from what had transpired three long centuries ago.
Muchas Gracias, Señor Edward Snowden !
you know holding a gun to someones head in a game of russian roulette.
You're doing it wrong.
yep, there's the good ol hacker "she was asking for it" defense.
the egg would have been all over at&t's face if this info had been released anonymously. but weev had his awesome internet persona to worry about.
someone forgot to tell him the cool part of hacking is not getting caught
How is this any different from someone just unlocking your front door because the lock mechanism is stupid and helping himself to all your belongings? Or how would you feel if you left your house and you left one of the windows open and so someone decided because the window was open, he is basically invited in to your house and can take whatever he wants? Only a fool would make that argument the thief has any right to be in your house. You can argue the homeowner should be more careful and get a better lock and close all his windows. You can argue that someone walking by and leaving a note to the house owner warning about the perils of being reckless is being a good citizen. However, the second this good citizen decides to actually enter the house and look around and take stuff, he is being a criminal.
The notion is more that AT&T has a responsibility to its customers to diligently protect its customers' sensitive information. It's not really saying that there is nothing wrong with the actions, but rather that the far greater concern is the irresponsibility of the party whose security was so poor.
Let's take this idea to an extreme scenario, albeit one that's not too improbable. For a very long time, a nuclear launch code was actually '00000000.' Let's say some hacker had accessed their network, determined this was the case, and made all of the machines with displays on the network say 'Change the fucking password before you doom us all, you stupid fuckwits.' Who are you going to be angry at, the hacker who intercepted their network, or the party that ignored their responsibility in protecting something that could have potentially destroyed civilization as we know it?
This is my signature. There are many like it, but this one is mine.
There is no difference to physical entity to electronic entity. Or are you pretending we need MORE law to regulate electronic/internet entity ? No ? Then imagine if I was telling you this :
"Any door that is unlocked is not a free for all. Openning and entering that door is not trespassing at all. And he had no legal requirement to notify the door owner first. "
We have already enough law on the book. If youa re accessing a direct URL and manipulate URL to see what is not normally accessible thru the public portal by a link, you are trespassing. Any "but it is not behind a lock / password" is a bullshit defense.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Would you defend the government for making a system where simply using a street address would allow one access to information (taxes etc.)? How about your Bank? Explain your reasoning, please.
I am not defending AT&T. I think they should be heavily fined and hopefully someone go to jail. I also think that someone who exploited the hole should also be sent to jail and heavily fined. The only people I am defending are the ones who had their information stolen.
Absolutely it does, it's implicit when it's on the web (short for World Wide Web) especially without authentication (doesn't that usually involve username + password?)
There are some authentications that do not use user/password. For example, Paypal Payflow uses a signature which is a single long number that identifies that account and gives authorization for access. It is a single number somewhat like an IMEI.
FYI email addresses are not private information.
Have you ever seen an directory of email addresses? There may be a reason for that. I have looked and I have not found a legal definition one way or the other. By the way, the parallel with phone numbers may be flawed as some numbers are unlisted and not allowed to be published in directories. I believe that the owner of the number must authorize listing the number.
You make a point of mentioning that this occurred thousands of times.
Make that millions of time with millions of different combinations.
What if you clicked on a link via a URL shortening service that directed you to one of these links, do you think you should be put in jail?
That is one URL and not millions of different URLs.
Do you think you should be liable for fraud for entering IMEI#s?
Yes, if the IMEI does not belong to you or you have not been authorized by the owner to use it.
What about accessing a website or service when its really busy (DDOS)?
If most of that load is caused by your servers hitting their servers then yes. If it is by normal browser traffic then no.
What about visiting slashdot and typing in an account name that's a misspelling of yours which happens to have the same password?
Don't you see how this is very different from trying millions of different password combinations? One of the precepts of law is intent. It is pretty easy to show no intent when typing in a few incorrect characters. It is easy to show intents when you create a script that generates millions of possible IMEIs and spams a server with them.
Lazy/incompetent/unprofessional people get no sympathy from me
I completely agree. I also think that people who exploit flaws for the purpose of profit and/or self aggrandizement should be held accountable for their actions.
We are actually not too far apart. In my view the problem was caused by both Weev and AT&T they both should be prosecuted. What do you think?
For the most part, on the web it really is up to the server to tell you if you're going somewhere forbidden. It's the only way to positively know.
I acknowledge that in this particular case, it could be argued that he should have soon realized that he was in a restricted area. However, given the convention (for the web AND for a physical business presence) and the ambiguity, it sounds like a misdemeanor charge at most to me.
If you're going to talk about fairness, you must address a 3.5 year prison sentence for discovering a few email addresses (and then not actually publishing them) in an unlocked back room.
