Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iPad Hack Statement Of Responsibility

techcrunch.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: iPad Hack Statement Of Responsibility

#61

Post by aneth4 »

rdl wrote: post #56
aneth4 wrote: post #48

Earlier quoted context omitted.

So he committed a crime and wrote words that characterize the intent behind crime in such a way as to increase prosecutorial interest and sentencing. Now you are saying he was just joking around when he said those things? Perhaps it's true, but it's stupid and it's hard for me imagine anyone taking that explanation seriously, certainly prosecutors and judges. If you walk into a bank with a gun and ask the teller for…

Yes, weev is an idiot. Yes, weev is abrasive. Fortunately neither of those are themselves crimes. Weev has always taken anything and turned it into drama. That's the whole Internet Troll thing. A normal defendant wouldn't, when faced with a chance to reduce his sentence by 1-3 years by "accepting responsibility", post something like this to the press. It basically screams "upward departure" to a judge, while at the s…

There is a difference between being abrasive and openly declaring unlawful intent. While the latter is not (always) illegal, it is a legitimate factor for prosecutorial discretion and sentencing.

Re: iPad Hack Statement Of Responsibility

#62

Post by mootothemax »

lawnchair_larry wrote: post #25
whyenot wrote: post #19

Earlier quoted context omitted.

That does not appear to be true. From the Ars Technica article on the case: "Auernheimer then helped Spitler refine his script to harvest a large number of valid e-mail addresses of iPad 3G users, suggesting that a huge data set would be needed to "direct market iPad accessories" or start a "future massive phishing operation," noting that the data breach would be "huge media news."

That is a joke. He is a troll. He makes satire videos and makes statements like that left and right. His security company was called "goatse security" and it was an ASCII picture of an anus. This might be offensive, juvenile, or unfunny, but it's nothing remotely close to criminal. The feds took a private IRC log out of context and pasted it into the indictment. This is not what the prison system exists for, and we a…

If what he says is a joke, and he's a troll, then he's also an unreliable witness. Hence why a trial is unnecessary to find out the truth? Because how can one know that he's telling he real story now?

Really, if you confess to a crime, and then turn around and say "ha ha, only kidding!" don't be surprised if people find it hard to trust anything you say.

Note: I'm taking what you've said here at face value and otherwise know very little about this case.

Re: iPad Hack Statement Of Responsibility

#63

Post by jamesaguilar »

redthrowaway wrote: post #60
jamesaguilar wrote: post #57

Earlier quoted context omitted.

"That guy got life in prison all for moving a knife about two feet in a certain direction! The system is corrupt!" I wish people could be a little more honest in the way they describe computer crimes. He knew or should have known that that api was not meant for public use. He is being punished for using it despite this knowledge.

You aren't seriously equating wrapping curl in a for loop to murder, are you?

Why do you even ask that. Isn't it obvious from my post that I'm pointing out that overly charitable wordings are misleading? Do you honestly believe that someone could have the mental capacity to enter words into this site and be unable to perceive the distinction between these two crimes? Or were you just trying to score a cheap rhetorical point by intentionally misreading me?

And again, of wasn't just wrapping curl in a for loop. It was doing that with the knowledge that the target was not meant to be public, storing that information, and sharing it with the media.

Also, it wasn't murder, it was assault with a deadly weapon. The victim went on to make a full recovery but it was the defendant's third strike.

Re: iPad Hack Statement Of Responsibility

#64

Post by mootothemax »

ghshephard wrote: post #3

I wasn't sure whether this is a spoof or not. Is he serious when he writes - "I did this because I despised people I think are unjustly wealthy and wanted to embarass them. " That was his admitted rationale - that he was seeking to embarrass people he despised because they were "unjustly wealthy?"

I'm presuming that was satire, although why he'd write something so easy for a trial prosecution to jump on is beyond me.

Re: iPad Hack Statement Of Responsibility

#65

Post by sdoering »

Can someone clarify something for me? As I am no American, I try to understand, if making public the email-addresses of the iPad-owners was anything remotely illegal (AT&T wise).

If so, why didn't weev just show law-enforcement - maybe with press present? Why not stage it so, that it is a deal between you and a press-outlet, a live showing of the problem, with a DA (or police/FBI, what ever) present?

I know, it only works, if the API, making personal-email-addresses public was illegal. But if so, he would have shamed AT&T, he would have "normal" people caring, not only the internet-bubble and he would be relatively save in terms of legality. Or wouldn't he?

Re: iPad Hack Statement Of Responsibility

#66

Post by dave1010uk »

redthrowaway wrote: post #60
jamesaguilar wrote: post #57

Earlier quoted context omitted.

"That guy got life in prison all for moving a knife about two feet in a certain direction! The system is corrupt!" I wish people could be a little more honest in the way they describe computer crimes. He knew or should have known that that api was not meant for public use. He is being punished for using it despite this knowledge.

