WarTalking Arrest 396
PhotonSphere writes "Having helped organize HoustonWireless.org, this really caught my attention! A Houston computer security analyst has been charged with 'hacking' after demonstrating the insecurity of a court's wireless LAN! This happened Wednesday and is only now getting the attention of the wireless community. The Register has the full story."
Mmhmm. (Score:3, Insightful)
Re:Mmhmm. (Score:2, Insightful)
Re:You Are Correct... (Score:2)
So? He wasn't an employee, he wasn't responsible for the system, and whether they fixed it or not wouldn't have affected him. That's like me breaking into your house to "prove" how bad your security is, then justifying it by complaining that if you had just told me how bad my locks were I wouldn't have changed them.
Re:You Are Correct... (Score:2, Insightful)
Person A: Your house is vulnerable. Somebody could break in anytime he/she wants.
Person B: Is not!
Person A: Yes, it is. And I suggest you get it fixed before somebody takes advantage of it.
Person B: Proove it!
Person A: Puts hand on front door's doorknob, turns doorknob, pushes door open. See?
Person B: Dials 911 on his cell phone. Hello, I'd like to report that "Person A" just broke into my house, and I want to press charges.
Re:You Are Correct... (Score:2)
So, analogy would be:
Person A: Your house is vulnerable. Somebody could break in anytime he/she wants.
Person B: Is not!
Person A: Yes it is. And suggest you get it fixed before somebody takes advantage of it.
Person B: Prove it!
Person A: Puts hand on front door's doorknob, turns doorknob, pushes door open. See?
Person B: Well I'll be. I'm glad you showed me before anyone else broke in.
Person A: No problem. By the way, I did the same thing last week; went into your house, rifled through your papers, drank your beer. No need to thank me.
Person B reaches for the cell phone...
What he did was stupid. (Score:3, Insightful)
Had he called their IT director, described the flaw to him in private, he chose to take it to the press first. He might actually have won business from the IT director had he been a little more professional about it.
Unfortunately, he chose to try and shock not only them, but the public as well.
He pulled an incredibly stupid stunt: did something illegal and told people about it. Don't you think he should've been arrested, too?
- A.P.
Re:Mmhmm. (Score:2, Insightful)
> If you want to make a point make it the legal way like the rest of us.
Hmmm...so notifying a public official is illegal now? *sigh* One more thing I'll have to remember, I guess. Just out of curiosity, what would you have done upon finding that peoples' -- possibly your own -- private information were being sent through the air, open to anyone with a network card? Ignored it? Well, that would make you a good little citizen, wouldn't it. Certainly better than actually doing something useful. Better yet, you could have dropped a few grand on a lawyer to sue them for privacy violations. That would be truly American!
There's no evidence here that this man was acting with any malicious intent or action. Why would you be so quick to label it "breaking in," when we're talking about a network broadcast over public spectrum. Hardly like throwing a rock through a window. A little bit more like watching TV, perhaps.
Deserved it. (Score:3, Insightful)
Just because you *can* do something doesn't mean you *should*.
Tired of having all these people act like "well, it's not secure, so I should poke around."
Re:Deserved it. (Score:2, Insightful)
Re:Deserved it. (Score:2)
Re:Deserved it. (Score:3, Insightful)
As I heard this morning, they arrested him because they found a single pr0n file on the server that they think was planted by him.
Re:Deserved it. (Score:3, Insightful)
"free security scans" are NOT welcome by anyone. Management types (IT and non-IT) cannot distinguish them from "real" hack attempts. CYA extensively or don't rattle the locks. 'Nuff said.
Re:Deserved it. (Score:5, Funny)
His biggest error probably was talking about it. He should have sold the info to some mobster gang. They'd probably be much more gratefull.
From an underworld IT worker in San Jose (Score:2, Funny)
Re:Deserved it. (Score:4, Insightful)
> Unless he was hired for the job, he deserves it.
That's absolutely absurd. The man simply brought to the attention of the clerk the fact that its network was insecure. That a person is prosecuted for trying to point out a potentially dangerous security flaw shows the extent to which this country has fallen into a legal and intellectual paralysis. He should be hailed as a good samaritan looking out for the safety of the county's information!
From the original article:
It appears that there was no malicious action or intent on the part of Mr. Puffer, but rather that the clerk's office is upset because someone discovered its incompetence. What would have happened if someone truly malicious had stumbled upon this network? To what ends could he or she have used the information found?
If you broadcast your network all over your block unprotected, you shouldn't be surprised when someone discovers it and pokes around. Plain and simple. What about those that willingly open their networks to the public? Should we make free public access illegal, so that fools like this can remain under their rocks and pretend that no one can see their secrets?
Re:Deserved it. (Score:3, Insightful)
Even if he had, there are many who would argue that a little poking around is natural and innocent when someone discovers such a thing (and one might not even know that they have stumbled into a restricted space without a little exploring).
