Slashdot Mirror
White House Web Page Cracker Faces Prison
gregstoll writes "Hacker Eric Burns (alias Zyklon) faces prison, according to this New York Times article (free registration required, of course...)" Meanwhile, according to an Excite News story sent in by lots of people, the DoD is thinking about removing JavaScript and ActiveX from its sites to make them harder for crackers to penetrate.
this isn't meant as flamebait, but he deserves it. the stuff he was doing was illegal. it has almost no practical use, other than to show a security hole, and the best way to do that is NOT by defacing the webpage. that's like breaking into a house and trashing it to show that locking your door is a good idea. yeah, it works, but there are other ways.
--
you must amputate to email me
i read all replies to my comments
This is, of course, to be expected. All cracking is illegal even if nothing is broken! This guy just hit the wrong site and got caught.
You must suffer the consequences of your actions, and cracking the White House site is a bad idea...
Computers can only simulate determinism. ~Hermetic.
If someone vandalized the white house I would imagine they would be getting jail time -- even if they just broke in and didn't do anything. I don't see why this should be any different. Anyway, who would have thought javascript lead to holes in named, apache, etc?
Heya, if we spread the rumor that removing JS and ActiveX will make sites more secure, maybe it'll just go away. Yeah, lets.
yadda
Is that really necessary? As far as I know all javascript exploits have to do with the creation of nasty javascript on the serverside (redirecting people to fake login pages etc). The client can really do little with javascript from their side. Of course if they are talking about Java and ACtiveX well then ummm just ignore everything stated above.
--codemonky
--"Karma is justice without the satisfaction"
If he broke into computers, he should be punished. But I'm a bit dubious aobut this 'three years' thing. Computers are no longer a luxury; most people reading this have computers as an integral part of their life. There's also the problem of 'what is a computer'. Can he play pacman in the local retro-arcade? What about a playstation? Can he program his video to record 'buffy' when he's at a parole meeting? Can he take cash from ATMs?
I could go on. And given the slightest incentive, I probably will.
Browsers are too powerful anyway. They should have access to your system the way they do now.
jackchaos.com
-Oy Vey
how can such a thing be imposed? with everywhere computers are showing up now...fridges...microwaves...toasters....3 years is a long time. Look at where they are now from three years ago! He would be unable to attend school, is THAT what the system wants?
Not defending what he did, punish him and let him go about his life. If he does it again punish him more severely.
This isn't like shooting someone and being unable to use a gun for 10 years or something...the puter industry is a little different.
Maybe I'm just lame but how does javascript and Active x make i easier. Or was that the point.
I thought the problem with ActiveX was that it was a security hazard for the browser -- the person doing the surfing -- and the browsing system. Ditto JavaScript. Can someone please explain to me how these tools are a threat to the servers and their hosting systems?
Or is this just the case of some non-tech-savvy DoD security wonk overreacting to something he's read and misunderstood about the security issues? It happened at NASA. You wouldn't believe the trouble we had getting Java code into mission control at JSC, because some misinformed security expert decided that Java == security threat. *sigh*
--JT
In addition to removing JS and ActiveX from their site the DoD MAY want to consider disconnecting their critical systems from the Internet altogether. I mean, is our entire nuclear arsenal at risk here? Could the end of the would come about as result of some 12-year-old with his new Gateway rather then the more conventional Judeo-Christian four horsemen?
I know that may seem ridiculous, but take a moment and think: if you had enough weaponry to destroy the would several times over, would you connect your network to the internet?
Sounds like the government is charging the same thing back to the public as it does paying for stuff. Three attacks? How in the world would that equal anywhere near $40,000 in damage. I mean come on now. Unless they are paying someone 300 bucks an hour or something to reconfigure a machine. Oh well I guess I won't be learning how to crack into websites anytime soon. Not that I wanted to do it in the first place, this was enough to discourage me.
Good is never enough, when you dream of being great!
How will banning the use of Javascript and ActiveX from DoD sites prevent people from hacking DoD servers? Also, how does this help client machines, do they not trust their own servers? The problem with Javascript and ActiveX, is when DoD people use DoD computers (PCs) to surf untrusted sites on the Web. Then Javascript and ActiveX, especially ActiveX, become a security risk. Mobile code is a problem when users go get it from an untrusted site, DoD users should not be doing that.
Those who can do. Those who can't sue.
A few things came up from reading this - the guy seems to think "the punishment is harsh for what he did".
I don't agree with this punishment for computer intruders, but the law is the law until it is changed by your elected representatives. And if you got caught, then tough tittie. You knew the risks. HNN has an excellent article about it.
Basically, this type of activity is like trespass & vandalism. In the UK, that's more like a slap on the wrist community service type punishment. I'm not going to go on about ethics or morals; that's been done to death and everybody has a different standpoint.
