Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tampa teen accused of being ‘mastermind’ behind Twitter hack

wfla.com

Post reply on HN
Print view View original

611–620 of 702 posts

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#611

Post by agumonkey »

nickff wrote: post #183
slg wrote: post #140

Earlier quoted context omitted.

The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.

From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.

Anecdote:

working at a court room I was bemused by the security talks about usb keys, yet the OS setup still allows usb driver installs automatically (granted their local presence). I know because I brought a keyboard to replace the busted one they had in-house and windows gladly set up everything plug`n`play.

I wonder if OSes have actual rules for this, and if there are secure corporate usb keys

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#612

Post by bryanrasmussen »

tomp wrote: post #609
bryanrasmussen wrote: post #601

Earlier quoted context omitted.

No one deserves any blame for being burgled when leaving their front door opened - however if a bank leaves the vault open they deserve blame because what's in the vault is not just theirs. Twitter left the vault open.

They absolutely deserve the blame. At least if I was an insurance company, I’d definitely put that in my contract.

Ok well, according to this https://www.awinins.ca/blog/am-i-covered-if-i-leave-my-front...

"As long as it can be established that your possessions have been taken without your permission most policies will pay out on a claim even if your front door was unlocked or your window open."

so - as it says later "Familiarise yourself with the terms of your policy" which I guess would lead me not to buying insurance from your company.

Aside from that allowing insurance companies to determine who 'deserves blame' seems to run counter to the common perception regarding the moral worth of insurance companies.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#613

Post by m463 »

Taek wrote: post #131

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? If a 17yo could do it, I'm sure a nation state could do it.

A nation state would more likely facilitate a 17yo doing it.

Do you really think Lee Harvey Oswald acted alone?

:)

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#614

Post by m463 »

VWWHFSfQ wrote: post #537
Taek wrote: post #131

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? If a 17yo could do it, I'm sure a nation state could do it.

> Hitting a 17yo with 30 felony charges feels a bit steep to me. Hitting them with 30 felony charges is perfectly reasonable/correct. Those are what the charges are for the crimes. But the punishment for those 30 felonies should/will be adjusted down. I think at most this person will lose 5 years of their life. Not like the 25 year old girl in Seattle that set a bunch of Seattle Police cars on fire during the protest…

I think physical violence is (and should be) treated more harshly.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#616

Post by dyslexit »

ehsankia wrote: post #535
montenegrohugo wrote: post #27

If this turns out to be true, then we can conclude two things: 1. It's incredible that the security of Twitter allows for a solitary 17-year old to gain full access to (any) account. 2. This also explains why the profit of the hack was 'only' ~$100k. Many speculated about how incredibly valuable such a hack could be and how much more a group could have profited from this hack. Using it for two hours of bitcoin scammi…

Wasn't there one more person involve (Kirk#5270) who apparently did most of the work and let these kids do the work? Sounds like a MafiaBoy situation, where more experienced hackers did the work and let younger script kiddies take the fall for it.

It's implied that the 17 year old is kirk

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#617

Post by 6dEOWVt4WN »

pps43 wrote: post #265
SahAssar wrote: post #155

Earlier quoted context omitted.

Having bad security is not criminal. If it was we wouldn't have a voting village at defcon cracked by pre-teens and there would be a lot more irresponsible CEO's in prison (so probably a better world).

Is bad security ok for, say, a bank or a nuclear power plant?

A nuclear power plant, no. Because, its most likely public property and so govt should have a say in its security. Even if it was a privately owned nuclear power plant, a breach would catastrophically and directly affect people who are not just its customers.

But, a bank, which is a privately owned entity. I think yes. If I own a bank and have bad security practices, and a breach impacts only my customers. I think the customers have the right to sue the bank but its up to me to decide what security I use, and if its not good the customers are free to choose to do business with another bank. But I don't think the govt should decide what level of security is sufficient?

Think of it this way, does this imply if my house is robbed I could be held liable because I chose to use locks on my house that were non compliant to govt regulation?

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#618

Post by kijin »

reitzensteinm wrote: post #539
VWWHFSfQ wrote: post #537

Earlier quoted context omitted.

> Hitting a 17yo with 30 felony charges feels a bit steep to me. Hitting them with 30 felony charges is perfectly reasonable/correct. Those are what the charges are for the crimes. But the punishment for those 30 felonies should/will be adjusted down. I think at most this person will lose 5 years of their life. Not like the 25 year old girl in Seattle that set a bunch of Seattle Police cars on fire during the protest…

The sentences should run concurrently. 4 years for setting a car on fire is not unreasonable, although maybe a little harsh depending on priors. It's a dangerous thing to do. But setting five cars on fire is not particularly worse than setting one car on fire.

O(log n) or O(sqrt(n)) might be a reasonable compromise between concurrent and consecutive sentences.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#619

Post by kelnos »

bryanrasmussen wrote: post #601
slg wrote: post #397

Earlier quoted context omitted.

The push against "victim blaming" is not about removing any possible role a victim would have in their victimhood. It is about destigmatizing victimhood and not blaming victims for things that are out of their control or that any other reasonable person would do. Let's imagine a situation in which someone breaks into my house and steals my TV. I deserve a decent amount of blame if I left my front door wide open befor…

No one deserves any blame for being burgled when leaving their front door opened - however if a bank leaves the vault open they deserve blame because what's in the vault is not just theirs. Twitter left the vault open.

That's absurd. If someone does something risky, and gets burned,they share some of the blame for it. Even if they accidentally left their front door open, that's still on them.

Certainly the burglar deserves the lion's share of the blame for what happened, but there's plenty to spread around.

My view is that if a reasonable person would have taken actions that would have avoided the issue in the first place, a person not taking those actions shares in the blame.

My bicycle got stolen from my garage a couple weeks ago. The garage was closed and locked, but someone forced the door at 4am and stole my bike. My bike was not locked to anything. My neighbor's bike was locked to a railing a few feet away from my bike, and did not get stolen. I share some of the blame here because if I had locked my bike up -- an entirely reasonable and prudent thing to do -- my bike would likely not have gotten stolen.

I think maybe the issue is because people are conflating blame with shame. No one should be shamed for stuff like this; it's a learning opportunity. I accept blame and responsibility for my part in my bike's theft, and if/when I get a new bike, I'll take better care to secure it, even when it's indoors.

Re: Tampa teen accused of being ‘mastermind’ behind Twitter hack

#620

Post by edf13 »

nickff wrote: post #385
slg wrote: post #254

Earlier quoted context omitted.

Then you need processes in place to make sure a single person being careless cant do this much damage. There are low tech solutions that would greatly improve security[1], however the overhead this introduces is hard to justify in a world in which these breaches aren't that damaging to a company. We need to change incentives for companies by either mandating these security practices or implementing harmful repercussi…

I agree that better security practices are advisable, but you're victim-blaming. Twitter wasn't 'asking for it', and neither were the individuals who lost bitcoins; the 'hackers' intentionally perpetrated deceptions, misrepresentations, and fraud against both Twitter and the general public. If you compare what these three did to a white-collar crime, the dollar amount was small, but the behavior was egregious.

It isn’t victim-blaming, it’s expecting Twitter to have relative safeguards in place and not have relative open doors to allow one person access to world leading accounts!
Post reply on HN