Heartbleed hack case sees first arrest in Canada • Hacker News Board

Re: Heartbleed hack case sees first arrest in Canada

#31

Post by mindslight » Thu, Apr 17, 2014, 2:11 AM UTC

unreal37 wrote: post #30

mindslight wrote: post #14

Earlier quoted context omitted.

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

Wow, you seem to be condoning theft here. The CRA website was hacked, using a hacking technique just discovered. It is not like "leaving a street-level window open". It's more like, a new way to pick a lock was discovered that no one knew existed, and he went around picking locks to see what he could find. He knew he was hacking the CRA when he did it. He can't claim to have done it accidentally. The CRA did everythi…

An open window is easily spotted, so it probably is more appropriate to say an unlocked window. I didn't deny that he hacked the CRA, or even that those actions are wrong in a sense (on a different day/topic I might make that argument..), but am just pointing out the draconian binary punishment for computer crimes that you're also referencing when you say "Hate to see his life ruined".

Let's say on a lark you go walking down the street trying doorknobs, open the first unlocked one, and sit down on the couch and watch TV until the owner gets home. You have trespassed, and if the owner presses charges you will most likely be punished. However, that punishment will most likely be commensurate with the severity of the crime, not life-altering years in prison.

Re: Heartbleed hack case sees first arrest in Canada

#32

Post by mindslight » Thu, Apr 17, 2014, 2:17 AM UTC

Zombieball wrote: post #29

mindslight wrote: post #14

Earlier quoted context omitted.

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

I like your analogy in that it portrays the fact that nothing was physically stolen, much similar to arguments used in piracy issues. However, my understanding of heartbleed is it can take many thousands of requests before interesting / meaningful data is returned. I doubt 900 SINs were returned in a single response (I could be wrong). So I suppose this is analogous to repeatedly sticking your head in & out of the wi…

Well the standard way of answering that question is that it has nothing to do with the number of packets, but with the ultimate intent and actual damages caused. Unfortunately the legal system considers basically any hacking to be witchcraft and is horribly miscalibrated as to what should be considered serious or not.

Re: Heartbleed hack case sees first arrest in Canada

#33

Post by rbanffy » Thu, Apr 17, 2014, 2:25 AM UTC

unreal37 wrote: post #30

mindslight wrote: post #14

Earlier quoted context omitted.

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

Wow, you seem to be condoning theft here. The CRA website was hacked, using a hacking technique just discovered. It is not like "leaving a street-level window open". It's more like, a new way to pick a lock was discovered that no one knew existed, and he went around picking locks to see what he could find. He knew he was hacking the CRA when he did it. He can't claim to have done it accidentally. The CRA did everythi…

> It is not like "leaving a street-level window open"

The OpenSSL thing is very much like suddenly discovering you had a street level window open for the past two years.

Re: Heartbleed hack case sees first arrest in Canada

#34

Post by meowface » Thu, Apr 17, 2014, 5:44 AM UTC

mindslight wrote: post #14

meowface wrote: post #12

Earlier quoted context omitted.

Intent should count, but if someone broke into a company's building at night, picked the lock to a manager's desk, and stole all the papers he could see and ran out...obviously a theft has occurred. Even if he was not looking for anything in particular, or did not plan on using any of the information found in the papers, he's committed a felony. In this case I don't think it's clear whether or not he went ahead to pa…

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

I think it depends on exactly what he did here. I don't know the details of the case.

If he simply ran the Heartbleed script for an hour or 2 and did literally nothing else after it finished running, then yes, your analogy is the correct one and mine is wrong. In that case he should probably only be liable for the money spent by the agency in investigating the attack.

If he scraped out the SSL private key from the results, that's clearly worse.

If he additionally scraped out everything that fit the format of an insurance number, then it's quite a bit worse.

If he planned on publicizing or personally using any of these, then it's far worse.

I would also argue that it's less like a window being left open, but rather a door located around the back of the building where no one goes accidentally being left unlocked.

Re: Heartbleed hack case sees first arrest in Canada

#35

Post by amits89 » Thu, Apr 17, 2014, 9:08 AM UTC

Google is one of the company which is affected very badly by HeartBleed bug, Almost all the services like YouTube, Gmail by Google are affected. Amazon, Yahoo! are also in the same list. We just need give attention to Apple & Microsoft who are not affected by Heartbleed. Check out detail list which shows list of company who are affected or not by this issue. http://www.dazeinfo.com/2014/04/17/google-inc-goog-worst-aff...

Re: Heartbleed hack case sees first arrest in Canada

#36

Post by JimmaDaRustla » Thu, Apr 17, 2014, 12:32 PM UTC

A lawyer I consulted with is defending him, making him out to be the victim by the RCMP. Seems like a tactic to distract people from what he actually did. http://www.lfpress.com/2014/04/16/london-teen-charged-in-hea...

Of course he's from my town, and of course he's taking computer science. This was my first instinct when I heard of the case, that it was some kid thinking he was safe behind his computer screen. I only say this because I seen it A LOT in this town while going to school.

Re: Heartbleed hack case sees first arrest in Canada

#37

Post by mindslight » Thu, Apr 17, 2014, 4:57 PM UTC

meowface wrote: post #34

mindslight wrote: post #14

Earlier quoted context omitted.

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

I think it depends on exactly what he did here. I don't know the details of the case. If he simply ran the Heartbleed script for an hour or 2 and did literally nothing else after it finished running, then yes, your analogy is the correct one and mine is wrong. In that case he should probably only be liable for the money spent by the agency in investigating the attack. If he scraped out the SSL private key from the re…

What he achieved should only be relevant in how it demonstrates intent. Deducing the SSL key could be done as a proof-of-concept, and should only matter if it can be used to show that he was planning on impersonating the site in furtherance of some other crime.

I do concede that the proper analogy isn't something so plainly visible to all as an open window, but it does have to incorporate an external motivating factor to try the door (perhaps a rumor floating around town that they tend to leave it unlocked and oh boy you wouldn't believe what's on the other side..)