Post from "weev" (AT&T/ipad data hacker) on his arrest and treatment

http://security.goatse.fr/hypocrites-and-pharisees

by robk • 16 years ago

176 78 16 years ago

security.goatse.fr

phreeza• 16 years ago

Unfortunate domain name. Almost didn't click it. But it is legit.

daten• 16 years ago

Unfortunate site logo as well. Between his writing style, the content of some of his posts, and the choice of name and logo, I'm finding it very difficult to take this author seriously.

rdl7• 16 years ago

The whole "goatse" thing is part of the performance art. Hacker groups have a long history of over the top stuff like that -- look at the Cult of the Dead Cow (cDc), Phone Losers of America, Legion of Doom, etc.

weev is a troll (in the 4chan sense), and a performance artist, but on this issue, he's actually being pretty straight up. He got some information about a security vulnerability, was asked to publicize it, did so, and is now being unlawfully screwed for it.

Was what he did prudent, especially for someone already on the FBI shitlist? No. Was it lawful? Yes. And, it certainly brought the security vulnerability, which was an incompetent decision by ATT, to public attention.

Robin_Message4• 16 years ago

Civil rights are actually not dependent on domain name, writing style, content of writing, name, logo, or in general any damm thing at all. They are called "unalienable rights" for a reason.

As Americans declared in a few days ago in 1776, "But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security."

If what he says is true, then it is our right, and our duty, to stand up for weev. If the government is this far in the wrong, then that is more important than any single individual's actions. Give him some cash (http://security.goatse.fr/help); write to the EFF; call your congressman; ask an America you know to do the same; but please, find another thread for discussing logos, e.g. http://news.ycombinator.com/item?id=1493603

If he is lying, then we need evidence he is lying, not that he has bad taste in logos.

EDIT: I clarified the above to add the "If what he says is true... // If he is lying..." without marking the edit, which I am now doing. I apologise if I edited after the children had posted.

dlytle2• 16 years ago

If his claims are accurate, and only minimally influenced by hyperbole, it appears he's at the center of a massive miscarriage of justice.

I'd be interested to see an analysis by someone who knows more about the law than I do.

rdl7• 16 years ago

I think it's shameful that no one has stepped up to provide him with free, top notch legal assistance. I'm relatively familiar with the case (I know weev personally, too), and he is actually not exaggerating. This is exactly the kind of case the EFF exists to defend. Yes, weev is a troll and a media whore, but that doesn't automatically make him wrong.

Goatse behaved in the industry accepted standard way in popularizing a security vulnerability -- full disclosure. I personally would have done the same (although I would not have kept illegal drugs at my residence after doing so, but I also would probably ventilate anyone breaking into my home without clearly announcing a warrant...)

Free weev!

iambvk• 16 years ago

Lets hope Apple will step-in and to stand by his civil liberties. I heard they took some moves for the same for Chinese workers :P

ErrantX7• 16 years ago

> Goatse behaved in the industry accepted standard way in popularizing a security vulnerability

Well, as someone working in the security industry I take slight issue with this. They appear to have cashed in on the media coverage as much as possible rather than focus on proper disclosure practices. I (and a lot of people in my job, I think) would consider it just on the wrong side of unethical.

rdl7• 16 years ago

Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however.

My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action.

If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible.

If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.

roc• 16 years ago

The defense of freedoms often involves defending those who exercise them in a way that we don't approve of.

ttol8• 16 years ago

Why is it "shameful"? It wasn't clear whether or not weev even asked the EFF/others to defend. It seems like he only asked the judge for a public defender and was denied, and then he ranted about that for awhile.

Did he ask others to defend or at least give him some free consult/referrals? Did he get denied by them?

rdl7• 16 years ago

I believe weev has some kind of negative history with EFF.

illumin83• 16 years ago

The problem is that weev doesn't understand how a grand jury subpoena works. He has not been indicted, nor charged with any crime related to the "hack" yet. He has only been asked to testify in front of a federal grand jury. The government has no responsibility to provide a public defender, because he hasn't been indicted and charged with a crime yet. Technically, he's not yet a defendant.

I should mention the other charge for possession is most likely completely separate, and being handled at the state/local level, since he didn't commit a federal crime in that regard (it would have to be interstate trafficking).

In short, weev doesn't understand how the federal justice system works and is asking for help.

illumin83• 16 years ago

I don't think the EFF should be spending donated money defending black hats from potential criminal prosecution. There are far more white hats out there that have been unfairly targeted for true responsible disclosure. There are also a lot more important free speech issues to defend than your right to shout private AT&T account information in a public theater...

jrockway• 16 years ago

I would have been 100% behind him if he had said, "hey, I noticed this hole, visit http://att.com/account_info.php?omg=noes and have a look!" By actually publishing the information, he proved that he accessed information he was not authorized to have, which the law does technically say you are not supposed to do. (The "hey, I noticed this hole", IMO, is not enough to build a solid case against him for accessing data he was not supposed to have. IANAL, though.)

