Judge Allows Sony to Unmask Anyone Who Visited GeoHot Site

http://www.wired.com/threatlevel/2011/03/geohot-site-unmasking/

by kenjackson • 15 years ago

153 85 15 years ago

rheide• 15 years ago

Sony always gets what it wants. While they're not fundamentally wrong, since it's their product, they're playing whack the mole with a large hacker community. This can't end well.

fingerprinter2• 15 years ago

I'll admit that I haven't followed the story that closely, but from my understanding, he hacked his PS3 and posted what he found, right? Wouldn't we, as a reasonably logical technical community, see that as his system and he would be free to do with it what he wants (the hack, probably not the post)? Perhaps posting it is where they have a case (INAL), but I can't see any justification for going after him for merely hacking/poking around his PS3 hardware and software.

I started to see this pop up in some posts recently:

* apple's hardware...they have the right to do what they want * sony's hardware...they have the right to do what they want

I don't exactly know when this started but I think it's worth correcting and trying to stop. No reasonable person would assume that you could buy any physical device and NOT be allowed to do whatever you want to it. There may be usage restrictions (you can't modify your car w/ a jet pack and expect to drive it on a public road...), but if you are doing something for educational/experimental purposes, I can't see how it would be illegal.

Anyone care to comment? I'm open to having my position changed if someone can show me why.

wlesieutre• 15 years ago

It's BMW's car. You're not allowed to use that gas station.

jdp23• 15 years ago

That's how I see it too, and I believe EFF and many others agree with you.

Sony, Apple, and others who want to deny people these rights obviously see things differently.

jarin2• 15 years ago

I've only seen people say "It's Apple's App Store, they have the right to do what they want with it", not "It's Apple's hardware, they have the right to do what they want with it".

I don't know anyone who would question a hardware owner's right to do as they please with it.

mcn• 15 years ago

IANAL, but the DMCA includes a ban on circumventing access controls. Recently exceptions to this ban were issued, allowing people to jailbreak their iphones. Unfortunately the broadest exceptions were limited to "telephone handsets."

The summary of the exception with respect to video games said this:[1]

>(4) Video games accessible on personal computers and protected by technological protection measures that control access to lawfully obtained works, when circumvention is accomplished solely for the purpose of good faith testing for, investigating, or correcting security flaws or vulnerabilities, if:

>>(i) The information derived from the security testing is used primarily to promote the security of the owner or operator of a computer, computer system, or computer network; and

>>(ii) The information derived from the security testing is used or maintained in a manner that does not facilitate copyright infringement or a violation of applicable law.

[1]http://www.copyright.gov/1201/2010/Librarian-of-Congress-120...

johngalt• 15 years ago

Morally I agree that something you buy is yours to do what you want with, but in practice there are routinely restrictions on what you can/can't do, each with their own degree of right/wrongness.

For instance most people find it reasonable that you can't:

-Modify/bypass emissions equipment on your car.

-Saw off the barrel of your shotgun, or modify semi-auto -> Full auto

-Buy one copy of a movie then show it to the whole neighborhood and charge admission

stcredzero2• 15 years ago

they're playing whack the mole with a large hacker community

Large companies need to realize that they're actually engaging in asymmetric warfare when they do this. The worldwide hacker community that's aware of Sony far outnumbers the internal dev group that did their security.

What's more, Sony suffers from the typical company illusion of hiring the top 1%:

http://www.joelonsoftware.com/items/2005/01/27.html

But groups of hackers on the internet have none of the friction that exists in corporations, and so are operating in a purer, less-diluted meritocracy. As a result, companies doing DRM are generally outnumbered by more qualified opponents.

The basic rule of asymmetric warfare, is that you don't take on your opponent in a head-on fair fight. That's absolutely the worst thing to do. You need to turn the situation on its head, like the IRA did. Usually, the outlaw is in the position where, "You have to beat them every time. They only have to catch you once." But the IRA had that turned on its head. They only had to get away with something "once," and the British authorities had to catch them every time.

Companies can deal with pirates, but they have to realize that they are the underdogs, not the big guy in this fight. The best thing for them to do is to figure out how to win without fighting. Failing that, they need to figure out how they can be the ones who "only have to win once."

