On my previous post,Eli resorting to his usual ‘lack of detail’ mode of communication wrote “Simply put Brandon hacked system where the data was stored..”. That claim raises questions and resolves none. For example: which “system” does Eli think Brandon hacked? And which actions of Brandon’s constitute “hacking”? Also, Eli is not UQueensland, so unless the source for his claim is the UQueensland itself, there is no reason to believe he knows what actions they consider hacking, nor what evidence they think they have ‘hacking’ or some unspecified by them sort happened on some unspecified by them system.
That said: we do know some actions Brandon took, and we can discuss whether they might be “hacking”– or, since that word is used in a variety or ways some of which represent entirely legal and ethical activities, whether known actions by Brandon might be illegal under the CFA. Here’s one action:
Brandon made http requests of the form “http://www.sksforum.org/thread.php?t=i&p=j” similar to those crawled and indexed by google show to the right. The sksforum.org server responded. That response included some html and javascript. The javascript code included a snippet that would forward a browser to another site (for example ‘wattsupwiththat.com’). Brandon recorded the links to the site. Brandon then did this multiple times and ultimately recorded roughly 18,000 links.
How do we know Brandon did this? He said so. Now the question is: is there any reason to believe this is illegal? I think not.
But others disagree. Over at Brandon’s site, a guy named Frank O’Dwyer seems to think that possibly we should think something about what Brandon did might be illegal based on the “Cuthburt” case in England or the “Weev” case in the US. I think examination of either of those cases suggest Brandon is free and clear because Brandon’s http: requests lack both the key feature that made Cuthburt illegal, and the one that might make “weev” illegal. (It’s not clear that what Weev did was illegal. But my point here is that what Brandon did is legal even if what weev did was not.)
Some might suspect I am now going to explain what Cuthburt and Weev did. Indeed I will.
Daniel Cuthburt: For reasons you can read at samizdata.net, Daniel Cuthburt an IT consultant working in the UK whose expertise was ‘penetration testing’ performed to two ‘pen tests’ on a web site.
The first test he used was the (dot dot slash, 3 times) ../../../ sequence. The ../ command is called a Directory Traversal which allows you to move up the hierarchy of a file.? The triple sequence amounts to a DTA (Directory Traversal Attack), allows you to move three times. It is not a complete attack as that would require a further command, it was merely a light “knock on the doorâ€. The other test, which constituted an apostrophe( ‘ ) was also used.
For those not knowledgable about pen testing “move up the hierarchy of a file” means that if a server is flawed, adding this sequence to a url can permit a person to obtain access to files stored above the web folder. That is: they can get into the non-web accessible portions of the server. Someone making this request is never just trying to “surf the web”.
Any pen tester knows that the request they are making is not asking for pages the admin of a site intended to make publicly accessible and that no one is ‘authorized’ to request files that are stored above the root. Although the person at samizdata.net seems to agree with Cuthburt’s defense team that the sequences as just “knock on the door” and not a “break in”, these sorts of requests are not authorized whether or not the request contains ‘additional’ parameter that turn it into an “attack”. Cuthburt almost certainly knew all this; the court believed so and convicted him of computer misuse.
Cuthburt is not an example of someone ‘merely’ entering a URL into their address bar and hitting “enter”. This is someone creating something that looks like a ‘URL’ but which they know is not a URL, and submitting it knowing that that specific command entered is intended to give them access to material that is not on the web. (Note: they only succeed if a security flaw exists. Nevertheless, this is the purpose of that sort of request.)
For what it’s worth: my site automatically bans IPs that try that sequences. Many other sites do so as well. The reason they do so is these requests are never authorized and permitting people to make requests that are never authorized is a rather dangerous policy for any site. In this case, the system Cuthburt ‘tested’ detected the request, recorded the IP, the company informed the police of the attempt, Cuthburt was arrested and later convicted.