Honestly, based on all indicators from the press over the last couple years, Weev has been a fairly miserable human being on most accounts, interested in causing disruption and not much else. The New York Times in particular did a very good expose on a number of individuals (Including Weev), covering their behaviors over the last couple of years, and their admitted trolling behaviors.
* http://www.nytimes.com/2008/08...
Here is a gem, highlighting some of his conduct.
Weev, the troll who thought hacking the epilepsy site was immoral, is legendary among trolls. He is said to have jammed the cellphones of daughters of C.E.O.’s and demanded ransom from their fathers; he is also said to have trashed his enemies’ credit ratings. Better documented are his repeated assaults on LiveJournal, an online diary site where he himself maintains a personal blog. Working with a group of fellow hackers and trolls, he once obtained access to thousands of user accounts.
I first met Weev in an online chat room that I visited while staying at Fortuny’s house. “I hack, I ruin, I make piles of money,” he boasted. “I make people afraid for their lives.” On the phone that night, Weev displayed a misanthropy far harsher than Fortuny’s. “Trolling is basically Internet eugenics,” he said, his voice pitching up like a jet engine on the runway. “I want everyone off the Internet. Bloggers are filth. They need to be destroyed. Blogging gives the illusion of participation to a bunch of retards. . . . We need to put these people in the oven!”
I don't know why people would do, or admit, things such as what the New York Times describes (usually it involves some kind of mental disorders)...but in the end, it all caught up to him.
Americans are never happy unless you're getting your human sacrifices, eh?
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
If you can go to the store and buy one, and put it on your network, and your network monitoring software can show you what it's doing, and it's unambiguously doing something that's easy for you to do, and makes it easy to get something that arguably ought to be a secret without your having performed any heavy duty rocket surgery...
It's public! Any of your customers can gain this knowledge without anything you didn't just plain give over to them! If responsibly disclosed and the company won't do anything about it, then they ought to be exposed. Now what is it that was exposed again? "Private" e-mail addresses?
Come on!
Restating the obvious since nineteen aught five.
I am sorry but going to have to disagree here. A url with an obnoxiously long query string, that is plainly designed to be used by a web service etc and not published isn't public. Using in what you can reasonably know is an unintended and potentially abusive way isn't right. Just like walking off with someones property they left in their yard is not right, but its also not as severe as breaking and entering. Ditto if I leave my house unlocked, if you enter you are trespassing, if you take something its theft but its not a B&E because there was no breaking.
The law should recognize the difference, between 'hacks' of opportunity like this were someone happens to spot something unprotected by any kind of authentication or authorization system yet is something a reasonable person recognize is not intended for public use and takes advantage verses someone who say crafts a buffer overflow and injects code or designs a SQL injection etc, breaking a lock so to speak.
Companies like AT&T though need to be exposed to civil suits for stuff like this, we should have laws that say you are responsible for personal information you collect and if you are negligent about protecting it or someone you in turn give it to is, you can be liable for any damages to persons you collected the information from resulting from the leak.
If we want to see security improved we need to make PII a hot potato. Hopeful lots of companies, advertisers etc would just decide its better not to collect it rather than risk law suits or class action law suits should it leak, companies that genuinely need that information would be less inclined to sell it, again to avoid the risks associated, and more inclined to secure and not do things like AT&T did here just because its easier than doing it safely.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Seems there is a prevalent feeling on Slashdot that if you leave yourself exposed, wittingly or unwittingly, then the folks who take advantage of that exposure should not be held accountable, should get the benefit of the doubt, or in some cases, even celebrated.
The principal at stake here is the social contract of Trust. We trust each other to not harm one another in everyday life. I trust the clerk at the gas station to not bash me in the head with a bat. He trusts me to not do the same. I trust that the people I invite into my house won't go through my stuff, that they will respect my privacy, and won't steal anything, etc.
People who violate this trust are called criminals, thieves, murderers, etc. Despite what the News says, this does not occur all that often. If it did then we'd be like Somalia. It's why we can function as a society.
Whatever the circumstances that led to this guy accessing, downloading, and keeping the information, he violated the general trust that we all have that others won't mess with our shit, even if we leave it exposed. He also violated the law, which says, in a nutshell, don't fuck with other people's shit.
If you want to use the unlocked door analogy, what did not do was leave a nice note for the owner saying, "hey, I found your door was unlocked". Instead, he went inside and took stuff, then put up posters all around the neighborhood telling people the door was unlocked, which door it was, and what stuff he took.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
False equivalence. Trolls aren't human.
Welcome to the Panopticon. Used to be a prison, now it's your home.