Teenage hacker became a legend attacking companies, then his rivals attacked him

https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-468e6cad

by fortran77 • 2 years ago

105 59 2 years ago

wsj.com

neonate• 2 years ago

https://archive.ph/nupuG

smcin• 2 years ago

"GTA 6 Hacker Arion Kurtaj Became a Legend Attacking Companies. Then His Rivals Attacked Him." - WSJ

(Newer headline, and useful for indexing the names)

A_D_E_P_T• 2 years ago

Article opens with:

The judge ultimately handed Kurtaj a sentence that his lawyers have called out of proportion with the crimes he stood accused of. The family declined to be interviewed.

Doesn't actually mention what the sentence was until the end of the article:

The judge gave Kurtaj an indefinite hospital order—a sentence confining him to a secure mental-health ward until doctors and U.K. officials decide he is no longer a danger to the public. He was 18 years old. [. . .] People in Kurtaj’s situation can apply for a review of their detention once a year. Otherwise, their detention is subject to government review once every three years, according to the Ministry of Justice.
Kurtaj’s lawyers and some experts on autism have said a potential lifetime of incarceration isn’t appropriate for a teenager like Kurtaj.

Thing is, there's basically a zero percent likelihood that it's actually a lifetime of incarceration. I haven't seen the statistics on this, but I'd bet that the average person incarcerated under such an order is out in a couple of years, and the vast majority are out within ten.

What's more, it's not a prison.

It’s up to his doctors whether Kurtaj can access the internet. He was sent to a medium-security hospital ward, where in the common areas shared with other patients, he was surrounded by tablets, phones and computers.

Come on, now. That sentence is neither as harsh (in terms of conditions) nor as draconian (in terms of duration) as the article wants us to feel. In the US, he be tried as an adult and he'd have it much worse...

The punishment rarely fits the crime, but I think that the system did okay with this one.

giantg22• 2 years ago

If I (autistic) had something I was good at and made me not feel like human garbage I wouldn't stop doing it. It wouldn't surprise me if a company hires him. This is something he's good at, but just seems to need some direction and oversight.

Firerouge• 2 years ago

While there aren't many statistics on this sort of sentencing, I did find some here: https://forum.mentalhealthlaw.co.uk/t/section-37-41-data-spe...

And based on the following:

The number of admissions has fluctuated between 1,500 and 1,700 since 2008.

And

The number of discharges and disposals has fluctuated between 1,350 and 1,550 since 2011

One can extrapolate that up to a couple hundred new admissions each year are staying in essentially indefinitely, as the discharge rate is generally always lower than the admissions rate.

whimsicalism2• 2 years ago

Seems ridiculously disproportionate to be sentenced with no end date? Even if 'in practice' it usually ends after some amount of non-determinate time.

JanisErdmanis4• 2 years ago

This will be controversial, but wouldn’t one be able to say there is a benefit to the society of having kids hacking systems, doing pranks, even collecting ransomware, and not fearing ridiculing their subjects in contrast to having national state attackers that harvest and sell secrets? The first type of attacker would pressure security to be taken seriously, whereas the second type of attack would rarely be noticed and disclosed.

Denvercoder92• 2 years ago

That's a false dichotomy. Having a few smart kids hack around doesn't end nation state attacks.

JanisErdmanis4• 2 years ago

They don't end nation-state attacks, but public exposure from teenagers hacking corporate computer systems can make them do their homework of fixing low-hanging vulnerabilities. As a result, the attacks from nation-state attackers could become more expensive.

giantg22• 2 years ago

I do believe in leniency towards juveniles so as not to discourage curiosity and learning. However, many attacks can be severely damaging. It seems this individual had many second chances but hasn't changed. Some intervention is necessary.

hackable_sand• 2 years ago

It is controversial because you are utilizing childhood rebellion

Which ignores the point

godelski• 2 years ago

I think you could generalize the OP's point to extend past children and still consider their question. I think you're focusing on the children part and ignoring the point.

