The Chronicles of Weev

muldrake · Jan 22, 2013

While I haven't always been a huge fan of weev, and he is not exactly the kind of person who makes a jury very sympathetic, it's certainly another case of an overreaching prosecution. I think society is better off knowing the vulnerabilities of our technologies than when only bad guys who actually intend to exploit these vulnerabilities know them.

Does sending weev to prison for years and spending millions to prosecute this bullshit make society any better? I don't think so.

From iPad Hack Statement Of Responsibility

ANDREW AUERNHEIMER

Editor’s note: Andrew Auernheimer, also known by his pseudonym weev, is an American grey hat hacker and self-described Internet troll. Follow him on Twitter @rabite.

In June of 2010 there was an AT&T webserver on the open Internet. There was an API on this server, a URL with a number at the end. If you incremented this number, you saw the next iPad 3G user email address. I thought it was egregiously negligent for AT&T to be publishing a complete target list of iPad 3G owners, and I took a sample of the API output to a journalist at Gawker.

I did this because I despised people I think are unjustly wealthy and wanted to embarass them. I thought this is the United States of America where we have the right to do basic arithmetic and query public webservers.

I was convicted of two consecutive five-year felonies, and am now awaiting sentencing.

I left the Aaron Swartz memorial tonight emotionally exhausted. Here is a guy who was beloved by many of my close friends, whose suffering and miseries I have shared in kind. I’ll never forget when the Secret Service started following me. My lover at the time and I treated it like a game, spending our days ditching surveillance in the best ways possible: speedboats, helicopters, club bouncers.

Over time, this has become less and less of a game. It soon became clear that I could not be both an activist and a capitalist. I quit my six figure job at the time because the former was more important to me. Then one day, everything changed. FBI agents tried to frame me for terrorism in 2008. Twice. They ruined my career, my relationship, my life. Nobody believed that I could be a terrorist so now they try to libel me as an identity thief.

Lawrence Lessig said of Aaron’s indictment that the prosecutor Ortiz was “either an idiot, or a liar.” I know this feeling all too well.

One of my prosecutors, Michael Martinez, claimed that our querying a public webserver was criminal because “it isn’t like going to ESPN and checking your sports team’s scores.”

The facts: AT&T admitted, at trial, that they “published” this data. Their words. Public-facing, programmatic accesses of APIs happen upwards of a trillion times per day. Twitter broke 13 billion on their API ages ago. This is something that happens more than the entire population of Earth, daily. The government has no problem with this up until you transform the output into something offensive to important people. People with “disruptive” startups, this is your fair warning: They are coming for you next.

The other one of my prosecutors, Zach Intrater, said that a comment I made about Goatse Security, my information security working group, starting a certification process to declare systems “goatse tight” was evidence of my intent to personally profit. For those not in on the joke: Goatse is an Internet meme referencing a man holding open his anus very widely. The mind reels.

I can’t survive like this. I am happy to be hitting a prison cell soon. They ruined my business. The feds get approval of who I can work for or with: they rejected one company because the CEO had a social network profile with an occupation listed as “hacker.” They prohibit me from touching any computer that isn’t federally monitored. I do my best to slang Perl code on an Android device to comply with my bail conditions. It isn’t pretty.

Ivy league educated and wealthy, Aaron dealt with his indictment so badly because he thought he was part of a special class of people that this didn’t happen to. I am from a rundown shack in Arkansas. I spent many years thinking people from families like his got better treatment than me. Now I realize the truth: The beast is so monstrous it will devour us all. None will be spared.

So now I stare at a form that the government wants me to fill out before sentencing labelled “acceptance of responsibility” and wonder what I can possibly fill in this slot. This letter is it.

I accept my responsibility, and hope you do too, of dismantling this terrible empire so that this can’t happen to anyone.

This is the difference between the prosecutors and FBI agents and I. They wish me utterly destroyed, and have been hounding me for years of my life. They have been surveilling me, by their own admission, since I was 15. You know what I wish for? A world where no man may abridge the liberty of another. Not me, not you, not the FBI, not federal prosecutors. I actually hope they have fulfilling lives, and come to realize the mistake of treating our Constitution like toilet paper.

This is a country where if you express ideas that federal agents don’t like you, you will be beaten, imprisoned, or killed. I accept my responsibility for offending seditious thugs, liars and tyrants. I say this is the duty of all decent citizens left.

God bless.

Andrew Auernheimer

(*Those who assert our right to access public web APIs can donate to the effort to overturn the Computer Fraud and Abuse Act. More info at cfaadefensefund.com. - Andrew Auernheimer)

Anonymous · Jan 22, 2013

So wrong.

