Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Security Government The Courts News

6-Month Sentence for NASA Cracker 329

lunartik noted an AP story running on a 6-month sentence given to Gregory Aaron Herns for cracking into the computer system at NASA's Goddard Space Flight Center. 'Herns told federal agents he was looking for computer space to store movies he'd downloaded. It took hours for technicians to find the problem, fix it and patch the system's security holes.'"
This discussion has been archived. No new comments can be posted.

6-Month Sentence for NASA Cracker

Comments Filter:
  • by Chess_the_cat ( 653159 ) on Sunday December 19, 2004 @08:55AM (#11129624) Homepage
    I'm surprised this wasn't posted under YRO.
    • Policing our own (Score:5, Insightful)

      by TFGeditor ( 737839 ) on Sunday December 19, 2004 @09:09AM (#11129687) Homepage
      Tacit approval of this sort of thing (cracking) paints us all with the same unsavory brush. If we do not start policing our own, the "geek/nerd" stigma will deepen. We are professionals, let's act like it.
      • Re:Policing our own (Score:3, Interesting)

        by back_pages ( 600753 )
        Tacit approval of this sort of thing (cracking) paints us all with the same unsavory brush. If we do not start policing our own, the "geek/nerd" stigma will deepen. We are professionals, let's act like it.

        Right, but I see you have a UID in the seven hundred thousands. You're new here! You see, you are absolutely correct - if we are professionals, then we should act like professionals. Unfortunately, the parent post is more correct - with the direction Slashdot has been going lately, I'm surprised that

      • This young naïve fool should have just stood up and told the judge that he was working on a special secret project for national security and that he couldn't say any more about it.

        Since the prosecuter wouldn't be able to prove him wrong, he would have gotten off and had the case dismissed.

        Should this happen to you, I suggest that you try it. You have nothing to lose and every reason to believe that you can get away with it.
  • by Nine Tenths of The W ( 829559 ) on Sunday December 19, 2004 @08:57AM (#11129628)
    NASA are claiming it was $200k. It'd be nice to see how much of that was spent on fixing the security holes he uncovered.
    • So would I, it didn't really sound like he did any actual damage, just used some storage space. And no I am not condoning what he did. I still am amused by this blowing up of damages every time one of these cases come about. I just wonder what the sentence would have been if he broke into a local warehouse and stored some stuff there. He gets 6 months here and then the additional sentence of limited computer use for 3 years. Pretty tough sentence on a CS major.
      • by Richard_at_work ( 517087 ) on Sunday December 19, 2004 @09:16AM (#11129728)
        He said he broke in to use storage space. Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in? Or are you going to forever view that system as 'dirty', with the costs associated with replacing that system and the data on it? This isnt a simple case of 'change the locks, add more CCTV', as you would with a physical wharehouse, you cant 'distrust' a physical building, there is a lot more he could do with a compromised computer system, including hiding unwanted code.
        • by More Trouble ( 211162 ) on Sunday December 19, 2004 @09:31AM (#11129788)
          Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in?

          Am I a competent sysadmin in this scenario? If "yes," then I guess I'm probably running a tripwire [tripwire.org] of some sort. So I boot from CD, take a look at what's been changed, and fix it. If I'm really on the ball, I'm using something like radmind [radmind.org], in which case I still boot from CD, but I let radmind reverse any damage that had been done.

          :w
          • And that will guarantee that you got everything right? To the point of trusting billion dollar vehicles and people? Sure.
          • While tripwire and radmind may have some utility in protecting system files, it does little to protect data. In a research lab you may be generating large data sets and if the intruder installs a root kit, the modified libc (and other libs that are installed) may have bugs or be incompatible with large simulations that are running (many of which are multi step). Thus the intrusion may in fact compromise serious work that is being done on the machine.
      • by NoOneInParticular ( 221808 ) on Sunday December 19, 2004 @09:28AM (#11129778)
        The more apt analogy would be a world where warehouses are used by burglers both for storing stuff and for putting poison in the stored food. When you find someone storing warez in such a house, are you still going to sell the crackers?
      • It costs a substantial amount of time and money to take the system off-line, preserve the evidence, attempt to determine what was exploited, format the disk, reinstall the operating system, applications, patches, and restore user data. Then you have to write reports and try to determine if other systems were compromised. All the while, you are not doing your regular job.
      • So would I, it didn't really sound like he did any actual damage, just used some storage space.

