6-Month Sentence for NASA Cracker 329
lunartik noted an AP story running on a 6-month sentence given to
Gregory Aaron Herns for cracking into the computer system at NASA's Goddard Space Flight Center. 'Herns told federal agents he was looking for computer space to store movies he'd downloaded. It took hours for technicians to find the problem, fix it and patch the system's security holes.'"
With the direction Slashdot has been going lately, (Score:5, Funny)
Policing our own (Score:5, Insightful)
Re:Policing our own (Score:3, Interesting)
Right, but I see you have a UID in the seven hundred thousands. You're new here! You see, you are absolutely correct - if we are professionals, then we should act like professionals. Unfortunately, the parent post is more correct - with the direction Slashdot has been going lately, I'm surprised that
Re:Policing our own (Score:2)
Since the prosecuter wouldn't be able to prove him wrong, he would have gotten off and had the case dismissed.
Should this happen to you, I suggest that you try it. You have nothing to lose and every reason to believe that you can get away with it.
I'd love to see a breakdown of the damages (Score:4, Interesting)
Re:I'd love to see a breakdown of the damages (Score:2)
Re:I'd love to see a breakdown of the damages (Score:5, Insightful)
Re:I'd love to see a breakdown of the damages (Score:4, Informative)
Am I a competent sysadmin in this scenario? If "yes," then I guess I'm probably running a tripwire [tripwire.org] of some sort. So I boot from CD, take a look at what's been changed, and fix it. If I'm really on the ball, I'm using something like radmind [radmind.org], in which case I still boot from CD, but I let radmind reverse any damage that had been done.
Re:I'd love to see a breakdown of the damages (Score:2)
Re:I'd love to see a breakdown of the damages (Score:4, Informative)
It's just a matter of principle in high value systems. What happens if he replaced the policy and key files for tripwire, masking his trail? What happens if he knew the passphrase to use the local and site keys? Even if you know he could not, it just isn't worth the risk. Either take your time to drill down and dig out the pieces, or take the same time to wipe and reinstall. For my money, I feel more secure about wiping and reinstalling.
Re:I'd love to see a breakdown of the damages (Score:2)
Re:I'd love to see a breakdown of the damages (Score:5, Insightful)
Re:I'd love to see a breakdown of the damages (Score:2)
Re:I'd love to see a breakdown of the damages (Score:2)
This is what he says he was seeking. What he intended to do, or what access he sold off to others may be different. I could tell you all day that I was breaking into your machine in order to fix things. However, I've already committed one illegal act. If I really wanted to make the shuttle go boom, why would I honestly tell you that and get myself into more trouble? I'd make up some story that sounded good at t
Re:I'd love to see a breakdown of the damages (Score:2)
Re:I'd love to see a breakdown of the damages (Score:2, Funny)
Well now, you had a port open on your firewall, and "pswrd" as as the password for root, so, it took me 1/2 hour to fix, plus 3 1/2 to get through security, so at $50,000 an hour, that will be 200k! I take personal checks...
Re:I'd love to see a breakdown of the damages (Score:2)
I'm not at all saying the cracker was right to break into NASA's systems. What I am saying is NASA has a responsibility to keep its systems secure, and spend the re
Re:I'd love to see a breakdown of the damages (Score:3, Insightful)
I/O, This is true, but you must remember at many educational and scientific institutions there are a lot of undocumented machines that sit back in the corners and closets that are not properly patched. This is because the institution does not want to seem fashist about their "computer policies" that could ha
Re:I'd love to see a breakdown of the damages (Score:5, Insightful)
There was much appreciation for the progress being made on the case. Apparently, the FBI had their suspect and were busy building an air-tight case for prosecution. There was a general air of victory. But what many failed to realize was the whole exercise was a signal of defeat. The incident represented potential compromise of data. It involved considerable man hours spent on investigation and recovery of the system. It also represented loss of equipment removed from the budget-strapped lab to support forensics activities.
This represents a couple different problems with the common view of information security at NASA.
It shows a lack of understanding of infosec issues. Instead of approaching infosec as a technical problem, the issue often gets far more attention as a legal / law enforcement issue. This is attitude calls for action after the damage has been done.
It shows a inappropriate focus on funding. All IT budgets are stressed. NASA is no different, and perhapses even more thinly spread than others. That means infosec activities tend to get cut in favor of other IT activities. Yet there is no perceived issue in later spending considerable resources to prosecute each infosec incident.