Either way, though, prison is not an acceptable outcome for this behavior. "Don't do this again," maybe, but not being locked in a cage for years. How would that help anyone?

Sujan• 16 years ago

I don't know anything about the story, but right now, it somehow looks like he's quite a nutjob. Writing shorter, more precise and in a chronological order of the events would really help the text to be more understandable and get the point across.

The situation is probably quite stressful for him, but he somebody should really help him work on the text so others understand what it's all about.

datasink• 16 years ago

His personal blog is worth a read for some context: http://weev.livejournal.com

He has some posts which suggest the FBI was bugging his apartment and covertly following him around town. This was months prior to the release of the iPad accounts. So, yes, I suspect he is dealing with some mental issues.

mikecane3• 16 years ago

Just because you don't "like" someone is no reason to violate the hell out of his rights. If they do it to him, they will do it to you. And your being "liked" won't help you one damned bit.

ttol8• 16 years ago

I'm still not convinced that his rights were violated. He says they are, but this is a guy who wrote a giant essay about his case, and then published it on the net, and ended it with a plea for donations/money. If I were in his shoes, I'd have spent the time calling the EFF to see if they can help, and asking for referrals. It almost seems like he is seeking attention.

Also, he seems to be able to obtain documents and requests from the gov to print online, yet also claims he can't get access to them but mentions some deadline. If you're not able to read the request/denied access to it, no judge will hold the deadline over you. That's just conspiracy/crazy talk.

mikecane3• 16 years ago

Of course he's seeking attention. So would you if you were being handled as he says he is. And who says the EFF has the manpower right now to handle his case? This is like people who turn to Legal Aid at the last minute and are shocked to find out they have limited resources, if not an outright waiting list. And given the behavior of both the government post-9/11 and Apple several years ago suing a rumor site out of existence, I'd rather bet on him than either of them.

st3fan5• 16 years ago

This whole article is not good for his case. I stopped reading halfway because it looks like the typical crazy person rant.

What he needs to do is get proper legal counsel.

furyg32• 16 years ago

You didn't read far enough, because he's being denied legal counsel.

rdl7• 16 years ago

He's being denied legal counsel for the drugs charges -- according to the letter, they are all minor misdemeanors, although originally he was alleged to have felony weight on him. That's actually a victory for him, so far.

The problem is there are potential actual felony charges under discussion, related to the original computer crime warrant. While he hasn't been charged, he doesn't get a public defender. If he's charged, he gets a public defender.

If I were in his shoes, I would absolutely be getting a lawyer (and I sent him $100 toward that, and asked some friends who are lawyers to consider it).

Honestly, not getting an Arkansas Public Defender is probably a victory for him, too. I would rather represent myself than rely on AR PD to defend me in a case like this.

altano• 16 years ago

Yeah really.

Has he contacted the EFF or other similar organizations? What's with all this defense of anti-semetism? Someone needs to proofread this. What's the call to action? If the domain name's not going to change, fine, but get rid of the giant anus illustration for such a plea. Yeesh.

st3fan5• 16 years ago

Full Disclosure != Free Speech.

You cannot just publish personal data and then call it 'free speech' and 'industry standard practice' of a 'journalist'.

Seriously .. where is the ethics in that?

How about actually trying to work with AT&T to get this fixed behind the scenes? Oh no, of course not, because that would not result in the right kind of exposure for these 'security experts'.

These things are all about ego and status. Hidden behind a thin shell of 'full disclosure'.

furyg32• 16 years ago

Well, it depends.

Testing/Evaluating/Disclosing an exploit isn't immoral in my mind, nor should it be illegal (in a perfect world).

Disclosing private details of third paries is certainly immoral in my mind, and should be illegal.

According to this logic publishing the exploit, so long as you're censoring output, is fine. If someone uses your exploit to download personal data, it's AT&T who is doing the immoral/hopefully-illegal disclosure. If that someone uses your exploit and then publishes the data or does some other naughty thing with it, book 'em.

You get moral brownie points under this logic if you notify the target after you discover the exploit. It's not required, because disclosure is notification. Nefarious-types aren't going to call up a bank to say "hey, we're stealing all your customer records", nor will they disclose this hole to the world.

Unpopular statement ahead: if you collect personal details, it's your job to secure your systems, and it's your fault if your systems leak them. Of course there's no such thing as 100% secure, but you're the one doing the risk analysis and design.

ErrantX7• 16 years ago

> It's not required, because disclosure is notification.

In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)

Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).

