Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

technologyreview.com

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#81

Post by vajrabum »

tptacek wrote: post #59
sneak wrote: post #56

Earlier quoted context omitted.

> regardless of how that retail brokerage chooses to authenticate access There was no other authentication system aside from HTTP in place in this case. If that's the only one, and it's wide open, any reasonable person knows that the information there is public. That's how the web works. We're allowed to load URLs on planet Earth.

I understand where you're coming from, but that logic doesn't really work, does it? I can tell you that somewhere there is indeed an application that will respond to an unauthenticated GET request by transferring funds between accounts. You and I both know that. Deliberately loading that URL on planet Earth to effect funds transfers will get you charged. So it's obviously more complicated than just "any unauthenticat…

That sounds like a pretty dubious assertion to me, especially given the nature of $$$. Care to provide some evidence?

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#82

Post by jonknee »

danielweber wrote: post #71
jonknee wrote: post #70

It's pretty scary that you can go to jail (for a long time!) for something as simple as: > ~curl http://example.com/att/[1-100].html I understand what the lawyers are saying, but this is just beyond common sense. There should be liabilities for deploying software that publicly gives out information you do not intend to.

If you've never deployed software without security flaws, it means you have never deployed software.

Sure, but why should who makes the software bear no responsibility? If a building is found to have a flaw the architect or an engineer are who get questions, not whoever noticed the flaw.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#83

Post by sneak »

lesterbuck wrote: post #69
BryantD wrote: post #67

Earlier quoted context omitted.

It's worth reading the indictment, here (thanks to ssclafani for digging this up): http://www.scribd.com/doc/113664772/46-Indictment "The Account Slurper attached AT&T's servers for several days in or around June 2010, and was designed to harvest as many ICC-ID/email pairings as possible." This is the indictment, so not proven, but the period for which the script ran is probably accurate. So nah, not a short time. Th…

I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.

Those are the things they DISCUSSED doing - what ACTUALLY HAPPENED was that they sent excerpts to the media and deleted their own copies.

It looks bad but I think it's more important to focus on the fact that they ended up doing the Right Thing with the data instead of fucking anyone directly - even when distinctly aware of the various opportunities available for misusing that data.

Many greyhat researchers don't have those ethics or morals.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#84

Post by tptacek »

vajrabum wrote: post #81
tptacek wrote: post #59

Earlier quoted context omitted.

I understand where you're coming from, but that logic doesn't really work, does it? I can tell you that somewhere there is indeed an application that will respond to an unauthenticated GET request by transferring funds between accounts. You and I both know that. Deliberately loading that URL on planet Earth to effect funds transfers will get you charged. So it's obviously more complicated than just "any unauthenticat…

That sounds like a pretty dubious assertion to me, especially given the nature of $$$. Care to provide some evidence?

If that sounds like a dubious assertion to you, I'm guessing you don't work in application security. Me and 'sneak do.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#85

Post by sneak »

gknoy wrote: post #73
nitrogen wrote: post #62

Earlier quoted context omitted.

I'm guessing that sneak wasn't referring to HTTP Basic Auth, but rather the fact that when an HTTP client says "GET", the server effectively says "HOW MUCH?" (A crude allusion to the classic "jump/how high?") I think sneak is arguing that receiving a response to an isolated GET request implies that the GET request was "authorized." Edit: after reading selections of IRC logs and e-mails from the indictment, my sympath…

I wonder what one could get an expert witness to testify to with regards to the meaning behind the HTTP protocol with respect to 'authorization'.

Sergey Bratus[1] (of Langsec[2] fame) testified as an expert witness for the defense in this very way within the last few days.

[1] http://www.cs.dartmouth.edu/~sergey/

[2] http://www.cs.dartmouth.edu/~sergey/langsec/

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#86

Post by tptacek »

BryantD wrote: post #77
driverdan wrote: post #14

From my understanding all you had to do was pass the ICC-ID to a script on AT&T's servers to get back the user data. I can see the court interpreting the ICC-ID as a form of access control since you'd have to guess them similarly to passwords. What isn't quite clear to me is what they did with this data. It seems they reported the hole to AT&T who then fixed it. That's good. It also seems they passed the data off to…

Point of information: did weev or anyone at Goatse Security report the hole to AT&T, or did they just send the information to the media? None of the reporting I read at the time said that they reported to AT&T, but I could easily have missed something.

According to Spitler's indictment, they did not; in a captured IRC chat, A.A. told another member of his group explicitly that he had not reported the breach to AT&T.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#87

Post by tptacek »

sneak wrote: post #83
lesterbuck wrote: post #69

Earlier quoted context omitted.

I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.