It may be worth stressing that this meeting happened several years ago. And there have been changes in how NASA, and the US Government in general, now perceive information security. So my observations do not represent an all-inclusive view of infosec at NASA (and those observations are my opinion and not policy of my employers). None the less, these observations are still applicable today.
One side observation to anyone considering taking a stab at *.nasa.gov space. Historical statistics show that you'll find suitable targets and manage to compromise a system. But keep in mind, for the US Government that is just the beginning. The FBI views a case as making progress over several years of investigation and finally prosecution. So the compromise of a system that takes minutes, and the abuse of that system over a period of weeks or months may mean that years later you'll find yourself in court.
Give the "damages' cost to the hacker (Score:3, Insightful)
Instead of going to the courts with a trumped up case about supposed damages in hundreds of thousands of dollars, they should give hundreds of thousands of dollars to the people who document holes in the security of sensitive systems.
And tax-free, too, if you please.
And give this kid the job of special intern for security at a decent salary. Loyal
Re:I'd love to see a breakdown of the damages (Score:2, Troll)
Re:I'd love to see a breakdown of the damages (Score:3, Insightful)
Re:I'd love to see a breakdown of the damages (Score:2)
But, what to expect from juniors who simply think that systems are a couple of "big" programs hooked together.
Wow... (Score:4, Insightful)
Re:Wow... (Score:3, Insightful)
If the guy was technically decent, it's a shame he'd be sent to a federal fuckodrome...
Re:Wow... (Score:2)
And he will find them.
Re:Wow... (Score:2)
It was the bandwidth he was probably after. He was probably setting up a place to exchange with others.
Re:Wow... (Score:2)
There's a self-deterioration effect, though, since if *you* can write stuff there, other people can write stuff there too, and they can delete stuff, which is a lot quicker than uploading it.
Re:Wow... (Score:3, Interesting)
Bad movies (Score:3, Funny)
Re:Bad movies (Score:2, Funny)
Great idea (Score:5, Funny)
LETS HACK NASA!
Step 1: Download movies.
Step 2: ???
Step 3: HACK NASA!
Re:Great idea (Score:4, Funny)
Re:Great idea (Score:5, Funny)
Sorry officer... (Score:2)
Mmm. No. (Score:5, Funny)
More like breaking into a bank vault to store the bicycle you just stole.
Re:Mmm. No. (Score:5, Funny)
****FOR IMMEDIATE RELEASE****
Longtime Slashdot.org member Ligur (453963) has been selected to replace Assistant U.S. Attorneey Greg Nyhus. Nyhus, although promising, proved unable to form relevent analogies in meetings with the press. Ligur, although not formally trained in law (a condition known as IANAL) is highly knowledgeable in general subjects, has excellent karma, and is frequently moderated to +5 funny.
Re:Mmm. No. (Score:3, Interesting)
Fire Hose Justice (Score:2)
Which is fine, as long as Uncle Sam is holding the fire hose, and rioting citizens are taking the splash -- and not the other way around [oz.net].
-kgj
crackers (Score:3, Interesting)
That's so obviously the cracker's fault...
Re:crackers (Score:2, Funny)
Re:crackers (Score:3, Interesting)
What we're objecting to is the idea that part of the "damages" this thief is being charged with would be the installation of bars in the windows afterwords.
Sure, charge him for actual damages, such as cleanup & verification. But charging him for patching the holes?
This is a good thing (Score:5, Insightful)
This is how the system is supposed to work.
Re:This is a good thing (Score:2)
Re:I don't know (Score:2, Insightful)
Re:I don't know (Score:2)
Really? (Score:2)
It's not like it was 6 years or something.
Put these morons to use (Score:3, Funny)
NASA could get valuable data, some small furry woonland creatures would be saved this fate and the world would have a few idiots less. Win all round scenario.
Maybe he hadnt checked pricewatch recently (Score:3, Insightful)
Re:Maybe he hadnt checked pricewatch recently (Score:3, Informative)
Tip to future crackers... (Score:2)
...who need hard drive space. Hard drives are VERY cheap [newegg.com] nowadays! My god. How many movies did this guy have?!
