Cardinals Face F.B.I. Inquiry in Hacking of Astros’ Network

http://www.nytimes.com/2015/06/17/sports/baseball/st-louis-cardinals-hack-astros-fbi.html

by QUFB • 11 years ago

156 114 11 years ago

It'll be very interesting to see how the Commissioner's Office responds to the FBI's findings. While I don't believe espionage is new to MLB, this is the first case of it reaching the public (and federal government) that I can think of.

jessaustin12• 11 years ago

It's lucky for them that Bill DeWitt Jr. chaired the search committee who hired the new commissioner. (Shades of Goldman Sachs' perennial association with the Treasury Department...)

However, if the Cardinals are as smart (and perhaps as ethical?) as they previously seemed, they'll get out in front of this, and voluntarily give up their 2013 pennant, as well as fire whoever was involved in this harebrained scheme.

vaadu• 11 years ago

Give up a 2013 pennant? Let me guess, you're a Dodgers fan.

Until there are details on what was done and by whom the Cards should do nothing more than fully cooperate with the investigation. Then and only then should the Cards and MLB decide how to respond.

dionidium2• 11 years ago

voluntarily give up their 2013 pennant

I'm a Cardinals fan, I admit it, but that's basically an insane suggestion. It's not going to happen and it's not smart. Why in the world do you think that would be smart?

bdcravens3• 11 years ago

Since they're no longer in the same division as the Astros, it's a bit less of a penalty, but I'd say every game since the initial breach against the Astros should be forfeited. Additionally, any draft picks during that time should be awarded to the Astros. (not the actual players, but that means they owe the Astros N first round picks, etc)

Probably not going to go down like that, but it's a matter of punishment, as well as compensating the team that was the victim. (I'm from Houston, so probably biased)

jessaustin12• 11 years ago

Dude should have used a password manager. Or maybe just a new password.

Also, the Cards staff probably shouldn't have logged in from home.

Also, how on Earth is this a valid use of the FBI's resources? Fix your broken crap yourselves, Astros.

bradleyankrom4• 11 years ago

Just because it's sports doesn't make it any less illegal.

jessaustin12• 11 years ago

It does make it much less important. Nobody is going to die because the Cardinals know what the Astros think about some high school pitcher. With this and the FIFA thing, it seems as if the FBI is interested mostly in sports. Meanwhile, murderers are on the loose, there has still been no meaningful investigation of the financial shenanigans for which we've all paid, there has been no examination of the FBI's own adventures in illegal surveillance and parallel construction, etc.

It's clear, too, that the Astros' staff brought this on themselves. When one is hired away to a competing organization, start using new passwords! Sheesh.

mdm_• 11 years ago

One multi-million dollar business franchise gained illegal access to the computer network and private data of another multi-million dollar business franchise. Sounds right up the FBI's alley to me.

themartorana4• 11 years ago

I'm not sure where the legal line gets drawn. There was no hacking. There was an attempt to use a password that worked.

Right now, "unauthorized access" is any after-the-fact declaration that someone didn't want someone else looking at something.

If there had been broken encryption, 0-day exploits, SQL injection attacks, etc... THAT is hacking. Not accessing a public endpoint that lets you in.

GFK_of_xmaspast• 11 years ago

Since when does the FBI care about corporate wrong-doing?

s0uthPaw88• 11 years ago

Here's how they did it:

"Investigators believe Cardinals officials, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials who had joined the Astros when they worked for the Cardinals. The Cardinals officials are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said."

nissimk• 11 years ago

And this is how they got caught:

"Believing that the Astros’ network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros’ network had been entered from a computer at a home that some Cardinals officials had lived in. The agents then turned their attention to the team’s front office."

carsonreinke2• 11 years ago

Where does one get a master list?

timboslice2• 11 years ago

Lot's of companies keep passwords in an unprotected Excel sheet :/

mikeryan• 11 years ago

Written on a whiteboard?

timboslice2• 11 years ago

TL;DR: a member of the Cardinals' staff left for the Astros a few years ago. Both teams had an internal system to track recruiting efforts etc. He used the SAME password in the new org, the Astros. Someone from the Cardinals org checked his master password list and was able to enter the Astros system with his old creds

Fuxy• 11 years ago

Wait does that mean they kept unhashed passwords? That's a big security no no and there's absolutely no reason they should have it like that.

jessaustin12• 11 years ago

That's a big security no no...

It's a no-no when the provider has a duty to the user, such as when the user is a paying customer. It's probably OK when the provider is the employer and the user is merely an employee? I say this because employers regularly do much worse stuff, like running MitM proxies that log bank passwords...

jonknee• 11 years ago

It could also have been something like LastPass that everyone in the office used.

fname• 11 years ago

I'm guessing they mean they had a break-glass list of passwords for accounts to access those systems.

coleca• 11 years ago

It's more likely that the Cards had a Excel file "Master_Passwords.xls" (or similar) with all his department's passwords listed in it on a shared department folder. No encryption, hashing, etc. Maybe they used Excel password protection on the file.

