Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

Criminal Charges Filed Against AT&T iPad Attacker 122

Posted by CmdrTaco from the someone-will-be-sad dept.
Batblue writes "The US Department of Justice will file criminal charges against the alleged attackers who copied personal information from the AT&T network of approximately 120,000 iPad users, the US Attorney's Office, District of New Jersey announced Monday. Daniel Spitler will be charged in US District Court in New Jersey with one count of conspiracy to access a computer without authorization and one count of fraud. Andrew Auernheimer will be charged with the same counts at the US Western District Court of Arkansas, which is in Fayetteville. Auernheimer made headlines last June when he discovered that AT&T's website was disclosing the e-mail addresses and the unique ICC-ID numbers of multiple iPad owners. Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information. AT&T said that nobody from Auernheimer's hacking group contacted them about the flaw."
This discussion has been archived. No new comments can be posted.

Criminal Charges Filed Against AT&T iPad Attacker More

Criminal Charges Filed Against AT&T iPad Attacker

Comments Filter:

  • Umm, yeah... (Score:5, Insightful)

    by fuzzyfuzzyfungus ( 1223518 ) on Wednesday January 19, 2011 @10:09AM (#34927536) Journal
    Uncle Sam and Ma Bell go wayyy back if you know what I mean. You don't sass the latter unless you are ready to deal with the former in a very bad mood.

    They did switch from "Engaged" to "It's complicated" a while back; but that part didn't change...

    • Awesome post!

    • You don't want to screw with the phone cops, man. [youtube.com] They blew up a transmitter in Cincinnati back in the 70's when some DJ named "Dr. Johny Fever" got out of hand...

  • Let's get this straight (Score:5, Interesting)

    by Tiger Smile ( 78220 ) <james.dornan@com> on Wednesday January 19, 2011 @10:12AM (#34927574) Homepage

    AT&T illegally gives the DOJ your phone calls, emails, messages, and other personal information in an up-to-the-second interface, and when some kid notices a security flaw the same DOJ comes after him? The public that puts up with this deserves to be treated this way.

    • Information must be free! (Score:3, Funny)

      by Anonymous Coward

      You're 100% right! He needed to scrape all the user information he could and go public with it! Your personal information wants to be FREE, and no corporation can stop its freedom.

    • So by Tigers reasoning, I have the right the just take what I want then.

      • Yup. And if you shoot and kill someone its not your fault since they weren't wearing strong enough body armor to stop the round.

    • Re:Let's get this straight (Score:4, Informative)

      by dunezone ( 899268 ) on Wednesday January 19, 2011 @10:41AM (#34927924) Journal

      Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information.

      Claiming to help? That is a great excuse there. They found a security hole in the system and instead of just reporting it to AT&T they pulled down private information which they did NOT have the right to access. In other words I left my front door unlocked, this doesn't give you the right to go in and snoop around and take my stuff, you CAN however report to me and the newspaper that my door is unlocked. That is why these "hackers" are in trouble. AT&T probably looked at the exploit and then realized not only was there a problem but the people reporting it took private and sensitive information, this then required them to go to the legal system because their liable for this. Most of these major companies have insurance to cover these types of incidents but unless they follow protocol the insurance might not pay out.

      Also the article attached to slashdot is missing information. They also gave the private information to Gawker.

      http://www.informationweek.com/news/storage/security/showArticle.jhtml?articleID=229000863&cid=RSSfeed_IWK_All [informationweek.com]

      And in apparently chat logs exists of these "hackers" discussing to sell or use this information in an illegal way.

      http://www.crn.com/news/security/229000878/feds-nab-web-trolls-in-at-t-ipad-hack.htm [crn.com]

      • Re: (Score:1)

        by shakah ( 78118 )

        In other words I left my front door unlocked, this doesn't give you the right to go in and snoop around and take my stuff, you CAN however report to me and the newspaper that my door is unlocked.

        Isn't the analogy more "If I put a bunch of things in my driveway (think "free" garage sale) along with a sign that said "please take whatever you want", but mistakenly put some of my wife's cherished possessions on display, should I be able to charge you with theft for taking my wife's things?"

