Hacker Barnaby Jack has died | Hacker News Reader

Hacker Barnaby Jack has died

reuters.com

236 pointscyanbane82 comments

Barnaby Jack was part of the soul of the software security community. He had so many friends. Please today remember that he was a real human being, and that he had friends who might read HN.

Indeed. It's rather tasteless and crass to revert to snark and conspiracies on this thread.

Whether conspiracy theories are warranted or not, it would be an error of logic to imply snark and conspiracy are equivalent.

No one is suggesting that they are equivalent; they're equally undesirable. Snark is, however, the typical response seen here to the also undesirable conspiracy theory.

Exactly. I mentioned on another submission, that got killed, that it would be a great tribute to the man if one of his friends/associates that new his work well could fill in and give his presentation at the conference. With so little time, I now think that might be unreasonable. Maybe use the time slot to hand out the slides, raise a toast and share some stories. The subject of his talk is incredibly important and should be distributed.

After minor digging, here is his blog about medical device hacking vs. the hollywood version:

http://blog.ioactive.com/2013/02/broken-hearts-how-plausible...

Interesting tidbit from the blog-The CEO's father has a pacemaker.

Blackhat will leave his slot open to commemorate.

https://www.blackhat.com/latestintel/07262013-remembering-ba...

Barnaby Jack "jackpotting" an ATM at BlackHat USA 2010: http://www.youtube.com/watch?v=v-dS4UFomv0&t=5m47s

In the last couple years he'd become (justifiably) famous for stunt hacks like this, but I think it's important to remember that the guy was the genuine article, genuinely talented, old school in the truest sense. Here's I think a better starting point for his work. Read it on the mailing list, like we all did:

http://marc.info/?l=vuln-dev&m=106331197530352&w=2

http://www.phrack.org/issues.html?issue=55&id=15

Please do not make comments about conspiracy theories. This event is not suspicious.

Citation?

Until there is a cause of death from a thorough autopsy, I think it's too early to say whether this is suspicious or not. I can't believe you are being upvoted for saying this.

Russia Today certainly knows how to state it for maximum effect:

"Hacker dies days before he was to reveal how to remotely kill pacemaker patients"

http://rt.com/usa/hacker-pacemaker-barnaby-jack-639/

Edit: It seems very relevant to keep in mind that this is not the first time someone (or even Jack in particular) had demoed remote kill switch functionality for human beings. http://www.bloomberg.com/news/2012-02-29/mcafee-hacker-says-...

The kind of thing they're referring to is commonplace in Russia, unfortunately, so you can't exactly blame them for thinking that: http://en.wikipedia.org/wiki/List_of_journalists_killed_in_R...

> I can't believe you are being upvoted for saying this.

Perhaps consider that many posters and readers here knew him in person.

For those of you who knew him, do you think he personally would have wanted a day without people being suspicious of their world or comments about conspiracy theories on the internet?

Because he sounds to me like a guy who really loved busting people's assumptions, in your face, and without apology.

Death was not suspicious. Confirmed by family. I'd rather not say anything more than that.

One family member expressed concern to me about his death.

(Note: concern, I am not claiming there was some conspiracy theory)

> Until there is a cause of death from a thorough autopsy

Even with that in mind: technology is probably sufficiently advanced today to be able to not leave any traces, if the budget is there.

Plus, don't forget that Hastings [1] was cremated without his family asking for it (there is always one way or another to make traces disappear).

[1] http://en.wikipedia.org/wiki/Michael_Hastings_%28journalist%...

Actually without knowing the autopsy results it is the opposite - very suspicious. 35 years old people don't just die at home. Let's hope the results will not be that he died of some kind of drug "overdose".

If you hear hoof-beats, you'd expect a horse, not a zebra (unless you are on a Safari).

It's not that uncommon that 35 year old people die at home. Common causes are suicide, unintentional overdose, aneurysm (brain, AAA), arrhythmia, a fall.

