Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"White hat" Facebook hacker gets 8 months in jail

bbc.co.uk

Post reply on HN
Print view View original

91–100 of 120 posts

Re: "White hat" Facebook hacker gets 8 months in jail

#91

Post by tptacek »

michaelbuckbee wrote: post #23
machrider wrote: post #4

Is it possible to be a "white hat" hacker if you weren't actually contracted by the target for penetration testing?

There is obviously a spectrum to this sort of thing, but I know of many people that will just habitually enter javascript alerts into a web services's forms to see what happens. Mostly this is just to evaluate the product and to see if it is trustworthy, but they'll often send along a polite FYI to the site owners letting them know if they have security issues that need addressing. Actions like that: finding vulnerab…

People can and will go nuts if you, for instance, accidentally mess up the DOM for their customers by getting an XSS payload cached and redisplayed in e.g. "saved search" results.

It sucks, but if your goal is to avoid legal drama, don't test without permission.

Re: "White hat" Facebook hacker gets 8 months in jail

#92

Post by tptacek »

rbanffy wrote: post #78
dkl wrote: post #31

Earlier quoted context omitted.

You do realize there are people in jail in California for life for stealing very small amounts, due to the "3 strikes law", where as the people responsible for sucking billions out of the US economy... well, none of them have gone to jail. (I did read about someone that did go to jail, but he was a low-level actor... it was clear it was a sacrificial lamb).

Even sacrificing lambs is useful - with time, the bigger fish will find very hard to get enough sacrificial lambs and the lambs themselves may start demanding larger rewards for their sacrifice. Wondering if lamb fat is good to fry large fish.

No, it's very gamey; a very little bit goes a long way, even in lamb dishes.

Re: "White hat" Facebook hacker gets 8 months in jail

#93

Post by cleaver »

bryanh wrote: post #22

> "He added that when Mangham was arrested he made "copious" admissions to police about what he had done." Given the chance, I always bang the "don't talk to authorities" drum. So now you have to wonder, how did his "copious admissions" help him? Seriously, if you are suspected of anything , no matter how innocuous or momentous: Shut. The. Hell. Up. Get a damned attorney. Of course the classic video needs to be linke…

Yep. That's what got Randal Schwartz convicted for running a security scan (as part of his job at Intel).

Re: "White hat" Facebook hacker gets 8 months in jail

#94

Post by lawnchair_larry »

tptacek wrote: post #90
lawnchair_larry wrote: post #87

Earlier quoted context omitted.

I think you are confused. I've been in the security industry for about 10 years. Disclosing a vulnerability is not illegal. Over the years, some companies have tried to sue over this, but these censorship attempts do not turn out well. Not only is it legal to disclose unfixed vulnerabilities, but it is legal to sell them. Presently, the biggest buyer of them is none other than the US government.

Whoah. Whoah. Whoah. You're handwaving around the real issue. It's not legal to find vulnerabilities by testing other people's running web applications without permission, and it never has been. People obviously do it, all the time, against sites that haven't officially given permission (as Google and Facebook have), and most of the time they get away with it, but they are rolling the legal dice every time they do. P…

My post, and his reply, were only discussing the disclosure of vulnerability information. I didn't say it was legal to attack a live system that you don't own. I see how you are making that logical leap in the case of facebook, but it isn't necessarily a given. There are ways one can legally become aware of vulnerabilities in facebook, and share that information.

Re: "White hat" Facebook hacker gets 8 months in jail

#95

Post by noahc »

tptacek wrote: post #88
linuxhansl wrote: post #86

Earlier quoted context omitted.

"I've talked my way out of around 9 out of 12 speeding fines" Wow you must be really good at that. In all my life I never managed to talk myself out of a ticket once I was stopped by the police.

I've avoided 9 out of the past 10 with a simple strategy of pulling over as soon as I feel like a cop might be following be (ideally before the lights come on), turning the dome light on in my car, rolling down the window, putting my hands on the wheels and admitting that I "assume" the cop was going to pull me over "because I was probably speeding". This is not your best strategy if: (a) You are driving on a suspend…

I have been pulled over 3 times and gotten 2 warnings (one written, one not) and a ticket for not having my insurance card on me (that was later dismissed). The first time I was going 75 in a 55, the second time I was going 45 in 30 and the third time I was going 65 in a 55.

The 65 in a 55 I pulled over as soon as I saw him slow down to turn around, the rest of the time I just admitted I was probably going too fast. Again, nothing special just mindfulness.

