Jury convicts NY man accused of AT&T-iPad hacking

http://news.yahoo.com/jury-convicts-ny-man-accused-t-ipad-hacking-023305967--finance.html

by jason_slack • 14 years ago

75 80 14 years ago

news.yahoo.com

Why a sad face? Did the article not represent his crime correctly? I don't know this person or his back story but if he committed a crime why shouldn't he suffer the consequences?

dietrichepp• 14 years ago

I'm guessing the mods will come in and delete that shortly...

JungleGymSam4• 14 years ago

Is asking questions against the rules here?

chimeracoder2• 14 years ago

In case you're not trolling, here's a link to what's currently #2 on the front page, which explains it well: http://erratasec.blogspot.com/2012/11/you-are-committing-cri...

JungleGymSam4• 14 years ago

It's my ignorance showing so be gentle. I'm not trolling. I don't read every link on the front page and what piques my interest may not be what piques yours. Having said that, I will read the article you linked to.

clarky07• 14 years ago

I suspect it is because many people don't think the "crime" he committed either actually is a crime, or if it is that it should be a crime. Lots of gray area around this particular activity.

hayksaakian• 14 years ago

Were they doing it for the lolz? As far as I can tell from the article, they're just regular criminals.

jack-r-abbit7• 14 years ago

That article's bias is showing. If that is all you read about the incident then sure.. they are just regular criminals. But there is more to the case than that. From what I've read elsewhere, the Feds used a bit of stretching to make that law fit.

smsm4213• 14 years ago

Could you back it up with some other sources then? if there's more to the case, where this more can be found?

k-mcgrady• 14 years ago

The title of this should be changed. Actual title is:

Jury convicts NY man accused of AT&T-iPad hacking

saurik2• 14 years ago

I don't know what the title was before, but this new title, while accurate to the article, is really confusing and I will say downright misleading if you aren't following this closely already... there were no iPads hacked, for example; this was an issue with AT&T's website, and probably would have worked against any targeted set of devices (where you could reasonably guess the ICCID; even if not, it is still entirely related to accessing servers).

(I saw this, semi-freaked as I'm constantly hacking iPads, and then read the article to find out the title sucked.)

Mithrandir• 14 years ago

For future reference, the title was "Weev Convicted :-(".

saurik2• 14 years ago

(OK, yeah, that title was even worse. ;P)

beatpanda• 14 years ago

"Provided the information to Gawker" casts doubt on any criminal intent in my mind

gwillen2• 14 years ago

Apparently they have IRC logs of him first talking about selling the information to spammers or using it to go phishing, which makes it a little worse.

guard-of-terra• 14 years ago

I would have said the same thing after discovering the stash. Not because I actually planned to do this but because the situation is bizzare and that's some sort of humiliating humour.

jamesaguilar• 14 years ago

Casts doubt on any benign intent in my mind.

welder• 14 years ago

From what I just read, he didn't hack anything. He found out that AT&T didn't require a password to check if an email was valid, then just got a list of valid email addresses.

How could a jury equate this with conspiracy to access a computer?

ajross2• 14 years ago

The computer held a list of addresses. It did not present that list to the public. He found a trick where he could probe the addresses, and used that trick to extract the list counter to the desires of the owner (and the owners of the addresses). I can't imagine how you think that access was authorized.

Now, sure, it's not much of a "hack" in a security analysis sense. And it was a terribly dumb bug, and a huge security goof by AT&T. But why should criminal law care about how difficult something is? You don't get off of burglary charges if someone's door is unlocked. And if AT&T is culpable for their poor engineering, they are so in a civil sense for damages; it doesn't make the hack less of a crime.

Admittedly there's a spectrum between "full disclosure" security research and grey hat anarchic asshattery, and there are cases where people have been wrongly prosecuted. But this case looks pretty black and white to me.

scotty793• 14 years ago

Information whether email is valid or not was made publicly available by AT&T. Shouldn't access to publicly available information be assumed to be authorized by the one who made the information public?

If you forget to wear your pants in public you are the one who is to be charged with indecent behavior not the people looking at you with intrusion on your privacy.

bifrost• 14 years ago

Its a travesty, Weev comitted no real crime.

zalzane• 14 years ago

What do you mean? It says he used an account slurper and stole people's personal information.

