Whole thing was incredibly fucked up.
Interesting to see how much more thorough the Wikipedia page is now.
> "Parson described the journalist as a “perpetrator” who “took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators” in an “attempt to steal personal information and harm Missourians.”"
⸻
1. Within some limitations: certain types of creative works, most notably typefaces, are excluded from copyright law, although it was determined that digital font files that describe the outlines of the characters are programs and thus eligible for copyright. Bitmap font files on the other hand, as an expression of a typeface design are not eligible for copyright.
2. Although works created by federal employees as part of their job are explicitly excluded from copyright protection.
3. Note though, that the timing of the registration impacts what you can sue for. If registration takes place after the infringement you can only sue for actual damages, but if it takes place before the infringement you can sue for punitive damages.⁴
4. I should add the obligatory disclaimers that all of the above only describes US copyright law and also I’m not a lawyer (although I did used to watch Law and Order a lot) so everything in this comment could quite likely be completely wrong.
>The password to this database was stored unencrypted in an executable file of the middleware product and was the same for all Modern Solution customers
>Modern Solution then reported the security researcher to the police, who searched his home and confiscated his work equipment
>The programmer has thus been sentenced to a fine of 3,000 euros and must bear the costs of the proceedings
X-Crawl-Reason: Finding spare license plates, throttled ONLY to prevent service disruption. To the best of my knowledge, [legalese claiming good faith and compliance to all applicable laws]
As a direct result, anything and everything can be a crime (e.g. violating a private company's Terms & Conditions), and the punishments are completely disproportionate to the actual criminality.
See the AT&T/iPad data leak, where AT&T were leaking private information on the internet with no security checks at all. Someone found it, told the press, who in turn told AT&T, but the FBI still investigated it as a "crime", raided their home, charged them with "conspiracy to access a computer without authorization." AT&T go no punishment at all.
See the AT&T/iPad data leak, where AT&T were leaking private information on the internet with no security checks at all. Someone found it, told the press, who in turn told AT&T, but the FBI still investigated it as a "crime", raided their home, charged them with "conspiracy to access a computer without authorization." AT&T go no punishment at all.
Should they have had better security? Yes. Was the vulnerability extremely basic? Yes. Doesn't change much, a vulnerability was used to dump a bunch of private data.
That's not nuance; the information was publically available on the internet without any security. Even search engines had indexed it before it was patched.
> They then went ahead and scraped as much as they could.
They told the press instead of releasing it.
> AT&T did not leak the information, Andrew did!
So AT&T dumping it all onto the open internet without any security isn't culpable, but the person who let the press know that their information was available to everyone is. That's quite an interesting take.
I'm struggling to see the nuance... You just repeated back what I already said, but added that you dislike the person personally, which is absolutely fine, but we're talking about miscarriages of justice not running a popularity contest. If you feel like they committed other crimes (which they likely did per Wikipedia), that is unrelated to THIS supposed crime.
> Was the vulnerability extremely basic? Yes.
There was no vulnerability. You just needed to request a record from a public web-server, which the server happily provided with no extra steps.
Let me ask this: When you request e.g. google.com, and they return a HTTP response, why is that not a "vulnerability?" Because we'd both agree it objectively is not. So then, why, when AT&T provides a URL with information they're meant to keep private but available to the public, and you then request it, that is suddenly a "vulnerability?"
Here is the actual URL you needed to call:
https://dcp2.att.com/OEPNDClient/openPage?IMEI=0&ICCID=<consecutive id>
You just needed to take any iPad's ICC ID and +1 for the next customer's record. So what is the "vulnerability?" Being able to count consecutively?
It's an easy trap to fall into (we all want consequences for shitty people), but it's also a blurry line to hold.
"First they came…"
"Nonprofit hires woman, but she quits after a few days, asks for pay for that time; they refuse, and things get worse from there. But! They don’t turn off her email access to a board member’s email. She and a friend comb through the account, download internal documents, and then ask for a lot of money. Federal crime? Third Circuit: Not until they actually revoked her access."