FBI Pays Visit to Researcher Who Revealed Yahoo Hack | Hacker News Reader

FBI Pays Visit to Researcher Who Revealed Yahoo Hack

wired.com

63 pointsAdmiralAsshat48 comments

I don't really know what will happen with this case but cases like this are the reason I never try to contact anyone on security flaws.

Sometimes just when browsing the web, I click on a wrong link or a button in an unexpected way and I see what must be security flaw. When you studied a bit in this domain, you _know_ that there is something. I never tried to contact anyone anyway because I have absolutely nothing to win. After all, if their server is exploited I'm not liable in any ways but they can try to sue me if I contact them.

I had the same experience when I spotted a flaw in a service that Aaron Swartz had setup. There's no way it can be fixed now, so I did the best reporting I could to the forks and left it at that.

I don't know if this is a valid example of that. Unless they threaten him with court/jail time/fines/etc. I'd say this was just a follow up thing they do sometimes.

He included the FBI in his emails to Yahoo.

You're right not to. In the absence of a published policy implying permission to test, it's illegal to intrusively test someone else's servers for security vulnerabilities.

I've found SQLi vectors by filling out job applications online, when they have a free-form text field and I use a contraction. (See also: the preceding sentence.)

I usually just close the window and apply somewhere else. Don't need the trouble.

Win by doing the right thing.

Would stay quiet if there was a similar situation in real life?

He cc-ed the FBI, and they followed up with a courtesy call. There is nothing in the article that suggests anything more than that.

I really hope they don't arrest him.

But at the same time, I hope they do and then he fights the CFAA and kills that stupid law once and for all.

You can tell that the CFAA got created during a period of moral panic about computer crimes (e.g. "a single hacker could take over our nuclear warheads and start WWIII" which is actually what the movie War Games (1983 Vs 1984 for the CFAA) is based upon).

The crimes are vague and the prison terms are absolutely bonkers. You can literally go hit someone over the head with a 2x4 and get less prison time than you could get for breaking into their iPhone.

The fact that a lot of courts are completely ignorant about technology in general and will eat up whatever junk a company tells them (e.g. "this XSS exploit cost us $50K in wages to repair!") is also a huge problem.

Don't I know it! I'm still paying my $9370 in restitution for discovering a 2+ year old unpatched vulnerability in 2011 and NOT using it to compromise their system further.

You likely cannot go into it too much, but any more to that story? Did you try and report it, and they turned you over to the feds, or did you see if it was exploitable and they reported you?

"You likely cannot go into it too much, but any more to that story?"

Nah, I already posted my experiences in multiple places. It's a long story.

https://scott.arciszewski.me/blog/2014/03/black-and-white-26... https://news.ycombinator.com/item?id=7954123

There's an excellent article written by some journalist (now ex-journalist, I suppose) on that point:

http://www.cnet.com/news/from-wargames-to-aaron-swartz-how-u...

the CFAA's punishments, drafted during a post-WarGames computer hacking scare and designed to deter intrusions into NORAD, threatened Swartz with stiffer penalties than if he had been convicted of assault with an actual crowbar...

"WarGames" inspired these extra-long prison terms. As soon as it was released in June 1983, the movie, starring Matthew Broderick as a teenage hacker who broke into NORAD's mainframe and nearly ignited World War III, electrified Capitol Hill and kicked off an anti-hacker panic...

No fewer than six different anti-hacking bills were introduced that year, and Congress convened its first hearings as soon as politicians returned from their summer recess. Rep. Dan Glickman, a Kansas Democrat, opened the proceedings by saying: "We're gonna show about four minutes from the movie 'WarGames,' which I think outlines the problem fairly clearly." A House committee report solemnly intoned: "'WarGames' showed a realistic representation of the automatic dialing and access capabilities of the personal computer."...

On the positive side, I was a kid and I watched some of those news reports on TV and begged for a computer because the idea of hacking into government computers looked so cool. That's what started my interest in programming.

> But at the same time, I hope they do and then he fights the CFAA and kills that stupid law once and for all.

