Hacker News Reader

Comment by JohnMakin | Hacker News Reader

They were accessing a system via internal endpoints not released to the public. They were also using stolen credentials a former employee of songbird brought over to ticketmaster, and accessed devices using stolen credentials. If that isn't "hacking" then the word has lost all meaning.

https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...

View on HN

IANAL but this is textbook unauthorized access of a computer as has been drilled into me in every boring corporate training I do for my security work and thus is "hacking".

Telling the judge "but I wasn't wearing my black hoodie while listening to K-pop while doing it!" is going to be about as effective as telling the judge the legal code can't be trusted because it's not backed by a CI/CD system adhering to Agile practices. (Which a non-trivial number of Hacker News posters probably think would work.)

A former employee taking IP with them is usually considered to be IP theft more than hacking, and that's basically what happened.

Two things can be true at once - he stole credentials, and then used those credentials to gain unauthorized access to multiple systems (hacking).

As far as credentials being intellectual property, that doesn't sound quite right but I'm not an IP lawyer and it doesn't really matter.

Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way.

> Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way.

If he did that it'd be prosecutable as breaking and entering, and it's perfectly reasonable to use the term "hacking" as the digital counterpart for "breaking and entering".

EDIT: It also looks like you work at Ticketmaster, or at least used to? If that's the case, that's a rather weird thing not to mention in the context of this thread.

To be clear: I agree it was hacking. I'm saying that aside from the IP theft angle, this kind of hacking doesn't usually get heavy handed consequences for individuals. AFAIK, the individual involved was not prosecuted criminally.

I used to work at Ticketmaster. I don't anymore and I didn't at the time of the incident, so it didn't seem relevant to the discussion.

Let's put it this way - if he held on to his badge/keys to enter a building and used these credentials to access a computer system without authorization, then yes, it would be called hacking. The word hacking gets thrown around in dumb contexts sometimes, but this is perhaps the clearest use of the word "hacking" I can think of.

Like, what would make this hacking to you? The way an attacker gains credentials to access a system does not really matter. If he socially engineered these credentials, it'd still be hacking.

Let's put it this way: before there were even laws against hacking, if you had a key you shouldn't have and you used to get into a building and steal some IP, if you were charged, it would be with trespass or breaking & entering, not hacking.

The term is appropriate, but it tends to evoke ideas of serious crimes, when hacking can be much more innocuous acts that often don't see much in the way of prosecution.

Reply on news.ycombinator.com