What would ultimately benefit society more - imprisoning this kid for a year, or making him teach (under supervision) underpriveleged kids how to use computers?
Strong data typing is for those with weak minds.
In the case of "(a)", I'd hope that no "high security systems" are accessible from the web. Surely the web servers are not on a network with access to sensitive data?
In the case of "(b)" the same thing applies. Would they really have a machine with access to both the WWW and sensitive defense info?
When the DOD talks about "high security" I assume this means as high as it gets anywhere. High security buildings have only one door. This makes it sound like they built a
"building" (so to speak) with thousands of doors and now they're lamenting the fact that they can't keep their eyes on all of them at once.
-
<SIG>
"I am not trying to prove that I am right... I am only trying to find out whether." -Bertolt Brecht
<sig>Guvf vf abg n frperg zrffntr
In the Netherlands crackers get caught too, but they only get a warning to stop being a naughty boy/girl. Killers will get in prison, not people who just had a little harmless fun! I used a major Dutch company's ports to send a lot of fake mail and used their servers to get even on this nazi pig I know and when they caught me, all they (the company) did was mail me back to say that they don't appreciate that stuff and ask me to please not do it again (and ended with friendly greets).
With the government and police it's more serious. The major crackerclubs here got caught now and then and the worst punishment they got was that their computers were taken from them (to analyse) and tey had to pay for the damage they did.
There's not really a big mafia here, we just get along and don't make a big fuss about nothing.
So much for the American freedom...
I worked for a company that had military contracts, and our corporate web pages had javascript -- but our firewall stripped out ActiveX/Java/JavaScript from external web sources. With ActiveX/Java/JavaScript the problem isn't usually the server, it's usually the client, right?
In any case, does anyone remember the _Far_Side_ that has the mother and son dog... the son is in Jail and the mother is visiting, saying ``You should't have chased the _president's_ car'' or something like that...
-- Erich
Slashdot reader since 1997
I admit to not knowing that much about this case, and don't have time to register for the NYT; but what that cracker did was illegal - so surely he should be punished?
.gov or .mil, it is highly likely that one day, you will be caught, especially if you are in the US.
I'm all for looking around interesting boxes on the net, but surely he must have known that whitehouse.gov is another matter, and he must have known beforehand that the consequences would be very severe.
IMHO, in a more general sense, if you are choose to compromise a computer, that's one thing, but when you change the HTML, that is just plain stupid. It's the electronic equivalent of putting graffiti on a wall: if your real information (name, address etc) becomes linked to your handle, you are in the shit. The electronic sense is even more stupid though, there are logs.
It also seems that an example is being made here. If you tread on the toes of any
Security has two sides: learning it, and becoming extremely knowledgable to the point where you are hightly employable, and the more sinister side of defacing web pages. I'll let you figure out which one to choose.
To me, this seems like justice.
Aieeee, the time.
I admit to not knowing that much about this case, and don't have time to register for the NYT; but what that cracker did was illegal - so surely he should be punished?
.gov or .mil, it is highly likely that one day, you will be caught, especially if you are in the US.
I'm all for looking around interesting boxes on the net, but surely he must have known that whitehouse.gov is another matter, and he must have known beforehand that the consequences would be very severe.
IMHO, in a more general sense, if you are choose to compromise a computer, that's one thing, but when you change the HTML, that is just plain stupid. It's the electronic equivalent of putting graffiti on a wall: if your real information (name, address etc) becomes linked to your handle, you are in the shit. The electronic sense is even more stupid though, there are logs.
It also seems that an example is being made here. If you tread on the toes of any
Security has two sides: learning it, and becoming extremely knowledgable to the point where you are hightly employable, and the more sinister, less knowlegable side of defacing web pages. I'll let you figure out which one to choose.
To me, this seems like justice.
Aieeee, the time.
After reading the article, its states that JavaScript poses a security risk. I was wondering if anyone could explain to me how does JS poses a threat on web pages.
I've never liked Javascript ever since it became too popular. Personally my Netscape has Javascript disabled, simply because too many sites pop up lame consoles without my permission and it annoys me to no end.
I view websites as repositories of information, not entertainment theatres. If you want "interactive" entertainment, you can always download Quake :-) or go to the arcade. But when I search for useful information on the Web, the absolute last thing I want to see is a site that takes forever to load, pops up endless consoles with irrelevent ads/notices/whatnot, cluttered with useless animations and "interactive" crap. Give me a break, just deliver your goods! (If you have anything other than those useless crap, that is.) When I'm looking for something, sites with Javascript, ActiveX and what-not just don't fit the bill.
I realize that many people browse the web just for fun, so these things serve more like curiosities than annoyances. But to me, there are cleaner ways to do this than with JavaScript, or ActiveX (with all its security flaws). But technicalities aside, I still think it's utterly rude for an unsolicited, irrelevent console to pop up every time I load something from a particular site.