      • Re: (Score:1)

        by Sam H ( 3979 )

        I think I can guarantee that no chat logs could exist that show Goatse Security members discussing selling or using the information in an illegal way. Or they would be fakes.

        I have personally answered requests sent to Goatse Security for a while, and have constantly refused all offers to buy or even have a look at the data. I am pretty sure some of the requests were bait to see just how greedy we were, so if the people who tried are honest, they will be able to confirm that no matter the amount of money pro

      • If all that is reported is the complete truth, then I agree with you. But is AT&T lying about being informed of the security flaw? Or in another way, has AT&T not processed attempted contact by the parties charged and forwarded this to AT&T's attorneys? Worse, did AT&T request proof of the vulnerability and then use that as a means to attack and prosecute these individuals?

      • Re: (Score:2)

        by Hatta ( 162192 )

        In other words I left my front door unlocked,

        It may surprise you to learn this, but the Internet is not a residential neighborhood. It is a public space, that which is not restricted is presumed to be accessible. I have to ask your web server for every page of yours that I access. If you don't want me to access it, make your webserver refuse my access.

        Just imagine for a moment if the burden was on the site visitor to ensure that he was authorized before he viewed a page. How would the internet work?

        • Sadly, I'm betting your argument trumps this guy's lawyer's. Lawyers always avoid the obvious because it doesn't hedge the bets.

      • If you left it out and available on the internet it is no longer private information.

        Any arguments to the contrary are basically cya bullshit.

    • Absolutely right. It's only illegal if you aren't paying AT&T/Facebook/etc for the user information you're taking.
    • Comment removed based on user account deletion

    • Re:Let's get this straight (Score:4, Interesting)

      by erroneus ( 253617 ) on Wednesday January 19, 2011 @11:18AM (#34928390) Homepage

      We are at the point ("beyond" the point is still at the point) where we need a Wikileaks for security issues. Increasingly, it is becoming hazardous to expose weaknesses in systems and services that render personal and/or sensitive information vulnerable. We are not going to change the government or regulatory bodies' minds about what appropriate means or whose interests are of higher priority. So it is best to decide whether it is best to claim the glory of being the discoverer or implementer of the exploit or if the knowledge needs to be out there without risk to your identity being connected with it.

      Stupidly, there are going to be "myspace/facebook" mentalities who will go for the fame regardless of the dangers. Personally, I would prefer to conceal my identity and get behind a wikileaks body to launder my identity from the work.

    • I've had problems with security disclosures before involving banks. Seriously, I need advice on responsible disclosure. Then I should start a wikileaks-style effort to help other people with the same.

    • You have a very strange morality. You are justifying the means to suit your ends. What he did was wrong. Not exposing the flaw, but going public with private information. As others have said, your concept of right and wrong is akin to anarchy.

    • Re: (Score:2)

      by Prune ( 557140 )

      "some kid"? Auernheimer has a Rolls Royce Silver Phantom and a history of major hacking successes. http://www.nytimes.com/2008/08/03/magazine/03trolls-t.html [nytimes.com] Some kid, indeed!

  • Bogus Charges (Score:2, Insightful)

    by Anonymous Coward

    The site was exposing the information. There was no unauthorized access, writing a script to parse publicly available information is not hacking.

    Anyone know what the fraud charges are?

    • Ummm, no. He was clearly accessing the system in a manner not intended. I don't lock the door to my house, but if you come and look through my things, you're still tresspassing, and it's still illegal.

      • Re: (Score:2)

        by scrib ( 1277042 )

        I find fault with the house analogy. It's common knowledge that you are not supposed to walk into someone's house uninvited. Websites are, for the most part, specifically designed as public spaces for any visitors. It is a very rare case in which a legitimate website actually invites you to access it.

        A better analogy would be if AT&T got a giant billboard labeled "AT&T Customer Registration Data for AT&T customer use only" which listed all the information.