You may disagree that intentional hacking can fall into such a grey area, sometimes described as analogous to checking the locks and then walking into an unlocked house. Fair enough. However, unless you have some additional facts to the contrary, the events in the article are more akin to walking by and noticing someone's door is wide open with the keys left in the lock. Any snooping might have been equivalent to peering inside as you walk by. You might even have ethical obligation to report it to a neighbour or the police and perhaps even take them the keys for safe keeping.
Finally, does anyone have any idea how we can educate the public and the law that pointing out a flaw or security issue is NOT the same as causing damage? He is being charged with forcing their system down and costing $5000 to install a secure system. Why is this the standard in the computing, but not in the real world?
Re:Deserved it. (Score:5, Funny)
Re:Deserved it. (Score:2)
from the Houston Chronicle [chron.com] article...
In a Chronicle article about the demonstration, Puffer said he noticed he could access the county network in early March, when he scanned for weaknesses throughout Houston.
He said he could also access numerous home, government, university and business computer systems.
County Attorney Mike Stafford said he will resume his investigation into whether the security breach was corrected as promptly as county officials learned of it and the origin of a pornographic picture found on the clerk's office server in March.
Noting a network is open/accessable is one thing.. noting you can access a number of specific systems leans more toward the probing side of things. And, as for the last paragraph, I would suspect either he found that or the subsequent audit after the intrusion.
Overall, the Houston article is rather vague as to his exact actions, so inference on his intent/whatnot is nigh impossible and therefore simple ASSumption.
Re:Deserved it. (Score:2)
From what I understand, the network in this case was completely insecure. There was no lock, there was no key. Meaning a 5 yr old with a laptop could gain access as easily as an IT professional.
you want to report an insecurity, do so with the people that create the operating system or program
The industry standard (many companies) behind the insecure wireless network in question does in fact supply a way of making a wireless network more secure. The county office had not bothered to activate these security features. Reporting them to the manufacturers would be meaningless. As much as we might like to think security is always the manufacturers responsibility, that simply isn't true.
Re:Deserved it. (Score:4, Insightful)
a company develops a new lock that makes it easier for anyone in the house to open the door. instead of using a key they can just wiggle the lock a certain way and they're in. someone notices that all these locks are made the same, and all that is required to get into the house is this same "wiggle". this person notices that these locks are in use at a government building. fearing that any criminal could get in, he rounds up a government official and a reporter and shows them how easy it is for anyone to get in. he then gets arrested for breaking and entering.
Re:Deserved it. (Score:2)
And that is breaking and entering.
No it isn't. "Breaking" means exactly what it says. Furthermore, allowing your machine to exchange radio signals with someone else's machine is not "entering" by any stretch of the imagination.
Re:RTFA (Score:2)
>>>>>
Actually, if I run down somebody in the presence of a public official, it matters. If there was intent, its murder (probably first degree because by inviting the official, it was premeditated). In that case, you are looking at the death penalty or life imprisonment. If it was an accident, its vechicular manslaughter, which is a misdemeanor in many places, so its community service and a fine or a short jail term.
Re: (Score:2)
Re:where do they get these numbers?? (Score:2)
Re:where do they get these numbers?? (Score:4, Insightful)
Re:where do they get these numbers?? (Score:2)
System backups? (Score:2)
Re:System backups? (Score:2)
Re:System backups? (Score:2)
It probably takes, what one day to restore that stuff at the most? If you are running redundant systems, then it should be a seemless swap, while you work on one set of systems, the others are still running, so you don't have any downtime.
If it takes you one day, and you are getting paid (or costing) 5K a day... I guess you make about what... (260 working days * 5K) = 1.3 million a year doing IT grunt work? What county do you work for again, I want to work there too...
Anyways, I hear of places all the time claiming anywhere from 5K to 250K in damages, for simple things that in no way cost that. Look at what they said that Kevin Mitnick cost the Telcos...
It's all BS, it doesn't cost that much. Anyway, what I think of is odd, is that they are charging for under 10K in damages. Normally the Police, or FBI won't even listen to you, if you aren't claiming some huge amount of damages, let alone actually go charge someone.
Ignorance is bliss. (Score:4, Insightful)
Re:Ignorance is bliss. (Score:4, Insightful)
But of course, in this case, it would require the government to admit that there had been a mistake, that confidential data conceivably might have gotten out without them knowing it, and that they weren't competent enough to detect the hole themselves. And that's why, instead, he's being charged.
Re: (Score:3, Insightful)
Re:Ignorance is bliss. (Score:2)
How is this considered even a remotely cogent analogy?
Salt water destroys (or used to) parts of said machines. Accessing a network destroys it how?
Re:Ignorance is bliss. (Score:2)
At least, you ougha keep the Coke...
But, nowadays, you'd be perhaps labelled as a terrorist.
Re:Ignorance is bliss. (Score:3, Insightful)
Most people don't need their egos fed 24/7 and
are able to take a dose of humility just fine
thanks. Those who can't... well... they're the
stuff assholes are made of.
