FBI arrests LulzSec member "recursion" for Sony Pictures hack • Hacker News Board

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#41

Post by infinity » Fri, Sep 23, 2011, 8:54 AM UTC

antimora wrote: post #9

In that can how is HideMyAss.com useful? Wasn't the service able to guarantee the anonymity?

I wouldn't trust this service, because I can't find any information about who is running this service - at least not in the few minutes I have spend clicking around on their site. Maybe there is some info somewhere, I have not found it.

In another comment a quote from a different article was mentioned regarding the Terms of Service. I could not find a page about the terms of service. Maybe it's me, but I think that these informations should be easy to find on a site.

Some other interesting points about this service are explored in an article by rsnake from ha.ckers.org:

http://ha.ckers.org/blog/20100104/anonymous-proxy-woes/

"So yeah, please don’t use CGI proxies, unless you really know what you’re doing. They really very rarely increase your security. Most of the time, they just decrease it, as a matter of fact."

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#42

Post by wnight » Fri, Sep 23, 2011, 9:29 AM UTC

coderdude wrote: post #17

wnight wrote: post #16

Earlier quoted context omitted.

Quit it with this codger pissing his diaper routine. I know blindly following the law is seeming more important as you get old but the "crime" consisted of sending malformed data and it caused games to go offline. Get over it. It's time to require Sony to run their business properly instead of investigating children as if they were mobsters. I swear, some people are retarded.

This isn't blindly following the law. So someone hacks your site and we praise the hacker and condemn you? Someone breaks the lock to your front door and we applaud the burgler and make fun of your lock? Get real. I'm sick of this attitude. Just because I understand right from wrong doesn't make me some kind of lackey for the law dogs. People with your attitude convey the wrong message. You don't like Sony, I get it.…

Ugh, physical analogies. That's my point. You're stuck in a world of things. Where things go missing or get broken.

This is data. Physical laws apply badly, especially when applied in fear by people who hardly seem to understand the domain. A webserver is giving out data. "Hacking" it is just tricking it into not checking what it's handing out.

Imagine a webserver as a really dumb employee. "Give documents in the first box, labelled 'public' to anyone. ..." If you've ended up telling that employee to give a copy of your financials to anyone who asks for it, because you forgot to tell them it wasn't a public document, it's your fault.

Not only would preventing this in law involve criminalizing many protocol errors and mistakes but it merely serves to hide the real problem - trusting inherently weak security.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#43

Post by wnight » Fri, Sep 23, 2011, 9:39 AM UTC

coderdude wrote: post #21

bandushrew wrote: post #20

Earlier quoted context omitted.

If I had taken the possessions of thousands of people, and promised to keep them safe in my house, and then a burglar broke in and stole everything. I deserve to be condemned. sure, the burglar should be punished for the simple crime of theft that he committed. but I took the possessions of thousands of people and failed to make them secure, despite promising to do so. Especially if I took all those possessions and t…

That is a terrible analogy. It's as if you were given peoples' posessions but you had someone working around the clock to find a way into your home to deface you. You're condemning Sony's engineers for missing something, even if it was a "simple" something. This LulzSec guy, however, did act in malice. He's the one who leaked information, after all.

He's, allegedly, the one who made the leak public. Yes. But that data was leaking for a long time and we have no way of knowing who else collected it.

If I had thought Sony was secure I'd actually be better off now, with my card visibly leaked, than before where only the bad guys had access to it. If my card was fraudulently used I'd have been in a bad position before the leak was known - I'd be assumed to be a criminal until I proved that I didn't make the purchases. After the leak became public I'd be more likely to get reasonable treatment from my credit card company.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#44

Post by epo » Fri, Sep 23, 2011, 2:22 PM UTC

wnight wrote: post #16

coderdude wrote: post #15

Earlier quoted context omitted.

Quit it with this hippy tech youth crap. The guy committed a crime. Get over it. It's time for him to face justice. I swear, some people are retarded.

Quit it with this codger pissing his diaper routine. I know blindly following the law is seeming more important as you get old but the "crime" consisted of sending malformed data and it caused games to go offline. Get over it. It's time to require Sony to run their business properly instead of investigating children as if they were mobsters. I swear, some people are retarded.

Recursion was 23, hardly a child, or are you saying Recursion was retarded?

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#45

Post by tsotha » Fri, Sep 23, 2011, 2:58 PM UTC

nitrogen wrote: post #37

tsotha wrote: post #35

Earlier quoted context omitted.

>the punishment fits the crime, not that we do our worst to everyone who breaks a law ever - this is unreasonable. How many million dollars did he cost Sony? I agree, let the punishment fit the crime. If he's lucky he'll have a few years left after he's released.

Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices. Digital security is not like physical security -- it's so "easy" to secure systems (in comparison to securing a physical location against e.g. looting or vandalism) that it's better to preemptively close all known classes security holes than it is to be lax with security and expect the law to sort th…

>Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices.

Ah, no. That's simply not true. "It was easy" is no justification for criminality, either legally or morally.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#46

Post by tsotha » Fri, Sep 23, 2011, 3:58 PM UTC

sophacles wrote: post #22

coderdude wrote: post #17

Earlier quoted context omitted.

This isn't blindly following the law. So someone hacks your site and we praise the hacker and condemn you? Someone breaks the lock to your front door and we applaud the burgler and make fun of your lock? Get real. I'm sick of this attitude. Just because I understand right from wrong doesn't make me some kind of lackey for the law dogs. People with your attitude convey the wrong message. You don't like Sony, I get it.…

Let's play the "more appropriate analogy" game: Say you take your valuables to a bank to put in a safe deposit box. They position themselves as a leader in safe deposit box technology. Then one night a burglar notices that the boxes are protected simply by a piece of cardboard panted to look like a real door, and there are no other security systems. Further the locks on the boxes can be opened by merely tapping them…

That's not an appropriate analogy at all. Sony isn't a bank. The financial stuff is incidental to the actual service they were providing.

Re: FBI arrests LulzSec member "recursion" for Sony Pictures hack

#47

Post by tripzilch » Fri, Sep 23, 2011, 5:12 PM UTC

shin_lao wrote: post #33

patrickod wrote: post #2

It's hardly surprising that these people are being caught. Using a VPN service that resides primarily in the USA, the same jurisdiction in which your attacks are being carried out, seems a bit shortsighted.

Actually I'm not surprised. They got too comfortable. They got lazy. Properly covering your tracks is extremely cumbersome and boring.

Well, there's that and there's using a USA-based VPN service.

They could have picked any other totalitarian police state in the world, Russian, Chinese proxies, they all accept creditcard, and the FBI could have done fuck all to get the logs.

Instead you know USA based companies are required to barf up the logs at the drop of a hat.

It's not just lazy, it's really really dumb.