        I know my analogy isn't perfect, but it'

  • this isnt a matter for the courts. I say we gather all the apple fanboys, give em apple branded pitchforks and let em loose. To give the guy a sporting chance, we hold the event in a large forest and he gets a 30sec head start

  • AT&T's motto: Trust Us (Score:3)

    by digitaldc ( 879047 ) * on Wednesday January 19, 2011 @10:15AM (#34927614)
    AT&T has the fastest 4G network....trust us.

    AT&T would NEVER compromise your data...trust us.

    • AT&T has no 4G network, and for that matter, nobody has one. The 4G specs mandate 100mbps of bandwidth.

      p.s. at 14-21mbps, theirs is definitely in the running for fastest HPSA+ or 3G+.

  • I thought an iPad Attacker whacked someone else on the head with an iPad. It would be a hoot and a half in court:

    Prosecution: "Your Honor, we charge the suspect with assault with a deadly weapon."

    Defense: "Your Honor, iPads are not classified as deadly weapons."

    There is probably a legal precedent somewhere. Laptops have been around for a long time enough, that someone whacked someone else on the head with a laptop.

    • Re: (Score:3)

      by Graff ( 532189 )

      There is probably a legal precedent somewhere. Laptops have been around for a long time enough, that someone whacked someone else on the head with a laptop.

      Google is your friend. [patch.com]

  • This may scream for jury nullification or no-bill (Score:3, Interesting)

    by davidwr ( 791652 ) on Wednesday January 19, 2011 @10:18AM (#34927662) Homepage Journal

    I'm going to assume for the sake of argument that the facts will prove he broke the law. If they don't the rest of this post doesn't apply to this case but it is still interesting from an academic/hypothetical perspective:

    It's hard to say what is "just" in a case like this.

    Is it more just to officially sanction (in the form of a guilty verdict by a jury) his behavior even though it was done with good intentions, or is it more just to officially (in the form of a non-guilty verdict or a grand jury declining to indict even if the facts prove guilt) say that it's in society's best interest that this behavior be tolerated or even encouraged in this context?

    Refusal to indict or refusal to convict in the presence of proven guilt is an important part of American jurisprudence. While such events should be very rare as prosecutors should never let cases get this far, no-bills and jury nullifications "in the interest of justice" are the people's last chance to say "the application of the law in this case is unjust -or- the law itself is unjust." Assuming the law or its application is not unconstitutional or otherwise illegal, once a jury convicts the now-convicted-criminal is at the mercy of the Executive Branch for a pardon or commutation.

    The sad part is neither the jury nor the grand jury will likely be allowed to see anything but the hard evidence and most or all of both groups will be too technically naive to make an informed decision as to whether it is more just to release this person or to indict and convict him.

    • Weev doesn't do anything with good intentions, and this was no exception.

    • Re: (Score:2)

      by Restil ( 31903 )

      Jury nullification is a double edged sword. While the pot smokers and computer hackers amongst us can imagine a world in which they'll never see a conviction based solely upon a jury's refusal to convict them in spite of clear definition of the law and no reasonable doubt, that same jury could find an innocent black man guilty of a crime against a white woman (think "To Kill a Mockingbird"), even though the evidence clearly shows that no crime was committed.... just because he's black. Of course, while th

      • Re: (Score:1)

        by Anonymous Coward

        I had a friend on a jury not long ago and one of his fellow jurors said guilty in the initial vote. When asked why, she responded, because the cops arrested him. Don't think every juror understands the concept of logic. They are, more often than not, average people and the average person, at least where I live, is pretty dumb. It took hours of arguing that while the guy very well might have been guilty, witnesses' memory was too flaky by this time to really say what happened. The trial was over an assault,

    • Is it more just to officially sanction (in the form of a guilty verdict by a jury) his behavior even though it was done with good intentions...

      I don't know how you prove your "good intentions" in court without taking the stand and exposing yourself to a withering, relentless, wholly unconstrained, examination of your character, history and behavior.

      The prosecutor will take you apart, piece-by-piece, beginning with your taste for "Goatse."

      Refusal to indict or refusal to convict in the presence of proven gu

  • Ethical disclosure (Score:5, Interesting)

    by SirGarlon ( 845873 ) on Wednesday January 19, 2011 @10:21AM (#34927690)

    "We believe what we did was ethical," Auernheimer told Computerworld last June. "What we did was right."

