Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

technologyreview.com

Post reply on HN
Print view View original

51–60 of 117 posts

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#51

Post by tptacek »

sneak wrote: post #42
driverdan wrote: post #14

From my understanding all you had to do was pass the ICC-ID to a script on AT&T's servers to get back the user data. I can see the court interpreting the ICC-ID as a form of access control since you'd have to guess them similarly to passwords. What isn't quite clear to me is what they did with this data. It seems they reported the hole to AT&T who then fixed it. That's good. It also seems they passed the data off to…

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent.

Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you break into a retail brokerage and execute trades on behalf of other people, you're going to be liable, regardless of how that retail brokerage chooses to authenticate access to the site.

(I don't have a position about this particular case; I know virtually nothing about it).

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#52

Post by josteink »

gabemart wrote: post #45
josteink wrote: post #20

Earlier quoted context omitted.

If you are going to nitpick, I will say that this is a feature that relies on browser-support. It's not fundamental to the web. Query-strings however by definition needs to be supported on the server-side. They are a part of the web. They are required for the web to work. Why is "browser-support" relevant? Your example is not supported in MSIE. I also thought it was removed from Chrome (in the name of "simplicity"),…

Huh, I had no idea that feature had been deprecated. I guess it's been a little longer since I used it than I thought.

It was used for lots of http://famous-website.com:long-token-nobody-will-ever-read@p... style attacks.

Microsoft's solution to the problem may not have been ideal, but at least that was the reasoning behind it.

Edit: And what do you see once you click post? Hacker news ironically proving Microsoft's point. It's a wonderful world we live in.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#53

Post by recursive »

> "The more concerning charge to online activists watching Weev’s case is based on the Computer Fraud and Abuse Act, which forbids “unauthorized access” to a computer."

There are HTTP codes to indicate lack of authorization. Presumably he didn't encounter those. How is this an argument?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#54

Post by sneak »

tptacek wrote: post #51
sneak wrote: post #42

Earlier quoted context omitted.

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent. Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you brea…

> No, it wouldn't expose Google to that liability

It wouldn't expose Google to that liability because Google is a large US corporation.

If it were a single greyhat individual with a history of unpopular speech, the argument would probably go something along the lines of "any reasonable person wouldn't spider the whole web, because they'd know they'd eventually get SOMETHING they're not authorized to access..."

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#55

Post by jcromartie »

ssclafani wrote: post #26

The indictment filed against Weev by the DOJ in 2011: http://www.scribd.com/doc/113664772/46-Indictment

The complaint cites "losses"

> To date, AT&T has spent approximately $73,000 in remedying the data breach. Those costs include, among other things, the cost of contacting all iPad 3G customers to inform them of the breach and AT&T's response to it.

BOO-#$%^ING-HOO.

As if AT&T shouldn't have had to lock down their user's info, and it's some kind of injustice to them that they have to do things the right way now. This perfectly highlights the fundamental disconnect between the corporations, the (their) legal system, and the Internet-connected world.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#56

Post by sneak »

tptacek wrote: post #51
sneak wrote: post #42

Earlier quoted context omitted.

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent. Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you brea…

> regardless of how that retail brokerage chooses to authenticate access

There was no other authentication system aside from HTTP in place in this case.

If that's the only one, and it's wide open, any reasonable person knows that the information there is public. That's how the web works. We're allowed to load URLs on planet Earth.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#58

Post by tptacek »

sneak wrote: post #54
tptacek wrote: post #51

Earlier quoted context omitted.

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent. Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you brea…

> No, it wouldn't expose Google to that liability It wouldn't expose Google to that liability because Google is a large US corporation. If it were a single greyhat individual with a history of unpopular speech, the argument would probably go something along the lines of "any reasonable person wouldn't spider the whole web, because they'd know they'd eventually get SOMETHING they're not authorized to access..."

I'm just stating facts. The prosecution is required to prove that the defendant not only exceeded their authorization to the application in question, but that they did so knowingly.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#59

Post by tptacek »

sneak wrote: post #56
tptacek wrote: post #51

Earlier quoted context omitted.

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent. Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you brea…

> regardless of how that retail brokerage chooses to authenticate access There was no other authentication system aside from HTTP in place in this case. If that's the only one, and it's wide open, any reasonable person knows that the information there is public. That's how the web works. We're allowed to load URLs on planet Earth.

I understand where you're coming from, but that logic doesn't really work, does it? I can tell you that somewhere there is indeed an application that will respond to an unauthenticated GET request by transferring funds between accounts. You and I both know that. Deliberately loading that URL on planet Earth to effect funds transfers will get you charged.

So it's obviously more complicated than just "any unauthenticated URL must be fair game".

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#60

Post by freehunter »

maratd wrote: post #50
freehunter wrote: post #46

Earlier quoted context omitted.

The problem with metaphors is that they only resemble what they are describing. They'll always be imperfect. The problem with web servers is that anything that is public-facing is just that. Security through obscurity is no security at all. Like I said, the guy went too far. But visiting a public-facing website is not a crime, no matter how you happen to discover the URL. There's no sign on the door saying "keep out"…

> Intent is a critical factor. Like I said, the guy went too far. He didn't enter by mistake, though someone could have. He entered with the intent of making unauthorized copies of private data. We're in agreement here. I think we're both making the same point. Intent is the key here. The problem is that if you just consider servers, configurations, permissions, and other technical aspects ... intent doesn't enter th…

I do agree that we're making the same point, and I wrote my response to you in the mindset that I had poorly communicated my initial conclusion. Your point compliments my own. The difference we may have is that I don't view intent in the highest importance when someone visits a public server. Intent will only get you so far as long as server, configurations, permissions, and other technical aspects are in order. The reason he was able to copy restricted data is because the technical aspects were not in order. That's where the muddiness comes in; you wouldn't need intent to make unauthorized copies in this situation. The Googlebot could have made unauthorized copies. Your browser's cache could make unauthorized copies. Archive.org could have made unauthorized copies. Googling for plaintext and valid credit card numbers might shock you in what Google is finding on public servers.

His intent comes into play only secondarily in my opinion. I might enter a store with intent to steal something, but if a security guard is standing next to me and a camera is watching, I'd walk right back out. The lack of security is what allowed him to complete his intentions of unauthorized copying. It does not absolve him of his crimes, but thinking about the potential for unintentional restricted data access tells me that his crimes sit in line with the failed (non-criminal but out-of-compliance) policies of the host.

Post reply on HN