Also, the article seems to be making the claim that HTML forms will not work if they ban Javascript?!?!?! Come on, people, CGI is NOT "mobile code", which is the question at hand! Banning Javascript is a good thing. Your CGI scripts can still work (or use Java servlets instead, if you're paranoid about security. Not that that is much more secure, though). Just cut that useless Javascript crap from your pages, the net (IMNSHO) will fare better without it.
mikre he sophia he tou Mikrosophou.
15 months for breaking into a computer. Whats the going rate for assault and battery, probably close to the same. I'm sure that people have gotten 15 months plus/minus for manslaughter. Lets look at the damage that was done here, someone posted 'j00 h4v3 b33n 0wn3d' with a list of names at the website. And now White House officials are screaming and yelling that he caused two days of downtime to their internal and external networks. I'm not a sysadmin but I know enough to be able to say that a hacked webserver should not affect a well built network to that extent. Plus, this kid is 19 years old. In our current day and age, lets be happy that he was messing around in front of his computer rather then planning to bomb his school. What will 15 months in jail teach this kid, do you really think he will come out with some positive reinforcement.
Just a quick correction:
He did not deface the Whitehouse webpage. He denied it, he knows who's responsible but refused to name them. (read Hackernews, www.hackernews.com) as an example.
I don't like the idea of limiting him to "3 years without a computer". I think that the laws are very vague on the definiton of what a computer is. Can he use an ATM machine? Work at McDonalds? Or operate any Point-Of-Sale system for that matter? Prison is supposed to reform prisoners, but denying someone computer access (not internet access) is like denying someone a way to make a living, and a lot of good that does to help them fit back into society again.
-=- SiKnight
there once was a time and place for system hacking/cracking, but it is no more... if you're interested in security, play with your own machines, or do something useful with their skills. of course, there is one resource available to these snot-nosed script kiddies that wasn't available before. that is the ability to crack systems with little or no knowledge of the inner workings of the system. it's kinda frustrating to look back and think about the time put into a problem in the "old days" and to see these kids using windows and "xploits" or whatever to crack remote computers in a matter of minutes.
-
out.
--bc
-----------------------------------------
the amazing bc
latin/funk flugelhorn & trumpet
webnaut, music junkie, sysadmin from hell
the amazing bc
just another guy doing IT
webnaut, music junkie, holes-in-head
Unless he wanted to go to jail...
Who in their right mind would try to do that? Isnt it basically akin to walking up and spray painting the white house?
I know what would be worse than jail for this guy, make him watch some "educational" videos on how hacking is "bad".
Or let Clinton boot him like the aussies tried to do on the simpsons...
icq:=22921393;
and when was the last time someone got 15 months for spraying graffiti, and be banned from using any kind of paint for 3 years?
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
Hacking originally was smart solutions for problems. (for example the coke-machine trick)
Hacking and entering is when a hacker enters a system, reads and changes data. Ie you hack a website, you dont crack it.
Cracking has always been to crack copy protection. Cracking has nothing to do with hacking.
Lost Carrier
Lost Carrier
http://www.geekboys.org
Questioning the decisions that Government makes, and the laws they pass, is supposed to be a central element of a functioning democracy. Yet if we're supposed to remain silent when it seems that those laws have led to bad or inappropriate consequences, the whole exercise is futile.
--
Xenu loves you!
Quote from Excite article: But without the popular code, Web sites become largely passive and unable to deliver the most basic interactivity.
;)
Just what exactly is 'interactivity' defined as here?
Most 'interactivity' can be achieved through well-coded HTML/forms and server-side code such as PHP3 or perl (hell, even a shell-script with CGI).
Perhaps 'pointless memory-hogging eyecandy' might be a better expression for most of the 'interaction' that Javasctipt/ActiveX offer
... if it doesn't work with lynx, it doesn't work at all, IMHO.
--
Yeah, that was very confused. I also couldn't see why people were worried about DOD sites not being 'competitive', whatever that was supposed to mean. I don't see that the military really should be involved in any kind of war for eyeballs (pun intended, and it made me cringe, too), so what does it matter? It's not like they need to make $$$ from their sites...
From what I gathered about classified networks during some of my job interviews a while back, they are kept very seperate. There were two ethernet jacks everywhere, a black one for the unclassified network, and a red one of the classified network. Managed hubs kept the hardware ethernet addresses in a database, so if you took a classified computer and pluged it into the black jack, it would not work, and vice versa. Most employees had two computers if they needed access to both networks. So, my point being that there really is no threat of outsiders getting access to classified information, because there simply is no path to the information. The external webservers are undoubtably on the "black" network. From what I remember, the "red" network is interconnected between sites, but is competely seperate, so I could use my "red" desktop to access other classified computers in another state (this was NJ to DC). And to relate this to the story, I really did not understand the point it was trying to make, very poor story. praXis
--
They still have cgi scripting and stuff like Flash.
