Slashdot Mirror
21-Year-Old British Man Arrested In Connection With VTech Hack (ibtimes.co.uk)
Ewan Palmer writes: A man has been arrested in connection with the alleged hacking of electronic toy manufacturer VTech which affected millions worldwide. The 21-year-old was arrested in Berkshire, South East England, on suspicion of unauthorized access to computers to facilitate the commission of an offence and suspicion of causing a computer to perform function to secure/enable unauthorized access to a program/data following the data breach in November.
From the BBC's coverage of the arrest: In the attack, servers used to support VTech's Learning Lodge app were compromised. ... The Learning Lodge database logged names, email addresses, encrypted passwords, IP (internet protocol) numbers and other personal data. Some of the information was about children including names, dates of birth and gender.
No credit card data was stored in the compromised database.
Details on customers from all over world, including the US, UK, France and China, were taken.
Some of the data is believed to have been posted briefly online before being removed.
When details about the extent of the data loss became known security expert Troy Hunt said he had "run out of superlatives to even describe how bad" it was.
I dread to think what could happen to some of the information about those kids and who might use it to target youngsters if he's sold it. VTech have been criminally negligent here too so one would hope some heads role, but this little turd really deserves the book thrown at him.
Am I alone in this uneasy feeling about so-called security pundits putting their breathlessness on display over some stupid, embarrasing and perhaps sometimes obnoxious hoaxes -- but far from "tragic", "catastrophic" or whatever superlatives?
C'mon. Tragic is that there are still people starving out there. Catastrophic is what's going on in Syria at the moment while the "developed countries" is quabbling in their disgusting powerplay over whatever.
But some compromised servers? Cool down, folks.
He'll rat out on all of his "anonymous" accomplices. Those cowardly nerds always do.
...he's a "Reeeeesearcher", only looking to expose vulnerabilities for the Greater Good of us all.
Encrypted passwords? Do IT departments really still do that? I would have hoped that most would have switched to hashed/salted passwords by now.
When details about the extent of the data loss became known security expert Troy Hunt said he had "run out of superlatives to even describe how bad" it was.
He should have invented a new word, such as badest.
"The breach was the badest I've ever seen."
Summation 2
I have to wonder what charges will be brought against the people who setup a system like this with no security? No charges whatsoever? Then expect it to keep happening again and again and again. The captcha for this is debacle, which is amazingly fitting.
The Learning Lodge database logged names, email addresses, encrypted passwords, IP (internet protocol) numbers...
Thank you, I really mean it, Thank you for clarifying that undecipherable IP acronym, my life is almost complete.
On the other hand, are they really IP numbers? I was not taught in school how to count with IP numbers, but I did get told that numbers would represent a plethora of things, like IP addresses for example.
UK Police have been visiting Teens who download denial of service software to warn them in case they become hackers and commit crimes.
http://www.engadget.com/2015/12/14/uk-police-visit-teen-hackers-at-home/
Only trouble is, the law that makes mass surveillance of the internet by the police possible... HAS NOT BEEN PASSED. So how exactly do they know the web history of teens?
There is some mighty big explaining to do, downloading denial of service software is not a crime, but yet somehow the police have all this illegal surveillance data, and that IS a crime.
http://www.bloomberg.com/news/articles/2015-12-10/u-k-cops-are-trying-to-scare-teen-hackers-with-house-calls
"The visit was one of about 50 U.K. police made this year to people they say used the Lizard Stresser site, many of them children. The Hull suspect, a teenager, couldn’t have done anything wrong, his dad told Hastings. He spent all his time upstairs, on his computer."
[He hadn't done anything wrong]
"Hastings is part of the Prevent team at the cybercrime unit of the U.K. National Crime Agency (NCA). The eight-person team tries to scare offenders on the “periphery of cybercrime” about the consequences of online misdeeds before they commit a jailable offense, boss Richard Jones says."
Before they commit a jailable offense you are already spying on them? Even though the law to permit that was rejected by Parliament and is currently still on hold pending a redraft?
Care to explain how that is???
so next time you find a bug, don't go public. just dump the stuff on the net.
Exactly what happened with hackingteam breach.
Seems police really wants to have this as the future standard how to handle security problems.
I'd be annoyed that my email address was leaked and the subsequent spam I would receive, but stealing and releasing an address book is that Earth shattering to these hyperbole infected nimrods?
A week in jail and three months of community service seems fitting.
The police go for the low hanging fruit and make a big song and dance about it.
What's even worse that's being overlooked here is that VTech was improperly securing and storing children's data. I agree with a previous response though, far from tragic considering it's just a name and dob. Nothing of great loss here that couldn't have been found in the public domain... This story is being blown way out of proportion.
Sorry, "battlestormblog" is not a credible source. The Guardian article, which is the only credible source you've supplied, does not contain any reference to religion. Do you have any actual evidence to share?
... embarrassing a large corporation by showing how easy it was to bypass security and releasing the proof to the media.
We can't have large corporations' money flows placed at risk now.....
that right there requires a full scale assault on the perpetrators and 100 years of jail time. Think of the children, said the person who required the kids names be in the db and the parents who wilfully gave that info out to access a toy.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Am I the only one that read that and start
Not even the heavily propagandized right-wing extremists believe what you're saying. You are deep into the lunatic fringe.
This kid will get punished for a corporation with such bad security that a kid could compromise it. The kid should be given a medal for his contribution to society, and the corporation punished.
in cook couny jail the us office is there.
Which would be their balls, no?
FWIW there is a documentary, from the BBC, confirming all of that. You can probably find it with a little Google.
The real scandal was not the fact that a group of paedophiles had brown instead of white skin, it was that the social services allowed it to happen because they didn't want to interfere with the "human rights" of twelve year olds to have sex.
To have a right to do a thing is not at all the same as to be right in doing it