Hacker News Reader

Comment by kreddor | Hacker News Reader

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

That's quite a feat.

> Rockstar Games alone told the court that the hack cost it $5m to recover from plus thousands of hours of staff time.

Either the kid is a genius or Rockstar really don't value their security much. Or maybe a bit of both?

View on HN

> That's quite a feat.

Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?

The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access.

I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.

To be fair: it is hard to not be around internet connected devices now

This is a really great angle and perspective to add in - I agree a noted habit / trend / short-hand in “severity” sometimes with technical subjects. I read through and also have heard some similar routine prep stories. Unusual? Absolutely!

Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are.

So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?

> Add that in with, reportedly a physical violence time in life

Throwing an autistic person into prison will do that. The child abuse that autistic people often receive in their childhood will do that

> the persistent threat maybe can heal out of it?

Or maybe just give them a job instead of throwing them in a padded cell for life?

I hope they worked out a deal at least

> That's quite a feat.

> makes him any more of a monster

You're attacking a straw man.

Saying something is "a feat" is a long way from saying they're a monster.

The statement in the article would sound to a non-technical audience like this guy is some sort of hacking magician, and I'm sure nobody minds this perception for the reason I mentioned above.

I'm just providing a counterpoint as well as a reason why there's an incentive to make this guy sound more skilled & evil than he really is.

> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?

Installing it is nothing: 2 touches away. But using this crappy Android experience (where the on screen keyboard obscures half of your terminal) shows talent and dedication.

I imagine this is where the Firestick and TV came in - screencast termux or ConnectBot to the TV so you can use the phone in horizontal mode as a larger keyboard.

> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device

Installing a Linux environment or SSH client on a Fire Stick in a hotel without access to a laptop?

Not familiar with Firesticks- is there an app in their App Store for SSH?

Fire devices just run a flavor of Android, without Google Play Services. Getting SSH on there is trivial, especially when rooted.

I would like to install SSH and root a Fire Stick with my phone. Where should I start?

Second result on Kagi: https://www.firesticktricks.com/install-apk-on-firestick-fro... ?

This would at least give you the ability to install an SSH or RDP client since those don't even require root.

From TFA, and given prior hacks, he's very skilled.

Someone should hire him as a white hat. Maybe they have some kind of custodial guardianship where the employer can monitor him staying clean.

It's tough though, how do you know that they won't use those skills against you? The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.

Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well.

Hopefully this story will have a somewhat happy ending, because it seems to not end yet.

He'd need a dedicated handler, and even then judging from the article's portrayal he seems like a hopelessly unmanageable type. He'd fit in with a modern-day A-team, come to think of it.

Could set him to work on hacking official state enemies, but you'd have to expect that he'd still engage in side-projects against whoever pissed him off or he had contempt for.

It’s not going to happen. He’s going to be closely supervised in a hospital indefinitely.

> The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.

Admitting you will continue to fight evil is not evil.

That would be interested, but is impossible as long as they refuse to avoid crime and state that they plan to commit more at the first opportunity

That wouldn't work, you could never trust him at all, as he's expressed zero remorse and actually intent to continue to do crime, and is apparently very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable as a white hat hacker

> very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable

This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary.

Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

>>> The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

This is exactly what I was referring to. We agree.

> Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

Very true.

Having seen that play out in real life before, I don't think he'd be as much of an asset as a liability. The problem with white hats is they need to have an interest in following some set of rules. With this guy it sounds more like his rule set is defined by whatever he finds interesting with little concern for legality or what others might find acceptable.

It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.

I’ve seen the opposite, the worthless manager, way more than the asshole genius.

To be fair, there are very few actual geniuses and a lot more unremarkable assholes.

How about the British intelligence apparatus? Seems like a person they would be very interested in acquiring.

Also seems like the sort of person who would leak everything, and not just for some principled whistleblower reasons, but "for teh lulz" or whatever.

Trust is more important than ability.

Maybe the only thing more dangerous than holding someone in a "hospital" as a sentence is to allow an employer to decide if they should be allowed out or sent back to serve their life sentence. It's just as bad as H-1 visas, or allowing illegal aliens into the USA with babies who are not given US citizenship. (I am not taking sides on whether we should give US citizenship to those people, deport them, or what. I am pointing out that making someone the slave of their employer is bad for society.)

No company will do this because you can hire competent, non violent white hat hackers that don't need monitoring.

And has no empathy, which makes him a lot more dangerous.

autism doesn't mean he doesn't have emotions

A valid diagnosis of one condition doesn’t preclude a litany of seriously dangerous other ones, either, correct?

You might as well say "He has psoriasis, he might also be an axe murderer." No, one fact doesn't preclude the existence of other facts, very good. That doesn't mean that making stigmatising connections is reasonable.

There was no connection made, GP merely pointed out their observation based on what he has done so far

He's a kid that "found" some pictures of an upcoming game, using dodgy means. But these pictures were publicly accessible, he didn't deceive an actual human to get them. Making them hidden, but public was a mistake by the company.