They are also the stuff politicians are made of.
Re:Ignorance is bliss. (Score:2)
Could be a screwed situation (Score:2, Insightful)
Re:Could be a screwed situation (Score:2)
-Rusty
Re:Could be a screwed situation (Score:2, Insightful)
Are you listening, government and businesses? Shoot the messanger enough time, and people stop sending you messages.
Hmmm. (Score:3, Funny)
Once again....security through obscurity... (Score:3, Insightful)
Another 'example' will be made... (Score:3, Interesting)
Or do you really want your next door neighbor's son finding out about that fraternity prank that had you arrested for stealing a minivan full of sheep in your boxers or some other weird crime?
My questions (Score:5, Insightful)
Did they create a public network? Public as in accessible to the public without any reasonable indication or security that it is indeed a private network.
I think broadcasting a private network and letting people on it is akin to making a public network.
It isn't this guys fault they had to shut down their network, it is the people who set up the insecure network in the first case.
Re:My questions (Score:2, Informative)
The decision was made Tuesday, after a computer security analyst demonstrated to Steve Jennings, head of the county's Central Technology Department, and the Houston Chronicle how the system could be compromised
Jennings said he was concerned that the system could be accessed from the outside and that he wanted to learn more about the problem before alerting Bacarisse
Burn the observatory, so this never happens again! (Score:2)
This is his crime?
I'm glad they've taken prompt measures to make sure nobody else every reports a security hole to them!
Re:Burn the observatory, so this never happens aga (Score:3, Informative)
Re:Burn the observatory, so this never happens aga (Score:2)
Re:Burn the observatory, so this never happens aga (Score:2)
The fact that this guy called the media out to witness this will damn him in court. He's watched _Sneakers_ too many times. The age of the geeky computer hacker is long gone; if you know a lot about computers these days, you're either a communist, terrorist or both. Ask any ordinary USian. They're *TERRIFIED* of computers. They refuse to give credit cards to my company because "we might be hacked". They constantly think that somebody stole our
Ignorance is the key matter at hand. The laws today are ignorant of the 'intent' of the accused, and for good reason. Every computer cracker ever caught has pulled the "i just wanted to show them how insecure their system was" line, and they're sick and tired of letting kids trash networks and getting probation for it.
No need for free security consultants (Score:4, Insightful)
Worst of all, for all we know he did not do this to demonstrate anything. The last time slashdot got up in arms about some supposed 'white hat' hacker it ended up being an excuse. In my experience it usually is an excuse. "Dude, I'm totally looking out for you when I hack your stuff!" No one should be that naive anymore.
Re:No need for free security consultants (Score:5, Interesting)
This is true. So why doesn't Harris County prosecute the case on these grounds? They seem to feel that their case is not strong enough without conjuring ludicrous claims that Mr. Puffer caused $5,000 in damages.
The claim of $5,000 arises entirely from the cost of taking down the network to secure it, not from any actual damage caused by Mr. Puffer. To say that Mr. Puffer caused $5,000 damages is to say that if it wasn't for him the Civil Courts Building could have left their 802.11 free and unsecured forever.
Worst of all, for all we know he did not do this to demonstrate anything.
You go, man! You're not afraid to tell it like it is! Now read the article. He accessed the network in a prearranged meeting with a newspaper reporter and a county official in the room. It's pretty safe to say he was taking part in a demonstration.
It's obvious that an indictment was not sought because of actual damages caused by the defendant. This case went to a grand jury because officials didn't want a newspaper story about how the Civil Courts Building decided to open their computer network to the whole world.
Re:No need for free security consultants (Score:3, Funny)
Legal cases in general inflate the damage and/or include all damages associated with the action. I'm sure this will be an issue in court.
>You go, man! You're not afraid to tell it like it >is! Now read the article
No, you read the article. He first broke in on March 8th then arranged his big expose on the 18th. Ten days of silence. I'm not suggesting he broke in purpose but it is a possibility. Did he really expect the government to say 'good job citizen' and pin a medal on him. Imagine the precedent that would set. Kiddies would be pouding networks right and left for the good of the nation and expecting to be written up in the paper as local heroes.
It can't be stressed enough that he did this in the stupidest manner possible. He could have taken this to a City Council meeting, started a class-action suit against the county for violating privacy laws, etc. Instead he supposedly went for the glory that the supposed white hat hacker seeks. Naive and stupid. Hopefully, the court will see his supposed true intentions and not lock him up.
Re:No need for free security consultants (Score:5, Funny)
Ten days? Seems sinister. Could that possibly be roughly the amount of time it takes to get an appointment with the appropriate county employee?
Serious Consequences fo InfoSec People (Score:5, Insightful)
What bothers me is that the reason things like this happen is ignorance of non-techies and refusal to see things in a reasonable light. If you were in a bank with a locksmith, and he showed the bank manager that the locks they were using were insecure, the manager would thank the locksmith and change the locks. Show a business manager the exact same thing with their network and they might decide to have you arrested.