Since I'm not a web developer, could someone who is explain what ActiveX adds besides M$, and what JavaScript adds that can't be done with the above.
Also, keep in mind that if the DoD websites have JavaScript and ActiveX, so do the DoD client computers.
The Department of Defense is considering banning all JavaScript and other mobile code from
military Web sites because the tools could pose a security risk to its computer systems.
If they want to keep security tight they should disable ActiveX and JavaScript on the workstations used to access at the DoD. Banning scripting on their web pages will do nothing. After all if a hacker breaks into a site the hacker can easily add a script to the site.
"Your sites will end up being less competitive overnight," Plummer said, adding that a
complete ban on all mobile script capabilities could lead to a Web presence that does not
permit online chats or the filling out and sending of online forms.
This is totally wrong. You don't need client-side scripting to make chat rooms or fill out forms. Server-side scripting (CGI for example) is adiquate. Sure you can't make a stupid little bear dance across the screen but who cares?
To give an example the tripod chat at chat.tripod.com even works with Lynx. So much for needing JavaScript or ActiveX.
In any case if you want to protect security disable ActiveX first. It basically allows anything to happen to your computer without your knowledge. Disable Java and JavaScript later. Some code might exploit a security hole in Java and might be able to cause some damage.
There are two interesting pieces here, one, the government is obviously trying to save face and stave off some future attempts. Second though, and more interesting to me is that here is an example of some kind of reasonable thought happening, in that they gave Java and ActiveX a shot, found them in-secure in the implementation they needed and are re-evaluating the validity of their use. Neither MS or Sun or anyone's spin team are able to talk their way of of reality and in the end this hack does show that. In reality the defacement hack should be a warning that more serious attacks can be made while the current setup exists. I belive that this makes putting him in jail a bit of an extreme response, punish him, sure, but see the light of his actions and their implications in regard to your systems.
Prehaps he should have had a look at this article before handing the feds a confession...
Anyway - 15 months for a defacement??? OUCH...
To the fool, he who speaks wisdom will sound foolish. ---Euripides
I would just like to point out, that by your definition, most of us have broken the law today. If you drove your car anywhere today and went even 1 mile per hour (1Kph) above the speed limit you are just as guilty, by your own defenition.
Granted the guy didn't pick the best way to expose a security flaw, and I do not condone his activity. I think he accomplished his objective.
Let ye free of sin cast the first stone.
It means MORE to the US government to squash a computer hacker than imprision a REAL criminal (the president). I mean COME ON!! This justice BS is getting out of hand. The kid did not do anything to harm the country or anyones personal being so why is he being imprisoned?? Now if u look at good 'ol Bill, he LIED under oath and committed a REAL crime but never was punished for it. I dont think malicous hacking is a mature thing to do, but I sure as hell dont think it is a crime punishable by prison. If you dont want to haxed then get your box off the net, or learn how to admin the SOB.
- Crackers (who think they're comp. science professors, which they are not)
- Gamers, chatters and surfers wearing beanies
- MTV crackers
- Crackers in movies like The Net (quote from The Net: "She copied the disk! Clever girl...") and Hackers (they used Mac laptops and played a game in which they flew through skyscrapers to hack into a computer: "Oh no, they're reaching the kernel!" and "Is that all that you have?!" as if you can hack more intense)
- So-called Windows freaks
If we extract those fake geeks from the real ones, there aren't many left!actually, I think the punishment makes them look MORE stupid.. a LOT more.
//rdj
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
Form handling and interactivity require Javascript and ActiveX? Maybe the GartnerGroup really are bunch of Microsoft stooges. Hasn't he ever heard of PERL? HTMLScript? PHP? C/C++? Director? Etc. (and sorry for the others I missed)? Which time capsule did this guy crawl out of that he thinks interactivity requires Javascript and ActiveX? Get a grip Plummer!
Form handling and interactivity require Javascript and ActiveX? Maybe the GartnerGroup really are bunch of Microsoft stooges.
Hasn't he ever heard of PERL? HTMLScript? PHP? C/C++? Director? Etc. (and sorry for the others I missed)?
Which time capsule did this guy crawl out of that he thinks interactivity requires Javascript and ActiveX?
Get a grip Plummer!
Yes, what he did was illegal (and collassally stupid -- poke a grizzly in the eye and you'll probably get mauled), BUT the severity of the sentance (and of sentencing requirements) for cracking into web sites is completely out of line with the seriousness of the crime.
1) If someone "breaks into" a computer it is not the same as breaking into a person's home. There is no physical threat present, and monetary damages have other aveneus for recompense.