I can't see any possible way this could happen in the courts. Yes, the law is too harsh, but it is pretty far from being unconstitutionally harsh. For anything less than life in prison (i.e., any "term of years" sentence) courts are incredibly deferential to congress in analyzing a sentence's proportionality. (In fact, until recently, at least one circuit had a rule that any term-of-years sentence was per se proportionate.) The supreme court has used examples like life sentences for parking offenses in explaining the threshold.

Can anyone here think of a ground for overturning CFAA on a ground other than disproportionality?

Other than the fact that it's so vague that it ought to be void?

I've never found it especially vague. (At least, not substantially more vague than any number of other criminal statutes.) The problem, rather, is that as it's written it seems to criminalize more than we want it to. That's bad, but not something the judiciary can fix for us.

You never received explicit authorization to access ycombinator.com did you, criminal?

1. Your point has nothing to do with vagueness. It has to do with precisely what I described: criminalizing too much.

2. The CFAA says nothing about explicit authorization. It just requires "authorization." There will be fringe cases where it will be difficult to determine what that means, but usually (including the example you helpfully provided -- yes, of course I'm authorized to access news.ycombinator.com) it could not be easier.

I'm not a lawyer (in fact, I hate lawyers), so here's some literature on the subject.

http://minnesotalawreview.org/wp-content/uploads/2012/03/Ker...

Thanks for the literature. I've actually already read it, and, though Orin Kerr is certainly a smart guy, I think he's wrong. (IAAL, by the way. Sorry you hate me.) I'm not sure what more there is to say, though, if you're not willing to actually defend your view.

I'll just finish with this though: not even the article you sent me suggests that CFAA will ever be struck down on vagueness grounds. Rather, he thinks that the void-for-vagueness doctrine will create some outer limit on courts' interpretation of the statute. These are what I referred to as the inevitable fringe cases. Note, though, that this article was written four years ago, and I've seen no indication that the trend he has identified has continued to develop in any significant way.

> (IAAL, by the way. Sorry you hate me.)

I meant in general. When you see prosecutors, defense attorneys, and judges deciding the plea bargain deals at strip clubs (with the pretense that they would merely "go through the motions" under public scrutiny) ahead of time, you tend to not respect the profession.

> I'm not sure what more there is to say, though, if you're not willing to actually defend your view.

My view is simple: I want that law to cease to exist through any legal means necessary because it gives prosecutors far too much potential for abuse. If vagueness isn't sufficient or is too disputable, let's find another attack vector.

I'm happy to hear we're on the same side, then. This time I agree with what you say about CFAA. The punishments are too high which, as you say, gives prosecutors an unfair amount of leverage. I'm simply trying to inject a dose of realism into the YC conversation on this issue: unfortunately, I don't think any judge is going to strike down, or meaningfully limit CFAA any time soon. The legal arguments just are not there.

If we want it fixed, we need to come up with a strategy to get Congress to fix it. That won't be easy, but I think it may be the only way. (Of course, CFAA is only one of many criminal laws that need to be reformed in precisely the same way. Drug laws are, of course, another great example.)

I do want to try to dispel just a bit of your cynicism about the criminal justice system, though. Unfortunately, I can't say a lot about the state systems, but I can tell you from extensive first hand experience behind the scenes in the federal court system that the plea bargaining process (and all the rest of it) works pretty much as advertised. While prosecutors may be overzealous, there is no shady back room business going on behind judges and prosecutors in strip clubs or anywhere else. (I'm not saying, of course, that it NEVER happens, but that, if it does, it would be a rarity and all the other judges would be aghast. The actual culture among federal judges would never condone what you've described.) This doesn't mean that defendants always get a fair chance. They typically have few resources, little knowledge of the system, and are threatened with huge penalties (though at least in federal court the appointed representation actually tends to be decent). But at least the courts themselves are not rigged against them. (I suspect much the same can be said for many state courts, but not, unfortunately, all.)

> I'm happy to hear we're on the same side, then. This time I agree with what you say about CFAA. The punishments are too high which, as you say, gives prosecutors an unfair amount of leverage. I'm simply trying to inject a dose of realism into the YC conversation on this issue: unfortunately, I don't think any judge is going to strike down, or meaningfully limit CFAA any time soon. The legal arguments just are not there.