Whenever I'm going to show a client ANYTHING I get full written approval ahead of time to discuss or test their security, and I get written approval to discuss my findings. There have been times when I've found vulnerabilities and not said a damn word because the client refused to sign off.
It's sad, there are people out there - and I've worked for and with them often - who really believe in security through anonymity and believe they are acting in their best interests by alienating and prosecuting the people who can really protect their networks.
What I will admit however is that part of the problem rests with people who try to look smart and show off the security vulnerabilities in a smart-assed kind of way. As annoying as it sometimes is, you need to manage people's expectations, fears and prejudices.
Re:Serious Consequences fo InfoSec People (Score:3, Interesting)
If you're Richard Feynmann and you go up to the general in charge of the Los Alamos nuclear bomb research stuff and tell him (and indeed show him) that the safes all the top secret research is in are insecure and can be picked if you can get at it with the door open (which was relatively easy to do), the general would (did) order that all safes be kept closed when Feynmann is in the room...
Not everybody in power appreciates weaknesses being shown; nor do they always get the point you're trying to make when you demonstrate the weaknesses. This applies to any field.
Damning evidence? (Score:5, Insightful)
Re:Damning evidence? (Score:4, Insightful)
I read the July 24th Houston Chronicle article [chron.com] and the March 21st article [chron.com] too. The Cheif County Clerk seems to be saying that one (1) pornographic picture found on one (1) of his department's poorly secured computers was the sole damage found. He claims it cost $5,000 to fix the damage he accuses Puffer (the whistleblower) of causing.
With a network as poorly secured as his practically anyone with a wifi card could have uploaded that picture.
If any repercussions should come anyone's way over this incident I don't understand why the first candidate isn't Charles Bacarisse, the County's District Clerk. Bacarisse claims that none of the computers under his administration could have been seriously damaged by the penetration of war-drivers. Okay, but am I mis-reading the Chronicles quotes from him? Doesn't he seem to have been completely oblivious to the vulnerability his insecure testing was opening to the rest of the computers on the County's system?
We have seen this before, with Randal Schwartz's ordeal at Intel. [matrix.net] This comp.security article contains a contemporary account [google.ca] of his "crimes".
The lesson seems to be that no matter how well intentioned you are, the only safe way to report a security vulnerability is if you can find a way to do so anonymously.
Re:Damning evidence? (Score:3, Insightful)
As far as I am concerned, that is a PUBLIC network. It would be like stringing Cat5 to a power/light pole outside my house, and outside my property, and then claiming tresspass should anyone plug into that network connection!
Wireless ethernet doesn't require any "authentication." This sounds like a situation that someone got caught out, and now wants a pound of flesh to make themselves look better.
I'd be likely to counter-sue claiming malicious prosecution.
Cheers!
Easy problem to solve!!! (Score:3, Funny)
That's hardly the "full story" (Score:2)
-a
Go to jail for helping out! (Score:2)
People are afraid of being proven wrong (Score:4, Insightful)
Pretty deranged, IMHO.
Re:People are afraid of being proven wrong (Score:2)
Your analogy is flawed -- he did'nt steal anything, just showed it was open.
Besides, being a local government facility, hence funded with taxpayer/citizen's money, citizens have a right to know about how fucked up it is. Looks to me like the security consultant was doing a perfectly fine watchdog job.
Re:People are afraid of being proven wrong (Score:2)
The details of the network configuration are not clear from the article, so it's hard to ascertain what, if anything, this guy did wrong. Note that it may not even be the case that the clerk that he demonstrated this to might have had the standing to give him permission to do so. Even so, it's clear that he connected to the network earlier. But what does that mean?
Using an analogy from cable modems/dsl and windows networking; if I go into Network Neighborhood on my 98 box and see thirty other machines (as was the case three years ago when I first got my cable modem connection), that's not hacking. The connection was not voluntary, so to speak, and I didn't make an active connection to any of them. If, however, I double-clicked on one of them and looked at the unsecured network shares, I was illegally trespassing on that computer. That's the difference between noticing an unlocked door to someone else's property, and opening the door and walking in.
I've seen reports of people's laptops automatically connecting to badly configured wireless networks. I don't think that's trespassing. But using the connection is. That's a choice you actually have to make. Yes, it seems like a natural thing to do, perhaps just to have a quick look because "the door was wide open". But that still doesn't make it right or legal. Partly this is the case because a) there's a violation of someone's property in any event; and b) it's impossible to be able to determine someone's motives. As someone else posted earlier, thieves caught just as they enter someone's house could claim that the door was left open and they were only investigating it before they alerted someone. Yeah, sure.
Texas Computer Crime (Score:2, Informative)
TEXAS PENAL CODE TITLE 7. OFFENSES AGAINST PROPERTY
CHAPTER 33. COMPUTER CRIMES
33.01. Definitions
In this chapter:
(1) "Access" means to approach, instruct, communicate with, store data in, retrieve or intercept data from, alter data or computer
software in, or otherwise make use of any resource of a computer,computer system, or computer network.