    The federal prosecutor disagrees. If you follow the link in TFA, you'll find:

    Rather than contact AT&T directly with what they'd uncovered, Goatse [Security] tipped off an unnamed third party, who in turn reported the design flaw to AT&T. Goatse took that route, Auernheimer said, to prevent AT&T from preventing the group from publicizing the e-mail address exposure.

    So, they found a flaw, then hid their identity, and didn't contact AT&T directly, instead disclosing the flaw to a third party (who can be trusted because ...?), because they thought AT&T might react differently than how they wanted it to. This is ethical exactly how?

    • Re:Ethical disclosure (Score:5, Insightful)

      by gnasher719 ( 869701 ) on Wednesday January 19, 2011 @10:27AM (#34927768)

      The federal prosecutor disagrees. If you follow the link in TFA, you'll find:

      So its like he claims: "I wanted to point out your security failures, so I opened your safe". And the federal prosecutor says: "You actually opened the safe and took the money out". While the first is possibly illegal, but let's us argue that no harm was actually done, the second is pure and simply theft.

      • It's more like:

        I opened your safe and took pictures of what was inside.

        Assuming the pictures were of mundane items that didn't reveal any secrets - such as a mundane picture of a bank vault with stacks of cash - then you can argue that no harm was done.

        If the picture is a clearly readable copy of the Coca Cola recipe on the other hand, then releasing it may be harmful.

        As to releasing "the picture" to an "responsible third-party escrow" as was done here, the ethics boil down to:
        * Was there a good reason to b

      • Re: (Score:1)

        by Yakasha ( 42321 )

        The federal prosecutor disagrees. If you follow the link in TFA, you'll find:

        So its like he claims: "I wanted to point out your security failures, so I opened your safe". And the federal prosecutor says: "You actually opened the safe and took the money out". While the first is possibly illegal, but let's us argue that no harm was actually done, the second is pure and simply theft.

        The only problem with your analogy is the lack of mention that the safe was on your front lawn, open, with a large sign saying "Please, help yourself to everything inside."

        • with a large sign saying "Please, help yourself to everything inside."

          What part of the real situation does that correlate to?

          • Re: (Score:1)

            by Yakasha ( 42321 )

            with a large sign saying "Please, help yourself to everything inside."

            What part of the real situation does that correlate to?

            A website, offered to the world with no access restrictions containing a web form specifically for the purpose of retrieving the exact information the "hacker" collected combined with a TOU document that does not prohibit such actions.

      • So its like he claims: "I wanted to point out your security failures, so I opened your safe". And the federal prosecutor says: "You actually opened the safe and took the money out". While the first is possibly illegal, but let's us argue that no harm was actually done, the second is pure and simply theft.

        I'm not a terrorist, I was just pointing out your airline security failures.
        Love, Osama.

      • > I wanted to point out your security failures, so I opened your safe

        Your safe is yours, their safe is $everyones.

        > actually opened the safe and took the money out"

        No. He made a digital _copy_ of the "money," their "wallet" still has the original "money." IOW, I have a Melbourne Red Metallic 2011 BMW M3, you are welcome to copy it (that's what the metaphor you're buying into is saying)! I will still have mine. Is OK with me, 'cause, I want a copy of your 1955 Chevrolet Series 3100 pickup. Hey if this

  • Perhaps I misread the story, but this "hacker" wrote a script to gather information that AT&T made public on their website, and HE is the one in trouble?

    • Re: (Score:3)

      by Jaysyn ( 203771 )

      Auernheimer made headlines last June when he discovered that AT&T's website was disclosing the e-mail addresses and the unique ICC-ID numbers of multiple iPad owners. Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information. AT&T said that nobody from Auernheimer's hacking group contacted it about the flaw.

      That pretty much sums it up. I wonder if the EFF will get involved?

  • web browsing is illegal now? (Score:5, Interesting)

    by wolfgang_spangler ( 40539 ) on Wednesday January 19, 2011 @10:35AM (#34927858)

    From the article:
    In a blog post earlier today, Auernheimer spelled out Goatse's case. "All data was gathered from a public webserver with no password, accessible by anyone on the Internet," he wrote. "There was no breach, intrusion, or penetration, by any means of the word."