2) A government or corporation operates on a completely different fiscal scale than an individual. $40,000 in damages to a large corporation is tiny (even microscopic when the government, with its $5 trillion budget, is the target. Whereas for an individual that is allot of money -- often more than one makes in a year. It is bad enough that corporate America is the recipient of enormous tax breaks, development grants, and other forms of corporate welfare, not to mention preferred status when it comes to legal and economic rights, but to eqaute a $10,000,000 corporations $40k loss with an average individual's $40k loss is really absurd.
3) Most of the "damages" this particular cracker is being accused of amount to fixing security flaws which already needed fixing. How would it have been if, instead of a punk teenager, cybersquadrons working for Slobodan Milosovic had cracked the site instead? They needed to fix their security regardless of what this kid did -- the only "damage" they can reasonably accuse him of causing is the time needed to recover the old web pages from backup and put them back on the server. The rest was work they needed to do, anyway -- sticking this cracker with the bill is extremely unjust.
4) Oh, they didn't have backups? Well, to blame that level of stupidity, incompetence, even negligence, on a cracker (however malicious) goes well beyond absurd.
Cracking is wrong. It should be punished. But to equate it with real-world breaking and entering, and to argue that financial damages which are miniscule to a large corporation and governments are the same as those for an individual of modest means and should be punished the same, is to toss justice to the winds and replace it with an ugly form of modern corporate witchburning.
Alas, while cruel, this kind of crushing penalty for individual misdeeds against a large corporate or government entity is hardly unusual in this country, so it is unlikely that this cracker will succeed in appealing his sentence on the grounds that it is "cruel and unusual."
The Future of Human Evolution: Autonomy
And this was "Insightful" how?
Oh good, an unfounded opinion with no supporting evidence...
...followed by an incomprehensible statement. So either you don't want things to change at all, you're missing some key words in there, or you're using "now" to mean two different timeframes.
As a comment this isn't too far from the average /. comment posted here. But it's definitely not "Insightful". I've read it five times and still have no insight into what the author was getting at.
[even more OT] While I'm ranting, what's up with everybody cutting and pasting their signatures at the bottom of their posts? If you have a /. account, you can put your signature in the space provided on your user page. Then other readers can turn off signature displays in their user profiles, and not have to download and view signatures. If everybody just pastes their signature lines at the bottom of their messages, then the system doesn't work.
OK, I think I'm done now.
Your right to not believe: Americans United for Separation of Church and
...because if internal web pages require ActiveX or Java for navigation, most users will leave those features switched on all the time, even when surfing untrusted sites.
If internal sites no longer require mobile code to be executable, then it will be easy (well, easier) to disable those features in the browser permanently with little impact on legitimate use.
Maybe I'm judging too harshly, but hey, I've just been asked to spell 'ls' by one of my users...
The notion of people reforming in prison is nice, but it just doesn't happen. Yes, you see the occasional article about it,which is exactly the point: it's so rare that it's newsworthy when it happens.
Prison renders criminals incapable of committing crimes for some period, and it punishes them. The criminals that do go straight usually do so because, in a moment of lucid thought, they realize that if they don't commit any more crimes, they don't have to go back! This is obvious to most of us, but a revelation to a large portion of the population in question.
This doesn't mean that we shouldn't try to teach them useful skills: this changes the choices that they're making about whether or nto to commit more crimes. But for Heaven's sake, please don't put the white collar criminals inthe same prisons with the regular folks--we don't want them cross-polinating.
While I'm at it, prison *is* cost effective for felons. I wish that I had a nice cite for it handy, but studies have shown that the financial losses alone from the crimes commited by felons are lowerthan incarceration costs. We pay taxes to lock them up, butwhile lose, they inflict a random tax.
I have been recently accused of a crime. While changing lanes on a state highway, I was struck by a vehicle that apparently attempted to pass me on the shoulder before I completed the lane change, ran out of shoulder, and struck my car. Because I was struck in a manner that appeared to indicate that I hadn't checked my blind spot, I received a traffic ticket for illegal lane usage. That is a crime. While supposedly a minor offence, the ticket clearly states "People of Illinois vs. ". Furthermore, contrary to popular belief, I am NOT guilty until proven innocent (of a traffic violation). In fact, if I so chose, I can elect a trial by jury. Us accused criminals do have rights (at least in the U.S.) It should be clear at this point that I am fighting this charge and maintaining my innocence (yes, I signalled, checked my blind spot, etc). But, if found guilty, I will forever have to admit that I am a convicted criminal (on job applications, to immigration officials while travelling, etc.) While most wouldn't bother, failing to do so is fraud (and possibly purgery), for which the punishment can be much more severe than the $75 fine I received. For example, I could be fired from a job for lying about a criminal past on an application, etc. Sure, it would be an unreasonable thing to do, but we all know that zealotry comes in waves, and technically I would be in the wrong. Since I don't particularly like the stigma associated with being a convicted criminal, and believe myself innocent of any wrong-doing, I will fight this. Legal fees will likely run from $180 up, so clearly it isn't a matter of not wishing to fork over $75 (which I would consider a reasonable fee for the service the police rendered in recording the accident for insurance purposes, if I didn't have to admit guilt). In Liberty, Rene S. Hollan P.S. in Quebec, Canada, asking to see a warrant or what one is charged with can be "reasonably" construed as delaying the process of law enforcement, and usually results in an additional charge of "obstructing justice" (which would probably not stick, but can lead to an immediate arrest). I've seen this happen to a poor black kid (Blacks and Montreal police do not mix) who was a few minutes late getting the last student-fare bus to go home and was arrested for trying to defraud the bus company by not paying full fare. It disgusted me to see the police respond to the bus driver's call with no less than six cops in riot gear to arrest what appeared to be a ten-year-old. Sadly, I did not have the courage to stand up to this blatant abuse of police power at the time.
