Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

spacehog371

macrumors regular
Dec 13, 2003
238
0
Hacking?

If I can hack a system by accidentally typing a URL wrong, then there is something wrong. My grandmother could make that mistake.

Yes, this guy wrote a script that tried a ton of different URL's, but this is no different than writing a script that automatically conducts google searches.
 

AppvanceTech

macrumors newbie
Jun 10, 2012
18
2
Allen, TX
Inmate 1: What are you in for?
Inmate 2: I killed a guy...
Inmate 1: Oh, hey you, what are you in for?
Inmate 3: I robbed a bank.
Inmate 1: Nice. Yo, what are you in for?
Inmate 4: I hacked iPad accounts.
Inmate 1: What's an iPad. Whatever. How much time you doin'?
Inmate 4: almost 4 years.

Inmates 1-3: WTF!?

so true
 

69650

Suspended
Mar 23, 2006
3,367
1,876
England
Not only do I like this sentence, but I would like it even more if it were longer. I don't understand the attitude here of some people who think this is no big deal. It IS a big deal.

Why is it such a big deal?

Did this guy profit significantly from his crime? Wall Street bankers screw the entire world and walk away with big fat bonus and a nice cushy job somewhere else. This guy does diddly squat and you think he's a master criminal.
 

Nightarchaon

macrumors 65816
Sep 1, 2010
1,393
30
Everyone knows there are major flaws. We have people who do this legally, and they do testify, and are hired by firms to check security.

Seriously, if security were as easy as some think, it wouldn't be a problem. But it isn't, and so it is a problem.

The people paid to this professionally are also paid to keep quiet when they find a flaw too expensive to fix easily (I know from experience this is the case) .. I'd rather there are the few who will risk prison to bring these flaws to the publics notice, it won't be me, I like my job and my money too much, but I like that other people have better principles than me :D
 

OrangeSVTguy

macrumors 601
Sep 16, 2007
4,127
69
Northeastern Ohio
Identity theft is near impossible if you're intelligent about how to protect your information. If you're just stupid and don't protect yourself, you kind of deserve whatever you get.

That's basically like me leaving my window or door unlocked and someone coming into my house in the middle of the night. I shouldn't have to lock my doors and windows but in this world we have to. I guess if you get shot coming into my house unannounced in the middle of the night, you deserve what you get.

Would be nice to see all the idiots that do identity theft be prosecuted like these individuals. But I guess it's only bad if you bring if you mess with the high-profile people. If they were just all average people's iPads email addresses, no one would give two ***** about it.
 

Muscle Master

macrumors 6502a
Oct 15, 2010
581
113
Philadelphia
AT&T should hire that guy and use him to fix holes in their security, putting him in jail is such a waste of talent.

What makes you think he is any good at fixing security holes? He has proven that he has no common sense at all. He has demonstrated that he has all the intention to do similar exploits in the future. He's probably impossible to work with and will just cause any future employer no end of trouble.

You throw enough money at these types of guys.. they'll do whatever you ask.. and do it well!
 

gnasher729

Suspended
Nov 25, 2005
17,980
5,565
You throw enough money at these types of guys.. they'll do whatever you ask.. and do it well!

Read this here:

http://arstechnica.com/tech-policy/...weev-sentenced-to-41-months-for-attipad-hack/

Just a complete idiot with not a bit of a clue. A notorious liar. Admitted that the intent was to blackmail AT&T, or sell the email addresses to spammers. If your company hired him, you'd make a collection for someone to meet him on the car park with a baseball bat.
 

X38

macrumors 6502a
Jul 11, 2007
539
562
Identity theft is near impossible if you're intelligent about how to protect your information. If you're just stupid and don't protect yourself, you kind of deserve whatever you get.

No, you don't. Blaming victims of crime because they lacked the knowledge to better protect themselves from the crime is stupid.

OTH, if you hack people's accounts, getting 41 months is more than deserved. He should have gotten more, including being banned from using the Internet for life.

----------

That's basically like me leaving my window or door unlocked and someone coming into my house in the middle of the night. I shouldn't have to lock my doors and windows but in this world we have to. I guess if you get shot coming into my house unannounced in the middle of the night, you deserve what you get.
[...]