It is also very definitely not ethical to hand the data you got to the media. :)

mfukar3• 16 years ago

Evaluating an exploit, unless sanctioned by a bilateral agreement between both parties (like in pentesting), is in fact illegal in most countries. Disclosure without proper notification of the affected parties can also lead (and sometimes does) in a lawsuit against you.

I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.

rdl7• 16 years ago

The problem with "responsible disclosure" is that a vendor can convince you not to disclose at all -- they can drag out the process of patching for months, and can try to convince you never to release the disclosure, or at least to wait until no one cares anymore, because some users may not have patched.

The purpose of disclosure is twofold: you want the vendor to fix the bug, but you also want the marketplace to take notice of the existence of the bug.

Knowing that Vendor M was informed of a bug and took 6 months to fix it, whereas Vendor L was informed of a bug and took 1 day to fix it, is useful to me when I'm evaluating an operating system vendor. The best way to have this information out there is to cause a big splash when you release it.

Fundamentally, the assumption is that white and gray hat hackers do not discover every bug out there. If you sit there and do semi-sophisticated static analysis on a lot of software, or fuzzing, you can discover a lot of 0-day vulnerabilities which no one has yet announced.

If end users don't feel pain from security vulnerabilities, they will not prioritize adequate security when they make purchasing decisions. Vendors with a strong security focus should support aggressive full disclosure of all vulnerabilities of all vendors.

dlytle2• 16 years ago

Maybe I'm just cynical, but it seems like working behind the scenes with the vendor doesn't seem to bear fruit very often. It's pretty frequent to read about companies that have ignored vulnerabilities until they're fully disclosed. Plus, AT&T doesn't exactly have a recent track record for keeping their network or services in good order.

Of course, the vulnerabilities that are fixed by working directly with vendors never end up the topic of news articles, so I'm sure it's not as cut and dry as an outside perspective would indicate.

st3fan5• 16 years ago

That is because you only hear about those cases where it did not work out.

Take a look at for example Apple's release notes for a security update: dozens of fixes, most reported by external companies and persons, all with proper attribution.

I'm fairly sure that the process does work most of the time.

mukyu2• 16 years ago

Are you even remotely familiar with the facts of the case?

weev claims to have received the data from an unknown source.

He then has AT&T informed through a third-party.

After that has happened and AT&T has fixed the vulnerability, he gives the data to a journalist and deletes it.

The journalist then writes about it and includes a small, badly redacted portion of it.

So, in summary weev did not publish the data in any meaningful sense and did make sure that the flaw was fixed before going public. What exactly about this is unethical?

st3fan5• 16 years ago

Uhhh ...

1) "he gives the data to a journalist" 2) "in summary weev did not publish the data in any meaningful sense"

Really!?

Pahalial• 16 years ago

I would agree that this seems to have been more about ego and status than an example of journalistic integrity and responsible security research.

That said, does the irresponsible disclosure of names attached to e-mail addresses justify what he's gone through, assuming a modicum of truth to his assertions of being denied a legal defense, gag orders, FBI raids, etc? In my personal opinion, his point that URL scraping is not in and of itself a crime is substantially true, and renders the subsequent raid unjustified. Whether that would render the drugs inadmissible or provide him any legal cover from that charge I certainly am not qualified to say.

On that note - could anyone point me towards literature on 'gag orders' in the course of U.S. justice? I'd be curious to read on the history and justification for these.

openfly• 16 years ago

Dude is nuttier than a baby ruth. He even somehow managed to pull the "zionists" card.

ttol8• 16 years ago

He definitely needs to get an attorney to prevent him from writing future statements/positions in public. Now whomever represents him will have a much harder time defending him since he's written an entire essay on the matter. Each and every word, sentence, statement, and position can and will be used against him.

mfukar3• 16 years ago

"Big law firm did it but didn't get punished, yet I did it and got raided."

Really? Are you really going for this elementary school argument?

Doesn't help when you distort the concept of 'full disclosure' and related practices, either.

No sympathy vote from me.

ErrantX7• 16 years ago

I am highly suspicious of the fact that this deals a lot with other cases and his past run ins with the government and very little with the actual case (at times it even seems to deliberately skip details).

As always; this is one side of the story and (thought I hate to say this) from a somewhat troublesome person. I think it is reasonable to treat this as a serious matter, but there needs to be a lot more objective insight before I'd send him some money :)

boredguy82• 16 years ago

  and found is in quotes for a good reason, as the drugs “found” near
  me were “found” in the execution of a warrant for computers only

For what it's worth, the Fourth Amendment protects against 'unreasonable' searches and seizures. Anything found in the reasonable execution of a search warrant is admissible.

I don't know where the myth came from that only evidence related to the probable cause of the warrant is admissible. This is an on-face absurd interpretation: by that logic, if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer.