Plus you're not "utilizing children" in the way you would with child labor. This is more "children are doing things, could we utilize this natural behavior to improve our society?" That's no exploitive of children unless you pressure them into hacking. It's also reasonable that we consider children are less likely to be severely punished because kids are, in fact, pretty dumb (which does not mean they also aren't pretty smart. Context matters ;)

Anyways, that's all besides the point of OP's question:

  Can we see hackers as a valuable tool for society? Since they put pressure on corporations to improve their security. Whereas when nation state hackers do similar things it is all kept quiet and so the knowledge of what needs to be fixed is less wide spread.

I think yes. As an analogy I think hackers in this way can be seen like a virus and the human immune system. Low exposures and in healthy systems allows the body to develop antibodies and fight off bigger attacks and/or when the body is weaker. But too much and the host is permanently damaged. But no viruses and the immune system becomes weak and fragile too.

Personally, I think if we want to get the former immunity boosting we should be promoting ways for people to hack on systems in non-malicious ways. Bug bounty programs. Clear paths to responsible disclosure. All that jazz. Accidents will happen and some will go too far, but intent does matter. But we also hear on HN about how people have found vulns, reported it, and the response is to sue the person disclosing for hacking. Even if this is exclusively untrue (lol), if it is widely believed then what incentive does someone have to report a vuln if they find it? Because they sure have incentives to do malicious things with that information.

I'm big on morals and sticking to them. But at the same time I don't think we can have a functional society where people's only incentive to do the right thing is that warm and fuzzy feeling inside, especially when there are incentives to do the wrong thing. Maybe we should reward good behavior instead of bad behavior...

stepupmakeup• 2 years ago

A clear distinction should be made, this isn't kids hacking companies for 'fun' or some kind of Kevin Mitnick-esque story where the thrill was having something they shouldn't or bypassing systems. These people wanted money and notoriety and got it by any means necessary, yet it took THREE arrests to finally put an end to it. They weren't just targetting multibillion dollar corporations, either.

Meanwhile in the very same country, the teenage criminal who helped ransom MGM casinos and London's transportation (twice arrested) is also free and likely actively deploying ransomware and sim swapping as we speak. I get that they're legally "children", but it's not like they're 9 year olds being tricked into do other peoples bidding, these are quite literally criminal masterminds working for themselves, and should be charged as one. "I promise I won't go online again" and supervision for a couple months obviously isn't working when you have companies getting hacked from a hotel room.

ackbar03• 2 years ago

What your basically describing is HackerOne but for kids. And I actually don't think it's a bad idea, they could consider doing a teenager version or do some program aimed at high schoolers. I'm sure it would be very well received, I would have thought it was the coolest thing ever.

otterley• 2 years ago

What would be the benefit, exactly?

ChumpGPT• 2 years ago

He was such a legend that they were able to catch him, monitor his online activity and his rivals were able to Doxx him.

Did it not occur to this legend that concealing ones identity when breaking the law is an important step?

arealaccount• 2 years ago

I admittedly only grazed the article, but fighting back almost is what you desire as a teenage offensive hacker.

mmsc• 2 years ago

He said the average age of anyone arrested for a crime in the U.S. is 37, while the average age of someone arrested for cybercrime is 19.

Indeed. So why is it that these billion-valued-companies can so easily be hacked by teenagers? Who would win: a trillion dollar industry of cyber security, or a bunch of bored outcast teenagers?

andsens• 2 years ago

The reason the average age is so young is because they are the ones getting caught.

duped• 2 years ago

I think it's more that older people are getting paid to do this work legally.

whimsicalism2• 2 years ago

No - I think it has much more to do with the fact that anyone smart enough to be doing this is going to be gainfully employed by the time they're an adult - but as an adolescent, you are bored, talented, and unrecognized - not a good combination.

This is exactly my story and I doubt it is very unique.

fortran77• 2 years ago

It's like the airplane with the dots!

throw20242• 2 years ago

Loosely agree with this, although greed can blur some people’s judgment

trox• 2 years ago

Because properly securing your systems is hard, especially if the attack surface is large. The attacker only needs to find a single weakness. Furthermore, you don't hear from all the teenagers trying to find vulnerabilities across the web, just when there's headlines.

protastus• 2 years ago

Yes it's hard and also not done well. Most companies don't fund security as much as they should. At best they'll hire an occasional consultant for the purposes of compliance with a supplier agreement or industry regulation they have to meet.

throw20242• 2 years ago

As a former bored teen, who went after similar sized companies (and was eventually caught), I’d say you’ve already got your answer - boredom, being a tad neurotypical helps too.