        This is what he says he was seeking. What he intended to do, or what access he sold off to others may be different. I could tell you all day that I was breaking into your machine in order to fix things. However, I've already committed one illegal act. If I really wanted to make the shuttle go boom, why would I honestly tell you that and get myself into more trouble? I'd make up some story that sounded good at t

    • Agreed. I'd like to see how much money was lost or required to fix damages versus the cost of fixing the security holes that should be fixed anyway.
    • Wow! If it took them several hours to fix, I would love to be the IT guy there!

      Well now, you had a port open on your firewall, and "pswrd" as as the password for root, so, it took me 1/2 hour to fix, plus 3 1/2 to get through security, so at $50,000 an hour, that will be 200k! I take personal checks...
    • I get the security holes [netsys.com] emailed [securityfocus.com] to me every day and fix them on an ongoing basis. This is a normal course-of-business expense, and charging the expense to someone else is...well...just a little bit gray ethically. NASA should have been fixing their security holes rather than waiting for someone to come along and try to pass the expense off on.

      I'm not at all saying the cracker was right to break into NASA's systems. What I am saying is NASA has a responsibility to keep its systems secure, and spend the re

      • I'm not at all saying the cracker was right to break into NASA's systems. What I am saying is NASA has a responsibility to keep its systems secure, and spend the required $$$ to do so, and they failed.

        I/O, This is true, but you must remember at many educational and scientific institutions there are a lot of undocumented machines that sit back in the corners and closets that are not properly patched. This is because the institution does not want to seem fashist about their "computer policies" that could ha
    • by _Sprocket_ ( 42527 ) on Sunday December 19, 2004 @01:32PM (#11131292)
      A few years ago, I was sitting in on a meeting for Infosec activities at a NASA Center. One of the first presentations was a rather nicely done outline of recent vulnerabilities and exploits admins should be taking action on. A look around the room saw a vast majority of glazed-over gazes. The next presentation was from our local FBI agent who discussed a recent compromise and the actions being taken to apprehend the perpetrator. The room was alive.

      There was much appreciation for the progress being made on the case. Apparently, the FBI had their suspect and were busy building an air-tight case for prosecution. There was a general air of victory. But what many failed to realize was the whole exercise was a signal of defeat. The incident represented potential compromise of data. It involved considerable man hours spent on investigation and recovery of the system. It also represented loss of equipment removed from the budget-strapped lab to support forensics activities.

      This represents a couple different problems with the common view of information security at NASA.

      It shows a lack of understanding of infosec issues. Instead of approaching infosec as a technical problem, the issue often gets far more attention as a legal / law enforcement issue. This is attitude calls for action after the damage has been done.

      It shows a inappropriate focus on funding. All IT budgets are stressed. NASA is no different, and perhapses even more thinly spread than others. That means infosec activities tend to get cut in favor of other IT activities. Yet there is no perceived issue in later spending considerable resources to prosecute each infosec incident.

      It may be worth stressing that this meeting happened several years ago. And there have been changes in how NASA, and the US Government in general, now perceive information security. So my observations do not represent an all-inclusive view of infosec at NASA (and those observations are my opinion and not policy of my employers). None the less, these observations are still applicable today.

      One side observation to anyone considering taking a stab at *.nasa.gov space. Historical statistics show that you'll find suitable targets and manage to compromise a system. But keep in mind, for the US Government that is just the beginning. The FBI views a case as making progress over several years of investigation and finally prosecution. So the compromise of a system that takes minutes, and the abuse of that system over a period of weeks or months may mean that years later you'll find yourself in court.
      • If the government is serious about fixing problems in supposedly secure and sensitive systems, then they should reward not punish people who find holes.

