'Weev' appeals AT&T iPad hack conviction US cybercrime lawyers have filed an appeal against the conviction and lengthy sentence imposed upon Andrew "Weev" Auernheimer in a high-profile iPad data leak case. Auernheimer, a member of the grey-hat hacking collective Goatse Security, was jailed for three years and five months back in March after he was found guilty of …
"Weev's conviction under the Computer Fraud & Abuse Act (CFAA) was heavily criticised in the security community because the leaked data was harvested from an insecure server."
Couldn't you say that about most internet facing servers?
"I launched an exploit against a server triggering a security vulnerability which rendered the server insecure and I collected information"
Not saying that they should give Weev zillion life sentences, just saying if this is his defense, it's shit.
Otherwise you would have no way of knowing whether following a URL would mean you had broken the CFAA. If the operator of the web site decided they didn't want you to access that page then you'd be guilty, even though there was no protection on the page whatsoever.
Likely an excessive sentence, but if it's even started, it will be in a comfy min. security adventure camp.
Weev is a self-obsessed and vain asshole, but will be a useful addition to the NSA or one of the several other "cyber-commands" once the charges are quashed to allow it.
"Otherwise you would have no way of knowing whether following a URL would mean you had broken the CFAA. If the operator of the web site decided they didn't want you to access that page then you'd be guilty, even though there was no protection on the page whatsoever."
Wasn't this an issue in the UK a while back?
I seem to remember comments saying that this would mean you were guilty of hacking if you manually altered the URL (e.g. Going 'up a level' by deleting bacwards to the next forward-slash)
Perhaps other readers remember more details...
Did you also miss "Auernheimer then distributed the list of email addresses to media organisations as proof of the vulnerability, forcing AT&T to acknowledge and fix the security problem."
No, having an insecure server with your customers' details is not OK and the only way to stop this happening is to name and shame companies which don't play nice when poeple tell them so.
...the only message this sends to the security research community is that if you discover a vulnerability, you could go to jail for sounding the alarm.
What the lawyer could not say is that this really encourages people who do this sort of research to turn the results over to the black hats, for profit.
"The Electronic Frontier Foundation (EFF) has teamed up with law professor Orin Kerr, internet attorney and EFF fellow Marcia Hofmann, and Weev's trial lawyers Tor Ekeland and Mark Jaffe in filing an appeal with the 3rd US Circuit Court of Appeals."
One can only assume that Larry Lessig was not available...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
