RIAA Website Hacked 247
gattaca writes "A lack of security controls allowed hackers to "wipe" the Recording Industry Association of America's (RIAA) website on Sunday.
The existence of an SQL injection attack on the RIAA's site came to light via social network news site Reddit. Soon after hackers were making merry, turning the site into a blank slate, among other things.
The RIAA has restored RIAA.org, although whether it's any more secure than before remains open to question, TorrentFreak reports."
It would've been funnier (Score:5, Interesting)
if they made innocuous little changes here and there, such as changing the words "do not support file-sharing" to "fully support file-sharing." It probably would've the RIAA much longer to realize they've been had, and I'm sure they would've gotten some interesting calls and e-mails :-D
Re:Why wipe it? (Score:5, Interesting)
I know it would never work. The judge would ph34r t3h ev1l h4xx0rz! But, if fun to dream isn't it?
Re:This gives reddit a bad name (Score:5, Interesting)
The RIAA are among the least of those who deserve to have their property rights defended.
Re:RIAA will use this (Score:5, Interesting)
Re:This gives reddit a bad name (Score:4, Interesting)
It is not my obligation to report it to the people who made the vulnerable software.
Your mentality is that of the DMCA.
Re:This gives reddit a bad name (Score:2, Interesting)
Re:Well-It's all relative. (Score:3, Interesting)
If someone punches you in the face, do you beat them to death with a crowbar? No, you punch them back. If someone pulls a knife on you, do you pull out your grenade launcher?
Re:Well (Score:3, Interesting)
And if you are going to hack a site, why not keep the site but insert and modify the pages just slightly so that the meaning of some statements will be slightly off the target. Harder to do, harder to spot but a lot mor fun for the world to figure out.
Even better if no backups exists for the site... Or if it isn't spotted until the backups are recycled!
Re:This gives reddit a bad name (Score:2, Interesting)
How about if you use that bug by submitting a link to the exploit, and in the submission title promote the use of that hack? How about if then a large segment of that community joins in? And by that action they collectively takes down a privately owned server and cause damages? Who is responsible then? Nobody?
Re:Why wipe it? (Score:2, Interesting)
Re:Why wipe it? (Score:3, Interesting)
Possible Trojan Injection? (Score:3, Interesting)
Still vulnerable? (Score:2, Interesting)
You bring to mind an interesting point (Score:5, Interesting)
Nah, how about a bunch of press releases saying that "the RIAA was wrong to sue music fans for sharing songs therefore we are dropping all the charges" and then seeing if the judge would say that if it was a cracked site or the RIAA itself.
The linchpin of the RIAA's lawsuit factory rests on the supposition that an IP address is exactly identical to a person. What the IP address does is legally identical to a person doing it. That's their argument.
So, if their website were to be hacked, wouldn't that exact same rule apply to whatever content was there? Their IP address is legally the same as the person/corporation/entity who owns it, right? That IS their argument, after all.
So why not use that against them in a legal sense?
It would be brilliant. The RIAA lawyers when they were brought into court for whatever happened to be uploaded there would have to make the argument that an IP address DOES NOT equate to the owner of the IP address in order to defend themselves.
They'd have to make our argument for us, and in front of a judge.
You couldn't ask for a better precedent.
Re:Well-It's all relative. (Score:2, Interesting)
Re:Well-It's all relative. (Score:3, Interesting)
Not really, those things need to be funded anyway in order to make the threat credible. The lawyers and prosecutors would be paid anyway, though I suppose you could factor in danger pay.
"Over-fining is much better then working this out. Especially if you don't know the correct percentage that the person will be caught."
How? It's a bit complicated for a back of the envelope calculation, but it wouldn't take an applied mathematician more then a day or two. And considering the costs of over-fining, the investment would be worth it. And if you look at crime data, it is extremely stable. We can estimate the probability of getting caught pretty well.
From a purely economic point of view, money taken from fines are just as damaging to society as money stolen. Once you take this to account, and assume a Pareto income distribution(and assume that people commit a crime when the expected value of the crime is above their wage rare), it's surprisingly easy to find a fine that minimizes the total amount of money stolen(by criminals or government).
It's x/p-c/p, where c depends on income inequality. So actually, an optimal fine would be less than what I naively calculated earlier.
Re:Well-It's all relative. (Score:3, Interesting)
The funniest part of it all is that I'd imagine that with an SQL injection-type attack it is really hard to prove malicious intent. So if they caught the people who did this and they walked because their lawyers were somehow able to cast doubt on malicious intentions, that would just be poetic justice for the RIAA (sir, I was just trying to create the userID ";truncate table users;"). Heck, XKCD [xkcd.com] just about says it all!
Re:RIAA will use this (Score:3, Interesting)
If Sony wanted to put out an album of a homeless guy banging on an empty garbage can and screaming obscenities there's is nothing the RIAA can do to stop it. (See Yoko Ono for reference)
If Island Records decides that it wants to make Anthrax's Persistence of Time album public domain there is nothing the RIAA can do to stop it.
If Columbia wanted to pull every album they publish off the shelves and take it all out of print there is nothing the RIAA can do to stop it.
Some monopoly. They have zero control.