        Instead of going to the courts with a trumped up case about supposed damages in hundreds of thousands of dollars, they should give hundreds of thousands of dollars to the people who document holes in the security of sensitive systems.
        And tax-free, too, if you please.
        And give this kid the job of special intern for security at a decent salary. Loyal
  • Wow... (Score:4, Insightful)

    by Flaming_cows ( 798162 ) * on Sunday December 19, 2004 @08:58AM (#11129633)
    6 months in prison because he was too cheap to buy a hard drive...
    • Re:Wow... (Score:3, Insightful)

      by mirko ( 198274 )
      It should at least have been 6 months of collectivity-related work.
      If the guy was technically decent, it's a shame he'd be sent to a federal fuckodrome... :(
    • This isn't funny, its the truth.

      "He's going to get to learn," Brown said. "There are other ways to live."
      And he will find them.

    • 6 months in prison because he was too cheap to buy a hard drive...


      It was the bandwidth he was probably after. He was probably setting up a place to exchange with others.

    • Warez boards make use of 'public FTPs', or directories with write access. Sometimes this write access is acquired through use of bugs or exploits. Then you upload your crap to the public FTP, post the address for people to use, and people will snag it for as long as it lasts.

      There's a self-deterioration effect, though, since if *you* can write stuff there, other people can write stuff there too, and they can delete stuff, which is a lot quicker than uploading it.
    • Re:Wow... (Score:3, Interesting)

      by Detritus ( 11846 )
      I had something similar happen to one of my systems at work. They filled it up with porn movies and used the site's large amount of bandwidth to distribute them to lusers all over the world. For months afterward, I could see unsuccessful attempts to download the files in the logs.
  • Bad movies (Score:3, Funny)

    by Red Warrior ( 637634 ) * on Sunday December 19, 2004 @08:58AM (#11129636) Homepage Journal
    Now if he'd just uploaded LOTR:ROTK instead of Legally Blonde....
  • Great idea (Score:5, Funny)

    by Anonymous Coward on Sunday December 19, 2004 @08:59AM (#11129640)
    Let's just download some movies. Oh wait, I've run out of space.

    LETS HACK NASA!

    Step 1: Download movies.
    Step 2: ???
    Step 3: HACK NASA!
  • Mmm. No. (Score:5, Funny)

    by Ligur ( 453963 ) <ligur DOT jakin AT gmail DOT com> on Sunday December 19, 2004 @09:00AM (#11129644)
    "It would be like clearing a sidewalk full of spectators with a fire hose so you can walk through it," said Assistant U.S. Attorney Greg Nyhus.
    More like breaking into a bank vault to store the bicycle you just stole.
    • Re:Mmm. No. (Score:5, Funny)

      by djdavetrouble ( 442175 ) on Sunday December 19, 2004 @09:21AM (#11129752) Homepage
      yeah, yours is better and funnier. He should step down immediately !

      ****FOR IMMEDIATE RELEASE****

      Longtime Slashdot.org member Ligur (453963) has been selected to replace Assistant U.S. Attorneey Greg Nyhus. Nyhus, although promising, proved unable to form relevent analogies in meetings with the press. Ligur, although not formally trained in law (a condition known as IANAL) is highly knowledgeable in general subjects, has excellent karma, and is frequently moderated to +5 funny.
    • Re:Mmm. No. (Score:3, Interesting)

      by autocracy ( 192714 )
      I work for a fire department. I'd kill for a day when spectators were in my way and refused to move. After all, if you park in front of a fire hydrant, policy's to run the hose THROUGH your car. In a fire lane? We'll use your car as support for the ladder truck's rigging. Don't think it hasn't happened before [thelunatick.com].
    • "It would be like clearing a sidewalk full of spectators with a fire hose so you can walk through it," said Assistant U.S. Attorney Greg Nyhus.

      Which is fine, as long as Uncle Sam is holding the fire hose, and rioting citizens are taking the splash -- and not the other way around [oz.net].

