Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel • Hacker News Board

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#11

Post by GHFigs » Wed, Jul 27, 2011, 8:52 PM UTC

jxcole wrote: post #3

I find this one the most worrying: "In 2008, the Massachusetts Bay Transportation Authority (MBTA) obtained a temporary restraining order to prevent a talk at DEFCON by three MIT students who had uncovered physical and logical security holes in MBTA infrastructure." I mean, the IOS guy worked for IOS, so he was divulging information that Cisco paid him to obtain. HBGary paid Aaron Barr to research anonymous, so they…

However, what kind of case could MBTA possibly have against some kids who found problems with their infrastructure?

The flaws they found allowed them to obtain, according to their talk's description, "free subway rides for life", which would deprive MBTA of an unknown amount of revenue which was rightfully theirs. They wouldn't disclose the vulnerability when MBTA approached them, although they changed the description of the talk to no longer imply they would explain how to get free rides.

You can read the MBTA complaint yourself: http://www.universalhub.com/images/2008/mbtamit.pdf

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#12

Post by jordan0day » Wed, Jul 27, 2011, 9:07 PM UTC

djb_hackernews wrote: post #5

Why would DEFCON want Aaron Barr on any sort of panel? The guy is at best a hack of a security professional and at worst a complete idiot of a slime ball who doesn't understand the first thing about technology.

It's a panel discussion -- you want different viewpoints. Aaron Barr almost certainly has a very interesting viewpoint w.r.t. anonymous and computer security in general, having been on the receiving end of a highly-publicized attack. Sometimes it's just as useful to hear about how something is wrongly done.

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#13

Post by timwiseman » Wed, Jul 27, 2011, 9:08 PM UTC

rdl wrote: post #2

I believe this falls into "doing it wrong". Backing out because they threaten to file an injunction is to capitulate too soon. You're supposed to keep going until/unless they actually get an injunction, and then challenge it (plus, civil lawsuit for loss of income due to the injunction once it's rescinded). BlackHat/BSidesLV/DEFCON is going to be really interesting this year, for a change.

You're supposed to keep going until/unless they actually get an injunction

I do not know if you have ever been involved in a lawsuit, but they can be enormously time consuming and ver expensive. In short, even if you are in the right they can play absolute havoc with your life.

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#14

Post by famousactress » Wed, Jul 27, 2011, 9:14 PM UTC

GHFigs wrote: post #11

jxcole wrote: post #3

I find this one the most worrying: "In 2008, the Massachusetts Bay Transportation Authority (MBTA) obtained a temporary restraining order to prevent a talk at DEFCON by three MIT students who had uncovered physical and logical security holes in MBTA infrastructure." I mean, the IOS guy worked for IOS, so he was divulging information that Cisco paid him to obtain. HBGary paid Aaron Barr to research anonymous, so they…

However, what kind of case could MBTA possibly have against some kids who found problems with their infrastructure? The flaws they found allowed them to obtain, according to their talk's description, "free subway rides for life", which would deprive MBTA of an unknown amount of revenue which was rightfully theirs. They wouldn't disclose the vulnerability when MBTA approached them, although they changed the descriptio…

Really? I thumbed through the complaint (thanks for the link), but I'm still really disturbed by this. It's presumably illegal to help yourself to free subway rides. The law protects the MBTA. How is it a crime to talk about how it could be done? The talk wouldn't deprive the MBTA of any revenue.. the application of information in the talk by third parties committing illegal acts would. It's akin to giving a talk on lock-picking, no?

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#15

Post by valentin » Wed, Jul 27, 2011, 10:10 PM UTC

GHFigs wrote: post #11

jxcole wrote: post #3

I find this one the most worrying: "In 2008, the Massachusetts Bay Transportation Authority (MBTA) obtained a temporary restraining order to prevent a talk at DEFCON by three MIT students who had uncovered physical and logical security holes in MBTA infrastructure." I mean, the IOS guy worked for IOS, so he was divulging information that Cisco paid him to obtain. HBGary paid Aaron Barr to research anonymous, so they…

However, what kind of case could MBTA possibly have against some kids who found problems with their infrastructure? The flaws they found allowed them to obtain, according to their talk's description, "free subway rides for life", which would deprive MBTA of an unknown amount of revenue which was rightfully theirs. They wouldn't disclose the vulnerability when MBTA approached them, although they changed the descriptio…

Here is the presentation: http://tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf

Re: Threatening Lawsuit, HBGary Federal Intimidates Aaron Barr Out of DEFCON Panel

#16

Post by rdl » Thu, Jul 28, 2011, 4:32 AM UTC

timwiseman wrote: post #13

rdl wrote: post #2

I believe this falls into "doing it wrong". Backing out because they threaten to file an injunction is to capitulate too soon. You're supposed to keep going until/unless they actually get an injunction, and then challenge it (plus, civil lawsuit for loss of income due to the injunction once it's rescinded). BlackHat/BSidesLV/DEFCON is going to be really interesting this year, for a change.

You're supposed to keep going until/unless they actually get an injunction I do not know if you have ever been involved in a lawsuit, but they can be enormously time consuming and ver expensive. In short, even if you are in the right they can play absolute havoc with your life.

I think he's already past the point of deciding where he'll be involved in a lawsuit or not -- holding out to force them to get a court order to bar the talk wouldn't make that materially worse.

I agree in a lot of cases about (especially individuals, especially people who aren't very wealthy) backing down from legal challenges, even if they have a good chance to ultimately prevail, due to the cost.

For a startup, getting involved in a major lawsuit can be a huge distraction too -- so even if it the startup wins the lawsuit, the company still is stunted and dies.