Should this not be a crime?

dpatrick86• 14 years ago

A whatchamawhoseit?

cheald7• 14 years ago

He wrote a PHP script that downloads incrementing URLs. You know, like `curl -O http://att.net/iccid/[0-100].xml`

AT&T put this information on a public interface and relied on obscurity of serial integers to protect it, then cried foul when someone crawled their unprotected data and claimed felony unauthorized access to a computer system because they didn't explicitly authorize him to download the contents of those publicly-accessible pages.

This conviction is a travesty.

throwaway218781• 14 years ago

weev is a criminal. He spent many years making a living for himself by stealing from other people. He gets to re-write this past of his because most of his former crew are gone. weevs defenders are people who didn't know him when he was most active (2003-2009).

This particular case is also pretty clear-cut. If you were a whitehat, why would you retrieve so much data? Why would you give the data to someone who was not with that company?

Reserve your sympathy for hackers who get set up by their businesses partners, or people who aren't thieves and backstabbers. weev is just beginning to get what he has had coming to him for ten years...

aw3c2• 14 years ago

sources please.

kyrra• 14 years ago

Regardless of his past, why did he pull so much information? And turning it over to gawker seems a bit wrong. He should have contacted the company. If they didn't do anything then he should have gone to the media.

It seems like he acted irresponsibily with the situation. It wasn't just one misstep, it was a few.

anigbrowl• 14 years ago

Unsuccessful troll.

TallboyOne• 14 years ago

That is an incredible beard, that must be where he draws his power from.

rhizome• 14 years ago

This isn't Reddit.

neya2• 14 years ago

And this my friends, is the fake world of democracy we live in. We are being illusioned to posses freedom that we don't really have. This is a game played by very powerful people at the top, who have the right amount of money at the right time and these people will continue to game this system. We need a change, desperately!

smsm4213• 14 years ago

Could you please explain how convicting a person that hacked into AT&T means we have fake democracy? I must be missing something here, could you elaborate a bit?

gsibble2• 14 years ago

In my opinion he's just full of shit.

WillP• 14 years ago

While I agree that "fake democracy" is a bit over the top, I also can't see how he "hacked into AT&T". There might be enough room to dicker over whether searching for a vulnerability equates to "hacking," but does anyone really believe Auernheimer did anything illegal by manually typing in an address?

cheald7• 14 years ago

Can you please explain how "GET /iccid/12345" is hacking? I must be missing something here, could you elaborate a bit?

neya2• 14 years ago

Ummm...so let's say you upload a couple of private photos from a strip club on Facebook. They were meant to be private, but unfortunately, technically they weren't. Now, I do some googling and I find out that I can view these photos from a couple of unique URLs. Now, I have two options:

1) Just tell you so that you can remove these photos and you alone will benefit from it.

2) Bring this to light so that, everyone like you who have posted their private photos will benefit from it.

Now, what is the best way for me to bring it to light? Contact Facebook?? Yeah, it's a good shot, but Facebook will probably do everything to suppress that this incident even occurred.

So, the only way for me to prove that I DID gain access to your private photos is by proving everyone that I Just did. And that is by posting this info somewhere that will gain media attention.

Now, a couple of points to note here:

I did NOT hack into Facebook.

I did NOT threaten you to provide me those photos.

I just took what was available already and posted it to another online medium, so this will be brought to light.

So, now, please tell me, how was my INTENTION malicious? My intention was good. It's not like I sold your photos and made a ton of money. I actually fought for your privacy and now I'm labelled a Villian. Great!

tareqak• 14 years ago

From my reading of the article, the defendant is being painted to be bigger, scarier target so that AT&T looks like a victim instead of a corporation failing to secure the confidential information of their customers as due diligence demands. From the comments on this thread, the defendant did not have intentions that were completely (as in 100%) benign. In addition, the co-defendant pleading guilty will probably make it harder for his legal team to prove his innocence. However, why is AT&T getting away with what basically amounts to negligence? Specifically, AT&T failed to provide reasonable (industry-standard) security to their users' confidential information (email addresses and other personal data).

It says about 120,000 Apple iPad users were affected, so 120,000 counts of negligence. My "class-action lawsuit" senses are tingling.

Edit: minor reformatting and rewording.

jason_slack• 14 years ago

While I agree that his past "clouds" peoples potential judgement of him, I can't help but wonder if it was really understood that this data was in publicly accessible. He didn't need to work his way through backdoors and breach what some would consider traditional security measures.

Jury convicts NY man accused of AT&T-iPad hacking

Related Stories