Before moving on to the much more complicated “Weev” case, let’s compare what Cuthburt did to what Brandon did. Did Brandon submit URLs that were designed to access material that was not in the web directory? No. He did not. The requests he made were designed to access material in the web directory of a public facing machine. So: the element that made Cuthburt’s http: request illegal is not found in Brandon’s request.
Now on to Andrew “Weev” Auernheime: In March 2013, Andrew “Weev” Auernheime, who is reputed to be an extremely dislikeable fellow was convicted under USA’s Computer Fraud and Abuse Act. Orin Kerr recently represented him pro-bono, and in April 2014 his conviction was overturned on the grounds that it was brought in the wrong jurisdiction. The weev is now out of the slammer. I’m not going to discuss whether what Weev did actually was illegal. Instead, I’m going to describe the describe the prosecutors case for which aspect of what he did was illegal. A link to the prosecutors brief in the appeal can be found at @ErrataRob ‘s blog (pdf).
When we read the prosecutors case, we can see the prosecutor went on and on and on about a particular feature of the URL’s Weev loaded– this feature has no parallel in what Brandon did. To discover the feature the prosecutor went on and on and on about, start by looking at the table of contents in the prosecutors brief in the appeal. We find a listing for “Argument”.
ARGUMENT
I. THE GOVERNMENT PRESENTED SUFFICIENT EVIDENCE TO PERMIT THE JURY TO FIND THAT THE CONSPIRATORS’ ACCESSING OF AT&T’S SERVERS WAS UNAUTHORIZED. . . . . . . 20
A. The Evidence Overwhelmingly Supported A Jury Finding That The Conspirators Improperly Accessed AT&T’s Computers By Impersonating Authorized Users. . . . . . . . . . . . . .24
B. The E-mail/ICC-ID Pairings On AT&T’s Server Were Neither Unprotected, Nor Open To The Public. . . . . . . . . . . . . . . . . . . . . . . 27
C. It Is Not A Bar To Prosecution Under The CFAA That The Victim Employed Bad Security. . . . . 33
D. Spitler’s Use Of Individual User’s ICC-IDs Is Not Fundamentally Different From Using Another Person’s Password. . . . . . . . . . . . . . 38
E. It Does Not Matter That The AT&T Server Responded As It Was Programmed To Do. . . . . . . .41
F. Neither This Prosecution, Nor the Government’s Interpretation Of The CFAA, Threatens To Criminalize Innocent Web Surfing By Ordinary Internet Users. . . . . . . . . . . . . . . . . 44
G. The Rule Of Lenity Has No Application Here. . . . . . . . . . . . . . . . . 45
H. The “White Hat†Computer Hacking Community Has Nothing To Fear From This Prosecution.47
(Italics mine. some ‘…’ trimmed.)
The argument describing why what ‘weev’ did violated the CFA is 27 pages long. For clarity, it’s worth mentioning that ‘weev’ was charged with conspiring to do things. The person who actually visited sites was named ‘Spitler’. So, you will read that “Spitler” actaully performed the illegal acts; weev conspired in these.
Notice above, the claimed illegal activity was not merely ‘loading obscure url’s”. The illegal activity was not loading ‘lots of’ obscure urls. It’s not “learning something AT&T did not want weev or Spitler to know”. It’s not even ‘doing something AT&T might disprefer.
The illegal activity involves “Impersonating Authorized Users” and accessing the servers in ways “Not Fundamentally different from Using Another Person’s Password“. The issue of “impersonating authorized users” and claiming what Weev did was analogous to “using another persons password” are essential to the prosecutors claim that what weev did was illegal because according to the prosecutor, the reason the access was unauthorized is that Spitler obtained access through “Misrepresenting”, “tricking” the server by and supplying something that is equivalent to a password. As a result of that trick, AT&T’s server pages to an unauthorized user– Spitler– when the only “authorized” user was the person who owned a particular Ipad. Moreover, even the authorized user was only authorized to access that page when using one specific Ipad, which that user owned.