My friend died last year at age 38. If the cause of death is not released it's usually drug or alcohol related.

Or the code word for something bad "suddenly".

My brother died, unexpectedly, at 36. He'd had an apparently long running problem with prescription pills that nobody knew about. I had an aunt (sort of, she died before I was born) who was 25 and went to lie down in the bedroom because she felt unwell; she had an undetected congenital defect in her aorta and bled to death internally. My father in law died of a heart attack at 27 because he had congenital familial hypercholesterolimia. His elder brother died a year later by electrocution.

Young people do just die for unobvious reasons, both to the (comparatively) famous and the obscure.

35 year-olds most certainly do die at home. The mechanism of death could have been something highly personal and highly embarrassing, nothing to do with drugs or conspiracies.

I once learned more than I bargained for when I asked too many questions at a friend's funeral. If his close family members don't want to elaborate on the circumstances surrounding his death, it is probably best not to press them.

Whenever people won't talk about how someone died, I (like most people) immediately assume auto-erotic asphyxiation.

Have some respect, please.

R.I.P. a great hacker who left this planet before his time.

PS: Also since it's not suspicious we can rule out your theory as anything like that would most certainly be suspicious.

To be clear, I wasn't making a comment about Barnaby Jack's death specifically. I have no idea what happened and if the family would like to keep it to themselves, I fully respect their wishes. I was just making an honest observation that whenever someone dies and people won't talk about it, that's always the first thing that pops into my head, particularly when there is a suggestion of embarrassment involved (which pertains to the person I was responding to, but not Barnaby Jack).

One of the most noxious effects of the recent NSA revelations is that puts whole of Internet Security Land in the realm of conspiracy theory. Our leaders have admitted that they have given us "unknown unknowns" for our benefit.

XYZ event may indeed be just a sad coincidence but circumstances certainly require us to now look at these critically.

And yes, this makes harder to filter out the ravings of the honest-to-god crazies, which is unfortunate.

OK, but I WOULD like to point people to this interesting link:

>"The Naval Surface Warfare Center, Dahlgren Division (NSWCDD) seeks Cooperative Research and Development Agreement (CRADA) Partners that possess the expertise, capabilities, facilities, and experience in the field of manufacturing, testing, and distribution of cardiac pacemakers.

https://www.fbo.gov/index?s=opportunity&mode=form&id=409766e...

So?

What?

More from the RFP: seeking information from companies capable of providing cardiac pacemakers for government testing, pacemaker programming hardware (loan OK), data and methodology for testing of electromagnetic vulnerability, and data on the demographic distribution of pacemaker devices domestically and internationally

From the 'Dahlgren' website http://www.navsea.navy.mil/nswc/dahlgren/ET/DEWO/default.asp... we see they are researching directed energy weapons of many types.

Directed energy (aka "EMP") weapons are said to be useful for disabling computers and electronic devices. Humans are by-and-large highly INsensitive to long electromagnetic waves (radio) until the waves become short enough to heat burn your skin (infrared, lasers) or your retinas. There's evidence of cancer at high exposures to short wavelengths, but causing cancer is not viable as a combat tactic.

But if you're going to deploy a directed energy weapon, you're going to want to have a reasonable idea of the effect on both electronics and the humans in the target area. They have a test range built for this. So it sounds to me like they need some help studying the effect of EMP weapons on people with pacemakers who might just happen to be in the target area. In other words:

Are these non-lethal weapons systems? If not, just how lethal are they?

Should we let an experienced officer continue to serve on a surface ship after he needs a pacemaker? Would he need any special precautions?

If someone dropped one on us, how many civilian casualties would we sustain? ("data on the demographic distribution of pacemaker devices domestically")

If we dropped one on country X, how many? ("and internationally")

I don't think this RFP gives any evidence to suggest that the US Navy is interested in doing the sort of medical device hacking that Barnaby Jack pioneered.