(2) "Communications common carrier" means a person who owns or operates a telephone system in this state that includes equipment or facilities for the conveyance, transmission, or reception of
communications and who receives compensation from persons who use that system.
(3) "Computer" means an electronic, magnetic, optical,
electrochemical, or other high-speed data processing device that
performs logical, arithmetic, or memory functions by the
manipulations of electronic or magnetic impulses and includes all
input, output, processing, storage, or communication facilities
that are connected or related to the device.
(4) "Computer network" means the interconnection of two or more
computers or computer systems by satellite, microwave, line, or
other communication medium with the capability to transmit
information among the computers.
(5) "Computer program" means an ordered set of data representing coded
instructions or statements that when executed by a computer cause
the computer to process data or perform specific functions.
(6) "Computer security system" means the design, procedures, or other
measures that the person responsible for the operation and use of
a computer employs to restrict the use of the computer to
particular persons or uses or that the owner or licensee of data
stored or maintained by a computer in which the owner or licensee
is entitled to store or maintain the data employs to restrict
access to the data.
(7) "Computer services" means the product of the use of a computer,
the information stored in the computer, or the personnel
supporting the computer, including computer time, data processing,
and storage functions.
(8) "Computer system" means any combination of a computer or computer
network with the documentation, computer software, or physical
facilities supporting the computer or computer network.
(9) "Computer software" means a set of computer programs, procedures,
and associated documentation related to the operation of a
computer, computer system, or computer network.
(10) "Computer virus" means an unwanted computer program or other set
of instructions inserted into a computer's memory, operating
system, or program that is specifically constructed with the
ability to replicate itself or to affect the other programs or
files in the computer by attaching a copy of the unwanted program
or other set of instructions to one or more computer programs or
files.
(11) "Data" means a representation of information, knowledge, facts,
concepts, or instructions that is being prepared or has been
prepared in a formalized manner and is intended to be stored or
processed, is being stored or processed, or has been stored or
processed in a computer. Data may be embodied in any form,
including but not limited to computer printouts, magnetic storage
media, laser storage media, and punchcards, or may be stored
internally in the memory of the computer.
(12) "Effective consent" includes consent by a person legally
authorized to act for the owner. Consent is not effective if:
(A) induced by deception, as defined by Section 31.01, or induced
by coercion;
(B) given by a person the actor knows is not legally authorized to
act for the owner;
(C) given by a person who by reason of youth, mental disease or
defect, or intoxication is known by the actor to be unable to
make reasonable property dispositions;
(D) given solely to detect the commission of an offense; or
(E) used for a purpose other than that for which the consent was
given.
(13) "Electric utility" has the meaning assigned by Subsection (c),
Section 3, Public Utility Regulatory Act (Article 1446c, Vernon's
Texas Civil Statutes).
(14) "Harm" includes partial or total alteration, damage, or erasure
of stored data, interruption of computer services, introduction of
a computer virus, or any other loss, disadvantage, or injury that
might reasonably be suffered as a result of the actor's conduct.
(15) "Owner" means a person who:
(A) has title to the property, possession of the property, whether
lawful or not, or a greater right to possession of the
property than the actor;
(B) has the right to restrict access to the property; or
(C) is the licensee of data or computer software.
(16) "Property" means:
(A) tangible or intangible personal property including a computer,
computer system, computer network, computer software, or data;
or
(B) the use of a computer, computer system, computer network,
computer software, or data.
33.02. Breach of Computer Security
(a) A person commits an offense if the person knowingly accesses a
computer, computer network, or computer system without the
effective consent of the owner.
(b) A person commits an offense if the person intentionally or
knowingly gives a password, identifying code, personal
identification number, debit card number, bank account number, or
other confidential information about a computer security system to
another person without the effective consent of the person
employing the computer security system to restrict access to a
computer, computer network, computer system, or data.
(c) An offense under this section is a Class A misdemeanor unless the
actor's intent is to obtain a benefit or defraud or harm another,
in which event the offense is:
(1) a state jail felony if the value of the benefit or the amount
of the loss or harm is less than $20,000; or
(2) a felony of the third degree if the value of the benefit or
the amount of the loss or harm is $20,000 or more.
(d) A person who is subject to prosecution under this section and any
other section of this code may be prosecuted under either or both
sections.
33.03. Defenses
It is an affirmative defense to prosecution under Section 33.02 that
the actor was an officer, employee, or agent of a communications
common carrier or electric utility and committed the proscribed act or
acts in the course of employment while engaged in an activity that is
a necessary incident to the rendition of service or to the protection
of the rights or property of the communications common carrier or
electric utility.
33.04. Assistance by Attorney General
The attorney general, if requested to do so by a prosecuting attorney,
may assist the prosecuting attorney in the investigation or
prosecution of an offense under this chapter or of any other offense
involving the use of a computer.