      -kgj
  • crackers (Score:3, Interesting)

    by Anonymous Coward on Sunday December 19, 2004 @09:04AM (#11129658)
    "It took hours for technicians to find the problem, fix it and patch the system's security holes'"

    That's so obviously the cracker's fault...
    • Re:crackers (Score:2, Funny)

      by CK2004PA ( 827615 )
      Yes it is his fault. Just like the guy who finds a way to disable home or car alarms, break in and steal stuff. Are you kidding me? You side with a criminal because the lock on some window wasn't good enough to stop a crowbar forced entry ? 6 monthes isn't enough, this caused far more damage than armed robbery and cost taxpayers more money than grand theft auto. I'd like to see what you think after someone commits a crime against you or a family member...we'll see you throw your "protect poor criminals beca
      • Re:crackers (Score:3, Interesting)

        by Firethorn ( 177587 ) *
        You side with a criminal because the lock on some window wasn't good enough to stop a crowbar forced entry?

        What we're objecting to is the idea that part of the "damages" this thief is being charged with would be the installation of bars in the windows afterwords.

        Sure, charge him for actual damages, such as cleanup & verification. But charging him for patching the holes?
  • by lorcha ( 464930 ) on Sunday December 19, 2004 @09:04AM (#11129663)
    He was a cracker. He cracked and abused a system. He was convicted, and was given a reasonable and appropriate punishment.

    This is how the system is supposed to work.

    • Can we find something more appropriate? The whole thing of having to come up with new labels for things just because they are online is silly and pointless. Is there not something like a vandal or other thing that is a stronger definitive that we can use for people who do this?
  • by Timesprout ( 579035 ) on Sunday December 19, 2004 @09:07AM (#11129677)
    NASA should be allowed use these idiots in their experiments. I'm thinking 'Effects on subject A when parachutes fail to deploy on capsule dropped from 50,000 feet' or 'Impact determination of Subject A foolishly slashing open his space suit in LEO" sort of stuff.

    NASA could get valuable data, some small furry woonland creatures would be saved this fate and the world would have a few idiots less. Win all round scenario.
  • by aardwolf204 ( 630780 ) on Sunday December 19, 2004 @09:11AM (#11129695)
    With hard disk space nearing $0.50 / gigabyte why on earth would you crack into NASA computers to store you movies?
  • ...who need hard drive space. Hard drives are VERY cheap [newegg.com] nowadays! My god. How many movies did this guy have?!

  • Huh? (Score:3, Funny)

    by Pheonix5000 ( 661842 ) on Sunday December 19, 2004 @09:14AM (#11129712) Homepage
    "It's not like firing up your Macintosh or your Apple where you push a button and wait six minutes for the thing to boot."

    He must be talking about Windows ;)
  • by dhilvert ( 608753 ) on Sunday December 19, 2004 @09:24AM (#11129764) Homepage
    ... after the accused stole my $3.59 flowerpot, I had to spend hundreds of dollars putting locks on all of my doors.
  • Nice (Score:2, Insightful)

    by jmcharry ( 608079 )
    Break into one government computer, go to jail. Break into tens of thousands of personal computers, ....
  • by ckedge ( 192996 ) on Sunday December 19, 2004 @09:31AM (#11129790) Journal
    .
    Herns was ordered to pay restitution for the damage he caused and will have limited access to computers for the next three years. After the judge outlined the terms of Herns' restricted computer use, Levine pointed out how hard those conditions will be for a man who does everything online, including paying his bills.

    "He's going to get to learn," Brown said. "There are other ways to live."


    The Canadian government has declared internet connectivity to be (I forget the exact term) a "necessity" or something.

    If you rob a bank, do they forbid you from walking into any type of business establishment for the entire duration of your parole? No! It would be idiotic - everyone needs a bank account or groceries in today's society, and there are already tons of other perfectly good laws to deal with the individual should they commit a crime in a bank or other "place of business" again.

    If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.

    Judges are going to eventually have to stop throwing out blanket "computer bans" as minor parole conditions - and realize that they have to handle it differently. PCs may/can be the basis of entire home entertainment centers, your library, your photo album, your telephone, etc etc.

    What they should do (and what would be more effective) is to ban the user from say spending more than 30 minutes at a time on a PC, or making an IP connection to a class of third parties, or posessing any tools or software that could be used for illicit purposes - and then have the parole officers make unannounced audits and/or taps.