As someone who has a defibrillator with remote-access capabilities, I'm thankful that Jack was trying to bring this vulnerability to light.

But why ? Didnt know anything about him but he looks like 35 years old. An Accident ? Something else ?

All these young tech people dieing lately is a bit unsettling.

Cause of death, if it is known, is probably being withheld for family privacy reasons.

Life is fragile.

I had a friend of mine drop dead of a heart attack at the ripe old age of 27.

A friend of mine died from pneumonia at 30. He went to bed not feeling well and never woke up.

All these young tech people dieing lately is a bit unsettling.

It's a big world. There are thousands of people (many of whom most of us haven't heard of, but a few have) who would get an HN mention if they died, and 20- to 40-year-old people still have a ~0.1% per year death rate.

It's nothing unusual. The Internet just makes people more attuned to it. If you went to a 1000-person high school, you probably only lost two classmates in your whole time and it was a big deal. Now, however, there are so many interesting people in the (amorphously defined) tech community that, yes, interesting young people are going to die all the time.

There is information on Twitter that a short statement will be released, but the family needs some privacy, time and space.

The original link isn't working for me but this appears to be the same: http://www.reuters.com/article/2013/07/26/net-us-hacker-deat...

Try this one: http://www.bloomberg.com/news/2013-07-26/barnaby-jack-comput...

I thought the comments on the link I gave were bad but those are just as bad.

I mean the 'omg hacker means evil and he deserved it!' stuff...at least the tinfoil hats make a bit of sense.

Isn't it sad that since the NSA revelations anything is really "on the table" for our imaginations? Nothing seems too far-fetched these days...

I know it's a hot topic, but the Snowden leak is hardly the genesis of distrust.

For me, it is more the case of Michael Hastings[1] that would bring foul play from a government agent rather than the Snowden case.

[1]http://www.foxnews.com/us/2013/06/24/journalist-michael-hast...

Indeed. I can't believe more people don't know about this.

I can't believe you crazies found HN.

The U.S. mortality rate is 0.008 per year. That means that in any gathering of 100 people (roughly the number of speakers at Black Hat), there is a 55% chance that at least one will die in the year before the event and a 6.5% chance they would die one month before the event. Over ten years of conferences, the odds that someone would die within one month of speaking is 49%. The under-40 crowd doesn't really appreciate this since death predominantly affects older people.

That doesn't consider that the age and economic status of conference speakers isn't representative of the U.S. as a whole. Not that it's impossible for it to be an accident, but the odds are certainly less than 49%, given that the crowd is mostly urban professionals.

Sorry, I should be clearer: I was calculating based on the general mortality rate. The accident rate is much lower (0.000391). I agree that either measure is skewed, though; this is just a rough calculation. The annual death rate for 35-44 from all causes (see http://www.data360.org/dsg.aspx?Data_Set_Group_Id=587) is 0.002, which puts the odds of a speaker death within one month of the conference at 15% over ten years. Poorer, but then again, this is for only one specific security conference. If you assume five security conferences a year of all sorts, it's back to 50% over ten years. I think it's a bit higher as these speakers live sedentary lifestyles, even for the U.S.

Yeah but that is for all causes and that includes things like long term cancer and other deceases that don't really strike suddenly.

Makes sense.

Another thought: Barnaby Jack was one of the top speakers and was to speak on a very controversial subject. I would guess that out of the 5000 speeches that were presented in your scenario only a few of them, maybe 2%, would contain information controversial enough that foul play would appear as a reasonable scenario to an outside observer (and this is being generous).