--
Looks like Mr. Puffer clearly committed the offense described in 33.02(a)
Now is Harris Country guilty of negligence in adequatelely protecting their computer networks? I'd have to argue that yes, in my opinion they probably are. Anyone who'd carelessly run wide open unprotected wireless ethernet in a local government agency is not only a moron, but also a very poor steward of public records, which is a job taken *very* seriously in Texas.
Informative (Score:2)
I would argue that 33.02(a) Effective consent was given in that it the network was publicly broadcast.
Television broadcasts are free to view, radio free to listen. This is implied in that they are publicly broadcast to any recipient.
Re:Texas Computer Crime (Score:2)
I'm trying to imagine what was in their minds... (Score:3, Interesting)
"He says we have a massive security hole in our network and that anyone, with the simple tools needed, could access much of the data we have going through our networks. He even showed us how it could be done."
"That's amazing! Why weren't we aware that these problems could exist?"
"Well, aparantly there's a few newly discovered flaws in the programs we've been using with our wireless tools that he was able to confirm..."
"Wait... how did he confirm this? Did he steal our files?!"
"Um... I don't think you understand. He had to see if we had these flaws before he could give us a proper warning..."
"He broke into our systems? That malicious..."
"Sir, no - this isn't like a lock that he sneaked in against our will to pick or something, these are open protocols that anyone nearby can test and..."
"Now we'll have to change all our systems... do you know how much it cost to install the last one?! This makes me SO mad!"
I can't imagine the motive to prosecute outside of pure ignorance of the concepts involved. To twist an old african proverb: No, you don't thank the person who burned down your house because you like the pattern of the ashes - but on the other hand, you don't attack the man who warns you that the house you live in is a dangerous fire hazard after he carefully shows you a non-destructive example of how easilly it could be burnt down.
Ryan Fenton
Re:I'm trying to imagine what was in their minds.. (Score:3, Insightful)
If locks could be picked without any witnesses, through the air, and were the only protection used for important information used to safeguard people's constitutional rights, and no one in the place knew that they could be picked at all - then yes, I'd definetly appreciate it if someone told me they were able to pick it. This is because otherwise, I WOULD NEVER KNOW THEY WERE PICKED UNTIL IT WAS TOO LATE.
More than that, the person who was concerned about my security would have no way of testing if I had this flaw without testing the lock first. On security that is supposed to protect court files, I believe the security should be tested as stringently as possible, by as many sources as possible. If the system is logically flawed, then the convenience of the system itself is meaningless - the information in a court's network is too important to let it escape like that.
Now, as to your question about if I'd like it if someone broke into my home and rummaged through my things - it is a loaded, unapplicable question in the first place. No one wants their stuff damaged. But I WOULD thank someone who shows me how simply my security could be bypassed because of "conveniences" I installed in my system. Ignorance is not safety, and warnings are not threats.
Ryan Fenton
Bullshit (Score:4, Insightful)
The person charged was not acting maliciously, did not cause any damage (what is claimed is bogus), and his actions were willfully disclosed in good faith. He got the raw deal...
Re:Bullshit (Score:2)
Your outsourced tech support staff of 5 people who bill at $125/hr spend a single 8 hour day working on it. That's how. Money adds up fast in the business world.
Re:Bullshit (Score:3, Insightful)
Re:Bullshit (Score:2)
Re:Bullshit (Score:2)
It should take about 5 seconds to walk over and pull the power plug for the WAP.
Vulnerability fixed.
For an extra $3.33, I would be glad to turn around and tell the man in charge that he is fired for being such a stupid ass.
There, for less than $7.00 we've solved the security problem (symptom), and also fixed the root problem - a clueless dolt.
Cheers!
Blame Game (Score:2, Insightful)
A different perspective: (Score:3, Funny)
Stefan Puffer, 33, was indicted by a Grand Jury on Wednesday with two counts of burglary for allegedly breaking into Harris County district clerk's offices. It's believed to be the first case of its kind in the US.
Puffer, who was employed briefly by the county's security department in 1999, could get five years in jail and faces a $250,000 fine on each count if convicted, the Houston Chronicle reports.
He's accused of accessing the offices March 8 in an alleged intrusion that cost the county a reported $5,000 to clean up.
District Clerk Charles Bacarisse told the paper that no confidential paperwork was disclosed but the alleged intrusion eventually resulted in the county closing its new offices only a month after they were opened.
But is the prosecution a case of shooting the messenger?
On March 18, Puffer demonstrated to a county official and a Chronicle reporter how easy it was to gain access to the court's offices using only a hammer and paperclip. Puffer first noticed the problem while scanning for insecure homes and offices throughout Houston earlier that month, around the time that the alleged offence took place.
Would you be upset at the above news story?
Really folks, with a $4 hammer, you'd be surprised at how "insecure" most homes are! Have you ever heard of a "white hat" burglar?
Re:A different perspective: (Score:3, Insightful)
I'd say its more analagous to an open window of the courthouse spewing court documents out onto the street. This guy unfortunately stooped down and picked one up.