    This goes along the lines of what kind of an effect would it have on you and your life if the police seized your computer in the midst of an investigation (not even an investigation into you, say your webcam caught some images of a crime). My PC is all of the things I listed above and more. And remember, saying "make backups" doesn't cut it, they always take your backups too and withholding those could get you in even worse trouble.

    To put it another way - the police need to develop methods that don't "deny you use of your entire house just to check the window for fingerprints".

    If they want to ghost the drive and look at the inside of the system before they leave, that's fine. But taking the entire thing for an indefinite period - unacceptable. (I'm talking about when I'm not the suspected murder or something :| )
    • Oh cry me a river. (Score:5, Insightful)

      by EvilStein ( 414640 ) <spam@BALDWINpbp.net minus author> on Sunday December 19, 2004 @09:49AM (#11129870)
      I guess he should have thought about that before HACKING A BOX AT *NASA* for pete's sake - and to do what, use it for Divx movies?

      This guy was an idiot and got what he deserved. Sorry. Perhaps he should have though first before compromising a piece of United States Government property.

    • If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.

      Your analogy about cars is not even close. The ban does not stop someone else from using a computer on his behalf. He can go to the bank to pay his bills, and the bank teller will use a computer to pay the bills. Or he can use phone banking. You don't need a computer to live a ful

    • IANAL, but if you do an armed robbery, you are unlikely to
      be allowed to get a gun permit;

      As you said, you might lose driving privledges under certain
      circumstances. analogus to losing computer use. Unlike
      your example of riding a bus, there is no practical way to
      have somebody else do your driving on the PC for you.

      A lot of damage can be done in 10 minutes, let alone 30.

      What judges must determine is the intent. Was the hacker
      intending to be malicious or intending to use a system not
      his own for the commissio
    • or posessing any tools or software that could be used for illicit purposes

      Such as a compiler?

  • by WidescreenFreak ( 830043 ) on Sunday December 19, 2004 @09:35AM (#11129808) Homepage Journal
    I don't buy for a second that he was doing it to find space for movies. It just makes no sense at all.

    Let's assume for a moment that all of his movies were DivX-encoded at 650 MB each, just for the sake of argument.

    * Hard drives four years ago were still relatively inexpensive. By working at McDonald's part-time for three weeks or so he could have had a new hard drive.

    * Even if he had so many movies that he required an additional hard drive, why could these movies not have been burned to CD-R instead? CD writers were available for less than $100 and CD-Rs could have been found for less than 50 cents a piece. He could have had virtually unlimited space as long as he purchased a new spindle now and then. (See afformentioned McDonald's reference.)

    * Most importantly, what did he expect to do with those movies? Unless he had a T3 or something equivalent to his house, he would have had to wait hours to both upload for storage and download to view. I've had 1.5 Mb/sec DSL for four years, so I know that it would have been feasible back then, but it still would have been far less effort to burn them to CD-R. And at least then they would have been portable, far more so than a hard drive.

    * Assuming 1.5 Mb/sec broadband, it would have taken almost an hour just to download one movie. So, he would have taken an hour to download, an hour to upload (at the VERY least since most broadband companies don't use the same upload/download speed), and another hour to download when he wants to watch it? Was he planning on installing a streaming media server as well?

    * Why NASA? Why not find some schlep on his ISP who wasn't running a firewall, had lots of space, and store the data there? A Joe-Clueless-User would have been far less able to determine who was storing data on his system than NASA.

    I'm sorry, but I just dont buy the "he was looking for computer space to store movies he'd downloaded" line. It makes absolutely no sense whatsoever. Sounds more to me like he was doing something nefarious and was hiding it or he was just looking for ego points and got nabbed in the process.
    • Ok, Lesse here....

      *Hard Drives Are Cheap* - Sure, but so are most University Students,

      *Burning to CD-R* - No, Means the movies are inaccessable from anywhere else, CD-R's rot, and you are assuming they are 650MB DivX's, what if they were not? What if, (God forbid) he wanted a little quality in his movies?

      *What to do with them?* You get a little confusing here, and are mixing points, (Connection speed vs portability), Whats more portable than a server online? with basically assured 24/7 uptime?, As well,
    • No, it makes sense.

