[baldfat]

Such a BAD use of tax payer money. So now we have to pay for 2 years of jail time (Probably 1 year for good behavior) for giving a key (That was actually not proven but was believed by the juror. The crime was the defacing of ONE page. This key also should have been revoked after he left the company.

The recommendation of 7 years is just crazy and even the lowered 5 years is just nuts. If you just look at the cost to the newspaper it was at one point almost a million dollars when the fix for the page was one editor reverting the page.

> In order to be convicted of felony under the particular provisions of the Computer Fraud and Abuse Act which prosecutors used to charge Keys, the conduct must exceed a threshold of $5,000.

That someone is responsible for paying a company to sure up their security is an issue. Or the inflation of cost to so Federal Prosecutors can get another win under their belt. That over reach is pretty high in this case.

[tptacek]

In this case, the problem wasn't so much that Trib Corp had poor security (they probably do though), but rather that an insider exfiltrated credentials to one of their servers to an IRC channel. There are a few companies in our industry where that attack wouldn't be devastating, because of very carefully designed security programs. But there are not many of those companies. Most companies you've heard of are just as vulnerable as Trib Corp was.

[matt_wulfeck]

But charging them with hacking? And putting them in prison for 2 years?

[tptacek]

There's no such charge as "hacking".

[matt_wulfeck]

Of course. We're able to make the distinction of being hacked versus someone crawling through an open window. If only jurors could be expected to do the same.

[tptacek]

What distinction is it that you're trying to make? Crawling into a building through an open window is no less of a crime than picking the locks. In fact: it's exactly the same crime.

[possibility]

Picking the locks is breaking and entering, going through an open window is illegal trespass, assuming you don't have to move any parts of the window. At least where I live. It depends on whether or not you have to use even the slightest amount of force to gain access. It also depends on your intent to commit a crime inside. If I'm looking for you because I've found your toddler wandering around outside and I open an unlocked door to call out your name, it isn't a crime. I'm not sure what happens if I pick a locked door in that situation, getting pretty contrived now. But let's say I heard your kid crying inside that you'd abandoned, it wouldn't be a crime to pick the lock and rescue him/her.

[baldfat]

Those keys were those of an ex-employee. When you let a person go or they leave the company those credentials should have been changed.

[danielweber]

They should have. He also should not have given out the password.

A failure to change the locks does not mean you have created an attractive nuisance to former employees.

[Retric]

Attractive nuance is supposed to apply to children.

However, failure to collect keys get's into murky situations.

[tptacek]

Can you be more specific about the murky situation we're talking about here? I moved offices from Oak Park back into Chicago a few months back. The landlord never collected the key. My old office was rented out (I can see from the window). Can I go look around inside it?

[Retric]

It's not that you have the right to go back. Rather, by failing to change the locks they might have some liability if you did go back.

If a lessor or landlord in Illinois does not change or rekey the unit's lock before the day the new tenant or lessee takes possession, and a THEFT occurs at that dwelling unit that is attributable to the lessor's failure to change or rekey the lock, the landlord is liable for any damages from the theft that occurs as a result of the lessor's failure to comply with the law http://www.securitydepositlaw.com/blog/chicago-tenants-right...

[ikeboy]

>At trial, prosecutors presented evidence of loss ranging between $10,206 and $13,147

>In an unexpected twist, while going over the defense’s objections to the PSR, Judge Kimberly Mueller limited the amount of loss (for purposes of sentencing) to whatever had been presented at trial, thus drastically reducing the amount of prison time recommended by the sentencing guidelines. In the end, by the judge’s own determination, the appropriate range for sentencing was between 37 and 46 months.

So the actual sentence wasn't based on inflated numbers, and was lower than recommended based on actual numbers.

(Or are you saying the "evidence" of loss presented at trial was fake?)

[baldfat]

I am saying that they INFLATED the loss to go over the $5,000 thresh hold.

[tptacek]

As someone who works in this field and has been a party to breach investigations, it is really hard for me to imagine a breach in which the website of the Los Angeles Times is defaced costing less than $5000. I'm actually surprised --- as, apparently, were the prosecutors --- that the established losses were capped at ~$15,000.

If you're operating a company with real customers and real cash flow at any kind of real scale, and you suffer a serious breach, figure $50,000-$60,000 is table stakes for getting that breach resolved.

The intuition you need, to price these things out, is that once an attacker obtains unexpected unauthorized access to a system, the very next thing they do (and, in this case, the very next thing they tried to do --- much to Keys chagrin) is extend and persist access. Which means that if you're resolving a breach, you have to re-assess every system that the attackers got unexpected access to and verify that they didn't (a) implant something that will restore access in the future or (b) uncover some latent vulnerability that would allow them to do that.