Most of the things I pulled could have been prevented if everything was checked against the OWASP top 10.

Then the other multiplier is how old the company is, at a certain stage there’s a digital footprint that isn’t properly documented internally.

Ylpertnodi2• 2 years ago

and was eventually caught

Would love to hear more.

jabuticaba• 2 years ago

Finally news about a hacker on hacker news

d0mine• 2 years ago

The word "Hacker" in Hacker News does not mean cracker https://en.wikipedia.org/wiki/Hacker_culture

RobRivera• 2 years ago

Do people feel autism is an explanation for shitty behavior like posting sexually explicit images on internal company slack channels?

labster• 2 years ago

An explanation, sure. A justification, no.

Just a reminder: the autism spectrum is wide, and two autistic people are likely to be more different from each other than a neurotypical person.

autoexec4• 2 years ago

It sounds to me like that's more of a teenager trait than an autistic one. Not to say that every teenager would find humor in putting dicks in unexpected places, or even that only a teenager would, but it's pretty on brand for boys in that general age bracket.

Teenagers are also biologically predisposed to occasionally making bad decisions. The kid in this article had a brain whose prefrontal cortex wouldn't finish developing for nearly another decade. I suspect that had a lot more to do with posting links to a penis in Uber's internal chats than autism did.

sulandor• 2 years ago

Teenagers are also biologically predisposed to occasionally making bad decisions.

humans are

dokyun• 2 years ago

No, the explanation is that it's hilarious.

aithrowawaycomm• 2 years ago

No, autism is an explanation for not saying "wow this guy is a real stain on society" and being reluctant to put him behind bars.

That being said I don't like infantilizing people who have autism without more profound disabilities in cognition (I am speaking as someone who has "mild" schizophrenia). Kurtaj seems to have normal intelligence and is not so disconnected from society as to be unaware what he allegedly did was wrong. In particular his alleged motivations and mental state during all this are not that different from a angry teenager with few friends and terrible judgment.

There are other factors that are important for sentencing. Unlike the angry teen, it sounds like Kurtaj might have trouble holding down a job even if he gave his best effort at emotional and occupational therapy. But when people with autism seem perfectly capable of making moral choices, their diagnosis should inform your empathy. Turning that into an exoneration not only excuses certain bad people, but also denies that certain good people actually understand they're doing the right thing. It's totally dehumanizing.

fefe23• 2 years ago

I'm sick and tired of the "the evil attacker attacked this harmless company" rhetoric.

Take some responsibility for your actions!

I loathe that you can apparently get away by telling reporters that it must have been a nation state actor. Oh it was just one kid in a hotel room? Well then he must have autism! Hey have you seen Rain Man? Yeah, must have been that kind of super power autism!

It's revolting. Get your act together and stop blaming kids. If a kid can unlock your door by entering the Konami code on your door bell, that's on you.

codezero2• 2 years ago

Locks are a social contract. We all know they can be bypassed, but doing so is illegal. Kids and adults should be held accountable for repeatedly breaking the law.

beeflet• 2 years ago

computer security isn't comparable to physical security and should be held to a higher standard because it can be.

When you expose a computer to a global computer network, you are exposing it to others with no shared social contract.

bookofjoe• 2 years ago

https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-4...

Jyaif• 2 years ago

From what I gather from the article he's doing social engineering, not technical hacking.

In other words: lying to, manipulating, and exploiting trusting folks, rather than finding technical flaws. Much less noble in my opinion.

dmix• 2 years ago

The what you do after social engineering and knowing what to ask for and pivot is very technical

CatWChainsaw• 2 years ago

In other words, all the things that politicians, CEOs, and Silicon Valley visionaries do?

Teenage hacker became a legend attacking companies, then his rivals attacked him

Related Stories