Anonymous · Jan 24, 2013

http://www.guardian.co.uk/technology/2013/jan/24/hacking-us-government-cyber-crackdown

Anonymous · Jan 24, 2013

everyone act like we don't know him

Anonymous · Jan 24, 2013

Know that you are respected, weev.

Anonymous · Jan 25, 2013

http://www.salon.com/2013/01/25/when_the_government_approves_of_hacking/

Anonymous · Jan 27, 2013

Anonymous · Feb 3, 2013

http://www.huffingtonpost.com/2012/11/20/andrew-auernheimer-ipad-hacker_n_2169003.html History
Andrew Auernheimer, iPad Hacker, Convicted Of Stealing 120,000 Email Addresses

^^^History

Anonymous · Feb 3, 2013

Anonymous · Feb 3, 2013

Anonymous said: ↑

I tried to make a pulp rag cover about vistaril but couldn't work the program. Have a go.

Anonymous · Feb 3, 2013

Anonymous said: ↑

I tried to make a pulp rag cover about vistaril but couldn't work the program. Have a go.

Perhaps, you gotta clear the word "Vistaril".

Anonymous · Feb 3, 2013

I don't get it.

PresidentShaw · Feb 3, 2013

JEWS!

Anonymous · Feb 5, 2013

Anonymous said: ↑

I tried to make a pulp rag cover about vistaril but couldn't work the program. Have a go.

Have you seen this yet?

https://whyweprotest.net/community/...ge-pulp-magazine-cover-w-pulp-o-mizer.108656/

Anonymous · Feb 27, 2013

Andrew Auernheimer had been scheduled to appear in federal court in Newark Monday morning. The sentencing was moved to March 18.

http://www.phillyburbs.com/news/sta...cle_0f545422-62a0-5995-a607-238085b6d12d.html

Anonymous · Feb 28, 2013

What should happen? AT&T should apologize to us for failing to harden their customer service websites and send a few of their own IT guys to jail for being idiots whose system was “crackable” by a script iterating a URL. To call this a joke ignores the very real tragedy of a young man cut in his prime. We can only laugh at the FBI’s risible arrest, the quick trial staffed by a definitively uninterested jury, and the creeping horror of his potential sentencing.

http://techcrunch.com/2013/02/28/att-hacker-andrew-auernheimers-sentencing-scheduled-for-march-11/

Anonymous · Feb 28, 2013

What do you think about the Aaron Swartz affair?

I think it is yet another example of judicial overreach. In the US and other nations, prosecutors seem to be aggressively targeting privacy advocates for the simple reason that openness is the enemy to most governments. I am more concerned about the Andrew Auernheimer incident, where they are about to jail a security researcher who found sensitive information just by incrementing URLs. He didn’t bypass any security features at all, yet the US government prosecuted him successfully for hacking.

It’s not only an outrageous verdict, it is stifling security research. It’s a truly chilling development, which will only aid attackers.

http://www.muscatdaily.com/Archive/...e-biggest-threat-to-the-enterprise-today-22l6

raboon · Feb 28, 2013

Go weev.

Anonymous · Mar 1, 2013

Sentencing's on March 18th: http://techcrunch.com/2013/02/28/att-hacker-andrew-auernheimers-sentencing-scheduled-for-march-11/

Anonymous · Mar 18, 2013

“It’s a fucking ludicrous charge,” Auernheimer told me this morning from New Jersey. “The FBI has tried to frame me for terrorism five times, and by their own admission they’ve been surveilling me since I was 15 years old.”

http://venturebeat.com/2013/03/17/t...ties-tonight-in-expectation-of-jail-tomorrow/

Anonymous · Mar 18, 2013

It's almost as if someone is trying to kill off the cool/sexy/funny/awesome hacker scene. All the best people are in jail or awaiting trial. Love you weev.

Anonymous · Mar 19, 2013

The judge handed down the sentence following a minor skirmish in the courtroom when the defendant, Andrew Auernheimer, aka Weev, was pinned and cuffed. Auernheimer was reportedly asked to hand the court a mobile phone he had with him during the hearing, and after handing it to his defense attorney instead, court agents cuffed him.

http://www.wired.com/threatlevel/2013/03/att-hacker-gets-3-years/

http://boingboing.net/2013/03/18/andrew-weev-auernheimer-to.html

Anonymous · Mar 19, 2013

Anonymous said: ↑

It's almost as if someone is trying to kill off the cool/sexy/funny/awesome hacker scene. All the best people are in jail or awaiting trial. Love you weev.

Maybe it's had it's day, continue to fap if need be though.