(I've been figuring this out, and yes, it can be done.)

jevinskie2• 15 years ago

They're trying to "only have to win once" by going after the top PS3 hackers. All of the defendants listed so far (geohot, fail0verflow) have unequivocally condemned piracy. Sony doesn't go after the pirate developers because, so far, none of them have shown much skill in uncovering new vulnerabilities - they take and rehash what fail0verflow, geohot, et al have done to support piracy. [1] Not to mention it is a lot easier to go after geohot, a guy who believes what he is doing is right and doesn't want to live in a world where he has to hide his research, than an anonymous pirate developer.

[1] The minds behind original PSJailbreak dongle (which enabled backups and piracy) do deserve credit for their brilliant USB exploit. Back to my main point, many have said that the PSJailbreak crew was only able to start their work after geohot exploited the PS3 hypervisor and documented how to do so.

lawnchair_larry• 15 years ago

Make no mistake, they're fundamentally wrong.

jseifer• 15 years ago

Reading this article was really crazy. Sony has also subpoenaed YouTube for information on anyone who watched the video he posted and it was approved. The rationale is that they're trying to sue in California and this will help better prove distribution there. It does not say what Sony intends to do with the information otherwise which is kind of scary.

metachris• 15 years ago

http://geohot.com/

oniTony• 15 years ago

I would imagine that a large portion of visits to GeoHot's website was due to the publicity of Sony's legal case. If Sony is trying to provably demonstrate “defendant’s distribution”, shouldn't there be a distinction based on the intent of access?

E.g. IP hits from Google's bots out of Mountain View should not count as "those who downloaded Hotz’ hack reside in Northern California".

marklabedz• 15 years ago

...and likewise for those who accessed the site(s) after the suit was filed.

A1kmm2• 15 years ago

  $ telnet geohot.com 80
  HEAD / HTTP/1.1
  Host: geohot.com
  User-Agent: Dear Sony, I heard you would be reading this log. Because of the way you treat researchers like GeoHot, and your own customers, I will never buy a Sony product again.

mcclung• 15 years ago

That's funny. I followed your lead... but I was less polite.

ssebro• 15 years ago

I was seriously just considering ps3 vs xbox 360, Sony's just made my decision so easy. I'll never buy a thing from them again.

redthrowaway2• 15 years ago

It's too bad, too. They took a huge risk with Cell, and it's finally paid off. This kind of behaviour is simply inexcusable, however. I have a ps3, but I don't want to buy new games for it. Not really sure what to do.

dekz• 15 years ago

    Referer: http://www.sony.com

kmfrk• 15 years ago

So, where would be a good place to host your site to dodge the jurisdiction of this craziness?

timdorr• 15 years ago

What Sony's trying to do is locate jurisdiction in the location where the data ends up. So, it would be irrelevant as to where it came from. You could host in Iran and they would still attempt to show it being under a CA court.

chc• 15 years ago

I think kmfrk is trying to ask if there are any countries where you would likely be safe from a judge turning over your users' data to Sony just to see if any of them were in California.

X-Istence3• 15 years ago

Good luck trying to get a US court order to make me do something when I am not under your jurisdiction ...

rosser4• 15 years ago

I don't know how much traffic their infrastructure is up to serving, but Iceland is supposed to be good in that regard. When the US tried to subpoena the Twitter account records of an Icelandic MP, the US Ambassador to Iceland was called in to explain TF the US thought it was doing. (Twitter was also able to quash the subpoena on appeal, and as it was regarding an Icelandic citizen, it's not directly on point.)

All that aside, it was my understanding that they wanted to remake their Internet image as a privacy haven of sorts -- the kind of place someone like Assange/WikiLeaks could safely host their service. I'm having a spot of trouble finding relevant primary sources; can anyone else help point me in the right direction?

rosser4• 15 years ago

(Following up to myself, since the edit link has expired.)

After some more digging, I found a few relevant links, the most direct of which is [1]. A number of other articles re-hashed the same points described there, but I did find a few like [2], which also describe Iceland's connectivity -- it's far better than I'd thought. As of a year ago, they had on the order of 8 tbps in undersea cables, stable ping times of around 100ms to the US (and, presumably to the EU, if not better), 100% geothermal power, and a climate that would enable passively cooled data centers.

I couldn't find anything directly relevant to whether access logs would be subpoena-able, but the reading I get from what I did find is that their focus is more on being a transparency haven than a privacy such. Whistleblowers, journalists, and their sources are clearly very well protected by the IMMI (which appears to have passed unanimously). It's also, however, explicitly stated that the new law won't change anything in the current law WRT child pornography and copyright infringement, usually the big bugaboos of the "we need to control the interwebs" crowd. (Not to say those aren't problems; they just aren't the problems they're usually made out to be.)