Huh? (Score:3, Funny)
He must be talking about Windows
Yes, your honor ... (Score:3, Insightful)
Nice (Score:2, Insightful)
Restricted access to computers -- has to change (Score:4, Insightful)
Herns was ordered to pay restitution for the damage he caused and will have limited access to computers for the next three years. After the judge outlined the terms of Herns' restricted computer use, Levine pointed out how hard those conditions will be for a man who does everything online, including paying his bills.
"He's going to get to learn," Brown said. "There are other ways to live."
The Canadian government has declared internet connectivity to be (I forget the exact term) a "necessity" or something.
If you rob a bank, do they forbid you from walking into any type of business establishment for the entire duration of your parole? No! It would be idiotic - everyone needs a bank account or groceries in today's society, and there are already tons of other perfectly good laws to deal with the individual should they commit a crime in a bank or other "place of business" again.
If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.
Judges are going to eventually have to stop throwing out blanket "computer bans" as minor parole conditions - and realize that they have to handle it differently. PCs may/can be the basis of entire home entertainment centers, your library, your photo album, your telephone, etc etc.
What they should do (and what would be more effective) is to ban the user from say spending more than 30 minutes at a time on a PC, or making an IP connection to a class of third parties, or posessing any tools or software that could be used for illicit purposes - and then have the parole officers make unannounced audits and/or taps.
This goes along the lines of what kind of an effect would it have on you and your life if the police seized your computer in the midst of an investigation (not even an investigation into you, say your webcam caught some images of a crime). My PC is all of the things I listed above and more. And remember, saying "make backups" doesn't cut it, they always take your backups too and withholding those could get you in even worse trouble.
To put it another way - the police need to develop methods that don't "deny you use of your entire house just to check the window for fingerprints".
If they want to ghost the drive and look at the inside of the system before they leave, that's fine. But taking the entire thing for an indefinite period - unacceptable. (I'm talking about when I'm not the suspected murder or something
Oh cry me a river. (Score:5, Insightful)
This guy was an idiot and got what he deserved. Sorry. Perhaps he should have though first before compromising a piece of United States Government property.
Re:Oh cry me a river. (Score:2)
Re:Oh cry me a river. (Score:2)
Uh, no. Perhaps you aren't aware that breaking into government systems is illegal. Also, loading illegal movies onto them is illegal. It's about his being a criminal.
Re:Oh cry me a river. (Score:2)
Re:Oh cry me a river. (Score:2)
Re:Restricted access to computers -- has to change (Score:2)
Your analogy about cars is not even close. The ban does not stop someone else from using a computer on his behalf. He can go to the bank to pay his bills, and the bank teller will use a computer to pay the bills. Or he can use phone banking. You don't need a computer to live a ful
Re:Restricted access to computers -- has to change (Score:2)
be allowed to get a gun permit;
As you said, you might lose driving privledges under certain
circumstances. analogus to losing computer use. Unlike
your example of riding a bus, there is no practical way to
have somebody else do your driving on the PC for you.
A lot of damage can be done in 10 minutes, let alone 30.
What judges must determine is the intent. Was the hacker
intending to be malicious or intending to use a system not
his own for the commissio
Re:Restricted access to computers -- has to change (Score:2)
Such as a compiler?
This just doesn't make sense (Score:5, Insightful)
Let's assume for a moment that all of his movies were DivX-encoded at 650 MB each, just for the sake of argument.
* Hard drives four years ago were still relatively inexpensive. By working at McDonald's part-time for three weeks or so he could have had a new hard drive.
* Even if he had so many movies that he required an additional hard drive, why could these movies not have been burned to CD-R instead? CD writers were available for less than $100 and CD-Rs could have been found for less than 50 cents a piece. He could have had virtually unlimited space as long as he purchased a new spindle now and then. (See afformentioned McDonald's reference.)
* Most importantly, what did he expect to do with those movies? Unless he had a T3 or something equivalent to his house, he would have had to wait hours to both upload for storage and download to view. I've had 1.5 Mb/sec DSL for four years, so I know that it would have been feasible back then, but it still would have been far less effort to burn them to CD-R. And at least then they would have been portable, far more so than a hard drive.
* Assuming 1.5 Mb/sec broadband, it would have taken almost an hour just to download one movie. So, he would have taken an hour to download, an hour to upload (at the VERY least since most broadband companies don't use the same upload/download speed), and another hour to download when he wants to watch it? Was he planning on installing a streaming media server as well?