Anonymous · Mar 19, 2013

Anonymous said: ↑

It's almost as if someone is trying to kill off the cool/sexy/funny/awesome hacker scene. All the best people are in jail or awaiting trial.

All the best people are still flying under the radar. If you want great sexy/cool/etc PR, don't become a hacker.

The Wrong Guy · Mar 19, 2013

"I'm Going To Prison For Arithmetic" - Andrew Auernheimer aka Weev

Published by wearechange on Mar 19, 2013

Before entering the New Jersey courthouse to face his sentencing on March 18, 2013, Andrew Auernheimer (Weev) gave a short speech to the press and to his friends. Auernheimer was sentenced to 41 months in prison followed by three years supervised release.

Auernheimer revealed a security flaw in AT&T's iPad user database, allowing him to scrape the data from 114,000 iPad users. The information was later on given to a journalist. In January 2011, the FBI did an investigation and filed a criminal complaint.

Auernheimer was convicted on conspiracy to access a computer without authorization (18 U.S.C. § 1030(a)(2)(C), part of the Computer Fraud and Abuse Act of 1986) and fraud in connection with personal information (18 U.S.C. § 1028(a)(7)).

Find out more about Andrew Auernheimr: http://freeweev.info/

Anonymous · Mar 19, 2013

"Anonymous said: ↑

All the best people are still flying under the radar. If you want great sexy/cool/etc PR, don't become a hacker.

Anonymous · Mar 19, 2013

The Lesser of Two Weevs

http://jerichoattrition.wordpress.com/2013/03/19/the-lesser-of-two-weevs/

Anonymous · Mar 20, 2013

http://cryptome.org/2013/03/auernheimer-091.pdf

UNITED STATES DISTRICT COURT
DISTRICT OF NEW JERSEY
MINUTES OF PROCEEDINGS
NEWARK DATE: March 18, 2013

JUDGE: Susan D. Wigenton

COURT REPORTER: Carmen Liloia

DEPUTY CLERK: Carmen D. Soto
Title of Case: Docket# 11-470
U.S.A. v. ANDREW AUERNHEIMER

Anonymous · Mar 20, 2013

Defense motions challenging sentencing

Anonymous · Mar 22, 2013

Tor Ekeland, P.C. ‏@TorEkelandPC

44m
andrew (weev) is currently at Brooklyn Metropolitan Detention Center. http://www.bop.gov/iloc2/InmateFinderServlet?Transaction=NameSearch&needingMoreList=false&FirstName=andrew&Middle=&LastName=auernheimer&Race=U&Sex=U&Age=&x=86&y=18…

https://twitter.com/TorEkelandPC/status/315092508608696321

Anonymous · Mar 22, 2013

Anonymous said: ↑

http://jerichoattrition.wordpress.com/2013/03/19/the-lesser-of-two-weevs/

QFT

Yesterday, Andrew Auernheimer (aka Weev), was sentenced for his 2012-08-16 indictment on one count of “fraud and related activity in connection with computers” (18 U.S.C. § 1030) and one count of “conspiracy to commit offense or to defraud” (18 U.S.C. § 371). This was the result of Auernheimer’s activities in 2010, where he manipulated a URL on an AT&T web site, and discovered an information enumeration vulnerability.

While a lot has been written the last 24 hours on this topic, mostly via 140 character Tweets, most stories aren’t covering the full range of issues surrounding this case. Some stories cover the harsh sentencing, while older stories cover the simplistic nature of the vulnerability found. What I find lacking are stories that put it together in context, to explain how absurd this is. There are three high-level components to this story.

The Vulnerability

Enumeration vulnerabilities come in a wide variety of formats. Via the web, they are often very simple and straight-forward. A web site serves up content specific to you, customer #1234. Poorly designed web applications will identify you as customer #1234 to the application using a variable that is passed via the URL you send to the server. For example:

/banking/account.php?date=20130317&account=checking&customer=1234

You can clearly see your customer number in the URL. What happens if you change 1234 to 1235 and submit it to the server? In this case, you go to jail for 41 months. No exaggeration, no bullshit. That is a basic example of an information enumeration vulnerability, due to extremely poor coding practices and absolutely no security review of the application.

The frequency of such vulnerabilities is disturbing. But not as disturbing as the multi-million dollar companies that are entrusted to protect hundreds of thousands of customer’s data. If you are browsing the web or using your banking application and notice the above, and casually change 1234 to 1235, who is the real bad guy here? You, or the corporation that decided not to employ the most fundamental security measures from the last thirty years?

