FBI arrests LulzSec member "recursion" for Sony Pictures hack • Hacker News Board

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#31

Post by davidw » Fri, Sep 23, 2011, 6:04 AM UTC

sophacles wrote: post #22

coderdude wrote: post #17

Earlier quoted context omitted.

This isn't blindly following the law. So someone hacks your site and we praise the hacker and condemn you? Someone breaks the lock to your front door and we applaud the burgler and make fun of your lock? Get real. I'm sick of this attitude. Just because I understand right from wrong doesn't make me some kind of lackey for the law dogs. People with your attitude convey the wrong message. You don't like Sony, I get it.…

Let's play the "more appropriate analogy" game: Say you take your valuables to a bank to put in a safe deposit box. They position themselves as a leader in safe deposit box technology. Then one night a burglar notices that the boxes are protected simply by a piece of cardboard panted to look like a real door, and there are no other security systems. Further the locks on the boxes can be opened by merely tapping them…

A lot of homes in the US are protected not even by cardboard, but by large glass windows facing the front of the house.

And yet, generally people get in serious trouble if they smash through that glass to access the house, despite it being incredibly easy to accomplish.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#32

Post by sophacles » Fri, Sep 23, 2011, 6:14 AM UTC

coderdude wrote: post #27

sophacles wrote: post #26

Earlier quoted context omitted.

I very clearly stated I care that a crime has been committed. I don't have an anti-corporate agenda. I have an agenda, but it is simply that we take care to ensure that: 1. the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. 2. that in our attempts to find justice in one case, we don't ignore a hundred others because our bloodlust. 3. that we assess the re…

I do not believe that your original statement did anything to convey what you've just said. I do not find this reponse unreasonable. I jumped the gun calling you retarded -- I assumed you were the usual tyoe that defends anonymous/lulzsec. They don't care about the crime, they don't see why it's a crime, etc. That was my impression. I do get angry in these discussions. These people are annoying. The others in this th…

Fair enough.

My original comment was intended to be very sarcastic. I don't respond well to platitudes and slogans, they usually just annoy me by ignoring that most things in life cannot be properly summed up in 6 words. I think that like many issues, both sides in this one seem to resort to shouting matches in which sides need to be taken, and people forget the issue in the desire to "win" and like I said, my response is usually sarcasm towards both... perhaps a bit of childishness on my part too there :)

Anyway, I appreciate your response here, thanks for that.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#33

Post by shin_lao » Fri, Sep 23, 2011, 6:27 AM UTC

patrickod wrote: post #2

It's hardly surprising that these people are being caught. Using a VPN service that resides primarily in the USA, the same jurisdiction in which your attacks are being carried out, seems a bit shortsighted.

Actually I'm not surprised. They got too comfortable. They got lazy. Properly covering your tracks is extremely cumbersome and boring.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#34

Post by sophacles » Fri, Sep 23, 2011, 6:31 AM UTC

davidw wrote: post #31

sophacles wrote: post #22

Earlier quoted context omitted.

Let's play the "more appropriate analogy" game: Say you take your valuables to a bank to put in a safe deposit box. They position themselves as a leader in safe deposit box technology. Then one night a burglar notices that the boxes are protected simply by a piece of cardboard panted to look like a real door, and there are no other security systems. Further the locks on the boxes can be opened by merely tapping them…

A lot of homes in the US are protected not even by cardboard, but by large glass windows facing the front of the house. And yet, generally people get in serious trouble if they smash through that glass to access the house, despite it being incredibly easy to accomplish.

True, but a home is not even remotely similar to a bank or Sony in this case. A home is a place where a single person or family is responsible for securing their own stuff. A bank (and sony) is a place where money was paid with the understanding of safekeeping. Not just by one person but by many. Since many people are concentrating stuff worth safekeeping in a single place, it stands to reason that that single place now needs to be as secure as many homes -- the payout is bigger therefore the burglar investment is bigger. A place that doesn't account for this but claims security should be held accountable, as that makes perfect sense.

Further I never claimed that the bank robber shouldn't be held accountable, in fact, if you read closely you see I explicitly claimed the opposite. I only added to it by stating that the bank should also be held accountable for not doing what they said they would (securing stuff without properly analyzing what securing means).

Tangent: it is questionable that a glass window offers less security than a piece of cardboard. At least a glass window, upon breaking, makes quite a bit of noise drawing attention (usually a security asset). The cardboard can be removed in a much quieter fashion. Neither withstands a minimal effort at getting past them. I would say both offer the same level of security.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#35

Post by tsotha » Fri, Sep 23, 2011, 6:34 AM UTC

sophacles wrote: post #26

coderdude wrote: post #19

Earlier quoted context omitted.

I highly doubt he breathed as much into "throw the book at him" as you have to defend your position. My name-calling is not absurd. What is absurd is your opinion on this matter. You're part of a vocal minority that doesn't care if someone commits a crime if it satisfies your personal anti-corporate agenda.