To be a bit more specific, Spitler (weev’s ‘conspirator’) visited urls with the form below :
https://dcp2.att.com/OEPClient/openPage?ICCID=XXXXXXXXXX
XXXXXXXXXX&IMEI=0
A specific numeric value that corresponded to the ICCID of a specific IPad would be included in the place of ‘XXXXXXXXXXXXXXXXXXXX’, and Spitler discovered that if he used an ICCID of an IPad owned by an AT&T customer and if he also spoofed the user agent to ‘tell’ the AT&T server he was using an Ipad (which he was not using) then the server would reveal the email address of the owner of the IP with that particular ICCIC number. It is worth noting that ICCID numbers are unique and are assigned to specific devices.
According to the prosecution, the following behaviors represent Spitler (with whom ‘weev’ conspired) misrepresenting and tricking the AT&T computers so that weev could impersonate an authorized user and pretend he was using a specific Ipad.:
- AT&T had programmed their script with the intention that it only provide information to the owner of a specific Ipad and only when the owner was using that specific Ipad. That is: AT&T didn’t merely “prefer” the page only be accessed by one and only one person, AT&T had created code restriction intended to prevent anyone other than the owner of that specific IPad from accessing that site. So, under the prosecutors theory, each individual page Spitler loaded was intended to be viewed only by one authorized user and even that user could only access when using their IPad. Spoofing the user agent to represent the connecting device as an Ipad was an element in the ‘misrepresentation’ required to make the AT&T script “believe” that the person visiting was using an Ipad and so deliver the page to someone under conditions in which AT&T did not “authorize” them to view the page.
- AT&T had programmed their script to return special information when a specific value was provided in place of the ‘xxxxx’ in the code above. While sometimes values in query strings is merely a parameter used to pass information and achieve some sort of functionality, in the case of AT&T the specific parameter in ICCID=XXXXXXXXXXXXXXXXXXXX was intended to be or act as a password. The prosecutor notes the parameter is a unique identifier for a phone and as such is expected to be presented by one and only one person. From the prosecutions point of view, AT&T’s intention that it be a password pretty much makes it a password. Or at least it falls in the category of things that may be viewed as passwords and the decision whether it is or is not a password is up to the jury.
In the words of the prosecutor
Here, Spitler wrote code that allowed him, through the use of carefully designed URLs, to “spoof†the iPads of actual iPad owners, such that AT&T’s servers were fooled into treating Spitler’s accesses as though they were accesses by the true owners of the spoofed iPads. In other words, AT&T’s servers were tricked into returning information that its system was designed to return only to the actual iPad owners, and only when they were accessing AT&T’s servers through their iPads.
This impersonation aspect here is key to the prosecutors case because the NJ code (which was included in the prosecutors complaint) makes it a crime “access without password based permission or code-based permission, or in violation of a code-based restriction by impersonating an authorized user.â€
Later, we read the prosecutor hammering away at the “impersonation” issue
Moreover, even if this Court were to conclude that impersonating an authorized user does not constitute a violation of a “code-based restriction,†the New Jersey statute nevertheless was still violated. The instruction given by the Court, which permitted the jury to convict the defendant if there was a “violation of a code-based restriction by impersonating an authorized user,†A706, was based on New Jersey case law which clearly holds that impersonating an authorized user constitutes “unauthorized access.†See State v. Riley, 988 A.2d 1252, 1263 (N.J.Super.L. 2009) (“unauthorized access†occurred “where the defendant impersonated authorized usersâ€) (citing State v. Gaikwad, 793 A.2d 39, 44
(N.J.Super.A.D. 2002) (defendant convicted of illegally accessing a computer system had a consistent pattern of “impersonating the userâ€)). So whether it is a violation of a code-based restriction is really beside the point. Regardless of how it is characterized, impersonating an authorized user to gain access to a computer is the prototypical case of unauthorized access. The evidence that Spitler impersonated authorized users was overwhelming. By falsely telling the AT&T server that he was using an iPad, while supplying the unique ICC-ID of other people’s iPads, Spitler was impersonating other authorized users when he accessed AT&T’s server.