I have been recently accused of a crime.
While changing lanes on a state highway, I was struck by a vehicle that apparently attempted to pass me on the shoulder before I completed the lane change, ran out of shoulder, and struck my car.
Because I was struck in a manner that appeared to indicate that I hadn't checked my blind spot, I received a traffic ticket for illegal lane usage. That is a crime.
While supposedly a minor offence, the ticket clearly states "People of Illinois vs. ". Furthermore, contrary to popular belief, I am NOT guilty until proven innocent (of a traffic violation). In fact, if I so chose, I can elect a trial by jury. Us accused criminals do have rights (at least in the U.S.)
It should be clear at this point that I am fighting this charge and maintaining my innocence (yes, I signalled, checked my blind spot, etc).
But, if found guilty, I will forever have to admit that I am a convicted criminal (on job applications, to immigration officials while travelling, etc.) While most wouldn't bother, failing to do so is fraud (and possibly purgery), for which the punishment can be much more severe than the $75 fine I received. For example, I could be fired from a job for lying about a criminal past on an application, etc. Sure, it would be an unreasonable thing to do, but we all know that zealotry comes in waves, and technically I would be in the wrong.
Since I don't particularly like the stigma associated with being a convicted criminal, and believe myself innocent of any wrong-doing, I will fight this. Legal fees will likely run from $180 up, so clearly it isn't a matter of not wishing to fork over $75 (which I would consider a reasonable fee for the service the police rendered in recording the accident for insurance purposes, if I didn't have to admit guilt).
In Liberty,
Rene S. Hollan
P.S. in Quebec, Canada, asking to see a warrant or what one is charged with can be "reasonably" construed as delaying the process of law enforcement, and usually results in an additional charge of "obstructing justice" (which would probably not stick, but can lead to an immediate arrest). I've seen this happen to a poor black kid (Blacks and Montreal police do not mix) who was a few minutes late getting the last student-fare bus to go home and was arrested for trying to defraud the bus company by not paying full fare. It disgusted me to see the police respond to the bus driver's call with no less than six cops in riot gear to arrest what appeared to be a ten-year-old. Sadly, I did not have the courage to stand up to this blatant abuse of police power at the time.
I'd think the security hole is the use of IIS, not Acive X/JScript. It's probably the most, and most easily hacked server software on the planet. If they are trusting security to NT/IIS I believe it is the sysadmins that deserve prison time. Remember, the only real security is made with scissors.
Sod 15 months.. I'm sure anyone that tried to graffiti the side of the White House wouldn't make it as far as the driveway before becoming a disfiguring red stain on the wall.
As a result, he gets 15 months in jail, is banned for doing any kind of painting (even though he would have been hot in the advertising industry), and is billed for a brand new window, as well as the new metal bars put in front of the window, on the outside, and the new security system put in all points of entry to the store.
Now, imagine that the "store" in question was the White House...
Sure, what happened was illegal, but it also goes to prove several things (that we already knew), such as 'the "superior" shall not be defaced', 'the White House is no normal shop', etc. However, I also believe that the US often strikes too hard, too fast, without thinking. It's an "eye for and eye" mentality, driven by the adrenalin rush, rather than thinking of the best of society. I am pretty certain that I could easily have fallen into the same hacking pattern myself, while I was in college, had I not been given the RESPONSIBILITY of administering one of the servers. In other words, I was put on the other side of the entire issue, worked together with administration, I had other people try to hack into the system (provided that they didn't destroy anything), etc. In other words, with the responsibility given to me, I turned lawful. But without such responsibility, if I was to be concidered "just a little kid who shouldn't have access to none of this stuff", there is no doubt in my mind that, in order to make use of my skills, I would turn to the more illegal side of computing.
And again, this is where I see the US going in the wrong direction. The country is generating criminals by treating its skilled residents as fools, and supressing them, rather than recognizing and giving them the tools to use their skills, in such a way that they'd also feel that they were part of BUILDING the country.
