You May Not Like Weev, But Your Online Freedom Depends on His Appeal

http://www.wired.com/opinion/2013/07/dont-hate-the-crime-hate-the-person-how-weevs-appeal-affects-all-of-us/

by Libertatea • 13 years ago

138 144 13 years ago

wired.com

andyzweb• 13 years ago

free weev

lesslaw• 13 years ago

It is a terrible decision

    curl http://domain.com/showdocument?[00000-99999]

should not be a crime!!

davidw3• 13 years ago

What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?

Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right?

Yes, it's their fault too for leaving it open, but you had a choice when you decided to access it N000 times, rather than saying "oops, that does something bad, I think I'll stop".

I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. Once you've shown that someone stupidly left their door open, the polite thing is to let them know, rather than walking around in their house looking at all their things to show them the error of their ways. IMO a fine would more than suffice as a punishment, though.

betterunix9• 13 years ago

"What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?"

Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?

dorkitude• 13 years ago

That would be a crime, because then the email addresses would've been "possessed" or "transferred" "in connection with" another distinct and separate crime.

But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.

walid7• 13 years ago

I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either.

In this case there is no crime. And I repeat this again, AT&T was behaving like http://www.mailinator.com/

DomreiRoam• 13 years ago

GET method should be Safe ( and Idempotent). The implementation is not respecting the RFC 2616.

The RFC says at the point 9.1.1 that: "Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the effects, so therefore cannot be held accountable for them."

IanCal2• 13 years ago

Should I be allowed to brute force passwords then?

betterunix9• 13 years ago

Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.

sejje• 13 years ago

Passwords are hashed in an attempt to conceal them.

Websites are served in an attempt to disseminate them.

There's a big difference here.

sneak20• 13 years ago

Yes. You can't use force or coercion to rob a server of data, all you can do is ask nicely (or repeatedly).

In a just world, we would let full responsibility lie with those who deployed the machines without understanding the consequences of, e.g., no login failure rate limiting.

efdee• 13 years ago

How about curl http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&passwo..., followed by curl http://domain.com/admin/wipeeverything?username=x&password=y ?

rpicard• 13 years ago

Couldn't we draw a line between retrieving information and modifying it?

stfu• 13 years ago

I, for one like Weev. He is a boundary pusher. Many even around here on hn might perceive his stuff as tasteless. But I sincerely wished more people were as dedicated to their "ideals" as Weev is.

Defending free speech means standing up for people who have controversial views - no matter how unease you personally are with these views.

theorique2• 13 years ago

Definitely. Free speech stands or falls on the most offensive speech.

It's easy to support free speech when all you say or hear is motherhood and apple pie. It's the things that make people uncomfortable that need protection from censorship.

sliverstorm• 13 years ago

It's the things that make people uncomfortable that need protection from censorship

Agreed; things like "Fire!" when there isn't a fire.

rayiner2• 13 years ago

How do you make this a speech issue?

speeder• 13 years ago

For example he got thrown into solitary for tweeting?

sneak20• 13 years ago

Weev was surveilled and harassed by the feds for ages before they finally got this one to stick.

He'd been on their radar for years due to his unpopular speech.

sneak20• 13 years ago

http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may...

I think he's despicable, but he's also my friend if only because he is willing to do whatever is necessary to stand up for what he believes in.

xyandnoz2• 13 years ago

Unfortunately, a big part of "what he believes in" is (to use his words) "make people afraid for their lives" and of course, "ruin lives for lulz". So, yeah, I agree he is willing to be quite bold in standing up for his right to ruin. That said, as much as I desperately want to see him behind bars for the things he has done, this AT&T conviction horrifies me, and I hope for all of our sakes he wins this appeal. And he has been right about one thing -- this IS about "embarrassing a big company". Because no law enforcement agency is willing to pursue the actual crimes he has committed against powerless individuals... the things he does to people as part of his "performance art". I have tried every way possible to justify his current conviction and sentencing. But I can't. I support #freeweev but I sure as hell don't support weev. And until/unless you and your family have been victimized by his "work", you really have no idea what he is capable of or truly believes in. -- Kathy Sierra

mjn• 13 years ago

The brief is actually quite readable: https://www.eff.org/file/37297

If you're already familiar with the background of the case, for the meat of the argument on appeal, skip to p. 15 (26th page of the PDF), starting with "Summary of Argument". That section lays out the five objections being raised on appeal, and is then followed by five sections making the detailed arguments.

edit: direct link, https://www.eff.org/file/37297#page/26/mode/1up

nicholassmith6• 13 years ago

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument.

   - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly relevant, it's an important technical detail. Sure he could have sat and put each string in in a long laborious process, but they circumvented that and went straight to the faster option. Once they'd established there was a hole they could have stopped rather than going for the motherlode. 

   - `if there’s no technical barrier...`, there was a technical barrier, it was just very, very small.

Don't misunderstand me, AT&T are massive idiots for letting a security violation on that scale leak out into the wild, and they should't have been surprised for it to be discovered, but if you're doing live security research and find a hole is taking 114k email addresses a particularly good way to report it?

He certainly didn't deserve the ridiculous amount of time that he got, but he's not an innocent in this example by any stretch of the imagination.

sneak20• 13 years ago

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL.

Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense.

It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the sim serial (ICCID), and ATT sends the HTML form with the email address already filled in, so all the user has to do is enter the password.

As it turns out, ICCIDs are sequential integers.

It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended.

Weev knew that the greater the number of records he got, the worse it would reflect upon ATT, and rightfully so.

res0nat0r2• 13 years ago

It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended.

The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.

vertex-four3• 13 years ago

So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems?

It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system.

Simplifying things a little, there was an API, which looked somewhat like this:

    GET http://example.com/get-email?device-id=123456
    > example@example.com

Now, if we replaced that with some sort of bespoke raw socket interface that somebody would have to reverse-engineer:

    CONNECT example.com:4567
    > <somemessage>123456<somemessage>
    < <someresponse>example@example.com<someresponse>

Would you still be arguing "it's on the web"?

What if I added a field named "password" which always had to be the same value, which was distributed to all devices?

What if it wasn't email addresses, but instead credit card data, or sensitive data such as your race, religion, sexuality, political leanings, medical information...?

I'm not attacking you, simply stating that in my opinion, it's not as simple as "if you can access it, it's public". There's an expectation of privacy for many types of data, especially when the data owner is not explicitly intending to publish the data.

nicholassmith6• 13 years ago

"It should always be perfectly legal to access a remote computer system via a publicly accessible interface.", no it shouldn't, no more than it should be legal for me to walk into your house if you've not locked the door.

The system worked exactly as AT&T intended, in circumstances they'd clearly not planned for. If they'd bothered doing a risk assessment they'd have spotted it, they took the lazy option and it didn't work.

lolcraft• 13 years ago

Even if you left the door of your house open, it wouldn't be legal for me to go inside and take your TV in protest.

Frankly, you're just torturing some unclearly defined terms ("Information Published on the Web", or "Expressly Designed Feature", or "it's up to a Remote System to respond appropiately") to make a point. Thing is, most of those terms are not legal, well defined terms; and when they are, your interpretation is lacking. You'd have a hard time convincing any judge that a company expressly desired to publish email directions of all of their customers, via some opaque and undocumented URL manipulation.

Disclaimer: I don't agree with weev's conviction, and some of its aspects are outrageous ("conspiracy to access a computer without authorization"?). But this "it was public information" angle is just bullshit. It's just badly reasoned.

tptacek11• 13 years ago

That first sentence doesn't make sense. If a merchant screws up and manages to post a flat ASCII text file of credit card accounts with CVV numbers on a URL in a directory with an Apache index enabled, your argument says "well, sucks for the merchant and all their customers".

There are clearly cases where the mere fact that someone has left something somehow exposed to a web browser does not connote authorization to access it. Those are the cases where a reasonable person, seeing what the data is after stumbling across it, would understand the exposure to have been a mistake, and not an authorization.

smsm424• 13 years ago

>> It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL.

By this logic, any information stored on any computer accessible via the Internet is published, so no unauthorized access to any data not behind an air gap is illegal. Including breaking into your private mailbox or your online banking account. I don't think I'd be ready to accept this. Are you?

solaris999• 13 years ago

There's certainly a fairly well culturally established method of dealing with holes in corporate internet security which Weev did not follow in this case.

However as a third person it's also useful for me to know the scope of this hole and how liable my own information was. Weev here is guilty of exactly the same reasoning that AT&T realised in court which is that a message is irrelevant without impact. And which has more impact: an article about how a vulnerability in AT&T security could have resulted in some leaked emails or an article about 114 000 potentially leaked email addresses?

pi18n• 13 years ago

If he were guessing passwords jail time might be appropriate.

It's fucking ridiculous that changing the user agent, even to circumvent server "protections", would be a crime worthy of any jail time whatsoever. What is he guilty of? Criminal misrepresentation of web browser?

walid7• 13 years ago

Mostly. Seems like AT&T is operating like http://www.mailinator.com/ where you can access anything using an ID without a password.

Fuxy• 13 years ago

The question is after hearing AT&T prosecute Spitler for discovering such a simple security hole (it could have been a lot more complex) would you feel safe disclosing any security hole even with the best intentions?

