Hacker News Reader

Comment by personjerry | Hacker News Reader

> with pretty much no skill required

Seriously? I know like none of the tools or terms they used, like wtf is shodan?

In general the author doesn't seem to follow the white hat guidelines, and I'd be worried what they've done is quite illegal (possibly on a federal level if the nofly list is so secret)

View on HN

maia[0] (it/she pronouns) is almost certainly aware of that this is illegal, and has been indicted by a grand jury for other government hacks.

shodan[1] is a search engine that deals in hosts and ip addresses rather than web pages, and is a goldmine for finding everything from exposed ip webcams to jenkins instances.

[0]: https://en.wikipedia.org/wiki/Maia_arson_crimew

[1]: https://www.shodan.io/

US law is neither a universal law nor an international one.

Accessing computer systems owned by a US company based in the US might constitute a violation of US law, but the hacker is based in Switzerland - where US law does not apply.

As you can see in the linked Wikipedia article, accessing these systems is probably not illegal in Switzerland, thus, for all intents and purposes, no crime was committed.

Here's an indictment from 2019 for similar activities. It's a crime in the U.S., thus prosecutable in the U.S. The question is whether Swiss authorities cooperate, not the jurisdiction.

https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...

The jurisdiction is quite questionable. If someone in north Korea would decide I'm guilty of breaking some bizarre law, I couldn't care less. Why would a Swiss citizen care about what the united states think is a crime?

It's easier to get extradited to the US than to North Korea

In fact I don't think any countries will extradite you to North Korea. There's plenty (including many in the neighborhood of Switzerland) that extradite to the US for at least some crimes.

Switzerland has assisted the USA in going after them, unless I'm missing something.

(I am open to missing something here)

According to its Wikipedia page [1], Switzerland doesn't extradite their nationals (including maia) without consent. maia might be trapped in Switzerland, but as long as it stays there the US can't get to it.

[1]: https://en.wikipedia.org/wiki/Maia_arson_crimew

And also it's been confined to Switzerland for at least a couple years now; committing US federal crimes isn't a new circumstance for it.

Legalities aside, it's morally wrong to hack a server, disregard reasonable disclosure, and publish (even to a selected group) an in-depth list of personal information; all for political reasons! (at least going off what their Wikipedia page describes as their motivations).

>- where US law does not apply.

Us law applies wherever they want. Very, very few governments will refuse a request....it's too expensive in the long run.

"Look at you, hacker. A pathetic creature of meat and bone. Panting and sweating as you run through my corridors. How can you challenge a perfect immortal machine?" — Shodan

Anyone even tangentially involved in infosec knows shodan though... so in that context everything done in the article was trivial.

You actually have most likely come across mentions of shodan if you use HN often. It is that search engine for insecure systems like exposed/insecure webcams.

I know those tools and i agree. There's no skill required to use a search engine for compromised/misconducted servers to find a compromised/misconfigured server and then pile around on it. I don't think it's so good to publish it instead of reporting to the airline but I'm pretty sure that is for political reasons considering the author's political views.

Hosting public facing Jenkins should be illegal tbh

I think she used publicly available common tools in this regard without specific knowledge of the airline industry. Even searching the internet is a special skill for those never used a computer or held a smartphone but is a no brainer for those never created a search engine algorithm.

As a nontechnical person who enjoys this stuff, also wasn't familiar. Anyone have a good rec for a starter guide for a nontechnical person to be able to do similar research (albeit in ideally more of a white hat approach)?

Reply on news.ycombinator.com