- The prosecutor further contends that weev and Spitler both “knew” that the pages they were accessing were intended to be viewed by one and only one person.
Now lets see if what brandon did contains the essential element in “weev”: That is, did loading url’s of the form “http://www.sksforum.org/thread.php?t=i&p=j” misrepresent or trick the server in anyway? Nope. Did Brandon think the pages were intended to be viewed by one and only one person? Nope. In fact, there are many reasons to believe they were intended to be viewed by many people — including those who found some of the links on Google.
Were the t=i&p=j intended to act as any sort of “password” when sksforum.org wrote the script? I very much doubt it. Had it been a ‘password’ would a person stumbling across it have any reason to suspect it was a “password” and that the uri was intended to be restricted to some group of people with special permission? Nope.
As far as I can tell, the i and j in the sksforum.org script these are what they appear to be: parameters. They are similar to p=N in the default URI’s created by wordpress sortware.
The URLs were not ‘secret’: URLs of this type were advertised by sksforum.org. In fact: the script was specifically crafted to leave these sorts of uris in our server logs rather than a second set whose existence the uri’s of the form ‘www.sksforum.org/thread.php?t=i&p=j’ were likely intended to conceal! These uri’s of the form ‘www.sksforum.org/thread.php?t=i&p=j’ appeared in server logs of admins — including those of Anthony Watts and Brandon Sholleberger himself. One would need to have a vivid imagination to conclude that the set ‘t=i&p=j’ with ‘i’ and ‘j’ as they appeared in Anthony Watt’s blog post was some sort of ‘special’ page which could be visited only by some group of “authorized users” that included Anthony Watts himself and the t=i&p=j’ represented a special ‘password’ one was using to represent oneself as “authorized”.
The fact that Google found some of these passwords, and visited…. well, I guess either Gooblebot “hacked” when it represented itself as “authorized” or Google and other bots were authorized. If the later, the case that Brandon couldn’t visit them is going to be pretty difficult to make as it would be nearly impossible for anyone to ‘know’ they were unauthorized. (In fact– I think everyone was ‘authorized’, even if sksforum.org might have hoped traffic would be light.)
But even if someone– possibly Eli or possible Frank O’Dwyer– were to insinuate that someone might find something illegal in something Brandon did the prosecutor in “Weev” certainly didn’t advance the theory that sort of access should be construed as unauthorized or illegal. The prosecutor in ‘weev’ construed tricking a server by providing ‘false’ credentials and so impersonating the indetity of an authorized user is illegal. That didn’t happen when Brandon requested pages from sksforum.org.
If someone like Eli or Frank think something Brandon did was illegal, it might be useful for them to say precisely what action violated what statute, and then explain their theory of how or why the action violates the statute. Pointing to examples in case law holding the actions similar to Brandon’s were found to violate the statute would be helpful. Examples of violations that involves actions might happen to share some perfectly legal elements (e.g loading a web page) but whose illegal elements do not exist in Brandon’s behavior is not helpful. Certainly the later sorts of examples aren’t going to convince anyone that Brandon’s actions constituted illegal hacking.
Update: The ruling in Weev’s appeal is at arstechnica (pdf). The conviction was waved for improper venue. The question regarding whether Weev’s behavior would have been an illegal violation of CFA is limited to footnote 5 which reads
5 We also note that in order to be guilty of accessing “without authorization, or in excess of authorization†under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code- or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. Ct. Law Div. 2009). Although we need not resolve whether Auernheimer’s conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published.
My take on this is the appeals court was dubious about the prosecutors theory that merely loading the login screen by requesting an URL that included ICCID=XXXXXXXXXXXXXXXXXXXX with the ‘xxxx’ corresponding to a unique identifier for a particular IPad was tantamount to using a password. That said: this is just a footnote.
It’s been up 15 hours. Linda has posted within 9 hours. If she really thinks this sort of thing is a death threat, stalking and so on, and that a visitor to her facebook page thinks the other person writing it constitutes her writing it or her stalking, you’d think she’d take it down. Nope. 
