Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

technologyreview.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#61

Post by mattzito »

sneak wrote: post #42
driverdan wrote: post #14

From my understanding all you had to do was pass the ICC-ID to a script on AT&T's servers to get back the user data. I can see the court interpreting the ICC-ID as a form of access control since you'd have to guess them similarly to passwords. What isn't quite clear to me is what they did with this data. It seems they reported the hole to AT&T who then fixed it. That's good. It also seems they passed the data off to…

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

I guess maybe the disconnect here is, and help me understand, but why did he need to gather 110k email addresses?

If he never had any intention of using them, or just wanted to publicize the breach, why not gather two or three and then go to the press?

I guess an analogy might be - I see a bunch of boxes on the curb outside a doctor's office. I open one up and look at the first manila folder - it's someone's medical records. I open the second, it's also medical records.

If I take those two to go show a reporter, or yell at the doctor's office, I'm ethically clean. But if I take the boxes home with me, I'm in a much trickier legal and ethical situation, as why did I need to take the records home?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#62

Post by nitrogen »

tptacek wrote: post #51
sneak wrote: post #42

Earlier quoted context omitted.

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent. Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you brea…

I'm guessing that sneak wasn't referring to HTTP Basic Auth, but rather the fact that when an HTTP client says "GET", the server effectively says "HOW MUCH?" (A crude allusion to the classic "jump/how high?") I think sneak is arguing that receiving a response to an isolated GET request implies that the GET request was "authorized."

Edit: after reading selections of IRC logs and e-mails from the indictment, my sympathy with weev has been reduced. Granted, an indictment will select the most salacious excerpts to make its case in the strongest way possible, but the conversations in the indictment are far from white hat (unless the defendants manage to convince the court that their talk of phishing and spamming was merely juvenile humor).

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#63

Post by danielweber »

emmapersky wrote: post #27
guard-of-terra wrote: post #23

He should totally have posted those on pastebin instead and shared on the net. I think that if one finds an embarrassing security vulnerability, they should look up the offending company and upon finding that company ever took part in the crap like described in the article, they should publish the vulnerability wide open, goatse-style, anonymously via pastebin. Those companies should suffer to the end of times and th…

Why should I, as an innocent party to a companies security failings have my personal details revealed. This is exactly why we have laws protecting identity theft and fraud. Naming and shaming the company and the extent of their security failing is enough. But only after they have patched the hole.

Because shaming is a whole lot of fun.

So we will come up with whatever justifications needed to say it's okay.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#64

Post by nitrogen »

mattzito wrote: post #61
sneak wrote: post #42

Earlier quoted context omitted.

The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question. The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators cri…

I guess maybe the disconnect here is, and help me understand, but why did he need to gather 110k email addresses? If he never had any intention of using them, or just wanted to publicize the breach, why not gather two or three and then go to the press? I guess an analogy might be - I see a bunch of boxes on the curb outside a doctor's office. I open one up and look at the first manila folder - it's someone's medical…

In computers, the only quantities that matter are zero, one, or many. My guess: weev wrote a script that incremented IDs just to see what would happen, it ran for a short time, and... whoops, there's 110k addresses there!

It's difficult to analogize this to the physical world; maybe you could say that you are the garbage collector, so your automated truck picking up one box of trash that happened to contain medical records is the same as picking up all the boxes, but that's still far from a perfect analogy.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#65

Post by BryantD »

Bah, more weev hagiography? He's not a whistle blower, he's a troll.

Look: first off, he didn't tell AT&T about the hack, he told a bunch of news organizations. See http://www.forbes.com/sites/firewall/2010/06/09/atts-ipad-ha... for details. "we did a benefit analysis and decided they could take our story viral the fastest."

One of those organizations presumably told AT&T; all AT&T has ever said is that they learned about the exploit from a business customer.

Second, weev is the same guy who got up on stage at Toorcon and lied about finding an exploit in Firefox. Just flat out lied. One of the ways in which he's a great social manipulator is that he has no qualms about the big lies, and doesn't really care if they're noticed.

Third, at the time, weev said "There is nothing in Apple’s SDK APIs that would allow an application to have this identifier [the ICC-ID] – it is a shared secret that should indicate physical proximity to the iPad." So while it's amusing to see his defenders talk about how unimportant ICC-IDs are, it's an interesting change of tune.

Fourth, even if you believe weev when he says he forced the Amazon delist of gay-themed books (I never have), that goes over the line from activism to exploiting.

Yeah, we do have to protect even unpleasant, obnoxious whistle blowers. I just don't see how weev counts as a whistle blower, and I think that any article on his situation should present the full picture rather than painting him as a misunderstood good guy.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#66

Post by nitrogen »

robmurrer wrote: post #25
josteink wrote: post #22

Earlier quoted context omitted.

Following that logic breeds bizarre results. What if you find this magic token because it was embedded in some client-side, javascript login-form? Are you a hacker for viewing the source? Securing content on the internet is easy. If you don't want it accessible to anyone, don't give the content to anyone who provides an unauthenticated HTTP request. Why are we putting the legal responsibility of maintaining security…

If I look under your doormat, and there is a key, and I use it to open your front door...

A house's front door implies an expectation of privacy. A web server implies an expectation of public access.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#67

Post by BryantD »

nitrogen wrote: post #64
mattzito wrote: post #61

Earlier quoted context omitted.

I guess maybe the disconnect here is, and help me understand, but why did he need to gather 110k email addresses? If he never had any intention of using them, or just wanted to publicize the breach, why not gather two or three and then go to the press? I guess an analogy might be - I see a bunch of boxes on the curb outside a doctor's office. I open one up and look at the first manila folder - it's someone's medical…

In computers, the only quantities that matter are zero, one, or many. My guess: weev wrote a script that incremented IDs just to see what would happen, it ran for a short time, and... whoops, there's 110k addresses there! It's difficult to analogize this to the physical world; maybe you could say that you are the garbage collector, so your automated truck picking up one box of trash that happened to contain medical r…

It's worth reading the indictment, here (thanks to ssclafani for digging this up):

http://www.scribd.com/doc/113664772/46-Indictment

"The Account Slurper attached AT&T's servers for several days in or around June 2010, and was designed to harvest as many ICC-ID/email pairings as possible."

This is the indictment, so not proven, but the period for which the script ran is probably accurate. So nah, not a short time.

There's also some great IRC logs later on where they're talking about using the collected email addresses for phishing, debating whether or not it's worth the effort if they don't get passwords, and talking about selling the resulting email database.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#69

Post by lesterbuck »

BryantD wrote: post #67
nitrogen wrote: post #64

Earlier quoted context omitted.

In computers, the only quantities that matter are zero, one, or many. My guess: weev wrote a script that incremented IDs just to see what would happen, it ran for a short time, and... whoops, there's 110k addresses there! It's difficult to analogize this to the physical world; maybe you could say that you are the garbage collector, so your automated truck picking up one box of trash that happened to contain medical r…

It's worth reading the indictment, here (thanks to ssclafani for digging this up): http://www.scribd.com/doc/113664772/46-Indictment "The Account Slurper attached AT&T's servers for several days in or around June 2010, and was designed to harvest as many ICC-ID/email pairings as possible." This is the indictment, so not proven, but the period for which the script ran is probably accurate. So nah, not a short time. Th…

I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#70

Post by jonknee »

It's pretty scary that you can go to jail (for a long time!) for something as simple as:

> ~curl http://example.com/att/[1-100].html

I understand what the lawyers are saying, but this is just beyond common sense. There should be liabilities for deploying software that publicly gives out information you do not intend to.

Post reply on HN