Not only that, he had the gall to go to a local official, and show it to them! And they had to get someone to close the window. It took about 30 minutes to get in touch with the judge who had left his window open. That's... $100 of damage, assuming, on a wild guess, the judge costs taxpayers $200/hour.
Re:A different perspective: (Score:2)
website of the county clerk? (Score:2)
however, i do note that the county attorney seems a little selective [chron.com] in what laws he wants enforced.
Balmer Steals Access and Brags About It (Score:5, Funny)
http://www.infoworld.com/articles/op/xml/02/07/
"For all his success at bringing Microsoft's warring constituencies together, there are still things beyond Bill and Steve's control. "I was in a hotel in Sun Valley last week that was not wired," Ballmer recalls. "So I turned on my PC, and XP tells me there is a wireless network available. So I connect to something called Mountaineer.
"Well, I don't know what that is. But I VPN into Microsoft. It worked! I don't know whose broadband I used," he chuckles. "I didn't see it in Bill's room. I called him up and said, 'Hey, come over to my room.' So soon everyone is there and connecting to the Internet through my room."
Chalk up another good day for Steve Ballmer, CEO. Bill Gates may be the chief software architect, but as Microsoft matures in the Ballmer era innovation in software shares the spotlight with teamwork.
"
I am incredibly torn on this... (Score:4, Interesting)
On the other hand, it sets a nice precedent for when the cable companies come snooping around, trying to enforce against "connection sharing" when people set up unsecured wireless access points on the end of a cable modem connection.
AT&T: We're disconnecting you for running an insecure access point.
Customer: I'm suing you for proving my network is insecure; thanks, Stefan Puffer!
-- Terry
I'm interested. (Score:4, Funny)
Damnit, my license is at stake here!
More info (Score:2)
What's the reporter doing there? (Score:2)
Although the metaphors aren't identical, if I reported to the police, or a homeowner that they've been leaving their doors unlocked, someone at some point will probably ask me how I know that. Computer security is taken rather seriously these days. There seems to be no effort in making sure there is any, but they sure like to rake you over the coals for any alleged violation of it. When the "victim" happens to be the government, especially the court system, that will just up the stakes even more.
Its unfortunate that this has to happen. But if your less than legitimate activities happen to result in useful information for somebody, don't think that the simple act of good faith by handing that information over will clear the slate for you. Either do it anonymously or get immunity first. Or just keep your mouth shut.
-Restil
One omission in the articles... (Score:5, Informative)
(I don't remember what his exact title was, and I don't remember the links offhand, but the official was definitely the head of the county's equivalent of an IT department.)
Just my $.02...
Re:One omission in the articles... (Score:4, Informative)
I just found an older link. It was Steve Jennings, head of the County Technology Department. Also, the article shows just exactly how badly Bacarisse reacted, inclusing saying "hackers, terrorists or anyone else intending harm would be detected long before they could do any damage or use the system illegally."
You can read the rest for yourself here. [chron.com]
Just my $.02...
Re:One omission in the articles... (Score:4, Interesting)
This has all the markings of beurocratic infighting. A techie quiting after a short, stormy tenure. A beucrocrat implementing an insecure network and assuring that it was no threat... and then convicting on charges of altering government systems. And that same beurocrat accusing another government worker of moving in on his personal feifdom.
The only thing I'm suprised is that after having seen the insides of all this, Puffer was stupid enough to make his name known. Big hint to whistle-blowers: use the press and insist on being anonymous.
Turn this around (Score:3, Interesting)
Same question goes with a neighbor? Can I charge my neighbor for hacking into my network? Is it my responsibility to line my walls with aluminum foil so my signal doesn't go out? Or is it his responsibility to line his walls so he doesn't accidently hack into someone elses network?
As I understand it.... (Score:2)
Cyberphobia strikes again (Score:5, Interesting)
So, let me get this straight. You happy people (non-tech) will put us in jail for attempting to help you use technology in a secure way, because you hate and fear us so much. You actually are prepared to alienate all of us (and imprison some of us) rather than deal with the embarassment of your own inability to use technology, and to willingly make it impossible for anyone to conduct IT security work in good faith. You want to make enemies of all of us, do you?
Have it your way.
Re:Cyberphobia strikes again (Score:4, Interesting)
