Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails • Hacker News Board

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#31

Post by josteink » Tue, Nov 20, 2012, 2:35 PM UTC

robmurrer wrote: post #25

josteink wrote: post #22

Earlier quoted context omitted.

Following that logic breeds bizarre results. What if you find this magic token because it was embedded in some client-side, javascript login-form? Are you a hacker for viewing the source? Securing content on the internet is easy. If you don't want it accessible to anyone, don't give the content to anyone who provides an unauthenticated HTTP request. Why are we putting the legal responsibility of maintaining security…

If I look under your doormat, and there is a key, and I use it to open your front door...

Rather if you leave a (possibly classified) document under your doormat, am I a criminal if I find them and read them?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#32

Post by babarock » Tue, Nov 20, 2012, 2:47 PM UTC

emmapersky wrote: post #27

guard-of-terra wrote: post #23

He should totally have posted those on pastebin instead and shared on the net. I think that if one finds an embarrassing security vulnerability, they should look up the offending company and upon finding that company ever took part in the crap like described in the article, they should publish the vulnerability wide open, goatse-style, anonymously via pastebin. Those companies should suffer to the end of times and th…

Why should I, as an innocent party to a companies security failings have my personal details revealed. This is exactly why we have laws protecting identity theft and fraud. Naming and shaming the company and the extent of their security failing is enough. But only after they have patched the hole.

Because you trusted the wrong people, and this has consequences.

The customer has to suffer from the mistakes of the companies so that:

1. She stops trusting any company blindly with her data.

2. The market demands improvements from the service providers (and no, sacrificing a scapegoat in court is not an "improvement").

3. Service companies react. Unless there's a major scandal, companies are slow to react to vulnerabilities.

About that last point, it's a bit unfair to assume that the activist tried to contact AT&T and they didn't react. I honestly don't know if that's what happened in this case, and I hope it is. However there are several cases of companies "turning a blind eye" on the issue.

As a customer, the only entity to blame when such a breach occur, is the provider that you entrusted with your data. Not the activists (regardless of their intents) nor the hackers or whatever monster you heard about in the media.

If I entrust (and pay) someone with my bike and it gets stolen on his watch, who's to blame? The thief or the guardian?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#33

Post by maxerickson » Tue, Nov 20, 2012, 2:54 PM UTC

robmurrer wrote: post #3

rcknight wrote: post #2

The article states "Weev and a fellow hacker who originally uncovered AT&T’s mistake and collected the e-mails didn’t ask the company for permission to access the Web addresses that shared iPad users’ private information" I really don't see how this argument holds up. From a technical point of view the very nature of HTTP includes asking for permission. You send a request "Please can I see the information at this URL…

>> required visiting an AT&T web address with a particular – and easy to guess – code tagged onto the end. How is this different than a password?

A password at least makes it clear to a bystander that some access control is intended at that URL. Consider the silly case where I have a server responding to example.com/funny/ and then try to claim that it was secure simply because I had not published the link. People would be quite confused if they went to jail for visiting it.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#34

Post by binarymax » Tue, Nov 20, 2012, 3:00 PM UTC

This is extremely dangerous. Condemning the whistle blowers results in a much less secure environment, since you'll scare away the white hats, and insecure systems will remain insecure. We need whistle blower protection laws in place, and we need them now.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#35

Post by pbhjpbhj » Tue, Nov 20, 2012, 3:00 PM UTC

batgaijin wrote: post #24

meritt wrote: post #9

We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible disclosure, and any whistle-blowers are immediately branded as "criminals" and "hackers". This whole process, or lack thereof, needs some serious disruption. Edit: My comment is intended to be a general observation and not specifically about this case

Disruption by who? Other sovereign entities?

Perhaps by the state in which a business or other entity is registered.

In some states there are strict laws about maintaining privacy of customer data. But, AFAIK, where I am there's nothing specifically addressing negligence in failing to address a security breach that can be called "cracking".

Government could, as part of their protection of their citizens offer a service of receiving security notices from third parties and passing them on to registered entities. The government run body could then check - and possibly advise on - the fixing of the [potential] data breach.

