Jury convicts NY man accused of AT&T-iPad hacking

Hacked is a very loaded word. In some circles, it means "did a brilliant work cleverly and ingeniously using some stuff not always as it was intended to be used", in others it means "did some computer voodoo and stole my data".

Searching for vulnerabilities on a public sites containing live private data is not a business that one should approach lightly. I personally wouldn't do it without being specifically asked for it. But even if one does, taking then massive amount of data is definitely not what a whitehat researcher does.

>>> but does anyone really believe Auernheimer did anything illegal by manually typing in an address?

As far as I know, he didn't manually type an address. He wrote a script that bruteforced ID protection and downloaded a massive list of private emails. Do I have a wrong information? How is it different from bruteforcing a weak password on an email account and copying all the emails - do you think this is legitimate too and that information was public?

It is not. As far as I can see in reports, however, this is not what Andrew Auernheimer did. He wrote a tool that bruteforces massive amounts of IDs and downloaded massive number of private emails, which were not public data. The fact the it was easy for him is irrelevant, just as the fact that somebody had weak password is irrelevant if you bruteforce it and access his bank or email account. If you do that - you'll probably be liable for unauthorized access, and excuse "he had a weak password, so it's like public information" is not going to work.

He knew that he was obtaining sensitive information that he shouldn't have been able to access (through at&t's negligence), however instead of following any sort of responsible disclosure, and reporting the incident to the company, he goes to IRC and talks openly about trying to use the information to benefit himself through insider trading and then gives the information to Gawker (again instead of contacting AT&T).

He probably could have had the charges dropped, had he composed his actions differently.

There wasn't "a couple of private photos". If Facebook protected it with a random key, and you noticed the key generator was flawed so knowing I live in, say, Montana you could bruteforce this generator in 3 days, and you wrote a script that indeed in three days bruteforced the key - yes, it would be "hacking Facebook". And if you took these photos and 100K of other photos and, saying nothing to facebook or me, went to the press - yes, it would expose you to criminal charges. If you intention was good, you would have stopped with one photo and notified facebook and/or myself and you would not write a tool to harvest and keep 100K of them. Creating and using such tool is what got them into trouble, not visiting some page or discovering some flaw. If you see neighbors door is open, you're not criminal. If you go in and go through personal possessions, because the door was open - you are. Selling has nothing to do with this - if you use it not for money but for lulz it's still the same. The evil is not in the money - the evil is in going where you do not belong and taking things that are not yours to take.

What about if you walk around and peek under everyone's coat to see if they forgot to wear pants?

What gives you the right to sell that data? What gives you the rights to what a reasonable person would understand to be sensitive and private data? You can't look at this from just a technical standpoint, but also the intent of the people involved.

Your question about forgetting to wear pants is a perfect example. In California, it's legal depending on the intent. The mere act is not a crime without intent, and looking at one without the other is pointless.

> Information whether email is valid or not was made publicly available by AT&T

By mistake. They left that hole open by mistake. I just re-read the details to be sure; the clear intention of the developer was that the email address would be retrieved (keyed on the SIM ID) to pre-populate a sign-in field for the user. That CCID is not meaningfully useful to the user. This API was clearly never intended as a "validation" mechanism, and for you to claim so is flatly ridiculous. It was a security hole, and a dumb one, and something AT&T should be held liable for if someone suffered damages.

But for you to claim that its very existence makes it legal to exploit to retrieve addresses of third party users is just insane, sorry. That's the kind of logic Weev relied on, and it's going to send him to jail. And rightly so: the rest of us in society don't particularly want jokers like you running around free looking to steal our email addresses.

To be fair, I doubt most "mainstream media" (ie. CNN, WSJ, NYT, etc.) would have noticed/cared about this information.

"Delete that" meaning remove the editorializing from the title, which they indeed have (not delete your question.)

My apologies, your comment seemed more sarcastic to me when I first read it for some reason. In any case, I hope that was helpful.

Couple that with how he reported it, the script he used to download the data, and everything else he did. You can't look at each action in isolation.

If I discovered that someone hadn't locked a filing cabinet, and then I rifled through it, found a whole bunch of names and social security numbers, recorded all of them, and then went to talk to a news organization with this list without ever notifying the people whose filing cabinet I'd gone through, do you think that would be OK?

Because that's pretty much the equivalent of what happened here. You say "AT&T put this information on a public interface and relied on obscurity of serial numbers to protect it"; this phrasing puts the blame on AT&T. Yes, they should not have done that. But that's about equivalent to forgetting to lock a file cabinet; it's a mistake that someone made. Weev then took advantage of that mistake to violate the privacy of thousands of people, providing their personal information to a news organization.

Now, I don't necessarily think that they should have been convicted of everything they were convicted of. Unless there are facts that I haven't seen, they haven't come anywhere close to committing identity theft. But you do have to admit that Weev did not exactly handle this responsibly, and did invade people's privacy.

It does not matter on what AT&T relied. As long as it was clear that this information is not intended to be public and he was doing something the system was not intended to do and circumventing access controls, however easy it was - and anybody with half a brain would know it was not intended to be public and he is circumventing access controls - the only right thing to do was to notify the admins, delete all the data and stay away. Bruteforcing the access and keeping the massive amount of data could not lead to any other outcome but him being considered a criminal.

This is old, but some people seem to misunderstand it still. If your neighbor has a weak lock, telling him about it is OK. Picking the lock, coming in and going through his private things, while keeping some copies of his bank statements, credit card numbers, etc. - is not OK and has a high chance of landing you in jail. And no, "he had a sucky lock" is not a good defense. You knew it wasn't your property and it wasn't a public place.

You are ignoring or ignorant of the other facts of the case and his other actions. Looking solely at the technical side ignores realities. Furthermore gaining access to sensitive data does not install you with special rights for that data.

I can't tell if you are trolling or are actually asking me how to Google for more info on this guy's case?