Comments on: Exposing public corporate cock-ups is not "hacking"

By: Brad Bell

Brad Bell — Thu, 21 Mar 2013 13:40:00 +0000

Gosh. It makes me reconsider my actions ‘hacking’ around ft.com’s paywall. I was, however, careful not to tell anyone else how to do it. I’m not a hacker. It’s something my mom could do. (She’s nearly 80 and thinks Facebook is the internet.) For the record, I didn’t actually do the ‘hacking.’ A giant US mega-corporation did the hacking (for profit), I simply took advantage of it to ‘steal’ the FT content and store it in memory. I have not profited from the knowledge I’ve gained – just become more depressed.

Note: this is a true anecdote that is phrased to make it sound criminal and intended as an ironic parallel. If it were criminal we’d have to ban search engines.

By: Daemonworks

Daemonworks — Wed, 20 Mar 2013 21:26:00 +0000

Besides, he didn’t just walk in, he walked in and rummaged through your underwear drawer, then went around the neighbourhood telling folks what he found there.

I’d say the sentencing is a little excessive, especially in light of the fact that raping a drunk girl, filming it and putting the video online gets you a year and tons of sympathy from the media.

By: Cowicide

Cowicide — Wed, 20 Mar 2013 20:42:00 +0000

I definitely think AT&T should be charged with indecent exposure.

They're definitely perverted.

By: Cowicide

Cowicide — Wed, 20 Mar 2013 20:37:00 +0000

By your logic, it should be a crime to look into a storefront window as you pass by and inform others you noticed a fire and/or dangerous structural issues inside.

By: Ethan

Ethan — Wed, 20 Mar 2013 19:49:00 +0000

Setting aside the joy of nitpicking, do you really think there wouldn’t have been a difference in whether the prosecution moved forward or the severity of the sentence if Weev had only accessed one email address?

By: dragonfrog

dragonfrog — Wed, 20 Mar 2013 19:32:00 +0000

He didn’t even use a security flaw. He notified the operators of a website, that their website configuration was incompatible with browsers configured to behave securely. That is all he did.

Just for that, the DHS investigated him for hacking. That is clearly a ridiculous overreach.

In conclusion: R. T. F. A.

By: dragonfrog

dragonfrog — Wed, 20 Mar 2013 19:28:00 +0000

See above – follow the whole thread. The comment you reply to, is itself in reply to a comment, and the actions I refer to as vandalism are the ones described in that comment (and done by someone else, not Weev).

By: lishevita

lishevita — Wed, 20 Mar 2013 18:44:00 +0000

He didn’t vandalize it. Vandalism involves some sort of destruction or defacement.

What he did was equivalent to writing a web spider that uses the way that web server software is written to go find all the web pages on a server and then index them. That’s not illegal. It’s just using the software the way it was written. He didn’t destroy anything. He wrote a script that used the software that AT&T wrote.

By: Ethan

Ethan — Wed, 20 Mar 2013 18:43:00 +0000

Hmm… Brad wasn’t prosecuted. Do you think he might have been if he used the security flaw 100,000 times?

By: Fogbert

Fogbert — Wed, 20 Mar 2013 18:31:00 +0000

Honestly? Once.

He didn’t have a legitimate reason to spoof the website and, just because it’s possible, isn’t a good enough reason.

By: Punchcard

Punchcard — Wed, 20 Mar 2013 18:17:00 +0000

Toooooooobs!

By: EH

EH — Wed, 20 Mar 2013 18:09:00 +0000

AT&T has made sure that there is no crime that they could be charged under for this.

By: EH

EH — Wed, 20 Mar 2013 18:09:00 +0000

So where do you draw the line in your analogy? How many times is too many?

By: Boundegar

Boundegar — Wed, 20 Mar 2013 18:09:00 +0000

Yknow, if I had the Secret Key to the Internet, I don’t think I would tell anybody. I would try it out behind 47 layers of proxies and crypto-thingamajigs, and if it was for real I would have a long hard think. Will I use this gizmo to rob banks? Will I disclose it to somebody who can patch it? Or will I post it on 4chan and say, “Have at it, boys!”

But regardless, I would be very very careful about leaving clues to my identity. I do not wish to be a celebrity, especially the kind behind bars.

By: EH

EH — Wed, 20 Mar 2013 18:06:00 +0000

Where is the private property line of a website? What constitutes the curtilage of a website?

By: EH

EH — Wed, 20 Mar 2013 18:05:00 +0000

Definitely in the “control the language/discourse” department.

By: Boundegar

Boundegar — Wed, 20 Mar 2013 17:59:00 +0000

Yes but they were fine upstanding young men with their whole future ahead of them, while weev is a DFH, and he has a beard.

By: signsofrain

signsofrain — Wed, 20 Mar 2013 17:43:00 +0000

I agree completely. What I am asking is, in Weev’s case, did he really give AT&T the chance to fix the problem before going public with it? If he didn’t at least give that cursory tug on the sleeve, he was wrong to release anything. I have NO problem with security vulnerabilities being released if they’re reported to the company and the company ignores it first. I do have a problem with active vulnerabilities being released on the internet where real evil-doers can get at them without a chance for the vulnerability to be addressed first.

