Teen hackers who live streamed cyber-attack on TfL jailed
bbc.com
bbc.com
Many years back when I used to do CS for WoW, a colleague of mine liked to say that the only reason some kids shit-talk the way they do is because it's online and if they tried it in person they'd get punched in the face.
These kids discovered that their actions have consequences to them in person and not just someone being upset with them remotely.
As a parent now (but oldest is only 5), it's stories like this which make me determined remain aware of the kind of stuff my kids get up to and continually explain that actions have consequences, even if those consequences are seemingly as trivial as making someone else feel shit about themselves.
I wonder if maybe 10 or so years from now, after these kids have actually reached decent emotional maturity, that they'll look back at their actions and think about how stupidly reckless and needlessly destructive they were, to both others and their own lives.
It was just simpler back then. There was no aslr, no hardware level protection from execution, traffic was all plaintext, switches didn't exist, or maybe they did but just nobody used them and everything on every network was just one giant collision domain, developers by and large didn't even think about securing software outside of DRM, and absolutely nobody understood the basic premise that someone on the phone may be lying to your business to get access to things they want.
The skillset that made you a 1337 h4x0r in the 90's makes you a mediocre sysadmin these days.
i can get on YT or some AI and find how to do virtually all of the stuff you mentioned, but back then you had to roll your own and figure it out yourself
but i am generally in alignment with the idea that they're not getting gub'mnt jobs now. 1) how could you trust them? and 2) there is a global glut of talent, including laid-off FAANG / big-org talent that you could scoop up.
why take a risk with an idiot who can't keep his ego in check long enough to maintain OpSec when you can hire a senior security engineer just laid off from Oracle with an MIT pedigree? 30 years ago the 133t haxor types were rare, but now they're churning out cybersecurity grads to the point of oversaturation.
It's ok that we disagree though.
I expect to find them at an MSP with a firm equal opportunities policy.
Basically everything that fits outside of existing patterns is illegal one way or another. Only people who are naïve to these consequences will ever be motivated to make these things.
This is just a disingenuous take.
Tornado Cash founder didn't get criminally convicted for "a genius way go use cryptography to send anonymous payments." He got convicted for operating a money-laundering service.
The fact that his service utilized "a genius way to use cryptography to send anonymous payments" is entirely orthogonal to the actual crime he got in trouble for. He would have gotten convicted just the same regardless of the cryptography usage, because the actual crime here was operating a money-laundering service.
Edit: correction, you didn't even say I was the one who blew things up. You just said someone blew up things with my new explosives. Which is exactly what I'm talking about. If guns weren't already old technology, the government would hold Mr Smith & Mr Wesson accountable for every gun death.
I would trust WhatsApp before I trust telegram.
Where's your list of things that nobody got in trouble for? Presumably you didn't include that because a trillion things happen every day without anyone getting arrested for them. Amazing. It turns out that not everything is illegal.
> Jubair has 22 previous convictions related to hacking, fraud and harassment.
There’s more to what was going on here and none of us is really qualified to diagnose the psychology behind it from the details. I hope they can find some peace later in life because they are obviously not lacking ambition or ability
getting in is often the easy part. getting out, undetected, with stuff that matters, is the hard part.
If you hack into a system and leave a note "I got into your system, I win", more power to you. If you do damage, go to prison.
This is the #1 reason bots exist. We can't just punch them down anymore, we're flagged as bad people.
I've seen people have this opinion many times before and I don't get it. People talk shit in real life all the time and it's a much worse situation in real life because they might punch you in the face.
This is why I don't mind online shit-talking, because it isn't going to escalate into a fight. In real life it might and imo the teens are more likely to escalate it especially if they are in a group.
Being kinda big I might even stand a chance against one - unless they had a knife, which they probably IME did - but there was always at least 5 of the "lonely lost boys," at least one carrying a baseball bat everywhere.
Weird, somehow without significant parental surveillance or explicit explanation I somehow managed to _not_ do much of the awful stuff my acquaintances with much more engaged parents did.
Must have been my autism, I guess.
> gained access to the data by tricking a phone help desk worker.
The whole edifice was built on a helpful, possibly overworked and possibly harassed help desk worker? The end result is that two kids end up in jail. It could have been so different, and better. What they did was wrong for sure, and has real-world consequences for those whose information was leaked. But, when I look at the contingencies that led to the outcome, it really does depress me.
"all for the want of a nail"
What does this have to do with anything in this article.
/s
Take it up with lawyers.
In your telling, autism is an excuse when they abuse others, because they cant help themselves. But, when it is for their benefit, the same person actually displays higher social skills.
Autistic people can be highly sociable by explicitly learning social skills. They can also learn social skills in order to manipulate others, as is the case here.
Lastly, explaining how a medical condition whose stereotypes seem to make others think those with it would not be capable of committing a crime were in fact capable of committing that crime in no ways is the same as excusing the crime.
Social engineering is just conman pressure tactics or hard sales tactics. It's so simple you can train your average stay at home mom or "hustle culture" bro to do it for Amway or similar in an afternoon.
It requires zero social skills. You aren't "Charming" the tech support, you are just badgering them and waiting until they do the normal human thing of trying to be helpful.
Exactly, you just ask normally. There’s no need for any special tricks. What would a real employee who can’t log into their account say on the phone? Just say that.
It kept https://en.wikipedia.org/wiki/Gary_McKinnon from being extradicted to the USA. Apparently the courts don't accept "your opsec is shit and I got in with default passwords", but they do accept "I have autism"
Let's try it in action:
- "Mr Wallace, we have several credible reports that you harrassed TV production staff by going around with no underpants on, and finding excuses to take your trousers down. What do you say to that?"
- "Did I mention I have autism?"
Ah.. I hate when stereotypes play out like this. It's always those single children.
(like a group that takes black hat hackers to white hat hacker projects?)
kids with like anti-social or aggressive tendencies plus maybe some tech "skillz"
a little belligerent, sure, and sometimes judges will push da yout with minor court issues into the service, but the army ain't recruiting murders and serious gangbangers, and for good reason
Pity we can't do the same as the Russians and just point them at geopolitical adversaries. Russian viruses have been known to uninstall themselves if they detect Russian language configured on the device.
They are teenagers. They don't belong in prison, they belong in an any cybercrime agency.
You don't get to argue that your crime wouldn't have been so bad if your victims weren't incompetent.
It would definitely come into play if TfL were suing Jubair & Flowers, but it's not really relevant in a criminal situation like this.
In any case you can't go out of your way to make the situation worse with a sort of sly understanding that because you're the victim the other person will wind up on the hook for it. They may wind up on the hook for it if you are a huge and exceptionally well connected entity and the other side is a nobody, but that's not how the system is supposed to work and it's not how it does work when the parties are on equal legal footing.
Such an infantilising and surveillance-normalizing slant. Why is it worthy of mention that an adult spent time unsupervised? (Sure, one of them was 17 at the time, but that didn't stop them from waiting until he was 18 to charge him)