So, net, I'm not sure Iceland's the answer to these kinds of shenanigans, but it's clearly a step in the right direction.

[1] http://immi.is/?l=en&p=intro [2] http://www.technewsdaily.com/iceland-promoted-as-future-data...

(EDIT: fugly run-on sentence.)

rapind3• 15 years ago

Seems like a good time to be in the VPN / Proxy business.

nitrogen• 15 years ago

I don't see how anybody trusts a VPN or proxy any more than their own ISP. It seems to me that using a privacy-focused VPN (1) makes you stand out more to anyone looking to bring down the proverbial hammer of justice, and (2) puts all of your access history in the hands of a potentially-hostile third party (the VPN/proxy provider, who could just as easily be subpoenaed, or even be run by an intelligence agency, like Tor).

rapind3• 15 years ago

My understanding is that it is not actually easy to subpoena records from all the VPNs cloaking traffic to a specific site. In fact there could be a significant cost attached to doing that. So while it might make you look guilty in some situations, it can protect your innocent behaviour from being snooped until you do something to justify appropriate suspicion.

As stated --- The approved subpoena requires the company to turn over “documents reproducing all server logs, IP address logs, account information, account access records and application or registration forms” tied to Hotz’s hosting. ---

I'm pretty sure they would need to apply for another subpoena in order to uncover any IPs coming from a VPN. Now this could be done if it was warranted, but most of the time I doubt it would be pursued and it might even be hard to prove it was warranted for each VPN?

Now just for fun, let's say you're tunneled to a VPN that's tunneled to another VPN, to another, etc. While you could still be chased down, it probably not practical in most situations like this. I wonder if one company could provide a service that uses multiple routings like this through different registered entities requiring the authorities to request records for each of the different entities in order to track down just one account. Then implement this on a large scale...

SriniK• 15 years ago

Who is up for protest against Sony? This is so lousy.

What is next? Telling every kid not to open 'a system' to figure out how things worked? Or may be lets ban engineers to be engineers?

EDIT: #shameonsony twitter handler. http://twitter.com/#!/srinikom/status/43853556645761024

smokeyj3• 15 years ago

Sony is acting like a company trying to maximize profits, it's our government that's tasked with defending 'the people'. If the government is the enabler, why not protest them?

sho_hn• 15 years ago

Your government isn't just tasked with defending the people, but also with acting on their behalf; given this, the persons that form the corporate entity Sony are not absolved of personal responsibility and subject to criticism.

The government may be allowing them to do this, but it isn't making them do it.

sudonim2• 15 years ago

Why not show Sony that this strategy will not maximize profits? That's a more certain path than expecting the government to do the right thing.

Voting with your dollars is the most powerful way that you as an individual can express your opinion in a corporatocracy.

tomkinstinch• 15 years ago

  "What is next? Telling every kid not to open 'a system' to figure out how things worked? 
  Or may be lets ban engineers to be engineers?"

Sears catalogs and manuals used to have exploded-view diagrams so that consumers could determine how to repair broken products (and so that they could select the proper part to order from Sears). We need to return to that world.

I sincerely hope that we will see a backlash against corporate control of consumer goods.

The more we know about what we own, the more we can learn, the more we can modify things suit our needs, and the more we can reclaim. Fixing something means it won't enter the waste stream. The sort of individualism that hackers embrace imparts a strong sense of ownership over possessions (and code). Think Ikea. Part of the appeal is the pleasure and sense of ownership that come from assembling furniture yourself. Why should electronics be any different?

I have a project in the works to help spread knowledge about the inner workings of things:

http://takeitapart.com

It is what it sounds like. Sign up if you like, and I'll send a single email when it launches.

nodata• 15 years ago

I can't find the link right now - but a guy did a study and found the most efficient way of demonstrating against a listed company was mass-shorting of stocks by protesters. I think he targeted Coke. I wish I could find the link.

Seems relevant right now. Vote with your money.

megaframe2• 15 years ago

How useful would that list even be, after all the attention this has gotten wont that IP list be absurdly long? Maybe there trying to use it to form conspiracies by association.

Well my IP is there. I don't own any Sony products, was considering a PS3 (since the price is right), and I almost never mod those kind of devices, but out of principal I don't think I could justify getting one now.

uxp• 15 years ago

I have a fantasy of every botnet in the world visiting his site DDoS style, but without the DoS part, padding the list to be miles long of printed court evidence.

