Hacker News Reader

Comment by ghshephard | Hacker News Reader

I thought weev was charged (and convicted) for hacking at AT&Ts website and extracting a bunch of people's personal information? He was certainly not engaging in what you would call "ordinary behavior."

Now, is this something that I, with a bit of idle time, curl, and awk might have done on a lark - yup. Does it scare me that I then might have been found guilty of criminal behavior? Yes. Would I have done something like publish people's personal information on Gawker? Not anymore. Would I let AT&T know personally that they had a security hole? Probably not - likely to be the messenger that would get shot. Is the NET result of this that the bad guys, who keep quiet, and make use of this information for nefarios purposes now have free rein, because nobody will mention it to AT&T? Yes. Is the NET-EFFECT of this law a reduction in security and increased number of security exploitations? Yes. Should the Law be Fixed? Yes.

View on HN

The information was available just by putting a URL into a browser and nothing more. Just change the number at the end to your iPad/iPhone ID, and the server will send you the user's information. There's no hacking or fraud involved.

Just because something is easy to do does not mean it should be legal. A person could walk into a business and find documents with private information that have been carelessly left in the open. That does not make it ok to take and publish them.

There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.

Let's not use metaphors. This isn't about federally-protected mailboxes or taking information from a private place like an office. The information was already published when AT&T put it on their public web site. Weev's activity after that was publicizing and commenting on the data.

Really, though, what's the difference between this and guessing a password? Are ICCIDs secret?

They're random, but each carrier has constraints. So they only had to search AT&T's space. http://en.wikipedia.org/wiki/Goatse_Security#AT.26T.2FiPad_e... Here's the ICCID structure http://en.wikipedia.org/wiki/ICC-ID#ICCID

Edit: To be clear, ICCID's are not private, they're printed on the outside of the SIM card.

Not exactly. He also had to change the User-agent header.

Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed.

The intent of the owner of the data does, in fact, count.

I'm not convinced that intent of the owner counts, but let's say it does. AT&T intentionally put the information on a publicly accessible server. They even distributed a script that fetched the data when it was requested, when users set up an iPad. So as far as "intent" counts, this data was intended to be accessed.

... by the user setting up that iPad.

Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.

The ICCID is not a password, it's an ID. It's not secret. In fact it's printed on the outside of the SIM card.

Most ID numbers are used as weak authentication: Driver's license numbers, SSNs, etc.

The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.

It's an ID, not an authentication token. If it helps, you can think of it as a username, not a password. It has to be transmitted in the clear or you wouldn't even know who you're talking about.

Doesnt have to be transmitted in the clear; that's exactly what TLS does; allows usernames and passwords to be transmitted with encryption so only the other party can recover them.

I do not intend for anyone to read this comment, and if you do so you are breaching my privacy.

This is all silly.

What he was doing certainly fell under the auspices of "hacking". I don't think there was any fraud. If you read my response, I make it clear it's the sort of thing I might have done if I had idle time on my hand. Well, except I probably won't anymore given the potential criminal sanctions.

Realistically, there isn't any legitimate reason for me to be doing this to AT&T's website anyways, other than idle juvenile curiosity (which I'll admit to having an abundance of).

> What he was doing certainly fell under the auspices of "hacking".

I really don't see how. He used the exact same query that AT&T's own script used. The server did not break, or expose any unexpected behavior - in fact it worked exactly as AT&T designed and intended for it to work. I don't think you can pin any of this on weev when it's clearly AT&T who screwed up and provided all their customers' data for the asking.

It was hacking because AT&T certainly didn't intend for people to be retrieving other people's personal information by randomly guessing ICCID numbers, and changing their User-agent header.

Look, I'm not arguing that this should be criminal behavior, and it certainly doesn't merit a jail term. I can't tell you how many times I've done stuff exactly like this - probably in the hundreds of times. Is it hacking when I paid $15 for a 1 week pass and then used curl to download 11 gigabytes and 10+ years of the American Journnal of Clinical Nutrition? Probably. But, to give all due credit to the AJCN, they detected my repeated queries, and redirected me to a page that asked me to wait 30 seconds between each query when doing bulk downloads.

So, there is a case where I wasn't doing the obvious (downloading through the web interface), "hacking", if you will, but the AJCN was clearly fine with it, they just wanted me to ease up a bit, and instructed me how to do so in a friendly way.

If weev is guilty of anything, it was not realizing that posting high-profile individuals names onto gawker was probably a Really Bad Idea (TM).

> It was hacking because AT&T certainly didn't intend for people to be retrieving other people's personal information by randomly guessing ICCID numbers, and changing their User-agent header.

I think the worst part about this is that it once again sends the message to companies that its OK to be this negligent. The law came in and fixed everything, the system works! Bad things were done, the bad people are in jail, full resolution.

I don't feel safer if every hacker ends up in jail. I feel safer when things are too hard to hack, or at the very least not brain dead easy to hack. This is very similar to Sony's response to repeated hackings of their customer's credit card numbers stored in plaintext: "We'll get those perpetrators!" instead of "oh we'll stop being ridiculously negligent now". The arguments of discouraging future hackers with harsh sentences don't work when 15 year olds are doing this all around the world. I want my information protected so that my money can't be stolen, not to receive retribution for it afterwards. If my bank left all the security boxes wide open for anyone to steal from, sure its still a crime to steal from them but I'd be much more pissed at the bank -- I pay them to keep that stuff safe!

I think we have too often come to accept crime followed by punishment as an ideal scenario, forgetting that sometimes there even exists the possibility of avoiding the initial crime in the first place.

Reply on news.ycombinator.com