The Crime

This aspect of the story is the perhaps the biggest disconnect for most readers. Instead of being exposed to the fundamentals, and the history of vulnerability discovery and how it influences disclosure, they get wrapped up in the media’s portray of Auernheimer. Yes, “weev” is a controversial character. He is an admitted Internet troll, an asshole of sorts, and a character of questionable repute. However, that doesn’t matter, at all. If being an asshole was a crime, all 18 people in the U.S. who weren’t would be left to read this.

So what did Auernheimer really do? He figured out an enumeration vulnerability in AT&T’s web site, that let him determine the entire iPad user database. This constituted some 114,000 iPad 3G users. What information did the AT&T site give up, that Auernheimer got access to? Email addresses. No full names, no physical addresses, no phone numbers, no credit information, no passwords. In case you weren’t aware, you can purchase 50 million email addresses on a single ISP for a whole $500.

Why the big deal? This is where it gets a bit murky, at least to an outsider. When a researcher finds a vulnerability in a product, service, or web site, they have several avenues for disclosure. First, they can sit on the information and simply not disclose it. This doesn’t protect anyone, because the idea that no one else will find it is absurd, and has been proven wrong many times over. Second, they can disclose it in a ‘responsible’ (poor term, commonly used) or ‘coordinated’ (better term, use it) manner, in which they work with the vendor to disclose it only when the vendor is ready, and the issue has been fixed. Third, they can disclose it without informing the vendor, or they can disclose it after informing the vendor but not waiting for a fix. Each of these scenarios happens every week, a hundred times over.

The average citizen, including jurors and judges, does not understand the history or intricacies of vulnerability disclosure. There are vendors and service providers that have a long history of not caring about vulnerabilities. That is, until it affects them in the public eye. A serious issue can exist for five, ten, or sometimes seventeen years, without being fixed. When the right light hits the ordeal, usually via a negative high-profile media article, the company suddenly takes an interest. If Auernheimer had reported this to AT&T directly and waited for a fix, there is a good chance it would have gone unfixed for months, possibly years. Every day that ‘coordinated’ disclosure happens runs the risk of someone with bad intentions finding the same issue.

Rather than go to AT&T and risk months of back-and-forth and/or waiting, Auernheimer opted to go to a media outlet. Why? Media pressure is one of the strongest motivations for a company to fix a vulnerability. One could argue that since the vulnerability was not very serious (again, just email addresses being disclosed), that going to a journalist instead of the company was not a big deal. Regardless of Auernheimer’s potential intentions regarding the embarrassment to AT&T, he took a route that would likely have the most success in getting the issue fixed.

The Sentencing

For his “crime”, Auernheimer was sentenced to 41 months in prison, 3 years probation, and ordered to pay $73,000 in restitution. Again, for showing how anyone could harvest a list of 114,000 email addresses. SC Magazine quickly wrote an article detailing 8 criminals that used computers in the commission of their crime, but received less prison time. I understand that courts are behind the times on computers, their use, abuse, and how to punish crimes related to them. I expect to see some discrepancy between sentencing in such cases. What I fail to understand is how a court can offer up such a sentence as compared to other crimes, that are certainly more destructive, and more heinous. Consider the following crimes and sentences, all handed down very recently:

Molesting 2 children can get you 14 months. [Source]

Child abuse can get you 32 months. [Source]

Manslaughter can get you as little as 42 months, just 1 month more than email addresses. [Source]

Possession of child pornography is good for 48 months, just 7 months more than email addresses. [Source]

Involuntary manslaughter, 50 month maximum per victim. [Source]

Perhaps the biggest comparison has been Auernheimer to the two Steubenville (Ohio) rapists who were sentenced for a total of three crimes, and collectively received less time. Trent Mays was convicted of raping a teenage girl, and ordered to spend “at least one year in an Ohio Department of Youth Services facility or until they are 21 years old“. Since Mays was was also convicted of having pictures of a minor in “nudity-oriented material”, he received 1 additional year. Ma’Lik Richmond, also convicted of raping a teenage girl, received one year in the Youth Services facility. Two rapes, and essentially one count of child pornography, and collectively they get 36 months, compared to the 41 Auernheimer received. More disgusting is what is being called the “rape culture”, where news outlets such as CNN were apologetic to the rapists, decrying the sentencing and claiming their “lives were over”. Perhaps if Auernheimer’s lawyers argued that he only “raped the AT&T system”, he would have received a year.

The Lesser of Two Weevs

Once again, forget about Auernheimer’s predilection for trolling or seeking to annoy people. That is entirely irrelevant to the case. He found a minor vulnerability on AT&T’s web site, he told a journalist who wrote an article about it, and AT&T fixed it. No one suffered real damage from his activity. He did not seek to profit from his activity. More interesting is that AT&T specifically wants bugs reported to them, which Auernheimer did about the same time as he notified the journalist. While he did not follow their desired process, both sides made their intentions clear; they want bugs fixed. In this case, they diverged in the method for effecting that change.