Weev said he told AT&T about it, AT&T (and presumably the court that convicted Weev?) say he didn’t.

In one case, I’d disagree with the conviction, in the other I wouldn’t. I’m willing to believe that Weev did the right thing, but I find it just as easy to believe that he’d stick it to AT&T for the fun of it. I can’t find evidence either way, only contradictory information in news articles. I’m just curious if anyone out there can claim to know the real story.

By: dragonfrog

dragonfrog — Wed, 20 Mar 2013 17:34:00 +0000

Check the comment I’m replying to – it’s specific to the example of someone defacing websites for lulz, just because the shared hosting provided didn’t properly isolate user content.

This isn’t a hacker reading a file, maybe adding an HTML comment (not rendered in the browser) to confirm the ability to write, maybe getting permission from a fellow service user to do a demo hack on their site, and in any case contacting the service provider so they can fix the problem.

By: dragonfrog

dragonfrog — Wed, 20 Mar 2013 17:29:00 +0000

It’s not even really comparable – Brad Hill didn’t even do a dubious thing 1 time. The thing that Weev did – obtaining information he probably shouldn’t have had – Brad did exactly 0 times. And still he was threatened with crushing legal action.

By: SomeGuyNamedMark

SomeGuyNamedMark — Wed, 20 Mar 2013 17:16:00 +0000

I thought it was pipes?

By: Punchcard

Punchcard — Wed, 20 Mar 2013 17:14:00 +0000

I once sat and looked at the internet from a public place. Turns out it is just a bunch of wires. I couldn’t see any data at all.

By: Nimdae

Nimdae — Wed, 20 Mar 2013 16:31:00 +0000

And just after I post the same analogy, I see someone else beat me to it.

This is precisely it.

The punishment does not fit the crime. I have a hard time even agreeing a crime was committed by Weev. If anything, AT&T should be charged.

By: Gilbert Wham

Gilbert Wham — Wed, 20 Mar 2013 16:30:00 +0000

The point is, large companies have a well-earned reputation for not giving a fuck about security breaches when ‘little people’ tug on their coatsleeves and tell them about it. Because it would hurt their bottom line to fix it, and it doesn’t need fixed cos nothing bad’s happened, right? That really, really is how they think. And then someone embarrasses them and hurts their bottom line and they go into full attack mode. Because… actually, I don’t know why because.

By: Nimdae

Nimdae — Wed, 20 Mar 2013 16:25:00 +0000

This is not the same thing at all.

If you leave your curtains drawn and decide to get undressed and someone sees you, that person is not violating any laws. In fact, if that someone were a police officer, he could fine you for public indecency or something similar. In the case of AT&T, they should have received some punishment for violations of their own privacy agreements with their customers.

In this case, however, a person looked in, went to let them know the window was open, and was charged with rape. Well, except he’s getting a harsher punishment than rapists, apparently.

By: danegeld

danegeld — Wed, 20 Mar 2013 16:19:00 +0000

What about the 4th amendment? If the data is visible from a public place on the internet, does AT&T have any reasonable expectation of privacy?

By: Peter

Peter — Wed, 20 Mar 2013 16:16:00 +0000

I don’t know, if I left my door open and somebody dropped by with a burger and a knife, I’d be pretty pleased.

Unless the burger’s tough, and that’s why you need the knife?

Then I wouldn’t be so pleased.

(Yeah, it’s obvious what you meant, and I agree, I’m just having fun)

By: SomeGuyNamedMark

SomeGuyNamedMark — Wed, 20 Mar 2013 16:15:00 +0000

Nothing new here. So AT&T messes up and gets mad at the person who pointed it out. Blaming the accuser for catching them doing something bad is something people learn to do as kids.

By: danegeld

danegeld — Wed, 20 Mar 2013 16:11:00 +0000

I think it sets a bad precedent. I’ve occasionally written scripts that pull files off websites by enumerating URLs, which is the same thing that Aaron Schwartz did. Fortunately I picked people who don’t monitor their traffic too closely. I think the bar for criminal prosecution needs to be raised somewhat. AT&T are responsible for securing the data they process, and their lapse has gone unpunished. Perhaps a civil suit could be filed against URL hackers to recover expenses dealing with the fallout, but jail time and a criminal record seems disproportionate.

By: Ethan

Ethan — Wed, 20 Mar 2013 16:07:00 +0000

I hadn’t meant to imply that Weev would have a get-out-of-jail-free card if he hadn’t gathered 100k names. Sure, if a law applies to doing it 100k times, then clearly it also applies to doing it 1 time. However, at least for me there is a difference. I have a lot more sympathy for Brad Hill and would easily believe he had the best of motives. With Weev, I can’t fault someone for wondering if perhaps there was some reason why he went to the effort of collecting so much data.