That being said, I am sure I will now be tremendously flamed for whacking down on the allmighty US of A.
Also, if this is indeed the case, it doesn't take a web page defacement to gather that they're stupid anyway.
--
--
Me spell chucker work grate. Need grandma chicken.
(They're my favourite consulting firm. Really. Very entertaining when there's nothing else to read.)
I dunno: many of the sites I visit (and the ones I implement) seem to manage fine without any mobile code whatsoever.
This is a bad thing?
(a) Untrue; (b) Since when was the DOD competitive?
BTW: has anyone seen mention of any kind of class action lawsuit against MICROS~1 for their criminal negligence in design and implementation of security models in their internet and web tools?
In more usual crimes like physical vandalism or arson, laws are needed to prohibit them because there's no other way to stop these crimes. (There's no such thing as totally spray-paint resistant walls, for example.) Laws are meant to stop crime by punishing it. They are not perfect.
:-)
In recent years, the same philosophy has been applied to information crimes like hacking. The difference is that there is such a thing
as a hack-proof web site. If the goal is to stop hacking, the best way to do it is to make your web site hack-proof, not rely on the incredibly inefficient legal system as a deterrent. (inefficient: how much does it cost for the judge, court staff, courtroom, lawyers, etc. to prosecute a single case?)
As society changes, legal philosophies need to change too. (c.f. the FSF.
As a side note, 15 months in prison? For a 19 year old who was able to put some files on a disk in Washington because the web site designers didn't do their jobs correctly? How many lives did he put at risk? Give me a break.
This Cracker is going to be SLAMMED by the gov't just for his arrogance of "I h4x0r3d your site so ha! ha! ha!". So now the Feds want revenge and to teach this guy a lesson he'll never forget. The law is already waaaay out of the picture by now. This is a personal vendetta. And if you don't believe me that this is so, walk up to a cop and flip him the finger. There's no law saying this is illegal, yet watch what kind of massive retalliatory punishment settles upon you. Will it be disproportionate to what is not even defined as a crime? You bet. Is what's happening to the cracker any different?
What if the hacker put up something really inciteful, like slurs against other countries?
Fine. If someone does that, they should be held accountable. What does that have to do with this case? Should the lawyers prosecute him for something he could have done, but didn't? As for making the country lose face, how is it his fault that they had crappy security? I'd say if anyone caused anyone to lose face, it's the admins responsible for the website. They were the ones that didn't have a secure box. Maybe they think they shouldn't have to worry about security because they can just prosecute anyone that makes them look bad. God help us if the military starts thinking this way.
"What do you mean the missile missed? The target moved?! Dammit! Get the legal department on the phone! Those bastards are trying to make us look bad!"
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
Posting anonymously, for hopefully obvious reasons.
Though I can't comment on the attack he was charged on because I have nothing to do with that site, I do administer a site he also attacked, and we cooperated with the investigators in Virginia.
In our case, he cracked root on several machines, set up sniffers, messed with our name server, and caused a lot of havoc. The main goal appears to have been to change our web page, but he did a lot of damage along the way.
So, don't assume that "just changing the web page" is a minor thing or is easily fixed. There could be a lot more to the story.
People have to know that this stuff is wrong. It's right up there with breaking into a house and vandalizing it.
Wow! I went to school with this guy and have known him since ... 2nd grade I think. We even played on the same soccer team as kids. Craziness. I wonder if he's gotten a job offer from the NSA? He has the working resume that should enable him to get in... ;~) /.? Oh well... enough clues there for someone to figure out who I am probably.
Hey Eric, best of luck to 'ya in your new job! Just don't store work files on your home PC, k?
PS How good is anonymous posting at
Well, the problem is that when you get too paranoid about security, you end up with less security.
In the China nuclear spying cases it turns out that the nuclear scientists had secure systems on their desktops right next to the insecure ones, but by the time a pc model gets certified for secure work it is obsolete. So, you can either wait for your secure P90 to grind out results or you can rock on your PIII/500.
I wouldn't be surprised if there were similar issues in the military of people trying to get their job done by working around the regs.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Your point? If you were to be blunt enough to stroll up to a peace officer and explain your inner feelings towards him via your middle finger, would you really expect him to ignore you? Hacking any governmental site is dumb. Getting caught is dumber. Being dumb is bad.
semantics are everything!
So, if I understand the legal thinking behind this:
Masturbating on the White House Lawn is far more Bad{tm} than masturbating on your common, everyday suburban front yard lawn.
In order to make that point, a judge could sentence you to non-use of your penis for 3 years.
======
"Rex unto my cleeb, and thou shalt have everlasting blort." - Zorp 3:16
Sacred cows make the best burgers.
I wish everyone would stop insisting that this kid did nothing wrong here. He broke into a web site and caused people a lot of grief. He knew what he was doing, and he was aware of the consequences.