1. Is it legal if someone hires you to kill them?
2. Is it legal if someone hires you to destroy some of their property?
3. If someone hires you to simply annoy them, what then? (i.e. a "crime" that does no measurable damages)
4. What happens if observe that a crime could easily be commited, and yet you do nothing?
5. What if you have advance knowledge of a crime, and do nothing?
There are two things working against techies: 1. Social engineering (direct or indirect) works on law enforcement with reguard to technology issues because they simply aren't trained. If the head of IT for a city or other "important" person calls and tells the law to arrest someone based on some obscure log printout, the law will probably be able to do so. 2. No one understands technology, except you, and well, no one will listen to you when you stand accused. Unlike other scuffles, the cops can't examine the situation and determine for themselves the severity and how to handle it.*
Clearly, #1 is illegal. Based on many cases in CA, VA it would seem that even if you have papers signed by the CTO and CEO , and you do a full security audit you can still be arrested. (Remember the case in CA where the guy did social engineering and took pictures of the server room -- thats it. He's serving a 1 year prison sentence. The board of directors and the President of the company sent him up -- the CTO and CEO resigned.) "Breaking the law is still breaking the law, irregardless of intent..." is what the prosecution successfully ordered. But whats the analogy for wireless? An english school boy standing on your lawn with a bell yelling about how you never lock your house when you leave that only some people can hear? Or is the better analogy like going up to someone's door, rattling it, then discovering that there is no lock? Its all a matter of politics and twisted truths -- not really the crucible that should burn all that away.
This is why you don't tell them (Score:2)
Call it evolution in action... (Score:2)
In essence, they're telling everyone "don't tell us about any security vulnerabilities we might have. If you do, we'll prosecute you".
Okay, Harris County, have it your way. If you want to live in ignorance, fine. The end result is that your network will end up being hacked by people who really are black hats and who don't give a shit about the integrity of your computer systems or network.
It's unfortunate that other entities that are inclined to be more reasonable will suffer, but so be it. Those that are really enlightened will probably put up a statement on their website saying something like "if you manage to hack into our systems or network and notify us immediately of the fact that you did so and how you did it, and do not make any modifications to our data or copy any of it that isn't already published, we'll not only refrain from suing you, but we'll pay you a reward for your efforts" -- the intent being to make it clear to white hat hackers that they really do want to know about security vulnerabilities.
But the bottom line is that places like Harris County will end up having a lot more problems than more enlightened places. Evolution in action.
I, for one, am not going to tell anyone a damned thing about any security vulnerability of theirs I stumble across unless I happen to work for them and have gotten prior permission to look for security vulnerabilities. And I'll laugh at anyone who behaves the way Harris County did and manages to get hacked later on.
Well, fuck 'em, and plunder is the message I got. (Score:2)
Though I may give my friends the location...
Criminal Intent (Score:2)
You don't get a B&E for pulling someone out of a burning building.
Re:He should go down for this (Score:2)
So, we should do it the Microsoft way? Tell the company about a flaw in their system and let them spend months to fix it, leaving countless unaware individuals completely vulnerable while the "proper authorities" formulate a cost-benefit analysis and figure out where the bug fix lives on the Gantt chart?
Why do you think we *have* news?? You would prefer to get all your news from press releases and government propaganda, it seems.
First of all, the county's IT department was negligent, possibly to the point of criminality, in providing WiFi access to the LAN without any security measures. Would Puffer be looking at five years of jail time if he plugged his laptop into a jack in the hall and found he had LAN access? Maybe. But isn't the County office, by definition, public property? He wasn't tresspassing.
It's like if the government was sending secret information unencrypted on 95.5 FM. You tuned in, told a govt agent and a reporter about it, and now you're the one who did something wrong? This makes sense to anyone here?
The person who really made out in this gig is the "Security Consultant" who charged $5,000 to "solve" this problem. Setting up a VPN for your WiFi clients takes what, about 20 minutes? But clearly the County was so alarmed about the Terrorist Hackers out there that they decided they needed a big expensive solutions. These are serious problems, you know, and they will probably get some of that Anti-Terrorism money from the Feds to pay for Hardening their System against FutureTerrorist Attacks.
By the way, I deal with confidential medical data as part of my job. There's this law called HIPAA. If I were to set up an open WiFi access point on my LAN, *I* could be jailed and fined up to $25,000. *NOT* the guy who is nice enough to tell us (but kind of a dick for telling the local paper.)
What's next? Are we gonna go after Richard Feynman for pointing out that frozen O-Rings make the Shuttle blow up? Mabye I should get hauled off for mentioning that you can punch through the hull of a pressurized aircraft while it's in flight with a big enough screwdriver!
Don't worry about me, though. When I get hauled off into the black Fed car, I'll just yell "Hack the Planet" to the kids on the street and next thing you know, the Slashdot Activist Justice League will rally to my defense!
Re:Headline is Wrong - Not White Hat (Score:2)
Of course, I don't know how much this guy poked around before he decided to tell them, so I really can't judge this one.
Re:Headline is Wrong - Not White Hat (Score:2)
>door, and on a hunch the guy went over and
>pushed the latch.
Ehh, maybe if he walked over, pushed the latch, then looked around inside for a while...
Finding an open lock isn't illegal - trespassing as a result of the open lock is.
They don't go into much detail about what he did with the open network during the time he knew about it, but what are the odds that he just ignored it and didn't report it till later cause it was on the back burner?
If they can demonstrate that he poked around, he broke the law.
-l
Re:Headline is Wrong - Not White Hat (Score:2)
Re:Headline is Wrong - Not White Hat (Score:2)
Re:A previous demonstration? (Score:2, Funny)