In the UK the Information Commissioner's Office handle data protection issues (including legislational requirements placed on organisations). They have a form [a .doc, that tells me a lot TBH!] for companies to notify the ICO (http://www.ico.gov.uk/for_organisations/data_protection/lose...); it's not much of a stretch to have a form for third parties but there would need to be legislation to deal with enforcing responses and providing an amnesty for those making [non-malicious] reports.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#36

Post by jebblue » Tue, Nov 20, 2012, 3:01 PM UTC

meritt wrote: post #9

We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible disclosure, and any whistle-blowers are immediately branded as "criminals" and "hackers". This whole process, or lack thereof, needs some serious disruption. Edit: My comment is intended to be a general observation and not specifically about this case

>> We live in a tech-filled world without a reliable means for responsible disclosure

There are many avenues for responsible disclosure, Google that phrase.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#37

Post by rquantz » Tue, Nov 20, 2012, 3:02 PM UTC

batgaijin wrote: post #24

meritt wrote: post #9

We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible disclosure, and any whistle-blowers are immediately branded as "criminals" and "hackers". This whole process, or lack thereof, needs some serious disruption. Edit: My comment is intended to be a general observation and not specifically about this case

Disruption by who? Other sovereign entities?

Perhaps something like wikileaks for internet security? Located outside US jurisdiction?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#38

Post by mcherm » Tue, Nov 20, 2012, 3:06 PM UTC

maratd wrote: post #4

rcknight wrote: post #2

The article states "Weev and a fellow hacker who originally uncovered AT&T’s mistake and collected the e-mails didn’t ask the company for permission to access the Web addresses that shared iPad users’ private information" I really don't see how this argument holds up. From a technical point of view the very nature of HTTP includes asking for permission. You send a request "Please can I see the information at this URL…

> From a technical point of view the very nature of HTTP includes asking for permission. A web server isn't an agent of the company and has no capacity to grant or deny permission. Think of it as a security system you install in your home. Now, if the security system is malfunctioning and you notice that it is malfunctioning ... do you call up the owner and let them know or do you go inside and look through their stu…

> A web server isn't an agent of the company and has no capacity to grant or deny permission.

Imagine I send a company a polite letter, requesting permission. The CEO hand-writes a letter (with his quill pen) telling me that I may access the information. After doing so, some critics on the internet start complaining that "A letter isn't an agent of the company and has no capacity to grant or deny permission."

Your claim is completely bogus. A web server DOES have the capacity to grant or deny permission because it is simply the mechanism by which the granting is delivered. Those who configured the server were the ones granting the permission.

I do not believe that the judge is claiming a web server cannot grant permission, I believe the judge is claiming that having to construct the URL by hand (rather than clicking on a link) is "a security measure" that has been "bypassed". For what it's worth (not much) I disagree strongly with this interpretation.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#39

Post by king_jester » Tue, Nov 20, 2012, 3:06 PM UTC

maratd wrote: post #30

freehunter wrote: post #18

Earlier quoted context omitted.

As an information security professional, I see two different issues at play here. First, they got access. They were granted access by the admin who did not lock down the server. I am not a lawyer, but I see the unauthenticated web server, no matter how much of a mistake, as being implicit permission to access the site. A house, by default, implies privacy. A web server is more of a business in this metaphor. If the d…

You don't live in a world governed by machines and pure logic. You live in a world governed by human beings and their nature. You have the capacity to recognize where you should be and where you shouldn't be. What you should be seeing and what you shouldn't be seeing. Right from wrong. > A web server is more of a business in this metaphor. If the door is open and the lights are on, it's implied you can come in and lo…

> If these clowns don't know how to secure their own damn servers, let them pay the price that will be exacted by less scrupulous individuals.

AT&T will not be affected whatsoever by a security breech, only those people whose information is leaked will be affected. The whole point of a white hat is to show this vulnerability and have it fixed before damage is done by someone with malicious intent.

> That's how the free market works. Stupidity is severely punished. They will very quickly learn how to properly set permissions on their server.

We do not live in a free market, and corporations are disproportionately powerful compared to individual people. You are asking that individual people have their data leaked and their lives potentially affected so that AT&T can look bad and then walk away from this situation without any punishment.

Further, it is very clear that companies make mistakes all the time with configuration their servers and tools in ways that makes data leaks and theft possible. We should demand that this flaws be exposed and fixed ASAP, there is nothing to be gained here by harassing those doing that exposure.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#40

Post by cloverich » Tue, Nov 20, 2012, 3:12 PM UTC

guard-of-terra wrote: post #29

emmapersky wrote: post #27

Earlier quoted context omitted.

Why should I, as an innocent party to a companies security failings have my personal details revealed. This is exactly why we have laws protecting identity theft and fraud. Naming and shaming the company and the extent of their security failing is enough. But only after they have patched the hole.

"Why should I, as an innocent party to a companies security failings have my personal details revealed." Because life is pain? But of course you can always sue the company that leaked your data and then mistreated people who warned them. Hell, you should. Probably with a class action suit.

> Because life is pain?

lol... just a touch dramatic there.