Nobody reliably assesses internal systems (those systems you get unexpected access to once you successfully obtain unauthorized access). Nobody. An attacker gets behind the login prompt on a CMS you've deployed? You probably need to re-assess the whole CMS, because a big chunk of your security for that CMS probably relied on the idea that attackers don't know and can't reach all the URL endpoints behind the login prompt. The attacker gets code execution somehow? Now they're on your internal network, and the same goes for every system on the internal network.

It adds up fast. And your insurance company will (a) demand that you pay it, and (b) shortlist your DFIR vendors for you.

Not fun times.

[jessaustin]

It is surprising to mere mortals that reverting a web page to a previous version, as GP described, costs that much. I can see an argument to include costs of investigation, and a much more tenuous argument to include costs to fix a vulnerability, but frankly the arguments not to include those costs seem more compelling. After all the defendant in this case didn't design and implement the relatively weak security. That was a business decision by managers and executives.

[EDIT:] I see you've added some material that explains why investigations cost more. That seems reasonable, but in many cases attackers are not within the reach of prosecution. If we allow firms to blame the "hacker" for needing to investigate how bad their security is, ISTM we're letting them shift the blame to parties who can't actually fix their problems.

[tptacek]

Can you be more precise about "relatively weak security"? The accused in this case exfiltrated credentials to the system that was compromised. Most companies would fall to that attack.

Meanwhile: they clearly can't just revert the web page. Keys gave a hacker group a login for a web application. How, exactly, does Trib Corp know how much damage the hacker group did to the server? There needs to be an investigation, and the norm is that the investigation should be done by a third party.

Meanwhile, there's a principle in the law that you take the victim as they come. In US tort law, it's called "the eggshell skull rule". It means if you hit someone over the head with a book or something and unexpectedly fracture their skull because it turns out to have been as thin as an eggshell, you are still responsible for the damage you caused.

[jessaustin]

It's my understanding that credentials were used to access a system from "outside" some time after the employment of the user associated with those credentials ceased. That is weak, relative to other firms that take the steps necessary to retire the credentials of former employees. I've worked at such firms; I know they exist. You probably have a better sense of the "average" state, however.

It isn't at all clear to me that the eggshell rule is relevant to this situation. This was not an act of violence. Packets were exchanged among computers, which resulted in other packets being exchanged among computers. The "legal reasoning by tortured analogy" one sees so often on HN has really crippled our collective intelligence.

[kbenson]

It's not even always about finding how bad your security is. Sometimes you might know exactly how they got in, but that doesn't affect whether you've successfully cleaned them out at all. Once someone is on your system, being absolutely sure you've cleaned the systems out of security issues is something you'll never quite be sure of, without booting trusted third party media and comparing the disk to a known good backup. Most sysadmins I know don't bother, it's easier to just restore from a known good backup and selectively copy anything over that was changed more recently. Restoring a live system from backup and making sure it's fit for production duty is quite a bit more involved than changing a password, or patching a program. It's not a huge burden, but extend it across tens of servers, and costs start piling up quick.

If you find out that someone's been coming into your house when you're not there for a few weeks, but you're not entirely sure how, you don't just change your key, you also check all your windows, possibly fix the latch or replace the window on any that are broken, etc.

[kybernetikos]

This is perhaps not directly related to this story, but it seems common that hackers are taken to be liable for the cost to fix whatever weaknesses they used to make the breach. This is like not fitting any locks on your doors, and then charging the burglar to put new locks on after a burglary.

The cost should generally be limited to the actual damage done by the hacker, rather than include things that the company should have been doing anyway.

After someone uses an open window to obtain entry, does that mean that they can be charged with the cost of locating and auditing every copy of every physical key to the premises, on the basis that they could have found one and stolen it while they were in the building?

[tptacek]

No, that's not common. The damages imputed to attackers arise directly from what they did. The problem is that people ignore a whole class of damages in these cases: the DFIR work that is required to ensure that whoever attacked you didn't also persist themselves somehow.

[kybernetikos]

The problem is that that work seems essentially unlimited (you can invent crazier and crazier possibilities that you need to check for), and doesn't seem to be something that we do so much for physical intrusions which nevertheless have the same features (you can find keys, take copies of keys, even change locks or cut make false walls / doors).

Your infrastructure should aim to be robust against people persisting themselves (in this case, something that allows an employee to persist themselves beyond the validity of their credentials is a serious problem whether the hacker does it or not). Where it is not, that's your failing. Charging the hacker for finding out where your infrastructure is failing is perverse since if anything their attack made it easier to spot a failing. If they did persist themeselves, then obviously the cost to fix that belongs on the hacker, but the cost to identify such things is something you should be doing anyway.