Hacker News Reader

Comment by mirkules | Hacker News Reader

A "security researcher" posted a video with compromised accounts claiming to have deleted all the data after reporting the bugs to Apple: http://www.youtube.com/watch?v=q000_EOWy80

It is really unfortunate and irresponsible that data in the video is not obscured.

View on HN

There was no need to take all that data at all. If he was interested in security he could just set up a test account, test the vuln with that account only, and send Apple the results. Job done. I doubt Apple would bother to prosecute for that, they might even thank him. Do they pay bounties for reports on security vulnerabilities? If not they should.

Taking all the data and publishing it, and then bragging about it on youtube (!) just leaves him open to prosecution, and I imagine Apple will go after him now for publishing the data of their developers.

I'm not sure I understand the logic of publishing this, but there seems to be a mentality of braggadocio among wannabe security researchers -

1. Hack high profile website and publicise it

2. ?????

3. Profit!

I'm not sure what step 2 is.

I don't really understand the amazement of everyone after looking at this video. He's Turkish (I think), not bound by U.S law and published this video as some kind of demonstration of his capabilities as a security consultant hoping to secure a nice gig or two.

Not the brightest idea he had there but neither are the responses here auto-assuming that if the video is in English then that person must be bound by U.S law.

He's bound by any U.S. law covered in the U.S./Turkey extradition treaty.

Generally speaking countries don't extradite their own citizens.

The article below says he's UK based.

http://mashable.com/2013/07/22/security-researcher-apple-hac...

I wonder how much of the problem is due to him being foreign (Turkish?) and neither speaking English as a first language nor necessarily being immersed in the technical/legal culture of the US. There might be a use for some kind of legal/PR advisory organization for people who want to do "aggressive disclosure" or "full disclosure" instead of "responsible disclosure", while not being proper blackhats with anonymity and lulzery.

Wow. I'm speechless. This guy is really stupid or doesn't care. He can (or rather "will") get into serious legal troubles.

I'm not 100% sure, because he didn't even blank out the emails.

Agreed. What he did might have worked in 2004. But these days he's just going to end up in serious legal hot water.

How is this legal? Seems like someone should be facing charges for this...

The Computer Fraud and Abuses Act is incredibly broad, it's basically impossible to prove a vulnerability like this exists without violating it.

It's of course NOT legal … I've just reported the video to Google.

I've just reported the video to Google sounds like a dirty, dirty euphemism

It's amusing (and sad) that while the NSA monitors all emails and every single phone calls of all Americans, but still fails to detect and prevent a computer intrusion of this magnitude into Americas largest company.

The video got taken down, is there a mirror anywhere?

Reply on news.ycombinator.com