Job Seeking Hacker Gets 30 Months In Prison 271
wiredmikey writes "A hacker who tried to land an IT job at Marriott by hacking into the company's computer systems, and then unwisely extorting the company into hiring him, has been sentenced to 30 months in prison. The hacker started his malicious quest to land a job at Marriott by sending an email to Marriott containing documents taken after hacking into Marriott servers to prove his claim. He then threatened to reveal confidential information he obtained if Marriott did not give him a job in the company's IT department. He was granted a job interview, but little did he know, Marriott worked with the U.S. Secret Service to create a fictitious Marriott employee for use by the Secret Service in an undercover operation to communicate with the hacker. He then was flown in for a face-to-face 'interview' where he admitted more and shared details of how he hacked in. He was then arrested and he pleaded guilty back in November 2011. Marriott claims the incident cost the company between $400,000 and $1 million in salaries, consultant expenses and other costs."
Let me show you my back door (Score:5, Interesting)
After I replied, he told me a story about a programmer interviewing for a position at Darden who had very good qualifications. He was asked the same question and immediately said, "Let me show you my back door", and proceeded to log into a company web site and pull up their web site administration page. The programmer actually seemed shocked when told that there is no way Darden could hire him.
There is a fine line between genius and insanity but stupid is all by itself.
It's a good thing he didn't pirate music (Score:2, Interesting)
30 months? It is a good thing he didn't pirate some MP3s. Then they would really be mad at him.
Re:Good (Score:5, Interesting)
I'm guessing Marriott's monetary claims are mostly "It's his fault we have to pay all this money, we wouldn't have to fix anything if he hadn't used those flaws to break in."
He still hacked and deserves what he got, but Marriott is just trying to shift the blame of their security flaws so investors don't point the blame at them.
Re:How someone can be that smart in hacking.. (Score:3, Interesting)
He is just not that smart, period. Say you run a company, some schmuck breaks through some web-app and steal some documents and then blackmails you with these documents to get a job? So what does he expect exactly, an actual job from you?
Let me put it this way - I wouldn't call cops on him, I would invite him for an 'interview' and clean his clock.
Re:Good (Score:2, Interesting)
It's "1337" hacker. Just sayin'.
And seriously, ... the incident cost the company between $400,000 and $1 million in salaries, consultant expenses and other costs. ???
That's got to be the craziest application of 'cop math' I've seen in a non-drug related case ever.
Re:Geez what a moron (Score:5, Interesting)
Actually I was thinking something similar. In a large enough company communication becomes a real problem. Departments don't really communicate much. If you were to study your target a while and figure out who everyone's superiors are and the like, all it would take is a well-crafted email from some higher-up that says "hey hire this guy" and the odds are the underling wouldn't go back to their boss and say "are you sure?" - they'd just start the paperwork. Large companies are dysfunctional that way. They kind of have to be. The more people in the company the less practical being well informed is.
Re:$1 mil? Seriously? (Score:4, Interesting)
A team of four at $250/hr/consultant and you are burning $40,000/week just in consultant fees.
Actually, you came in way low on that. I've been one of those consultants, and you end up doing WAY more than a 40 hour week when cleaning up a major incident. The first engagement I did, we billed 100 hours each in the first 5 days, and indeed we were billed at $250/hr...for a grand total of an even $100,000 for just the first week. That was a decade ago; costs are higher now. This also didn't include travel or expenses, or any opportunity costs of delayed projects (there were many). We ended up having to go over the entire environment with a fine-toothed comb, discerning what may or may not have been owned. Anything in doubt got nuked and totally rebuilt (not recovered from backup) just like you said. Fortunately, they had good backups of their databases, so recovery of that data went just fine...but databases are the one thing that is least likely to be properly recovered from backup media, owing to the MUCH greater complexity of doing those backups right. I don't even know where to begin on determining the cost, if it turns out you lose a database instance as a result.
Re:Good (Score:5, Interesting)
If you were the IT guy at my company, I would complain to the CTO until I got an exception to your restriction. I don't care about your petty concerns when they get in the way of doing my job. Neither does anyone else.
Good fucking luck. I am the CTO.
Petty? Setting aside your childish attitude, your job does not come first. The company comes first. Without the company... you don't have a job.
You are part of the problem. Instead of trying to understand the "why" of a policy you actively undermine it with a blatant and flagrant attitude mixed with ignorance, shortsightedness, and selfishness.
As the CTO, I need to protect the integrity of the company. That means making sure that there exists policies, software, and infrastructure design to protect corporate assets. Part of corporate assets is data. Customers trust us with their medical records, insurance policies, financial information... I could go on.
Am I to tell a customer that we had 1,000,000 records leaked because you wanted to transfer around executable files and bitched and moaned along with a couple of other people till you got your way? Hardly sounds reasonable. In fact, it makes me look I just was not doing my job.
Funny how that works out huh? Everything I try to do to reasonably find a balance between use of the system and security of the system is seen as some sort of fascism by people like you and you actively bitch and moan to try to undermine it. Yet.... when something goes wrong.... well that's my fault. The particulars are not relevant, such as your behavior and participation, because I was just supposed to magically create a world where you have no restrictions and everything works in perfect safety.
Now instead of acting like a child, why don't you give me an actual reason why you need to send executables and protected, nested, compressed files around in email?
This whole conversation got started with you saying it was impossible to prevent data leakage and penetration, I then offered a reasonable response, at which point you said you would try to undermine it to your fullest extent. How much sense does that make?