Sounds like a good solution for identity thieves as well.
 

bananawaffles

macrumors newbie
Mar 18, 2013
1
0
ITT: Cranky geriatrics, who equate computer knowledge with wizardry, cheering an individual receiving a disproportionate sentence based on the broad application of law(s) written in the 80's that were intended to prosecute the computer hacking equivalent of Charles Manson, but is instead used to prosecute pranksters, political activists, the young, and the poor.

To all the Ted Stevens' and Sarah Palin's reading this: Please, for everyone's sake, go back to watching the 700 club.
 
Last edited:

charlituna

macrumors G3
Jun 11, 2008
9,636
816
Los Angeles, CA
Sounds like you have sympathy for a guy who could wreck peoples' lives via identity theft..

And over 100k at that.

Besides which, how likely is it that he'll serve the whole time. Provided he doesn't screw up during his post release

----------

Like they did with Aaron Swartz? That really worked out well...
.

THEY didn't do jack to 'poor' Aaron. The prosecutor indicated she intended to go for the max to set an example but he wasn't convicted or sentenced. Because that self proclaimed 'activist' was really just a coward who was too scared to actually fulfill his self given title and take a stand and took his own life instead.
 
Last edited:

charlituna

macrumors G3
Jun 11, 2008
9,636
816
Los Angeles, CA
Something tells me that in prison, this guy's "security" is going to get breached by a lot of people looking to access his system through the back door.

A. Rape jokes are never funny

B. it is highly unlikely he'll be in prison with violent offenders. If he's not in a min-med prison he'll be in such a population kept separate from the really nasties. If he doesn't file and win an appeal and stay out all together.

----------

If he had only found the vulnerability and reported it, he could have claimed good intent, and it would be hard to argue he did any harm. He did not do that though, he was not trying to be a Good Samaritan.
.

Yep, he only needed perhaps 10, maybe 20 emails to know this might not be a random one off thing. He could have stopped them, contacted AT&T etc. instead he collected thousands of emails which he publicly said he intended to sell to spammers or such, apparently tried to blackmail AT&T and so on. AND indicated he was going to try such tricks again and again as much as he wants.
 

marksman

macrumors 603
Jun 4, 2007
5,764
5
Anyone who questions whether this was illegal hacking or not is cuckoo for cocoa puffs.

----------

In that case - why aren't AT&T in the dock for leaving customer's data vulnerable in such an unprotected way. Maybe rather than giving "hackers" such harsh sentences, we should start making the people who left the vulnerabilities there in the first place accountable.

Yeah lock the person who forgot to lock their door who gets robbed shouid be punished. What about the guy who manages to sneak past security and download all the data, don't Punjab the actual criminal just the victim?

Makes perfect sense.

----------

I would hope one wouldn't go to prison for 3 1/2 years for walking into someone's house and looking around.

In many states that is burglarly and yes you could get that kind of sentence. Especially if you were a pompous ***** to the judge.

----------

Are you even familiar with the facts of the case? I'm not the sort of person who thinks computer crime ought to have no consequences -- far from it, in fact. I am, however, quite alarmed by an overzealous interpretation that effectively criminalizes the legitimate GET requests after the fact.

You request resource X at a given URL. The server responds with the requested resource. That's it, end of story. If you're allowing public access to your systems, the onus is on you to secure it. AT&T didn't.

The "open front door" metaphor a few people in here have used is absurd, precisely because of it fails to recognize how the HTTP standards operate. Ignoring the plethora of biases associated with the "home" image, the better (but still flawed) analogy would be that you walk down a street, knocking on the doors to various homes, and the houses choose to open the door for you in order to allow access.

I don't know which you know less about, computers or analogies.

----------

Lawl.... Great guy people here are defending.

I hope some of that GNAA info makes it to the prison population he will be mingling with.

No doubt this dumb arse kid will be sobbing himself to sleep for months.

----------

All this guy did was enter a URL into a browser. It was AT&T's crappy computer system that returned all the info without any verification process. Their software coders were lazy and slack and this guy gets 41 months? Ridiculous.