    How did he do anything illegal?

    • Re: (Score:1)

      by Anonymous Coward

      No good deed goes unpunished. Thank you for visiting the United Corporate of America (tm).

    • Re: (Score:1)

      by Anonymous Coward

      Don't believe that the laws mean what most people think they do.
      I was recently convicted for a _very_ similar incident (here in Norway).
      There was no intrusion like most people would think ("breaking a lock/protection" etc) , but I was still convicted since the data was not meant to be publicly accessible.

      • Re: (Score:3)

        by Cwix ( 1671282 )

        Thats like putting a sign on your lawn and suing anyone who pauses to read it.

        • Re: (Score:2)

          by tgd ( 2822 )

          No, the correct analogy is that you aren't welcome to enter my house and take my microwave because I'm having an open house and have a plate of free cookies out.

    • You run a business. Your front door was open. Your office is open and it didn't say "private" or "employees only" on the door and there was no reason for me to think it was off-limits to the public. Printouts of your customer confidential data are on your desk in plain view.

      I walk in and start taking pictures then share those pictures.

      Did you do anything illegal?

      I can probably beat a trespassing rap but I probably could not beat charges related to my copying and disseminating the information unless it wa

    • He collated the information and distributed it, for one. By analogy, compare noticing the file cabinet's been left unlocked and telling someone, against photocopying everything, giving it to the gossip sheets, and then couting on those to tell someone.

    • The users have a reasonable expectation of privacy (in spite of AT&Ts carelessness). He willfully violated the users' rights to privacy. Capturing email addresses and ID numbers also likely falls under the category of identity theft.

  • ... of course they did. They are a massive company in size, and any company that size who puts info on the Web knows that they must legally protect this data.

    Since I don't have all the info in this I can only make assumptions based on what I read in the article.
    * AT&T made an application on their web site that allows an individual to enter in key info and pull back specific user data.
    * Individuals were surfing around AT&T's website
    * It was stated in one article that Hackers "guessed" 114,000 iPad I

  • The definition of insanity (Score:3)

    by Zontar_Thing_From_Ve ( 949321 ) on Wednesday January 19, 2011 @11:31AM (#34928570)
    ... is doing the same thing over and over again and expecting a different result.

    How many times on Slashdot have we seen the following scenario?
    1) Hacker finds security hole.
    2) Hacker uses security hole to login to system. He may or may not do questionable things there.
    3) Hacker gets caught and there's proof he was on the system and he wasn't authorized to be there.
    4) Hacker looks at a trial and possible jail time.
    5) Hacker claims innocence, saying that he was "just trying to help get the problem fixed".

    Really, if you haven't learned by now that logging into systems where you don't belong may get you into deep trouble, there is no hope for you.

  • Granting that didn't contain anything sensitive. Rare to see a real name.

    It did contain a wealth of usage data which their competitors wanted.

    That was not hacking in any meaningful sense of the word. Program entered player# then sucked results into database.

  • but i DID submit a much better title for this story:

    "Goatse Security Busted Wide Open"

    http://slashdot.org/submission/1447640/Goatse-Security-Busted-Wide-Open [slashdot.org]

  • You consider someone who already contacted AT&T and never got a returned phone call or email a hacker because he thought the people should know their info is unsecure...well then I guess most people could be considered hackers too....as I would want anyone in my close proximity of services to know if their services was ailing.

  • Two articles this [crn.com] and one refered to by the first state "facts" that are in opposition. [crn.com]

    The first states that the accused ran their tool June 5 to June 9th, and released on July 10th.
    The second states that AT&T fixed the hole on June 8 and told affected users about the breach on June 9th.

    I see reports [crunchgear.com] that this information was on Gawker on the 9th, not the 10th.

    I see reports [allthingsd.com] from June 14 that AT&T sent messages claiming to have learned of the fault June 7th. This seems likely to have been because Au

Slashdot Top Deals

Never test for an error condition you don't know how to handle. -- Steinbach

Close