Slashdot Mirror
RCMP Arrest Canadian Teen For Heartbleed Exploit
According to PC Mag, a "19-year-old Canadian was
arrested on Tuesday for his alleged role in the breach of the Canada Revenue Agency (CRA) website, the first known arrest for exploiting the Heartbleed bug. Stephen Arthuro Solis-Reyes (pictured) of London, Ontario faces one count of Unauthorized Use of Computer and one count of Mischief in Relation to Data." That exploit led to a deadline extension for some Canadian taxpayers in getting in their returns this year. The Register has the story as well. The Montreal Gazette has some pointed questions about how much the Canadian tax authorities knew about the breach, and when.
I for one welcome arresting people who seem to think it is a good idea to enter someones home just because they didn't get to update all their locks on their home.
Sure it is easy to update your PC, but if you have a mission critical application running, you need to make sure you take all the right steps even with the security vulnerability to make sure it doesn't go down.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
So you do something stupid like that in the US or Canada or England or any other civilized area and you get caught in like a day. Do it in Russia or Indonesia or Turkey or Israel (mega malware hotbeds) and you might get caught somewhere between 2 years and never. Where is the UN on this one? OHHHHH THAT'S RIGHT it's all old people who don't know a thing about technology. That explains the problem.
I imagine this kid will get what he deserves, but what about the CRA? They should've immediately taken their servers offline until they were patched. Will anyone get any heat for that?
I'd care about his age if he were 10-14 years old or about that, who didn't hack at that age?
When you're legal age you know what you're doing.
Ah the brilliance of youth -
"I have a script for an exploit"
"I can try it against the tax man"
"I won't get caught"
"I'm not going to use the results so no-bad"
"Hey what's with the cuffs!"
Damn that was a quick arrest. His basement must have not very deep. Something tells me he was not realizing the extent of his actions because: -picked the worst entity to try the exploit on -picked an entity in his home country -7 proxies and all -prison.
On it being 'revealed' he suffers from Ass Burgers?
Here in USA it's being reported this way:
"Heartbleed hacker caught in Canada"
Translation:
Media sheep, go back to sleep. We caught THE hacker responsible for Heartbleed, thus it can fall into the memory hole. Any concerns you may have about your fellow citizens, their business interests or governments monitoring you, or perhaps about the general competence of software development (!!!) can also go back to sleep.
Sleep, sleep my lovelies. Tomorrow there is obedience at school/job, and then shopping and sexy videos on the internet. Sleep, sleep.
Futurist Traditionalism
I like the name of the "Mischief in Relation to Data" charge. It sounds vague enough it could mean just about anything.
Heck, this might even be on my resume, I'll have to check.
You guys will never understand the RCMP. They're probably one of the last competent police forces on the planet, and the vast majority of Canadians respects them. Our city or provincial police forces on the other hand...
>> The Register has the story as well
Duh - the Register is where most of us read the story so we'll know what to write when the same news appears on SlashDot tomorrow.
I never wanted to do this in the first place!
I... I wanted to be... A LUMBERJACK!
Because history and showmanship tell you a lot about capabilities.
USMC does their fancy pants silent drill with unloaded 60 year old assault rifles. I wouldn't suggest pointing and laughing.
No one expects the RCMP, their two chief weapons are surprise and strangely competent horses!
and stylish hats
Their three chief weapons are surprise, strangely competent horses, stylish hats and a fanatical devotion to the laws of Canada.
Their four... hang on a second, I should just do the entrance again.
(I'd continue, but that's about all I know about the RCMP, my knowledge greatly inspired by the old Dudley Doright cartoons.)
I wasn't expecting a Monty Python reference.
I wasn't expecting a Monty Python reference.
It's all right. Nobody expected this Monty Python reference.
They're probably one of the last competent police forces on the planet, and the vast majority of Canadians respects them.
No.
The RCMP have abused their power and neglected their duties like every other police force.
You guys will never understand the RCMP. They're probably one of the last competent police forces on the planet, and the vast majority of Canadians respects them.
You gotta be kidding.
There was the incident of 4 armed RCMP officers who tasered some poor unarmed schlub FIVE times and killed him:
http://en.wikipedia.org/wiki/R...
And they lied about it and tried to cover it up by refusing to release the video.
Then there was the RCMP officer who kicked Buddy Tavares in the face. Tavares was complying with the police, he was unarmed, and had his hands on the pavement. Oh, and it was recorded on video.
http://thescottross.blogspot.c...
http://www.theglobeandmail.com...
There was the time the RCMP pepper-sprayed hapless protesters who were legally & peacefully protesting so that Suharto, the dictator of Indonesia wouldn't have to see them:
http://www.cbc.ca/news/canada/...