Just a hunch, but I've seen it many times at past employers.

helyka• 11 years ago

Well had they deleted the password and someone still accessed the network without authorization and the FBI investigated the situation (much like they are now) then the Cardinals could have been charged with obstruction of justice under the SOX act Section 802.

http://www.soxlaw.com/s802.htm

slg• 11 years ago

Last year, some of the information was posted anonymously online, according to an article on Deadspin. Among the details that were exposed were trade discussions that the Astros had with other teams... Believing that the Astros’ network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros’ network had been entered from a computer at a home that some Cardinals officials had lived in.

And the only way they were caught was because they likely leaked some of the information they found to Deadspin. I remember at the time of the original Astro's leak, it was very interesting what specifically was leaked. It was not anything that could damage the Astros from either a legal, financial, or competitive standpoint. It only served as an embarrassment to the front office, almost as if the specific information leaked was meant as petty revenge while trying to walk a line by abiding by a certain competitive and moral code.

zekevermillion• 11 years ago

Could someone please get the NYT to drop the paywall on hackernews links?

pcl• 11 years ago

That's a really good idea. Are there any NYT folks here? Is there a procedure in place for doing this sort of thing? I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community; it'd be nice to have the same treatment from media organizations.

smeyer• 11 years ago

I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community

Really? I'd suspect it to be the other way around. For reference, here are some HN stats: https://news.ycombinator.com/item?id=9219581 .

dragonwriter4• 11 years ago

I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community

I wouldn't be so sure of that; considering my own pattern, even when my reading is being driven by HN, I usually do several google searches for related content, including frequently Google News searches for related news items from other sources, for each page I go to directly from HN. And not all of my reading -- even related to development/startup things -- is driven by HN.

dangrossman• 11 years ago

You can't show Googlebot one thing (the article) and real people another (the paywall) without being penalized and losing your free search traffic. That's why visits referred from Google see the full article. It's not because someone at NYT decided they don't want people from certain sites to become paid customers; if they could paywall Google-referred traffic without losing that traffic they would.

asquabventured• 11 years ago

Could someone please get the NYT to drop the paywall on hackernews links?

Use self-destructing cookies or a plugin like it to delete the cookie everytime you close the tab and you won't run into the NYT paywall.

Alternatively, you could use a plugin like refcontrol and set your referrer on NYT as news.google.com and be in the clear if you like hanging on to cookies for some strange reason.

alan_cx• 11 years ago

"The attack represents the first known case of corporate espionage in which a professional sports team has hacked the network of another team."

Im pretty sure that in F1 one team hacked another for design details. That said, I cant find a source. IIRC, it was Renault hacking Ferrari, but Im not sure.

bradleyankrom4• 11 years ago

This? http://www.autosport.com/news/report.php/id/15417

josefresco• 11 years ago

"hacked the network"

Hardly. I'm sure there are countless examples of employees improperly using access given to them by their previous employer.

ghughes• 11 years ago

That distinction seems somewhat dubious. The end result is the same.

CONTRARlAN• 11 years ago

Guessing you're talking about this:

https://en.wikipedia.org/wiki/2007_Formula_One_espionage_con...

Kevin_S3• 11 years ago

This is shocking, I followed this closely last year as I am a die-hard Astros fan but never thought it would be another team. I definitely doubt the Cardinals endorsed this, it was just some dudes that had access. These guys will be fired (if they haven't already) and there will be fines. Nothing too crazy will happen.

Though if the FBI finds that the GM/high level execs knew about the activity... this will be unprecedented. The penalties would be staggering as MLB would want to crack down extremely hard to deter future bad behavior.

remarkEon4• 11 years ago

Really interested to see how Bud Selig responds to this. Looks like this is the same guy (Luhnow) who SI did a pretty good thing last year about, reference how the Astros were doing a Ctrl+Alt+Dlt[1].

The cynical side of me says that Selig and MLB will try to maybe milk this for some rating or something, considering the meme going around that baseball is dying.

(full disclosure, Twins fan here, so I'm gonna be cynical about anything that Selig does)

[1] http://www.si.com/longform/astros/

Edit: Guess I missed that Selig retired in January. Damn you, work!

gtCameron• 11 years ago

Selig retired in January. Rob Manfred is the commissioner now.

wj• 11 years ago

Just FYI, Selig is no longer the commissioner.

mrchucklepants• 11 years ago

Nice to meet another die-hard Astros fan on here. There aren't too many of us.