Is it just me or is denying someone use of a computer for 3 years some sort of infringement on the individual's rights? Yes he committed a crime. He is being punished for this already. I'm a bit confused as to how it is legal for a judge to forbid someone from using a computer.
Is someone who steals from a convenience store forbidden from shopping in a store after they get out from prison?
Are there other examples where someone who commits a crime can be denied freedoms after they serve a prison sentence?
i got this dialog on irc:
doodz 1: dude! they got eric! shit!
doodz 2: let's not hack another site again! agree?
doodz 1: i'll never touch a computer again!
do you think that by punishing eric will makes the kids stop. hell no! the only action that 2 of eric's friend will do is cr|h the site again. and this time they will make sure they won't get caught. i'll bet on all of my $34.98
--
You're a cartoon of rebel! You're all like exaggerated version of yourself! - Gerard Jones
illegal? yes. but never says it has no practical value. these kids shows what terrible security the sites had.
you are saying that give e-mail to the admin saying that they got a bad security. i have try that. it doesn't work. check www.djakovo.net. i have given them e-mail for the past 3-4 month. then came SysEdit. i keep telling them...but they won't listen.
--
You're a cartoon of rebel! You're all like exaggerated version of yourself! - Gerard Jones
Does anyone know anything about the origin of this person's nom de hack: 'Zyklon'?
The association that I made immediately is with 'Zyklon B', the trade name of the agent used in Germany to gas Jews during WWII.
Whatever his crimes or misdemeanors, his choice of hacker name instantly diminishes his credibility with me.
Sack Sysadmins who can't rebuild in the time a full restore could be done. Assine remarks - the belts and braces approach - reinstall everything indeed is for LCMs. There are smarter ways to rebuild a compromised system - like running rsync against a master image. The audit log, duplexed , will be trustworthy, as will any file checksum/alterations. If you dont trust these - then get a better operating system, as well as paying overtime to people who are supposed to administer security (LOG CHECKING BY ANOTHER NAME) This assumes you have a backup strategy and disaster recovery process in place, as well as QA and change procedures, and can competently do partial restores, as well has having some automatic rebuild scripts.
Thats why something like tripwire exists. All you gotta do is a partial restore of the affected files and reboot ; after fixing the problem so it does not come back; The author claimed excuses for not being on top of the situation. I find subscribed security alerts beat kiddy hacks like this every time. I know that there are more holes - that the non-kiddies know about, that are most hush hush. It pays to be across the holes in several OS's, as similar tricks ripple through. The resources to punish would be better directed to education.
Surprise surprise. What do you know? The right to silence, and the right to an attorney are pretty well enshrined in a very high proportion of all first world countries, including most of Europe, and Australia, Canada, etc.
Enough with the ego massage.
Open Source. Closed Minds. We are Slashdot.
This sentence has its corollary: Thou shalt not tempt.
Quite obviously, it's time Her Britanic Majesty lent her webmaster to the ex-Colony to teach the Presidential and many other system admins how to do their jobs so that they do not tempt the country's citizenry. Number one is to teach the admins how to restore a system from backup in less than Two Days! For goodness sake, can't you do it properly even on the Head of State's server? It's not the hacker's fault that the sysadmins are a bunch of utter no-hopers. Now update the o/s on www.whitehouse.gov to somthing a bit more modern and the Web server to something a bit more secure.
telnet www.whitehouse.gov 80
Trying 198.137.240.92...
Connected to www.whitehouse.gov.
Escape character is '^]'.
HEAD / HTTP/1.0
HTTP/1.1 404 Not found
Server: Netscape-Enterprise/3.6
Date: Wed, 24 Nov 1999 09:05:13 GMT
Content-type: text/html
Connection: close
Netcraft tells me that the o/s is Solaris.
contrast this to:-
telnet www.royal.gov.uk 80
Trying 193.32.28.66...
Connected to www.royal.gov.uk.
Escape character is '^]'.
HEAD / HTTP/1.0
HTTP/1.1 200 OK
Date: Wed, 24 Nov 1999 09:53:44 GMT
Server: Apache/1.3.3 (Unix) (Red Hat/Linux)
Last-Modified: Wed, 03 Nov 1999 12:23:59 GMT
ETag: "e808-2214-3820295f"
Content-Length: 8724
Keep-Alive: timeout=15, max=100
Content-Type: text/html
Connection: close
Connection closed by foreign host.
The first is a real temptation the second is not anything like as bad.
In spite of he misdemeaners; what the Ultimately Satanic Area has done to this young boy is totally over the top. A free society? HoHum! I hope that the AC account really _is_ anon. Oh well we'll soon find out.
Hi just wondering if anyone could provide me with a copy of the article referenced here, I can't seem to find it online anymore (or not free anyway). thanks