* Why NASA? Why not find some schlep on his ISP who wasn't running a firewall, had lots of space, and store the data there? A Joe-Clueless-User would have been far less able to determine who was storing data on his system than NASA.
I'm sorry, but I just dont buy the "he was looking for computer space to store movies he'd downloaded" line. It makes absolutely no sense whatsoever. Sounds more to me like he was doing something nefarious and was hiding it or he was just looking for ego points and got nabbed in the process.
Re:This just doesn't make sense (Score:3, Insightful)
*Hard Drives Are Cheap* - Sure, but so are most University Students,
*Burning to CD-R* - No, Means the movies are inaccessable from anywhere else, CD-R's rot, and you are assuming they are 650MB DivX's, what if they were not? What if, (God forbid) he wanted a little quality in his movies?
*What to do with them?* You get a little confusing here, and are mixing points, (Connection speed vs portability), Whats more portable than a server online? with basically assured 24/7 uptime?, As well,
Re:This just doesn't make sense (Score:2)
What he was doing wasn't just storing movies. It was storing movies in a place where others could download them. Having movies gives you points, but having movies on a really big internet connection and letting lots of other people download them gives you major points. Especially if you set it up as a trade system, so you *get* lots of movies and such at the same time.
NASA (like most companies) has lots of space on a big internet connection. There ya go.
Re:This just doesn't make sense (Score:2)
Rational thought from a teenage mail? (Score:2)
Are you from a different planet?
Re:This just doesn't make sense (Score:2)
No sh*t - I've just bought an NEC OEM 16x dual layer DVD+/- CD-R/RW burner for £36.00 ($70) from an online store. Hate to think what the profit margin was for all concerned.
Yeah - let's give the CS student a computer ban... (Score:3, Insightful)
And 200k of damages? Er, did he delete research papers or something? (If he did, to make room for his movies, he does deserve it, though).
Sounds more like 200k to finally get their asses moving to fix some security holes, which were there in the first place.
He went into my house, through the big holes in my fence, climed through my dried-up moat, opened the door with the broken lock, and then stole my potted plant. It cost me a fortune to replace the lock, refill the moat and fix the fence.
Re:Yeah - let's give the CS student a computer ban (Score:3, Funny)
Wow, the word 'hacker' wasnt abused, for once (Score:2)
Sure its just a pet peeve of mine, the mis-use of the term 'hacker', but it doesn't lessen the annoyance factor for me.
when you know there is a bug... (Score:4, Insightful)
let's further assume that the party that posted the vulnerability is being purposefully uncooperative. but they agreed to get the vulnerability tested independently by a third party who also happens to be uncooperative. how much does it cost your IT department?
i havent got a clue. but 200k seems like a lot. it would seem that keeping a network secure is very expensive business. and i agree that this is true for physical installations, but digital? i mean seriously. unless of course you are over working your staff who also answer all the phones for tech support in-house making it impossible to manage their time or actually do the work they were hired for in the first place. but 200k for a bug? jesus.
i feel really bad for nasa. no matter what system you use there will be bugs and even when that is not the case a system can be badly configured. if each of these issues costs on average 100k (just a guess) to "locate, fix, and patch" can you imagine how much money is going into IT departments right now? or how much money is going into the IT industry? its like paying the plumber 4 times (just a guess) more than his already expensive rates (apparently there is a shortage of plumbers) and honestly believing that this is the way the world should work.
for crying out loud people. what exactly did this kid do? "shutdown -h now"? and it takes 15minutes to boot up? i mean sorry guys, but maybe you should be protecting your system a little better. i always tell myself. if a teenager can pull a prank like this one there are two things you should do. punish the teenager the way we punish any teenager for a prank like this (which they have sort of done). secondly, get some help securing your systems because a foreign nation will not be looking for space to store movies. they will be out there looking to cripple your systems and not necessarily permanently, 30mins could be critical for a crack squad tectical unit and if it is as easy as just shutting down a server......
ps. to be fair, it could be that restarting the system as part of their "locate, fix, and patch" program takes a lot of time (more than 10 minutes?). there again my friends i would suggest a better system to reduce your costs. this has nothing to do with me believing you shouldnt punish this guy. but quit posting damages that could have been avoided if you spent a little more time designing a better system that met your needs. if google can do it i am sure you can too.
if it takes so long to restart your system even during normal maintenance then build redudancy for your production environment. if this is really just about your personal inconvience then remember you are a plumber and that crap cloggin the pipe is your job.
