A Virginia hacker catches the attention of federal law enforcement

This guy is an idiot. Maybe he's very good technically, but this isn't even good policework. This is straight out of the troll method of questioning [1].

[1] "Detritus was particularly good when it came to asking questions. He had three basic ones. They were the direct (“Did you do it?”), the persistent (“Are you sure it wasn’t you that done it?”), and the subtle (“It was you what done it, wasn’t it?”). " -- Terry Pratchett, Feet of Clay

> [...] will randomly cause a digit to flip and a Web user will be sent to the wrong site — for instance, Micro2oft.com instead of Microsoft.com.

Disappointed, but not surprised, that the given example is incorrect - Micro3oft.com would have fit.

http://www3.amherst.edu/~jcook15/ascii-binary-chart.gif

I don't think "you're such a talented criminal, would you like a job?" coming from a federal agent is terribly trustworthy. It was previously used to catch the Half Life 2 hacker back in '04, although granted he basically did it to himself.

At the very least, it would seem like a bad idea to sign something like that without a lawyer, who I assume wasn't involved because, well, what lawyer would say "yeah, go ahead and sign a confession in exchange for an informal verbal job offer"?

Don't Talk to Police https://www.youtube.com/watch?v=6wXkI4t7nuc

I was an early 2000's script kid who got in a lot of hot water over my actions. Then three years later, right before I was to go off to college, two FBI agent showed up at my house to offer me a job. They went about it in an extremely sketchy way that made me very uncomfortable. I said no and called a lawyer.

The big thing I learned from that whole situation is that you should say as little as possible to law enforcement without a lawyer present.

If Muneeb is charged, any attempts at recruiting hacking talent will be hindered. This could make DHS look very bad if they push this forward.

> There was one catch: Akhter said he was required to sign a statement saying he had created the hack and to show agents that he could actually do it.

It sounds more like DHS caught someone doing social engineering, hired him to help them catch hackers, and this is what he came up with.

the majority of comments on this thread are off with there suspicions of foul play on the "hackers" part.

the details from the article mostly add up. there is information missing that could confirm this (review of skill-set showing competency in side channel attacks, perhaps a followup on the DAPRA grant) but the general attack described could be possible. also intelligence agencies looking for snitches should be read as an agent fishing for a spy. A special type of spy with technical skills. It might be that after hitting the first "go higher him and bring him into our RED_or_Black team" later the agency got cold feet or countered and as a result they could only offer him the more arms-length freelance type of position where you work on blackbox projects while remaining independent but also have the alternate task to feed information about the community. This. Happens. This is the modus.

The only thing I do not get is when they were still looking to higher and put him close rather than the arms-length position, why the "would have to move to Seattle" requirement? And this sparks my attention because pre-snowden I knew several security analysts in Redmond that doubled as consultants for Gov. I wonder if Gov eventually just setup shop there?

The really baffling part is how he possibly thinks he could be helping himself by giving this interview.

The job offer is a pretty obvious lie. Full government jobs don't pay $150,000+ until you get to an extremely senior level [+] (private contractors do pay that much, but DHS certainly can't extend job offers on behalf of a private contractor). I think it says quite a bit about the ego and/or ignorance of this person if they thought they were so special that they would be offered this type of job...

[+] http://en.wikipedia.org/wiki/Senior_Executive_Service_(Unite...

It is highly unlikely they would consider anyone who breaks the law for a job. DC doesn't work that way, typically. Trustworthiness is a more sought after quality than any other. If you even have bad credit or smoked a joint in the last year you won't be getting any secret clearances anytime soon, let alone if you committed a major crime.

Let there be no mistake about it: they were/are to build a case against him. Simply telling your co-workers about a hack that you could have easily made up to impress them isn't even enough evidence for a search warrant, let alone an arrest. The fact that he played into the not-so-clever ruse that DHS used on him so naively is a perfect example of the difference between intellectual and real-world intelligence. Any 10 year old from a bad neighborhood would have known not to say anything to the agents, yet he sat there, with his family looking on, essentially saying "yes, please take away my future" with every word he said and wrote.

On a side note...

>He also has dabbled with other “black hat” hacks, such as code that allowed him to win Web auctions with low-ball bids.

This was mentioned in passing, but it would be interesting to find out what technique he claims to have used to accomplish this.

If the government ends up prosecuting him, it will be a massively idiotic move on their part. It's already bad enough that they've withdrawn their job offer. To use a war analogy, this situation is similar to your army shooting a surrendering enemy at the end of a battle, thereby ensuring that no future enemies will want to surrender and will instead fight to the death. You gain a short run benefit at the expense of destroying your reputation.

Offering him a job under false pretenses and then prosecuting him creates a big disincentive for any future hackers to a) talk to government officials who approach under seemingly benevolent circumstances and b) even want to work for the government at all if it pulls scummy moves like this.

Most likely DHS won't be able to use this guy as a federal informant now that this article is out. Did he think that crying to the press would give him some kind of immunity to prosecution?

This was almost certainly a social engineering hack (if it is true at all which I don't believe it is). There is no trick to how a gift card works...

A token value is stored on the card which maps to a number in the backend, where they keep state. The value on the card is static..

It also sounds like his motivations are criminal.. Otherwise he would have stopped before stealing hundreds of dollars

I hope the DHS doesn't hire people who make mistakes and bad decisions as much as this guys did.

are there ISO standards for computer security ?