Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"White hat" Facebook hacker gets 8 months in jail

bbc.co.uk

Post reply on HN
Print view View original

41–50 of 120 posts

Re: "White hat" Facebook hacker gets 8 months in jail

#41

Post by nbpoole »

koenigdavidmj wrote: post #3

https://www.facebook.com/whitehat Facebook themselves have a policy of tolerance toward white hat hackery (basically `give us a reasonable amount of time before releasing to the public' and `do what you can to protect other users' privacy). I want to hear their side of this.

The title of this submission is completely inaccurate: the person in question is in no way a "white hat":

http://www.guardian.co.uk/technology/2011/aug/17/facebook-ha...

> Between 17 April and 9 May he is accused of downloading a computer program "to secure unauthorised access" to Facebook; of attempting to hack into Facebook's "Mailman" server; of using PHP script to secure access to another Facebook server, dubbed "Phabricator"; of sharing a PHP script intended to hack into that Facebook server; and of securing "repeated" access to another Facebook server.

Re: "White hat" Facebook hacker gets 8 months in jail

#42

Post by icebraining »

JonnieCache wrote: post #24
smsm42 wrote: post #18

Earlier quoted context omitted.

While it is indeed despicable to imagine that there's a different law for big and small companies, it is long known that the size of actual and potential harm is considered when crime and punishment is being discussed. One would probably get different punishment for stealing $10 and stealing $100K (though if you manage to steal $100M you may actually get away with it, but that's another story). If his lawyer would ar…

You can't compare this to $10 vs. $100000K because the actual damage done here versus him doing the same thing to the servers of a small company is not x10000 the size, if that makes sense. The harm caused in both cases is negligible. I suppose you could count the large amount of time facebook probably had to spend going through their systems to make sure they were clean. Surely the money for their security team was…

Surely the money for their security team was already spent though?

I doubt Facebook's security team is just sitting idly waiting for an attacker to give them something to do. Each hour devoted to this is an hour they can't use for other tasks, besides the possibility of having to pay overtime.

Re: "White hat" Facebook hacker gets 8 months in jail

#43

Post by nitrogen »

daeken wrote: post #36
joshmattvander wrote: post #16

Seems ridiculous for a company who has the word "HACK" all over the inside and outside of their office, to put energy into this. Hire the kid and move on.

As far as I know, once you turn something like this over to the FBI or other authorities, it's out of your control. You've already lit the fuse -- where the rocket goes from there isn't your choice.

Hypothetically, could Facebook later say, "Oh, actually, we're retroactively granting him access to our systems, so he didn't actually access beyond his authorization"? Or would that get someone at Facebook charged with making a false report to the authorities?

Re: "White hat" Facebook hacker gets 8 months in jail

#44

Post by unreal37 »

koenigdavidmj wrote: post #3

https://www.facebook.com/whitehat Facebook themselves have a policy of tolerance toward white hat hackery (basically `give us a reasonable amount of time before releasing to the public' and `do what you can to protect other users' privacy). I want to hear their side of this.

I agree, dubious use of the term white-hat. He hacked into their systems, stole the code, and kept a copy on an external hard drive. Didn't do anything malicious, but didn't contact Facebook about it either. They discovered the intrusion by accident, and it took them months to track him down.

So "keeping the data to himself and doing nothing with it" is considered white hat?

Re: "White hat" Facebook hacker gets 8 months in jail

#45

Post by noduerme »

What it sounds like from the article isn't that he destroyed $200,000 worth of property; it's that $200k is what it cost Facebook to fix a security hole he discovered. Meaning it was money they needed to spend on security before someone with truly malicious intentions found it. Does Facebook seriously think that sending kids to jail is a viable substitute for building good security into their product, or that it will deter future attempts and mean they won't have to spend another $200k next time? More likely, next time they won't know about it, or it will come from a country where they have no power to find the responsible party. They should be on their knees thanking this kid; just another reason to loathe FB, I guess.

Re: "White hat" Facebook hacker gets 8 months in jail

#46

Post by DenisM »

Usually when news like this comes up there are many comments along the lines of "it's okay, if you behave/do not touch data files/disclose/etc". Bad news folks - this might be ok by you, it's not ok by the law.

Unauthorized computer access is jail-time illegal. Do not access any computer or computer network without owner's permission. Seek legal counsel if you're not 100% clear about this, and do it before you get your ass in trouble.

Re: "White hat" Facebook hacker gets 8 months in jail

#47

Post by unreal37 »

tstonez wrote: post #2

[Without knowing the full details of the case or proceedings] I don't see how putting this, clearly quite gifted, young person in jail for 8 months is going to help him, Facebook or anyone else for that matter. Surely, there must be other options except jail?! Maybe some form of community service where he would then be an asset rather than a cost to the general public. If he can infiltrate Facebook, I am sure there a…

The article states that the judge clearly wanted to send a message to other hackers that this type of hacking is not "just fun". To give him a job as a professional security consultant would send the opposite message.

Reminds me of the movie War Games.

Re: "White hat" Facebook hacker gets 8 months in jail

#49

Post by icebraining »

joering2 wrote: post #30
JonnieCache wrote: post #13

"You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance," he said. This is the kind of thing that makes my blood boil.

I can spare my karma and you can downvote me now for saying this (but my blood is boiling too), but I can bet you my left arm (I'm left-handed) that if that "international business" called Facebook would go down for longer than 25 minutes, you would see world's work-power suddenly increased by 40%.

I think you're biased due to where you live. Many people don't work with computers and at least around here (southern European country) the number of smartphones is still very low (2.8% in August). Not to mention that FB only has 640M users of working age, vs the 3.25 billion people of working age in the world.

Re: "White hat" Facebook hacker gets 8 months in jail

#50

Post by noduerme »

DenisM wrote: post #46

Usually when news like this comes up there are many comments along the lines of "it's okay, if you behave/do not touch data files/disclose/etc". Bad news folks - this might be ok by you, it's not ok by the law. Unauthorized computer access is jail-time illegal. Do not access any computer or computer network without owner's permission. Seek legal counsel if you're not 100% clear about this, and do it before you get yo…

It's still fair to say that prosecuting after the fact, if you can find the person responsible, is a pretty shoddy way to run your security. And if you acknowledge that, then it isn't difficult to see the value - both to product and to PR - of choosing to be magnanimous with the benign ones. It's still fair to criticize Facebook for an overreaction which appears to be a way to cover its own ass and deflect attention from the larger issue, namely, that it should have spent to prevent this in the first place, and that nobody knows who else is accessing user information.
Post reply on HN