Kevin_S3• 11 years ago

No doubt, I'm in the Cleveland area so I am seeing them here in July. First time in a while.

rrss1122• 11 years ago

Why is it so unbelievable that another team did it? The Patriots have been caught many times engaging in shady activities, including outright spying once. If a football team can do it to another football team, it's conceivable a baseball team can spy on another baseball team too.

mikehearn3• 11 years ago

outright spying

The Patriots filmed the Jets' sideline during an actual NFL game that was happening in front of like 80,000 people. It isn't even illegal to film opposing coaches on their sideline, you just can't do it from your own sideline[1]. That's what Spygate was. Is that really spying? Is it outright spying?

[1] https://en.wikipedia.org/wiki/2007_New_England_Patriots_vide...

bdcravens3• 11 years ago

These guys will be fired (if they haven't already) and there will be fines. Nothing too crazy will happen.

By the letter of the law, this is a crime. You may be correct, but something substantially more could happen.

kolbe6• 11 years ago

We don't know the details, but I think it's safe to say that if the allegations are true, the Cardinals engaged in a form of cheating. It could be that their cheating had very deep and nefarious implications, but I doubt it. If anything, they may have stolen some secrets that gave the Cards an advantage over the Astros in player acquisition strategy.

What I cannot get over is how absurd is it that the Federal Government has been able to insert itself so deeply into a problem that doesn't warrant FBI involvement in the slightest. Athletic teams have been cheating for centuries. Sometimes that cheating involves ruined careers for both the cheater and the cheated, and sometimes they involve teams losing money. But what they rarely involve is the FBI. And the only times I can think of when they have involved law enforcement have been narcotics or gang related.

To me, this sounds no worse than various other advantages that teams unethically gain for themselves. That our legal system allows for this particular type of cheating to potentially be a federal crime is frightening. Let MLB handle this internally, and play ball.

[edit: holy shit. I get it. The FBI is acting within its legal right (and duty). This is a moral statement about the law that they are tasked with enforcing.]

remarkEon4• 11 years ago

-> Believing that the Astros’ network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros’ network had been entered from a computer at a home that some Cardinals officials had lived in. The agents then turned their attention to the team’s front office.

So it looks like the Astros/MLB were unable to determine internally how their network was compromised and then contacted the FBI. This seems perfectly reasonable to me.

kolbe6• 11 years ago

I like that aspect, which is using the FBI's resources to help solve a problem. But, to me, it's fucked up that once you call the FBI, they take over, and often bring absurdly punitive charges with them. We saw this with Aaron Schwartz and Sergey Aleynikov.

lern_too_spel3• 11 years ago

Interstate computer fraud and abuse is a federal crime. That the business affected plays some boring game doesn't make it any less of a crime than if they sold sugar water or provided computer services.

ams6110• 11 years ago

Chances are that a large amount of what might appear to be "intrastate" internet traffic ends up routed out of state. Does that give the feds jurisdiction? Or would it have to be based on the endpoint computers being in different states?

kolbe6• 11 years ago

I'm not saying it's not a crime. I'm saying that it's fucked up that it is a crime.

edgesrazor• 11 years ago

If I'm not mistaken, I would guess the only reason the FBI is involved is because it's interstate computer crime, which is their jurisdiction. I see what you mean though - if it's just a matter of someone stealing the old GM's password and using it to log in, let's not waste the taxpayer dollars.

bps4484• 11 years ago

You're thinking of this as if it were two local amateur sports teams, which makes it seem like it's absurd for the FBI to be involved.

Instead, I would look at this as two multi-million dollar businesses engaging in corporate espionage. When seen from that angle, it is exactly the sort of thing the FBI should be involved in.

detaro• 11 years ago

why does the size of the organisations make a difference?

kolbe6• 11 years ago

Should the FBI be involved when the Pats deflate some footballs? That cheat cost some team tens of millions of dollars. I don't think so. I think it's for the NFL to decide.

jordan0day2• 11 years ago

I get what you're saying, but I'm actually happy the FBI is getting involved when it's a matter of "hacking" (regardless of the appropriateness of that term) involving a multi-million (billion?) dollar companies.

Or to put it another way, I'd much rather the FBI spent it's time prosecuting crimes committed by large companies than screwing over kids like Aaron Schwartz for their minor indiscretions.

netik• 11 years ago

This really sounds like more of a "Astros suck at employee off-boarding" problem. They failed to lock out users of the previous system long after they left the company.

Regardless of their weak password storage scheme (which must be fixed), a simple set of changes (like disabling public access to their system, disabling VPN for terminated users, and changing passwords) would have stopped this from ever occurring.

jessaustin12• 11 years ago

No this was on-boarded employees using the same passwords at their new job that they had used at the old job. I bet the Cardinals were at least savvy enough to disable Luhnow's old accounts.

paulsutter• 11 years ago

Let's see if the penalties are as severe when a major sports team is caught hacking as opposed when a nerdy computer guy is caught hacking.

Cardinals Face F.B.I. Inquiry in Hacking of Astros’ Network

Related Stories