You aren't seriously equating wrapping curl in a for loop to murder, are you?

I know it's a bit off topic but it's even simpler than that with bash expansion:

    wget http://example.com/?id={1..10}

Re: iPad Hack Statement Of Responsibility

#67

Post by DoubleMalt »

zmanji wrote: post #5

If anyone thinks weev deserves any sympathy, you don't know the full story. weev had malicious intent and wanted to harm AT&T by exposing users data. Instead of doing anything remotely rational he took all the data and wanted to sell it. Laws take into account indent (mens rea) and there is a lot of evidence in his indictment that he wanted to profit off this act. He shouldn't be compared to Aaron Swartz

The intent is immaterial if the actions are not against the law.

If accessing published information (and incrementing a number in an url cannot be considered breaking in ...) is against the law, there is something terribly wrong with the law.

That said if he tried to use the data to extort money from AT&T that would of course be a criminal offense (even if the "intent" was robinhoodian).

To illustrate with an analogy: If someone takes a picture of a hapless drunk girl dancing topless in a bar (AT&T), that is not criminal. If this person approaches the girl and asks for money to delete the incriminating pictures, that is extortion. If the person sells the picture to an interested third party, this might constitute the case for a civil lawsuit (see the texxxan case...)

In any case no special laws are needed for judging behaviour in the virtual world.

Re: iPad Hack Statement Of Responsibility

#68

Post by ghshephard »

rayiner wrote: post #39
ghshephard wrote: post #37

Earlier quoted context omitted.

Wasn't it just email addresses that he published? I'm all for protecting personal information, but I find it hard to believe it's a felony for collecting a list of email addresses.

The crime in question was accessing a computer system in an unauthorized fashion to collect e-mail addresses. Yes, the distinction is relevant. Taking photos of my wife in public and publishing them? Creepy but not illegal. Walking through my door (locked or unlocked, it doesn't matter) to take photos of my wife in my house? You're lucky if you don't get shot.

But, in this case - didn't he just spoof a user agent and toss fairly guessable CCID numbers?

Certainly hacking, and given that he doesn't work for, or is associated with AT&T - some type of criminal trespass - but, we're talking community service here, not a felony. Slap the hand, don't cut it off.

I would hope we can all agree that there is a pretty big difference between a pervasive attack where someone spear-phishes a user inside a company, plants a trojan, and uses that to acquire sensitive intellectual property for financial gain, and/or do damage - versus what weev did - trying some pretty obvious numbers on the public website with an iPad user agent.

Re: iPad Hack Statement Of Responsibility

#69

Post by ghshephard »

lessnonymous wrote: post #45
miw-sec-work wrote: post #29

weev still thinks that AT&T 'published' this information. AT&T had no intention on 'publishing' this information, he abused their system in order to obtain it, then he leaked it. No weev, you found a bug in their web app, then _YOU_ willfully published other peoples personally identifying information for your own fame and glory. Unfortunately, someone who's name and details you leaked didn't like that, and called in…

But they did publish it. Just because they didn't _intend_ to publish it doesn't mean it wasn't published. Right now the URL I'm looking at has "id=5095821" in it. If I change that to "id=5095822", I'm looking at something else published by Hacker News. But by DoJ standards, I'm "hacking" and have broken the law if HN didn't deliberately publish it. weev is an ass. But he didn't hack anything. These cases are trying…

He certainly hacked it - but that's not necessarily pejorative. Your average individual couldn't just try entering the number into AT&T - weev had to spoof the user agent, and, make some intelligent guesses as to what valid CCID's would be.

It's not the world's greatest hack, but it certainly was using the system in a manner that I'm certain AT&T did not intend. The IRC logs indicated that they knew what they were doing was likely criminal, and if AT&T discovered them, would "sue" them.

Whereas I'm guessing PG would be fine with you incrementing the number on the HN URL. And I'm pretty certain that's not criminal behavior.

It's important to note, that just because weev was hacking the AT&T site, didn't mean it was a criminal hack. In my mind it barely crosses the line - and he gets punished somewhat, but I'm thinking a week in jail and 30 days community service - not the silly levels that the feds are going to in this case.

Re: iPad Hack Statement Of Responsibility

#70

Post by rsingel »

zmanji wrote: post #5

If anyone thinks weev deserves any sympathy, you don't know the full story. weev had malicious intent and wanted to harm AT&T by exposing users data. Instead of doing anything remotely rational he took all the data and wanted to sell it. Laws take into account indent (mens rea) and there is a lot of evidence in his indictment that he wanted to profit off this act. He shouldn't be compared to Aaron Swartz

May we see some proof of the full story. There's nothing to that effect in the IRC logs other than some jokes about how the data is valuable and how they could sell iPad accessories. As if. What did he do? Wrote a bunch of journalists to get press and then deleted the data.
Post reply on HN