Outrage over AT&T iPad data slurp hacker conviction
Greyhats lifted names and emails without busting security
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A grey hat hacker has been found guilty of breaching AT&T's site security to obtain iPad customer data.
Andrew "Weev" Auernheimer, 27, from New York, was convicted of conspiracy to hack and identity fraud over his role in a 2010 exploit against an AT&T account maintenance website that resulted in the leak of 120,000 email addresses of iPad owners, Reuters reports.
Auernheimer’s lawyer, Tor Ekeland, said that his client intended to appeal the verdict of a New Jersey jury, a point confirmed by Auernheimer.
The case is been closely watched in the information security community because Auernheimer recovered the data from the AT&T website without bypassing any security controls. The appeal will therefore focus on whether the Computer Fraud and Abuse Act offences were committed by Auernheimer, an important point of law that has implications for both penetration testing and the reporting of security vulnerabilities.
Rob Graham of Errata Security has a suitably angry and fiercely argued blog post on the implications of the case here.
For now, Auernheimer is on bail pending the results of a sentencing hearing. Auernheimer, a self-described internet troll, was a member of the group of computer experts known as "Goatse Security" that went to Gawker with details of the breach after they had notified AT&T of the problem.
Scripts developed by Goatse Security mined the names and email addresses of about 120,000 early adopter iPad owners, including White House staffers, celebrities, journalists and wealthy financiers. ®
COMMENTS
Re: He did however pretend to be other than who he was
Oh, be quiet.
Stop using moronic analogies that don't apply here; either you have the barest minimum grasp of computer networking (because what weev and GoatSec did is clearly not the same as a burglar walking into an open house; and even using the term burglar is an appeal to emotion: you're loading it already), or you're a troll, and not a clever one.
Chilling effects on computer security research are serious. People are trying to help YOU, the end user, be secure. If it turns out that I am going to get prosecuted for finding and reporting/exposing a vulnerability, then I won't disclose it. Why would I risk that?
You can be sure that'll increase the amount of people selling their exploits privately to groups like Vupen, or to Iran, or Russian cybercriminals. In the end, the person getting shafted will be you, the end user.
Re: He did however pretend to be other than who he was
"... because what weev and GoatSec did is clearly not the same as a burglar walking into an open house ..."
No, what he did was the equivalent of selecting a house at random, opening the door to determine who the occupant is, then moving on to the next house and so on. The server wasn't just handing out the data, he had to send requests (brute force) to get the data.
"If it turns out that I am going to get prosecuted for finding and reporting/exposing a vulnerability, then I won't disclose it."
No, you'll get prosecuted for publishing private data after exposing a vulnerability. Was it really necessary to fetch 120,000 email addresses and provide them to Gawker? It's great that he informed AT&T, but he was an idiot for handing out the collected data just because he could. AT&T were definitely negligent here, but it didn't warrant divulging the data as well as the method.
Re: He did however pretend to be other than who he was - @AC 13:19
That's pretty much EXACTLY what he did. He tried doors at random, and if they opened he collected the data behind the door. If you're using a public system that asks you for a user ID then you can't complain that guessing an ID isn't hacking if the system doesn't then demand a matching password. It's not difficult hacking, but the degree of difficulty doesn't distinguish between legal and illegal.
Now if he'd proved the exploit and told AT&T about it then (without publishing the results) that's fair game. Embarrassing them in public after they fixed the hole is fine too. He crossed the line by publishing the data he'd extracted.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