Damn. Oh well. What can we do? :)

> If we want it fixed, we need to come up with a strategy to get Congress to fix it. That won't be easy, but I think it may be the only way. (Of course, CFAA is only one of many criminal laws that need to be reformed in precisely the same way. Drug laws are, of course, another great example.)

Agreed.

> I do want to try to dispel just a bit of your cynicism about the criminal justice system, though. Unfortunately, I can't say a lot about the state systems, but I can tell you from extensive first hand experience behind the scenes in the federal court system that the plea bargaining process (and all the rest of it) works pretty much as advertised.

This was the State of Florida system, not the Federal one, so it's probably corrupt in different quantities than the one I witnessed firsthand. :)

That's disappointing to hear. Some state court systems do indeed need a lot of work.

HN allowed me to create an account. If that isn't "explicit authorization", then I don't know what is.

Infragard allowed me to create an account, which was also not even used to find a hole in their system. Yet I was still charged with exceeding authorization via CFAA.

I hope he doesn't. He seemed like genuinely wanting to help Yahoo against attack and probably copied FBI as a courtsey.

He justifies his actions by comparing them to walking into a house with an open door[1]. Since when is it socially or legally acceptable to walk into stranger's houses? Last time I checked, that will get you shot. [1] - http://www.futuresouth.us/wordpress/?p=52

Not only walked in to the house but moved things around (killed running processes, added another backdoor and gave himself shell access).

I really don't know what he was thinking. How many times have we heard the story of the hacker that does something and is asked by law enforcement to work for them. Or the student that gets arrested or expelled when he discovers a vulnerability in some school software.

He should have expected this and taken precautions against it. Or not reveal himself at all.

I feel like a major problem is that companies blame security researchers when their stock price inevitably takes a fall after a major breach. When you start messing with big money, the Feds come calling.

Who does number 2(Feds) work for? :)

"Hall’s server got attacked, but the attack was coming from an unlikely place, a server that belonged to WinZip."

He should sue WinZip or report them for the same exact "crime."

He could have if he had observed it passively rather than trying to get control of the remote server. As it is he has set himself up for a counter-suit.

For a criminal case, where is the mens rea?

For a civil case, what quantifiable damage has been done?

You should be asking the GP, not me.

I guess I was wrong... [1]

https://news.ycombinator.com/item?id=8416798

The author of the original disclosure states on his blog that this is no big deal, in fact he's been asking for a visit for a while and if anything is upset that it took so long

> http://www.futuresouth.us/wordpress/?p=52

All these people here defending the CFAA, as if it's good law or something. "How dare he connect on that host on that port! He should've known better! He got exactly what he deserved!"

It would be funny if it weren't so sad.

Shouldn't he have been expecting this?

He CC'd the FBI in his email to Marissa Mayer..

Would this be analogous to self-defense? A server was trying to hack into his computer (his honeypot). Logically, taking measures to stop the intruder would be legally acceptable. Yes, the server could just have been blacklisted, but stopping the problem at its source is more effective imo.

Would this be a valid defense if he ever gets accused? Is hacking into the server of a hacker who is hacking you to stop the hack legally acceptable?

This is why we can't have secure things.

> Hall says examining and then killing the malicious code was a kind of justified trespass, much like removing a child from an overheating car.

The difference being: no one was in immediate danger of dying. The two situations are not equivalent at all and I cannot figure out any way to make them so.

Maybe that analogy is not perfect, perhaps one that is more property damage related would be more apt?

"It's like breaking into an upstairs apartment to turn off the water that is flooding your apartment below"

Are you allowed to do that? Probably not?

The problem is that you could come up with all sorts of analogies of justifiable/unjustifiable trespassing to justify your argument. What about breaking into an upstairs apartment because they left their TV on too loud?

The owner of the "apartment" (WinZip in this case) probably would have taken action without the need for any "trespassing" if he'd just alerted them.

I'd love to see a development of the law that aligns with Blackstone's Commentaries on trespass and ravenous beasts of prey: it is justifiable to enter another's servers in order to hunt and kill worms because destroying such creatures is profitable to the public.

Reply on news.ycombinator.com