I very clearly stated I care that a crime has been committed. I don't have an anti-corporate agenda. I have an agenda, but it is simply that we take care to ensure that: 1. the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. 2. that in our attempts to find justice in one case, we don't ignore a hundred others because our bloodlust. 3. that we assess the re…

>the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable.

How many million dollars did he cost Sony? I agree, let the punishment fit the crime. If he's lucky he'll have a few years left after he's released.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#36

Post by thaumaturgy » Fri, Sep 23, 2011, 7:02 AM UTC

tsotha wrote: post #35

sophacles wrote: post #26

Earlier quoted context omitted.

I very clearly stated I care that a crime has been committed. I don't have an anti-corporate agenda. I have an agenda, but it is simply that we take care to ensure that: 1. the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. 2. that in our attempts to find justice in one case, we don't ignore a hundred others because our bloodlust. 3. that we assess the re…

>the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. How many million dollars did he cost Sony? I agree, let the punishment fit the crime. If he's lucky he'll have a few years left after he's released.

HN user rtm is a YC partner and the infamous Robert Morris, of the Morris worm which had a nice impact on the internet back before it was the internet.

I guess we're lucky that rtm had a few years left after he was released.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#37

Post by nitrogen » Fri, Sep 23, 2011, 7:02 AM UTC

tsotha wrote: post #35

sophacles wrote: post #26

Earlier quoted context omitted.

I very clearly stated I care that a crime has been committed. I don't have an anti-corporate agenda. I have an agenda, but it is simply that we take care to ensure that: 1. the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. 2. that in our attempts to find justice in one case, we don't ignore a hundred others because our bloodlust. 3. that we assess the re…

>the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. How many million dollars did he cost Sony? I agree, let the punishment fit the crime. If he's lucky he'll have a few years left after he's released.

Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices. Digital security is not like physical security -- it's so "easy" to secure systems (in comparison to securing a physical location against e.g. looting or vandalism) that it's better to preemptively close all known classes security holes than it is to be lax with security and expect the law to sort things out.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#38

Post by Jach » Fri, Sep 23, 2011, 7:27 AM UTC

antimora wrote: post #9

In that can how is HideMyAss.com useful? Wasn't the service able to guarantee the anonymity?

I always thought the main purpose of things like HideMyAss.com are to get around stupid filters installed at your workplace or school. Thankfully neither for me have filters, but I've visited my old high school a number of times and I just throw everything through an ssh connection to my home machine.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#39

Post by redthrowaway » Fri, Sep 23, 2011, 7:32 AM UTC

Steko wrote: post #30

guelo wrote: post #8

It would be great if they would go to trial so that maybe we could find out how the FBI tracked them down. My suspicion is that it's all an abuse of spying laws intended for terrorism. Unfortunately these guys will probably all plead.

http://www.thetechherald.com/article.php/201138/7643/Proxy-l... "According to HideMyAss.com, “…services such as ours do not exist to hide people from illegal activity. We will cooperate with law enforcement agencies if it has become evident that your account has been used for illegal activities.” The service stores logs for 30-days when it comes to Website proxy services, and they store the connecting IP address, as…

Why on Earth would he use hma when tor is readily available and far better at hiding your nefarious deeds? At the very least, if you live in the US, use an extranational vpn. Take some of those "hacking" skills and use your neighbour's wifi, wiping the logs after each session. For the FBI to have an IP address that leads back to you means you're incompetent.

The lack of technological sophistication from these guys just further highlights the negligence on the part of the victims. If someone who knows this little about security can infiltrate your network and steal your secrets, then you have serious problems.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#40

Post by shabble » Fri, Sep 23, 2011, 8:08 AM UTC

nitrogen wrote: post #37

tsotha wrote: post #35

Earlier quoted context omitted.

>the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. How many million dollars did he cost Sony? I agree, let the punishment fit the crime. If he's lucky he'll have a few years left after he's released.

Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices. Digital security is not like physical security -- it's so "easy" to secure systems (in comparison to securing a physical location against e.g. looting or vandalism) that it's better to preemptively close all known classes security holes than it is to be lax with security and expect the law to sort th…

There's the issue that digital data is much more valuable (and/or damaging). Nobody is going to break into an office building to steal their filing cabinets in the hopes of finding enough info there to guess someone's mother's middle name and subsequently hope to steal their credit card or bank account. Being able to effectively search, filter, and map against other sources makes digital data particularly valuable. In essence, digital crime scales.

That said, I'm not sure I agree with your claim of the ease of digital versus physical security - physical security is something we're fairly good at, having had a few thousand years of practice. I suspect the number of bank robberies in which human factors (The physical equivalent of rubber-hose cryptanalysis being 'pointing a shotgun at the manager') massively outweighs those that were exploited by technical means.

That's not to say that they weren't negligent in not even taking the basic precautions that are common sense to anyone working in the field, and even many who aren't.