There is plenty of case law establishing limits on reasonability. For instance, in the execution of a lawful search of an apartment looking for weapons, officers saw a stereo that 'didn't fit the furnishings'. They lifted up the bottom of the stereo to take down serial numbers, and the person was arrested for having stolen the stereo. The problem, of course, is that weapons aren't stored under the bottom of a flat-bottomed stereo, and certainly the serial numbers weren't a reasonable part of the search for weapons.

But having drugs out in the middle of the room in 'plain view' is clearly reasonable. Even from weev's own post, the drug evidence passes the Horton test.

cschep• 16 years ago

If you don't know what a Horton test is, like I didn't.

http://en.wikipedia.org/wiki/Plain_view_doctrine

sp332• 16 years ago

His point is that the original warrant had no probable cause. So any evidence collected in its execution should be inadmissible.

edanm• 16 years ago

Is that really the case? If the police is executing an illegal warrant, but comes across someone, say, murdering someone else, is that not considered evidence?

(This might very well be the case, considering the "Fruit of the Poisonous tree" doctrine).

boredguy82• 16 years ago

The argument that there was no probable cause is very unlikely to hold up in practice. The law is very lenient to the issuance and execution of warrants.

  Warrants are favored in the law and utilization of them will not 
  be thwarted by a hypertechnical reading of the supporting 
  affidavit and supporting testimony. For the same reason, 
  reviewing courts will accept evidence of a less "judicially 
  competent or persuasive character than would have justified an 
  officer in acting on his own without a warrant." Courts will 
  sustain the determination of probable cause so long as "there 
  was substantial basis for [the magistrate] to conclude that" 
  there was probable cause.

http://caselaw.lp.findlaw.com/data/constitution/amendment04/..., citing United States v. Ventresca, Jones v. United States, and Aguilar v. Texas.

If you're interested in some of the intricacies of 4th Ammendment jurisprudence, http://www.law.yale.edu/documents/pdf/1994Fourth.pdf is a phenomenal article.

thwarted• 16 years ago

if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer.

But they couldn't cite the murder as admissible evidence of felony tax evasion, it would need to be separate charges, wouldn't it?

Well, at least you were able to dodge the tax evasion charge by distraction/misdirection. Now, about this little murder thing...

stcredzero• 16 years ago

He seems to be an unabashed anarchist when things are going his way. Now that they aren't he's crying out about his rights.

illumin83• 16 years ago

He seems to be unfamiliar with the legal process, and really needs to get a lawyer. From the partial scans of the US attorney's letter, it sounds like a federal grand jury would like to subpoena him as a witness to testify about the gathering of AT&T subscriber email addresses and "electronic chip IDs" (I think the letter is technically incorrect). The letter informed him that if he failed to appear he might also have criminal charges filed against him.

This is a normal part of the process of a federal criminal investigation. What happens first is that a grand jury is formed. The jury investigates evidence, calls witnesses, and tries to determine if a crime has been committed, and if so, who committed the crime. Then, the grand jury might issue a federal indictment, or it might just determine that no crime was committed and drop the case completely.

If he or someone else is federally indicted, then he would be formally arrested and have to go to federal court to stand trial as a criminal defendent. It sounds like it has not gotten close to this point yet.

Edit: I also wanted to mention that you have no right to an attorney as a witness of a grand jury. You may choose to have an attorney represent you and be present, however, the financial burden is in no way the federal governments to provide one for you. IF you are charged, then you may receive a public defender if you have insufficient financial means to pay for your own defense.

Federal cases take months and years to prosecute. By refusing to participate with the grand jury, he might be opening himself up to the fact that another witness could implicate him and he might be indicted. Of course, there is also the saying "if nobody talks, everybody walks."

He really needs to get good legal counsel and decide if he wants to testify in front of the grand jury, and decide what he wants to say.

Also, he's not helping his cause any by speaking out on the web. Mentioning his past anti-semite ramblings is also probably not the best way to gather sympathy.

I also think he does a disservice to the security community as a whole to advocate black hat ideology at hacker conferences, and then talk about "responsible disclosure" and how he was just trying to protect the poor customers of AT&T. This seems to be rewriting history.

eplanit• 16 years ago

There is no doubt some ego-based confusion in his mind. It's evident from the first sentences: "...I’m sure you’re all familiar with from my previous excellent blog posts"

jeb• 16 years ago

A goatse symbol as his logo, makes anti-israel videos, has drugs lying around his apartment, describes his own blog posts as excellent, and apparently publicized some type of private information.

This is not a housewife being attacked by a SWAT team, it's someone who is likely to drift in and out of such problems who happens to have drifted in.

skn• 16 years ago

Link to cached copy http://webcache.googleusercontent.com/search?q=cache:http://...

superk• 16 years ago

I feel sorry for the dude. He is asking for our help via cash or writing to our local, state and national representatives. That's a rock and hard place.

Post from "weev" (AT&T/ipad data hacker) on his arrest and treatment

Related Stories