Those are the things they DISCUSSED doing - what ACTUALLY HAPPENED was that they sent excerpts to the media and deleted their own copies. It looks bad but I think it's more important to focus on the fact that they ended up doing the Right Thing with the data instead of fucking anyone directly - even when distinctly aware of the various opportunities available for misusing that data. Many greyhat researchers don't hav…

That's why they've been charged with "Conspiracy", isn't it? The elements of federal Conspiracy:

(1) An agreement between two or more persons to commit at least one crime.

(2) A person joining the conspiracy knowing of at least one of its objects and intending to help accomplish it.

(3) One of the members of the conspiracy performed at least one overt act for the purpose of carrying out the conspiracy.

So, here:

1. Let's build a database of stolen AT&T email addresses associated with iPads and then sell them to spammers.

2. Here, run this script as I adjust to to increase the number of accounts it successfully finds.

3. Oh, look, I ran this script and got 100,000 email addresses.

Not good, right?

Look, if you read Spitler's indictment, it really doesn't seem like this particular conspiracy wanted to do anything but troll a huge company with thousands of people's personal information. I don't have a whole lot of sympathy for the defendants here, but it does seem like an injustice that could have been addressed in civil court.

It seems like a stretch to convince a jury that these people really wanted to sell the information they collected.

On the other hand, I think the idea that AT&T made this information available to the public in such a manner that you could have in good faith harvested hundreds of thousands of addresses is pretty much bunk. It's not going to help that A.A.'s first instinct was to run to the media because simply having the addresses was such a big story that they'd be on the front page of NEWS.GOOGLE.COM. He more or less immediately made clear to everyone that he knew he had no business handling that data.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#88

Post by sk5t »

babarock wrote: post #32
emmapersky wrote: post #27

Earlier quoted context omitted.

Why should I, as an innocent party to a companies security failings have my personal details revealed. This is exactly why we have laws protecting identity theft and fraud. Naming and shaming the company and the extent of their security failing is enough. But only after they have patched the hole.

Because you trusted the wrong people, and this has consequences. The customer has to suffer from the mistakes of the companies so that: 1. She stops trusting any company blindly with her data. 2. The market demands improvements from the service providers (and no, sacrificing a scapegoat in court is not an "improvement"). 3. Service companies react. Unless there's a major scandal, companies are slow to react to vulner…

This is an excellent point... sloppy, careless companies can operate more cheaply (until they go down in flames); insulating the consumer from these security risks would introduce the same kind of moral hazard as insulating investors from the downside on risky investments.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#89

Post by tptacek »

sneak wrote: post #85
gknoy wrote: post #73

Earlier quoted context omitted.

I wonder what one could get an expert witness to testify to with regards to the meaning behind the HTTP protocol with respect to 'authorization'.

Sergey Bratus[1] (of Langsec[2] fame) testified as an expert witness for the defense in this very way within the last few days. [1] http://www.cs.dartmouth.edu/~sergey/ [2] http://www.cs.dartmouth.edu/~sergey/langsec/

Do you really buy this line of argument? How many banking applications configure themselves so that they rely on the intended meanings of HTTP verbs and authorization headers as their primary overt security mechanism? And of those, how many do so correctly?

I get why Bratus would testify. The defendant here needs all the help he can get and is morally entitled to the best case he can possibly present. I respect and admire everyone who is trying to help him out. But presuming he's not guilty of a real conspiracy to defraud anyone, I have a hard time believing it's because AT&T's web application vulnerability entitled the public to their database.

Re: Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails

#90

Post by BryantD »

sneak wrote: post #83
lesterbuck wrote: post #69

Earlier quoted context omitted.

I just glanced through the indictment linked above and the IRC log snippets are extremely damaging. Very hard to make the case that this is a purely innocent whistle blower. Maybe its just trash talking among friends on IRC, but it will sound very, very bad when read in court.

Those are the things they DISCUSSED doing - what ACTUALLY HAPPENED was that they sent excerpts to the media and deleted their own copies. It looks bad but I think it's more important to focus on the fact that they ended up doing the Right Thing with the data instead of fucking anyone directly - even when distinctly aware of the various opportunities available for misusing that data. Many greyhat researchers don't hav…

It's debatable whether or not they did the right thing. Many security researchers would say that the right thing would have been telling AT&T first, giving AT&T a reasonable amount of time to respond, and only then going to the media.

This also speaks to motives. At the end of the day, I don't really care whether or not weev is a good guy. I do think it's important to be really clear about why he does the things he does, because otherwise you're not having the real conversation. IMHO, it's more important to protect jerks than it is to protect nice guys. It's harder to protect jerks.

Therefore, you're doing the community a disservice if you paint weev as an angel. Let him be who he is. Then defend him if his case merits it.

Tangentially, "many greyhat researchers don't have those ethics or morals" is irrelevant. The question at hand is whether or not weev acted morally, not whether or not he did better than average.

Post reply on HN