You know all hacking just involves typing some stuff on a keyboard.

Why are people being so abhorently dense?

----------

Hacking?

If I can hack a system by accidentally typing a URL wrong, then there is something wrong. My grandmother could make that mistake.

Yes, this guy wrote a script that tried a ton of different URL's, but this is no different than writing a script that automatically conducts google searches.
Yes it is actually much different than that.
 

Bluestrike2

macrumors member
Nov 9, 2008
53
19
Pittsburgh, PA
I don't know which you know less about, computers or analogies.

Unfortunately, that's non-responsive to my original post. But well done with your obvious ability to ignore points contrary to your own ill-conceived cognitive biases.

Web servers (and by that, I refer specifically to the software ala Apache, nginx or countless others)

As for my attempt to rework the original metaphor, you'll note that I was quite explicit about both its flaws, as well as the limits of my own revisions to it.

The entire notion of a home carries with it an implicit understanding of just what a home represents, and especially in this instance, a general series of expectations regarding privacy and security. This understanding can be easily contrasted with a public place, such as a storefront, where the primary purpose is to engage with members of the public entering the premise.

The HTTP protocol is, at its heart, rather simple. Browsers issue GET requests for a given resource at a specified URL, and the server processes the request in order to determine whether or not the request is valid. If it is, you get the resource at the given URL. If it isn't, tough luck, you don't.

GET requests have no effect on the server in question. They're simply a method for information retrieval. GET request posted, response returned. The system works because we trust that it does what it's supposed to. The presumption is, as a result, that I'm authorized when a response is processed and provided unless explicitly rejected.

In this instance, AT&T's failures explicitly processed his requests as authorized and legitimate. That wasn't their intention, fine. It doesn't matter. They screwed up. Users, search engines, and the internet in general can't function if the basic trust inherent to the HTTP protocol is undermined by an absurd interpretation of an overly broad statute that, after the fact and based solely on prosecutorial action rather than specific legislative intent, criminalizes a simple GET request after the fact.

There was no breach of AT&T's servers. Every single request that the little ******* made was responded to by their server and the information he obtained was explicitly provided to him as a result. It's as simple as that.


Lawl.... Great guy people here are defending.

He's an ******* and a troll. No one's ever denied that. Hell, you'd be hard-pressed to find many who *don't* actively dislike him. And that's being gentle.

Unfortunately, when it comes to defending civil liberties and the rule of law, far too often it requires doing so in reference to people that the vast majority of society just don't like.

This isn't a legal argument, nor is it one that advances any real understanding of the facts of the case. And it's also an absurdly bad basis for criminal law.

Case in point? I think you're an ******* who doesn't know what he's talking about (particularly on matters of logic as well as the HTTP protocol), lacks even rudimentary reading comprehension skills, and represents to a lesser extent many of the deleterious character traits Auernheimer displays. But that doesn't mean I think your interpersonal skills should be criminalized, nor does it mean I think you should be the target of spurious prosecution based on an overly flexible interpretation of the already tragically flexible Computer Fraud and Abuse Act of 1986.
 

jasvncnt

macrumors 6502
Jan 20, 2011
451
112
New Jersey
There will always be lots of other cases where you can argue that the sentence was too strict or too lenient. But that's completely pointless if you don't know all the details about these other cases, so what you argue might be completely wrong, and even if you are right about these other cases, it doesn't change this one in the slightest. Let's assume you are right and there were two rapists who got a sentence of one fifth of what they should have got. You are basically claiming that as a result, every single sentence should be reduced accordingly.


You may feel a bit different if it was you it was affecting.
 

DrDomVonDoom

macrumors 6502
May 30, 2010
314
0
Fairbanks, Ak
In that case - why aren't AT&T in the dock for leaving customer's data vulnerable in such an unprotected way. Maybe rather than giving "hackers" such harsh sentences, we should start making the people who left the vulnerabilities there in the first place accountable.

What? thats like saying don't blame a rapist or the robber.

She should have covered up or they should have locked their house.

I agree if it weren't for less *******s there would be far less thievery in this world, but thats stupid.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.