The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence)

During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places.

But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...)

A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral).

I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do.

Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.

The overall treatment of children, especially teenagers, in society is absolutely shocking. Literally they are like slaves. As a child, the family can be the single most tyrannical thing we will ever experience in our lifetimes. It can be a mini totalitarian dictatorship if you are unlucky to have bad parents.

In 100-200 years time from now people will be talking about this, just as we look back to barbaric times in the past now.

Empathy, not emotions.

Empathy: the ability to understand and share the feelings of another.

I don't know about you, but if I said someone doesn't have empathy I would think that I'm the one lacking it, since I can't possibly imagine understanding that person or their feelings.

I feel empathetic to you.

Autism doesn't preclude empathy at all. In fact, I would say it augments it once the other person's feelings are understood. What's generally lacking is realising the other is feeling in a certain way until it's explained to them or they have otherwise rationalised that feeling. Which, relatively ironically, will never be enough to make a neurotypical person feel empathy.

I don’t understand why you explain this to me. I just answered empty vs emotion. I am not discussing anything.

He may have emotions but certainly he doesn't care about those of others and the damage he can provoke. He actually wants to continue to be a criminal.

FTA: A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."

The guy needs help because he's autistic, and watched closely because he's also a sociopath.

Plenty of people want to commit crimes that aren't sociopaths.

"empathy impairment" is a fundamental feature of autism. It's not stigma. It'a not universal, but it is a major part of why it's a disorder in the first place.

As someone with autism, I lack empathy for (most) fake situations. Once I realized therapists and their ilk were lying about sad stories, I stopped having empathy for those sad situations.

Ditto for fake news stories.

Only mentally unfit people can pass a therapist's tests and be empathetic for people they know do not exist.

I'm not saying what you're saying is invalid, but I do have empathy for people that don't exist. It's called fiction and I find it quite enjoyable.

Oof, hopethis makes parent think.

Let's flip this around: think about what you just said.

you seem to be implying that feeling empathy for characters in work of fiction is clearly "normal" if somebody doesn't think that way it should give them pause. What you said may be construed as "hey you freak, if you only think for a moment you'll obviously notice that it's perfectly normal to feel empathy for fictional people, after all story telling is such a fundamental human feature that if you're not feeling that way there must be something wrong with you or at the very least it's you're fault because you're not thinking hard enough about that".

Of course, I'm not saying you actually believe that or accuse GP of that, but words and tone matters and can hurt. Think about that

Ummm feeling empathy for fictional characters is something that should be considered normal. If you find yourself not able to do that, you should understand that you may not be neurotypical and should get a diagnosis to understand what other blindspots you have in life that you should be aware of.

And that's fine. Does it make anyone less empathetic if they don't though? At least where it matters - where someone else's feelings are involved vs. literally no one else's (since they don't actually exist).

True.

I should have added: I also dislike being manipulated. I fail silly tests at work because I find them demeaning. If you want to know what I do on the job, drop by and watch.

This is relevant to psychological evaluations because the tests are so silly and contrived, and go on for so long, that I lose patience with them.

TL;DR: that's an outdated idea with an ever-growing body of research refuting it

Autistic and neurotypical people can empathize with others like them, but have trouble between the groups [1]. This is called the "double-empathy problem" by the paper which proposed the idea [2]. More recent papers explore subjects such as information transfer accuracy [3] with the same results: autistic participants understand each other perfectly well when allowed to use their preferred means of communication, as do neurotypicals. However, the two groups have trouble understanding each other. Further work extends this to a generalized model with extremely unsurprising results: people tend to be closer with people who think like them [4].

[1] https://link.springer.com/article/10.1007/s10803-015-2662-8

[2] https://kar.kent.ac.uk/62639/

[3] https://journals.sagepub.com/doi/10.1177/1362361320919286

[4] https://academic.oup.com/scan/article/16/1-2/222/5940490

No, but empathy is something autistic people famously struggle with

is it the same for male and female autists?

Each hack was going into a company Slack server and saying "hell o i am the admin gibe me password". I'm not impressed.

Personally, I think that a skilled exploiter is the one who finds such an easy loophole and exploits it efficiently and first; not the one who writes the most impressive code or finds the deepest algorithmic backdoor. I respect social engineering as much as anything when it comes to this domain.

An genius would not only pull of the heist but get away with it.

There is no physical evidence: DNA, fingerprints.

shouldn't they at least try to use this kid for good instead of locking him up ? but then who know maybe a 3 letter gov agency will take him to a bunker somewhere

He's violent and uncooperative:

> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.

The TLA aren't hurting for talent these days either.

"Use" implies control / coercion, given that this guy doesn't seem to respect authority, that's not going to work. You can't make anyone work for you or "do good".

Conversely, it seems pretty easy to pay people to do bad things.

They have lions in zoos and circus for decades, just saying

If he didn't have a keyboard and typed on his phone like I do, they could also say that he "hacked them using only his thumbs".

Reply on news.ycombinator.com