      What he was doing wasn't just storing movies. It was storing movies in a place where others could download them. Having movies gives you points, but having movies on a really big internet connection and letting lots of other people download them gives you major points. Especially if you set it up as a trade system, so you *get* lots of movies and such at the same time.

      NASA (like most companies) has lots of space on a big internet connection. There ya go.
    • You expect a teenage male in high school to use such a rational thought process?

      Are you from a different planet?
    • "CD writers were available for less than $100 "

      No sh*t - I've just bought an NEC OEM 16x dual layer DVD+/- CD-R/RW burner for £36.00 ($70) from an online store. Hate to think what the profit margin was for all concerned.
  • by CharonX ( 522492 ) on Sunday December 19, 2004 @09:45AM (#11129853) Journal
    I applaud the judge for his great insight - giving a Computer Science student a computer ban.

    And 200k of damages? Er, did he delete research papers or something? (If he did, to make room for his movies, he does deserve it, though).
    Sounds more like 200k to finally get their asses moving to fix some security holes, which were there in the first place.
    He went into my house, through the big holes in my fence, climed through my dried-up moat, opened the door with the broken lock, and then stole my potted plant. It cost me a fortune to replace the lock, refill the moat and fix the fence.
    • They didn't have any chairs to sit on in the server room while they fixed security holes, so they made a big pile of money and sat on that, and it worked almost as well. After the whole fiasco NASA is now researching a new more expensive type of money that is more easily convertable to a sitting appliance.
  • Nice to see term not used improperly for a change.

    Sure its just a pet peeve of mine, the mis-use of the term 'hacker', but it doesn't lessen the annoyance factor for me.
  • by Fortun L'Escrot ( 750434 ) on Sunday December 19, 2004 @12:20PM (#11130758)
    say a vulnerability is posted on the web and it happens to affect your systems. how much does it cost you to get your IT department to locate, fix, and patch the problem?

    let's further assume that the party that posted the vulnerability is being purposefully uncooperative. but they agreed to get the vulnerability tested independently by a third party who also happens to be uncooperative. how much does it cost your IT department?

    i havent got a clue. but 200k seems like a lot. it would seem that keeping a network secure is very expensive business. and i agree that this is true for physical installations, but digital? i mean seriously. unless of course you are over working your staff who also answer all the phones for tech support in-house making it impossible to manage their time or actually do the work they were hired for in the first place. but 200k for a bug? jesus.

    i feel really bad for nasa. no matter what system you use there will be bugs and even when that is not the case a system can be badly configured. if each of these issues costs on average 100k (just a guess) to "locate, fix, and patch" can you imagine how much money is going into IT departments right now? or how much money is going into the IT industry? its like paying the plumber 4 times (just a guess) more than his already expensive rates (apparently there is a shortage of plumbers) and honestly believing that this is the way the world should work.

    for crying out loud people. what exactly did this kid do? "shutdown -h now"? and it takes 15minutes to boot up? i mean sorry guys, but maybe you should be protecting your system a little better. i always tell myself. if a teenager can pull a prank like this one there are two things you should do. punish the teenager the way we punish any teenager for a prank like this (which they have sort of done). secondly, get some help securing your systems because a foreign nation will not be looking for space to store movies. they will be out there looking to cripple your systems and not necessarily permanently, 30mins could be critical for a crack squad tectical unit and if it is as easy as just shutting down a server......

    ps. to be fair, it could be that restarting the system as part of their "locate, fix, and patch" program takes a lot of time (more than 10 minutes?). there again my friends i would suggest a better system to reduce your costs. this has nothing to do with me believing you shouldnt punish this guy. but quit posting damages that could have been avoided if you spent a little more time designing a better system that met your needs. if google can do it i am sure you can too.
    if it takes so long to restart your system even during normal maintenance then build redudancy for your production environment. if this is really just about your personal inconvience then remember you are a plumber and that crap cloggin the pipe is your job.
  • by Nimey ( 114278 )
    I'm impressed that some rising-star prosecutor didn't get him sentenced to eight years of hard time. Maybe the system still works here and there.

As you will see, I told them, in no uncertain terms, to see Figure one. -- Dave "First Strike" Pare

Working...