And many many more.
If you compare their failures to those of other police forces they don't even come close. They're in another league. They may get some publicity but I'd far rather deal with the RCMP than a city cop. The RCMP may have had a few incidents, but city police forces are corrupt from the top down.
I am withholding judgment until actual facts are known.
Would not at all be surprised if CRA was previously owned then used "heartbleed" and this kid (who I suspect actually did run a heartbleed probe of some kind) as cover or the most convenient explanation out of incompetence.
Don't see how anyone can anyone trust them after BS PR statement they posted to their site when they would have known at that time they were compromised.
I've talked to an accountant about this and we're both convinced this was an RCMP sting. They announced there was a vulnerability on their website about six hours before they patched it. That's either totally stupid and insane, or it was a police sting and they were just waiting to see who would be stupid enough to try and break in through the open door. Please have a seat.
The dangers of knowledge trigger emotional distress in human beings.
Other than the fact that they misidentify an exploit as a virus, you're telling me that Fox News has a better headline?
Fox News, that I'm told like the Daily Mail in UK is nothing but a tabloid that no one serious reads? And that's supposed to be completely unrelated to it being one of only a few media sources that are right-wing?
Do tell.
Futurist Traditionalism
This is more like making a copy of the old credit card carbon copy slips; it doesn't appear to have any effect on the credit card itself, however it can be used for fraudulent purposes. In Canada, the SIN (Social Insurance NUMBER), is used by CRA, banks and potential employers, which means that being able to associate name, address, and SIN renders the information ineffective as a private/unique identifier.
NSA isn't spying on Americans. You disagree? You're overly paranoid.
That's a common tactic used by Communists and other totalitarians to silence dissent.
Oh wait, I see:
That's from your journal where you as an apologist for censorship endorse the idea of firing people for having "offensive" opinions.
I think you have mental health problems in addition to a serious lack of moral fortitude.
Futurist Traditionalism
>They're probably one of the last competent police forces on the planet
Is that because they're mounted or despite their superequine status?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I'm no fan of any police force, and there are massive problems with the RCMP and its culture of sexual harassment and oppression, but as a police force they're doing a lot better in terms of police work than most of their counterparts. Their abuse of the system to intimidate, harass and oppress the people they ostensibly protect is significantly less than their friends in the US, UK or Australia.
Are they perfect, no; far from it. But Given a choice between the FBI and the Mounties, I'll take the Horse Corps any day.
AC cause mod points
Meanwhile, government agencies use the same exploit without any fear of retaliation (even buys them with your money)
http://www.wsws.org/en/article...
I've got better things to do tonight than die.
Horses are the only thing that flow quickly and easily through the series of tubes, unlike poker chips.
IE, a polling organization conducts a poll for a vendor with a cost of one million dollars to the vendor to see which is the preferred widget, X or Y. Then, some third party comes along and points out a flaw in their testing methodology, thus invalidating all of the collected data.
That third party has "rendered that data meaningless, useless, or ineffective" and thus could be found guilty under this statute as worded.
This is just off the top of my head with 5 seconds thinking on it, I am sure many many such scenarios could be created. Data is not the same as physical property, you can't just take a property law and replace the word "property" with "data" and expect it to make sense (see the original "mischief" section above in the law).
Whoever got this on the books should be drawn and quartered.
I thought they rode ponies? Ar, ar, ar, ar, ar.
(n/t)
RCMP compared to say? OPP and issues with let's say...oh...Caledonia? Or several other issues? Let's run away, away, run away way. Let's arrest the other non-native protesters so we don't enflame the natives? Doesn't get better when the OPP are involved or the courts either here in Ontario. How about Ipperwash? When the natives were shooting at the police, and they had it on film, and the courts refused to hear the evidence? I've have a friend who was in the military at the time and she was shot at while her helicopter was doing a flyover. They refused to allow evidence of that in too.
Or how about the CBSA, when they stopped hundreds of american natives coming into Canada with guns? The RCMP arrested them but the courts let them go and where did they end up? Ipperwash shooting at the OPP, at the RCMP, and at the CF's. Please, the RCMP has problems without a doubt, but they're not a patch on either what goes on with the natives, some of the serious issues with the courts, or even with the provincial police forces when the government jams their fingers in and tells them to "back off."
Om, nomnomnom...
He attacked early. Did he wrote the attack tool himself? Or did he received it from someone else?
According to the statement on the CRA web site, it was security agencies that told the CRA that 900 SINs were stolen:
So, are the security agencies monitoring traffic to government web sites, so that they are so specific? What else are they monitoring?
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.