Re: "White hat" Facebook hacker gets 8 months in jail

#96

Post by CHsurfer »

It seems that the government(s) make a lot of noise about how valiantly they pursue these 'dangerous' hackers, but they won't go near the state sponsored industrial espionage that appears to be coming out of China. Why are we so proud of persecuting our own citizens while we ignore much more damaging actions carried out by another government?

Re: "White hat" Facebook hacker gets 8 months in jail

#97

Post by batista »

molesy wrote: post #85
sumukh1 wrote: post #74

Earlier quoted context omitted.

Correct me if I'm wrong, but I believe you are not supposed to fish for anything after you are pulled over. Just keep your hands on the wheel. If the officer sees you leaning over trying to find something after you're pulled over he/she could see that as suspicious behavior.

Just to reiterate, it really hurts to see so many people saying "have your ID ready". From the very moment an officer pulls you over they will be anxiously watching your every move, hoping you're not the next one that attempts to pull a gun on them. Reaching for anything when pulled over is the absolute worst thing you can do to an officer no matter how innocuous you may think you seem. Please, just keep your hands o…

Well, that's in the US. Fortunately, a lot of people live in countries where you can do whatever when stopped and the officer will never suspect you are trying to pull a gun on them, or pull a gun on you.

That's because, in those countries, it NEVER happens (i.e for someone pulled over to shoot the cop). So you can go get your ID or whatever, and then you have a chat, and they maybe give you a fine for speeding or whatever.

Re: "White hat" Facebook hacker gets 8 months in jail

#98

Post by buff-a »

d2vid wrote: post #58
bryanh wrote: post #22

> "He added that when Mangham was arrested he made "copious" admissions to police about what he had done." Given the chance, I always bang the "don't talk to authorities" drum. So now you have to wonder, how did his "copious admissions" help him? Seriously, if you are suspected of anything , no matter how innocuous or momentous: Shut. The. Hell. Up. Get a damned attorney. Of course the classic video needs to be linke…

In Britain (where this case was tried), the law is different. If you don't mention facts that you will rely upon in court, it can harm your defense. Shutting up is not as much of an option: http://en.wikipedia.org/wiki/Miranda_warning#England_and_Wal...

"You do not have to say anything unless you wish to do so, but I must warn you that if you fail to mention any fact which you rely on in your defence in court, your failure to take this opportunity to mention it may be treated in court as supporting any relevant evidence against you"

F.U.D. made law. Well done England.

Fortunately England still requires a Jury, and Jury's still acquit people despite the police and prosecution spouting outright lies from the moment a person is arrested. If you naively believe that the police do not do so, see if anyone in your circle of friends is a defense lawyer/solicitor who has represented people at police stations and have a candid conversation with them.

If you get arrested in the UK (or anywhere) shut up and say only "I invoke my right to silence. Get me my lawyer."

Re: "White hat" Facebook hacker gets 8 months in jail

#99

Post by wisty »

rosstafarian wrote: post #75
wyclif wrote: post #26

Earlier quoted context omitted.

Upvoted. Never, ever, talk to the cops.

That's advice if taken literally is horrible. Never talk to the cops if accused of a SERIOUS crime, always get some sort of legal council. If however you get pulled over for running a stop sign or some other traffic violation/small offense and you know the cop saw you, don't insult their intelligence. Judge the situation I've gotten out of every traffic ticket by being polite and honest. I'll usually try and apologiz…

The difference is, a trafic cop doesn't want to arrest you. They don't want to book anyone, but their boss told them to go balance the books by fleecing drivers. If you make their job easier, they might let you off with a warning.

A cop who's investigating a real crime wants to get a conviction. And they aren't in a position to do plea bargaining (like a traffic cop), that's the DA's job (then the judge's, if it gets that far). It's not a terrible idea to negotiate with the DA and judge, but you need a lawyer to help you do it.

Re: "White hat" Facebook hacker gets 8 months in jail

#100

Post by [deleted] »

mmaunder wrote: post #54
wyclif wrote: post #26

Earlier quoted context omitted.

Upvoted. Never, ever, talk to the cops.

Upvoted too because I preach this to friends/family regularly for serious issues/offenses. However I've talked my way out of around 9 out of 12 speeding fines in various states by being nice and kissing a bit of ass during the last decade. Cops are people too and when they walk up to your window after pulling you over, they may actually be scared. And you know fear leads to anger, anger leads to hate, hate leads to y…

[deleted]
Post reply on HN