The answer is obviously no and if you can't make it public without risking being sent to prison the only option is selling it to some shady spammers.

Which would you prefer happened? From my point of view what they are doing is basically pushing the hackers to the "dark side". If we disclose it we get arrested if we sell it we might get caught and arrested or make a lot of money. I'll take option 2.

nicholassmith6• 13 years ago

Yes I would, but I'd follow the standard responsible disclosure rules that are fairly common place. As far as the information that's been presented makes out, there was no responsible disclosure. In fact, weev attempted to say they were going down that route whilst at the same time discussing on irc how they could use the information for fairly black hat purposes.

I think the industry basically needs to take the informal responsible disclosure rules and try and get them made a bit more formal, for everyones benefit.

antitrust• 13 years ago

Looks like proof of concept to me. The test in my mind is what gets done with those 114k addresses. Did they get leaked? No -- and the company was notified of the breech? No harm, no foul.

onedognight• 13 years ago

This is the same as if the URL was the following and all you had to do was change the phone number and you would get an email address.

    http://att.com/email?phone=555-1212

And Weev noticed this and wrote a for loop to try all phone numbers.

linuxhansl• 13 years ago

A few points that stuck out:

* "AT&T representative testified its reputation suffered as a result of the hack"

No, their reputation suffered, because they were incompetent. Ironically, without this trial I would have never heard about this.

* "At sentencing, instead of hearing about the effects of the iPad “hack,” the government recounted in detail Weev’s “attitudes” towards others on the internet."

That is because of the adversarial legal system in the US. All that matters is to sway an uninformed jury. The specific matter of the case is almost irrelevant as long as the jury comes to a "guilty" verdict.

Lastly, this reminds of a civil version of the current Snowden debacle: Attempt to prosecute anybody who reveals wrong doing or incompetence.

dllthomas3• 13 years ago

I don't think I go as far as others here. I am not sure an open door is an invitation to dig through someone's diary; that is, even if someone is incompetent in managing their security, there should probably still be a point at which abusing that crosses a line - though I am very open to discussing just where that point is (and some liability should certainly still sit with those who deployed an insecure system).

All of that said, I wholeheartedly agree that damage to reputation (where such damage comes only from revelation of the insecurity) is the fault of the people failing to live up to their reputation, not those exposing the reality of it.

rhizome12• 13 years ago

What if the diary is left open on the kitchen table, the "kitchen table" being the internet?

jakejake2• 13 years ago

I was a witness for a trial once and it's kinda bizzare. After all of the lawyers speeches and questions and explanations of the law - in the end it just boils down to how 12 random people feel about it. I left with the feeling that the process is fair only in the sense that it is equally random and unfair to everyone.

If the prosecutor is able to make you seem unlikable, or you do it to yourself, you most definitely increase your risk of being convicted. Mr. Auernheimer strikes me as somebody who enjoys being shocking and perhaps unlikable in the traditional sense, which is not an ideal situation in court.

pcwalton• 13 years ago

Well, as a defendant you can waive your right to a jury trial, and many people do for this reason.

IanDrake3• 13 years ago

https://www.eff.org/deeplinks/2013/06/eff-access-public-webs...

A link to the Craigslist vs. 3Taps spat in this article brought back memories. Craigslist had also threatened me with a C&D letter suggesting they'd use the CFAA to lock me up. I contacted the EFF who promptly told me to go screw...

I assumed that was because Craig is on the board of advisers and CL was a major sponsor. I'm glad to see they're finally helping someone against the giant internet bully that is CL.

coding123• 13 years ago

so here's the solution. 1) Make a website called "freeweev.com" or something 2) Put some legal mumbojumbo at the bottom of the site that says something about unauthorized usage of this website is a crime. 3) Make the post-signup page URL look something like this: http://freeweev.com/?id=12

That simply says "Your email: ...@gmail.com will be updated when we have info on the case. Thanks for your interest" 4) Let people "find this" 5) Get lots of people to report on the problem 6) Fix the problem after the press gets it 7) Freeweev.com takes everyone to criminal court under CFAA. No lawyers necessary, just tell the Judge that there appears to be no difference in these cases as the AT&T case, all of these people that hacked our site should go to jail for 41 months. Also make sure that this involves MANY people. 8) Legal breakdown, no software development for anyone (like the screen-writers strike right?)

aclevernickname• 13 years ago

What a useless article. Jury found weev guilty already, and now they're filing an appeal. No word on when the appeal will be heard, just 1,000 words to fill up that lack of information, combined with linkbait headline.

You May Not Like Weev, But Your Online Freedom Depends on His Appeal

Related Stories