Wow (Score:2)
Re:Makes perfect sense!?! (Score:5, Insightful)
Re:Makes perfect sense!?! (Score:2, Insightful)
Lets see...
"Here we have a person that is very much talented towards lockpicking..."
Does a lockpicker know much how to build efficient locks actualy?
Does a computer security breaker know much how to actualy build secured systems?
Is that much different?
Re:Makes perfect sense!?! (Score:2)
Bzzzt! Wrongo. What he said was...
"Does a lockpicker know much how to build efficient locks actualy?
Does a computer security breaker know much how to actualy build secured systems?
Building that effecient lock and secured system is about designing same, not about assembling components, ala Tinker Toy.
Also, you can buy books on how to pick locks and find bookoo info on exploiting security holes. Your straw just burnt up.
Re:Makes perfect sense!?! (Score:3, Insightful)
No, here we have a first-class idiot that felt breaking into a NASA system to illegally use their storage space (likely to set up a public FTP full of pirated movies) was preferable to something semi-sane like buying another hard drive or server.
I guarantee you there's plenty of law-abiding people out there that vastly outclass th
Re:Makes perfect sense!?! (Score:2)
Perhaps thinking before committing one of those felonies would have done him some good.
Seventeen is plenty old enough to know good and goddamn well that what he thought of, planned, and executed was fucking illegal. If he didn't, then I sure's hell don't want him further educated in his abilities.
He and only he pissed away his career-making years. Tuff shit.
Re:Makes perfect sense!?! (Score:2)
Must be your first time on
Re:Hacking Vs Cracking (Score:5, Informative)
I disagree.
Cracking == Breaking or "cracking" any type of computer security, weather it be software or a server.
Hacking == Programing.
Re:Hacking Vs Cracking (Score:2)
...and companies who write quick user interfaces in C because it's 1337 usually don't stay in business past year 1. Use the right tool for the job.
If the customer wants a program that collects a couple choices from the user on his desktop machine, writes it to a file and FTPs it off to some central server, I use VB. If they want a server program that processes 3000 100k files every hour, and mig
Re:Hacking Vs Cracking (Score:4, Informative)
Re:Hacking Vs Cracking (Score:2)
Re:Hacking Vs Cracking (Score:2)
Re:6 Month Sentence for NASA Cracker (Score:2, Insightful)
Re:6 Month Sentence for NASA Cracker (Score:2, Insightful)
Re:6 Month Sentence for NASA Cracker (Score:2)
Re:6 Month Sentence for NASA Cracker (Score:2)
The sentence seems a bit much considering the intent of the crime (stupid attempt at finding DL/UL site), but not really unduly harsh.
Re:6 Month Sentence for NASA Cracker (Score:2)
Moll.
Well it's not exactly new.... (Score:2, Funny)
Re:Harsh (Score:2)
Re:Harsh (Score:2)
Um....that's the point.
Re:Responsibility (Score:2)
Re:Responsibility (Score:2)
I don't see how you can say that since his purpose was to illegally make use of someone else's assets. As someone else has pointed out, this is no different than having substandard locks on one's house. Just because someone can easily break into your house doesn't make the actions of the robber justified.
Saying that the robber broke in to store his couch in the basement just so he can point out the substandard locks is just stupid.
Re:Responsibility (Score:2)
Re:Responsibility (Score:2)
That would depend on how good your lawyer is!
Re:In space nobody can ... (Score:2, Informative)
Re:SELinux (Score:5, Insightful)
Cracking into NASA is one thing. You're up against propellor-heads and zoomies, nice people who think space is neat. Cracking into the NSA is a whole 'nother ballgame. Those folks are professional paranoids, and while they don't kill people, they certainly know people who do.
Re:Kevin Mitnick (Score:3, Interesting)
Kevin Mitnic hacked into Sun's systems and read some of the OS code. Before his sentance was up SUN OPEN SOURCED at least SOME of this code. Furthermore, Sun claimed millions in loses for this intrusion. Yet we can all see the sun is setting on SUN. The value is in millions of people having access to the source code so like a languge (english for instance) it can be used and improved apon and adapted to meet a wider range of needs. English for instance would h