If Aurenheimer had tried to profit from his activity, I understand how the court would seek to punish him. If he sent emails to all 114,000 people defaming AT&T, or caused them to receive excessive emails, I would expect a harsher punishment. But given that a bank loan manager was recently sentenced to six months in prison for computer fraud in an attempt to increase her own lines of credit by more than $200,000, you have to wonder what other factors are at play here. Companies are frequently dealing with vulnerabilities, some disclosed directly to them, some exploited by bad guys, some reported via the media first. Why is the AT&T case so special?

It will be interesting to see how other crimes are dealt with in comparison. For example, the same day Auernheimer gets sentenced to prison, other anonymous researchers share their recent work that involved illegally accessing 420,000 systems on the Internet. In the United States, that constitutes 420,000 felonies.

That said, I for one am grateful that Aurenheimer reported the vulnerability, both to the media and AT&T directly. Given my personal history of dealing with vendors in vulnerability disclosure, I don’t blame him or any other researcher who opts not to work with a vendor. It is often a time-consuming and painful process, that typically challenges your faith that a company cares about security and their customers. In this case, we got the lesser of two Weevs; the one that wasn’t intent on pissing as many people off as possible. The one who didn’t opt to use the information for profit, that didn’t sell the list to criminals, that didn’t actively try to compromise AT&T systems. And for that, he will receive over three years in federal prison. Think about it.

The Wrong Guy · Mar 22, 2013

"The Best Fucking Thing That Could Possibly Happen": Hacker Convict Weev Bids Farewell to Freedom

By Adrian Chen

Auernheimer's lawyers plan to appeal. Now that he has become a symbol for the unfairness of the Computer Fraud and Abuse Act, a group of heavy hitters has come on board to help, including the Electronic Frontier Foundation and the cyberlaw expert Orin Kerr. The case may go all the way to the Supreme Court.

http://gawker.com/5991737/the-best-...-hacker-convict-weev-bids-farewell-to-freedom

fishypants · Mar 22, 2013

The Wrong Guy said: ↑

Electronic Frontier Foundation

finally!

Anonymous · Mar 22, 2013

ANDREW AUERNHEIMER IS NOT AARON SWARTZ

http://www.digitaltrends.com/opinion/andrew-auernheimer-weev-is-not-aaron-swartz/

Anonymous · Mar 22, 2013

Those of us who genuinely want to do the right thing – not for the lulz, but for justice – must shed ourselves of Auernheimer’s self-serving, self-destructive escapades
.

That strikes me as self-important bollocks, for two reasons:

1. The author thinks he's just super-important and his reputation must be protected - he's trying to avoid guilt by association.

2. What matters in the case is what the alleged perp did, whether it was illegal and whether it should be illegal, and whether the punishment fits the alleged crime. Not what his personality is like.

If the author wants a super-perfect examplar for the cause then tough shit - this is the real world.

Anonymous · Mar 22, 2013

Aaron was almost super-perfect.

Anonymous · Mar 22, 2013

Anonymous said: ↑

Aaron was almost super-perfect.

Even better now he's a martyr!

Anonymous · Mar 22, 2013

Anonymous said: ↑

Even better now he's a martyr!

o fuck off

Anonymous · Mar 23, 2013

It's all shits n giggles on the netz until the real world comes along, then it's not so funny. Consequences can be a bitch huh.

Anonymous · Mar 23, 2013

The infamous iPad hacker will get another day in court, and this time, he'll have a dream team of lawyers to defend him.

Andrew Auernheimer, also known as Weev, was sentenced to 41 months in prison on Monday for computer crimes. In a blog post on Thursday, Orin Kerr, a former federal prosecutor and an expert in computer crime law, announced he was joining his defense team pro bono and he also confirmed that they had filed a notice of appeal (PDF), the initial step in the appeal process.

http://mashable.com/2013/03/22/ipad-hacker-weev-appeals/

http://www.computerworlduk.com/news...erts-pitch-in-to-appeal-att-hackers-sentence/

http://gawker.com/5991737/the-best-...-hacker-convict-weev-bids-farewell-to-freedom

http://news.firedoglake.com/2013/03/22/embarass-att-3-years-rape-someone-1-year/

Log in or Sign up

The Chronicles of Weev

muldrake Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

PresidentShaw Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

raboon Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

The Wrong Guy Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

The Wrong Guy Member

fishypants Moderator

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Anonymous Member

Share This Page

Customize Theme Colors

Predefined Skins