Hacker News Reader

Comment by stryk | Hacker News Reader

OK, so what were they going to do with the evil cracker's passwords.... steal from him? I'm no lawyer but how in the hell is this not a felony? They intentionally distributed malware that steals passwords. Jesus christ, some people, man... some people...

View on HN

Not only that, but such any "evidence" acquired by this route would surely be inadmissible. You aren't allowed to break the law just because you think someone else might have done it first.

FYI there are only some countries where evidence is inadmissible solely because it is aquired illegaly (eg in the United States, but not most of Europe AFAIK). Not that I in any way condone what this company have done.

Even in the US, the exclusionary rule only protects you against illegal evidence acquisition by the government. If a private party illegally gathers evidence against you (without any government prompting), that is admissible. See for instance Burdeau v. McDowell [1]. Another interesting case on this topic is Sackler v. Sackler [2], where the New York State Court of Appeals held that evidence illegally gathered by private investigators (working for one of the divorcing spouses) was admissible in divorce proceedings.

[1] https://scholar.google.com/scholar_case?case=107551340662323...

[2] https://scholar.google.com/scholar_case?case=641943334909742...

That's true. However, using credentials harvested in this way is almost certainly going to constitute unauthorised access of a computer system and a breach of the Computer Misuse Act.

  OK, so what were they going to do with the evil
  cracker's passwords.... steal from him?

Presumably get access to invitation-only torrent sites? To distribute more malware / gather IP addresses for prosecution?

By giving the same malware to all their customers??? And all those people are supposed to just take their word for it that they didn't use it on everyone else? This is about as non-frivolous as a lawsuit can get. if I'm the customers of this product I would sue them into the ground, there's no way they take this to court. And with that public statement they made flat-out admitting to it's use that's evidence at this studio's boss' criminal proceedings. What kind of goddamned morons OK the use of a tactic like this?

Get their Paypal credentials and pay for the game using fake purchases?

And then get shutdown by PayPal for violating the ToS by transferring money into your own account unauthorized. How would that help?

Threaten them personally. By locking them out of accounts or worse. It sounds like they were going after an individual extrajudicially.

Reading the linked articles above it says they used it to get into an invite-only site to figure out exactly who the cracker was. They don't say exactly why they want to do that.

Reply on news.ycombinator.com