  Let F = foul play occurred in order to disrupt a conference,
    D = death of speaker one month before conference

  Let P(D) = (.02 deaths per year for 25-35 y.o) / (12 months in a year) = 0.0017
  Let P(F|D) = .001 (assuming 1 in 1000 chance foul play was involved given a death of a speaker at a conference)
    P(F) = P(F|^D) * P(^D) + P(F|D) * P(D) 
         = 0 * 0.98 + 0.001 * .02
         = 0.00002
  Let P(D|F) = 1 (chance of death if foul play is involved, assumed 100%)

  So Bayes theorem gives us:

  P(F|D) = P(D|F)*P(F)/P(D)
       = 1 * 0.00002 / 0.0017 
       = 0.018 (chance of foul play for a single speech given the speaker died 1 month before)

  Let P(C) = 0.02 (probability of a controversial speech)
  P(D) = .0017 (from above)

  Let P(C&D|F) = .5 (assuming there is a 50% chance the speech was controversial given foul play did occur, and death always occurs from foul play)
  P(C&D) = .02 * 0.0017 = 0.000034
  P(F) = 0.00002 (from above)

  P(F|C&D) = P(C&D|F) * P(F) / P(C&D)
         = 0.5 * 0.00002 / .000034
         = around a 30% foul play was involved in Barnaby Jack's death

There are a lot of assumptions here that could adjust the final figure up or down, but if I did my math right, foul play does seem a reasonable scenario, (but not a foregone conclusion).

edit: removed line "P(F|D) = 0.00058 (from above)" as pointed out by user 0003. End result didn't change, though.

  P(F|D) = 0.00058 (from above)

Can you explain this line?

http://en.wikipedia.org/wiki/Bayes%27_theorem

Sorry, that line was erroneous, but didn't affect the rest of the calculation as far as I can tell. I have removed it.

Let P(F|D) = .001 (assuming 1 in 1000 chance foul play was involved given a death of a speaker at a conference)

P(F|D) = P(D|F)P(F)/P(D) = 1 0.00002 / 0.0017 = 0.018 (chance of foul play for a single speech given the speaker died 1 month before)

Is this a typo? I don't understand how you're finding two different values for P(F|D).

Let P(F|D) = .001 (assuming 1 in 1000 chance foul play was involved given a death of a speaker at a conference)

Am I right that here you claim that every 1000th death of a speaker is by foul play?

I'd expect such number of deaths to be more orders of magnitude less common.

And this is why Bayesian Decision Theory is utter bullshit. Do you seriously think you can, with any real degree of accuracy, predict how likely it was that foul play was involved?

So... if I am asked to talk at BlackHat, then there is a 55% chance I'll die!

;-) (JK I know thats not what you meant...)

There is 100% chance we will all die, whether invited to talk at BH or not.

Historically 100% have died, but it's not necessary to be that way - consider it a bug to be fixed.

The use of statistics and such can't really take away from this being a suspicious seeming coincidence. It can, however, show that coincidences are relatively common and so do not automatically imply a hidden hand. However, given that recent revelations have made a hidden hand a less-than-extraordinary event, we can get all Bayesian and say a rise in the prior has increased posterior probability here.

It is a little sad. Those days where one could rule out foul play by the US government in a case like this - those days are most certainly over.

That said in this case we'll have to trust his family.

The correct link to the Reuters article is http://www.reuters.com/article/2013/07/26/net-us-hacker-deat...

I find the title of this article to be unsettling. The title almost makes it sound like he died to avoid going to the conference.

While I guess that feeds into the much beloved past time of conspiracy theory, I can't help but think it could have been worded significantly better.

When I originally saw this I posted it with the title as it was on the article. The article itself has been updated with a lot more information than was originally on there and also the title has changed.

Corrected Link http://www.reuters.com/article/2013/07/27/hacker-death-idUSL...

BBC article here: http://www.bbc.co.uk/news/technology-23467411

To many researchers are turning up dead lately.

Conspiracy theories go go go!

Too many? How many have turned up dead?

One is too many?

One is not "researchers."

Citation Required

"But certainly any threats, no matter how minor, need to be eliminated.”

-Barnaby Jack

I had only met him in person once, but he was clearly a great human being. I'll remember the drinks we shared.

The article is 404?