GeoHot's blog, geohotgotsued.blogspot.com, specifically mentions that his hack got very little attention outside of the standard homebrew hacker scene up until the point he was sued and every tech blog and publication linked to him. These actions are just absurd. GeoHot even states that he has come across means to restore the cryptography on the device, which could effectively shut out piracy. I doubt he'd ever hand it over though. There's no reason to be nice to the guy who's kicking you in the crotch.

robryan• 15 years ago

Really they should have hired him to work on console security, as well as officially allowing the system to be modded to allow home brew, take away the incentive for the homebrew people to further enabled piracy and get it seems the best person to defend their console against piracy in the future.

eneveu• 15 years ago

I think Sony wants this list to be absurdly long, because they plan to use these IPs to "prove" the distribution of the key, according to this reddit comment: http://www.reddit.com/r/gaming/comments/fxkkv/sony_to_track_...

"If you read the legal ruling, it's very clear that this judge's ruling is being done so that any information found is designated as Attorneys Eyes Only, meaning that it is restricted to anything relevant to the case (and specific matter being challenged) at hand is disclosed, and anything else summarily forgotten. Hell, the document makes clear that this information is for jurisdictional discovery only, which determines whether or not Geohot can be tried in California."

"Relevant case law allows Sony to subpoena records to determine jurisdiction. They can subpoena Geohot's host because it's pertinent to whether or not his hack had an impact in California, and that the distribution of the key took place. They're allowed to subpoena his tweets to see how many people in California read them. The same goes for the other handful of companies they've subpoenaed."

This won't stop me from boycotting Sony from now on, though. I was actually planning to buy a PS3 to play blu-rays and maybe start playing video games again. No more.

micah_moo• 15 years ago

What about people who just saw it in a feed and out of curiosity looked :S

Hacktivist• 15 years ago

I'm sure they don't care about people who just loaded up the home page. They are more than likely after the IPs that downloaded the files that are posted on the site (maybe they will try to tie them back to IPs used to acces PSN?)

mikecarlucci• 15 years ago

Haven't a number of courts ruled that an IP address isn't a person? I feel like that should apply here.

Edit: http://arstechnica.com/tech-policy/news/2011/02/court-confir...

I guess they don't want to sue the visitors just reveal identity? This seems like shaky ground for Sony.

Jach• 15 years ago

Maybe they'll put a list of repeated identities in their next rootkit they ship with their laptops and when it detects someone associated with an identity it will signal the battery to explode...

jrockway2• 15 years ago

Ironically, they'll be guilty of the crime "battery".

Anyway, I think we all wish companies would take their revenge in the form of actual violence so that they would actually get in trouble, but they are smarter than that. Emotional pain hurts more than physical pain.

SoftwareMaven• 15 years ago

(Based on what they've currently said, which I wouldn't trust, personally)

They aren't looking for identifying information. They are looking for location information to prove that San Francisco is an appropriate venu. IP addresses will give them pretty strong location evidence, regardless of who was behind that IP.

jchonphoenix• 15 years ago

Everyone not from CA run a script to access GeoHot.com?

This way Sony will have to try the case in NJ.

smokeyj3• 15 years ago

I wonder what the judge almighty thinks about Sony's rootkit projects..

Rariel• 15 years ago

Civil Procedure FTW! Or the loss. I'm not surprised the judge allowed this, it is necessary to prove Sony was correct in filing in CA because the state has jurisdiction over GeoHot. I would be surprised if they granted personal jurisdiction over a kid in NJ.

jonursenbach• 15 years ago

Where is the EFF during all this?

itistoday• 15 years ago

From his site FAQ:

Q: Why doesn't the EFF fund this?

A: Ask them. They have offered to provide some legal help though, which is much appreciated.

jevinskie2• 15 years ago

They filed a friend of the court brief [1] which the judge didn't seem to get the point of [2]

[1] http://www.wired.com/images_blogs/threatlevel/2011/03/efflet...

[2] http://www.wired.com/images_blogs/threatlevel/2011/03/speror...

nu2ycombinator• 15 years ago

Looks like the problem here is the judge. She doesn't even know how internet works. "Retrieve all the code"

asdfor• 15 years ago

I can't figure out based on what grounds the judge granted access on the IP logs. Also, what sony could do with the ip addresses?. Nothing, they are just trying to force people away from any websites with such information. The user base of the PS3 are underage teens, vulnerable to such scare tactics ....

Judge Allows Sony to Unmask Anyone Who Visited GeoHot Site

Related Stories