TechCrunch: Skating on Thin Ice

http://www.jgc.org/blog/2009/07/techcrunch-skating-on-thin-ice.html

by jgrahamc • 17 years ago

115 42 17 years ago

chanux• 17 years ago

I think he is hiding something in his article. Interesting.

jgrahamc12• 17 years ago

I'm not hiding anything. I'm just pointing out that this sort of gloating is a really bad idea. If I had actually broken into TechCrunch's systems do you think I would post an article about it?

Herring• 17 years ago

Or maybe that's what you want us to think. After that last hack, you'd be rather high on the suspect list.

kenver• 17 years ago

When you take the proverbial out of someone elses systems, on a technology website read by thousands of tech savvy people you're asking for trouble.

jgrahamc12• 17 years ago

Agree. It's one step down from when companies shout about how secure their systems are and then offer some 'challenge' prize money that they assume will never be won.

IgorCarron• 17 years ago

Aren't the situations a little asymmetrical or are they ? How much does a disruption in Twitter service affect people and how much a disruption in Techcrunch affect the internet economy.

Retric• 17 years ago

Are you suggesting they are both almost useless?

Edit: On second thought I assume you mean one of them is useful, but I could not tell from your comment which you though was more useful.

alex_c• 17 years ago

I really think that puts things in perspective a bit.

TweedHeads3• 17 years ago

At least this post will have everybody running like headless chickens at TC deleting every unethical or compromising evidence and fixing every possible security hole.

But there will always be one hole left...

jgrahamc12• 17 years ago

Or, Michael Arrington could just send me an email and I'll tell him which machine I'm talking about.

scorpion032• 17 years ago

Would you also let know, which machine it is, if _someone else_ mails you.

TweedHeads3• 17 years ago

Make him sweat for 24 hours before giving any clue, so other hackers can put their mad skillz to test.

If they break in that wouldn't be your fault.

tdavis• 17 years ago

I never, ever gloat or make fun of others when it comes to security. It seems like a no-win situation. If you go to someone privately with security concerns, you're generally seen as helpful. If I publicly oust somebody, there are all sorts of people like the author (but far less scrupulous) who might consider it their duty to knock me down a peg... and I'm no security expert.

Using "password" for a password is really stupid, but "really stupid" is relative to the knowledge level of the person pointing it out, in most cases. I'd prefer not to find out what really stupid thing I've done to allow some script kiddie access to my servers (or whatever the case may be).

davidw2• 17 years ago

I actually don't care much for the tone of this article either, for that matter. It's just a bit off for some reason IMO. Perhaps it comes across as a bit of gloating itself? I'm not sure, but it's not that big a deal.

erlanger• 17 years ago

Yes, but he has something to back it up.

J_McQuade• 17 years ago

The tone reminds me exactly of the bit in The Hitchhiker's Guide to the Galaxy where Slartibartfast calls Arthur Dent "late" in an effete attempt to sound sinister and threatening...

... but that's probably just me, though.

vaksel• 17 years ago

I'm no "hacking expert" but is hacking nowdays really just you guessing/stealing a person's password?

froo3• 17 years ago

Not all that's involved. Sometimes "hacking" involves creative pranks.

For example, one prank I pulled (which was admittedly pretty basic and silly) was a creative redirection using .htaccess for a certain someone's fixed IP address who used to lurk a site I ran last year. This person had an extreme distaste for me, because of the existence of the site and she would publicly slander me for something I never did at every available chance.

So I decided to have a little fun with her.

I set up a page with her (publicly available) photo with large text headline saying that she had been hacked, which the redirection went too.

Total time to setup - less than 3 minutes.

Having her write me a lengthy email me telling me that she was going to call the police (in Australia) and have me arrested was pretty interesting. I never responded.

I think I would be freaked out too if the next time I visited someone's blog (which I was hypothetically consistently leaving trolling/nasty comments on) there would be my picture there, exclaiming how I'd been hacked.

Sometimes the illusion of having "hacked" someone is just as satisfying as the real thing, without the messy potential of jail-time.

jacquesm5• 17 years ago

Remind me to stay on your good side.

We pulled a similar prank on a guy working on implementing 'verified by visa'. Every morning he'd walk in to the office and read the same news site. So, three days before completing the project we cloned the news site and posted an article that VISA had decided to abandon VBV.

He walks in to the office, starts reading the headlines (-- expletive deleted --) slams his coffee down and walks out of the office.

To his credit within 20 paces he started laughing like mad, knowing he'd been had. Pretty clever dude, it would have taken me a bit longer... :)

To protect the guilty and the innocent alike, no further references, but rest assured that a few words were addressed to VISA execs that were not exactly pc.

Lots of fun with the DNS.

vidarh• 17 years ago

Back in the day I was running an ISP, and when we did a website redesign at some point we added reverse lookup of the users IP address followed by a quick little dictionary lookup to add a "Back to [users ISP]" link (we did not have much business/marketing sense) if it matched any of the major ISPs.

Two days later we got a frantic call from someone at another ISP to tell us that someone had hacked our server and added a link to them - he wanted to make sure we didn't think it was them that had done it.

sfphotoarts• 17 years ago

I think that what TC are doing with the stolen documents is deplorable journalism, but his site remains, and is currently unhacked, so I guess he has the last laugh.

jgrahamc12• 17 years ago

A quick follow up. TechCrunch got in contact and we had a quick back and forth. They confirmed that the security vulnerability I was pointing out was something they had worried about already and taken action to mitigate.

They also said "We have had thousands of breakin attempts over the past few days". No surprise really.

And they are planning some posts pointing out the vulnerable nature of apps in the cloud.

TechCrunch: Skating on Thin Ice

Related Stories