Ethical hacker faces war driving charges

Found this article on TheRegister
it sounds kinda scary, get arrested for showing how insecure the set-up is. :(
anyway.. here's the article..

Quote:

---

By John Leyden

A Houston computer security analyst has been charged with hacking after demonstrating the insecurity of a county courts wireless LAN.

Stefan Puffer, 33, was indicted by a Grand Jury on Wednesday with two counts of fraud for allegedly breaking into Harris County district clerk's wireless computer system. It's believed to be the first case of its kind in the US.

Puffer, who was employed briefly by the county's technology department in 1999, could get five years in jail and faces a $250,000 fine on each count if convicted, the Houston Chronicle reports.

He's accused of accessing the system March 8 in an alleged intrusion that cost the county a reported $5,000 to clean up.

District Clerk Charles Bacarisse told the paper that no confidential information was disclosed but the alleged intrusion eventually resulted in the county closing its wireless LAN only a month after it was activated.

But is the court prosecution a case of shooting the messenger?

On March 18, Puffer demonstrated to a county official and a Chronicle reporter how easy it was to gain access to the court's system using only a laptop computer and a wireless LAN card.

Puffer first noticed the problem while scanning for insecure 802.11 networks throughout Houston earlier that month, around the time that the alleged offence took place. ®

---

Quote:

---

Originally posted here by jcdux
Found this article on TheRegister it sounds kinda scary, get arrested for showing how insecure the set-up is. :(
anyway..

---

Yes, that is scary. However, we do not have the full facts on what process he used to prove his point. How do we know he didn't change a database to draw attention to this discovery, and don't you think he would first off say "Hey, I have a feeling this LAN is insecure, do you think we should check it out". He couldn't get into trouble if he had permission to test for insecurities. I just have this feeling that he was caught by setting someting up to prove the point. just my .02

Or maybe he was trying to do something he shouldnt in the network, got caught and used the "checking the area for insecure lans" as a coverup?

Quote:

---

from avenger_jcc
Or maybe he was trying to do something he shouldnt in the network, got caught and used the "checking the area for insecure lans" as a coverup?

---

Or maybe..

[pong]/me starts ranting[/pong]

if you keep your heads down and ignore the problem, the government will introduce shitty laws that protect the clueless and prosecute the security conscious folk.
:(

It’s not that far fetched to assume that one day in the not so distant future, you could be labelled a cracker or cyber-terrorist just for owning (not even using) tools or programs that could be used for cracking etc.
:(

Hell, it goes further than that.. if the US government / congress ($ Hollywood $)
introduce their proposal that allows for “technological self-help measures”
(ie: I think that by some very remote chance that you may have hax0red me and stolen my credit card details electronically from my pc, I can hack your ass with impunity) (see http://theregister.co.uk/content/6/26357.html for a register type biased background)

Come to think of it.. the government has amassed *ahem* stolen lots of info about me and I want it back.. time to legitimately target those ‘secret’ servers to discourage big brother once and for all....
...
..
.

Where does it stop or start?
Where can you draw the boundaries?

It all gets blurred, if we’re not careful, anybody with a small of understanding of security could and might be labelled cracker, cyber-terrorist's or worst of all... hacker

Security by obscurity doesn’t work.
Punishing those who want to better understanding of the threat of cracking / cyber-crime doesn’t work either.

All I see is governments heading full steam ahead into legislation and laws that protect the software companies & Hollywood at the expense off everyone else.

[pong]/me stops ranting[/pong]

;)
jcdux

Quote:

---

Originally posted here by jcdux
It’s not that far fetched to assume that one day in the not so distant future, you could be labelled a cracker or cyber-terrorist just for owning (not even using) tools or programs that could be used for cracking etc.

---

Jcdux.... You won't like this :deal:

Quote:

---

Originally posted here by 2600
The Secret Service has made it quite clear with the recent prosecution of the Bernie S. case that they intend to use whatever means necessary to put hackers behind bars. In the Bernie S. example, they successfully managed to lock him up with violent criminals for nearly a year, solely because of his possession of written material, software, and bits of hardware. In other words, not much at all. With such vague requirements, the prospect of selective prosecution seems a certainty for many more of us. What the Secret Service has done transcends the mere interests of computer hackers. Their behavior, vindictiveness, and lack of concern for upholding the values of a free society are of concern to Americans of all varieties.

---

Quote:

---

Originally posted here by jcdux
Where does it stop or start?
Where can you draw the boundaries?

---

Patriot Act = Hackers *Life in Prison*
New MPAA Bill = Legal Hacking

and that works how??????

well, I guess.... :withstupi

The system was hacked on March 8

Puffer gave his 'demonstration' on March 18

On march 18 he claimed to have discovered the hole around march 8, while war driving.

Puffer also used to work for the place that got hacked.

So they put 2 and 2 together, added in the 1, and arrested him, i think they have enough to rightfully charge him.

was he stupid enough to announce he found the hole, after he broke in or just a victim of circumstance and someone else broke in. thats kinda up to a jury to decide.

In this case, i don't think law enforcement was wrong to arrest him and it dosn't sound trumped up to me.

Just my 2c worth, and i hope tdob1 and i are correct in this, but... if i know of, or discover, a security problem in the county system, it takes about five minutes to call the Sheriff and explain to him what i think the problem might be, and would he like to test the theory. He's gonna say 'sure, let's get the commissioners together, a fresh pot of java and have a go at it. if you're correct, we'll fix the problem and send a letter to the editor showin' all the citizens how we're tryin' to stay ahead of our system-based problems...' On the other hand, if i go prowling around in the county server without permission, and get caught, somebody's gonna get an elevated temperature about it all, complain to the co. atty, and if there's a law that can whack me you can bet they'll use it. After all, the co. atty works for the citizens, not the lawbreakers although he is charged to also make sure there is good faith prosecution.
With the case at issue, we don't know what kind of a relationship there was between the accused and his ex-employers, why he no longer works there, or what the background is. Like somebody said, now it's up to the jury. if the technician is indeed innocent, i hope the twelve stay awake long enough during the techno-babble to find for him. JMHO :D

how in the hell do you get caught war driving? if he was truly trying to inform the county about a problem and got arrested for it, then when they get hacked again they deserve whatever they get... it doen't pay to be a white hat, you still looked upon as a cyber terrorist!

all white hats should come to the darkside!

p.s. how do they come up with those figures, $5000 loss because of an intrusion, home pc's get rooted everday are these users allowed to quoted dollar figures to thier losses?

if a company access a cookie on my computer without my permission am I allowed toroot thier box for hacking mine?

just my .02

Good point Old Man just cause you know of a hole it is not an invatation to get on the netwok. Then ya know Old Man gov thing lowest bidder got the job and the consultant told the powers that be no one will know cause they are young and foolish cause hey they inveneted all this dot come dot gov stuff no one knows but them the faults.

How ones gets caught War Driving funny where honey pots are :)

Nth Man, he wasn't trying to help the county, he was trying to further his career by calling a press conference and showing how good he was. Problem was, he broke into it ten days earlier to be sure that he could, probably using knowledge he gained while working their. He must have thought he was to good to be found out.

5k dollars is not hard to figure out, after a break in I imaging some high priced security specialists were called in, spent hours auditing every file to see if they’ve been accessed and altered in some way, people had to stop working while the were checking the files. These people who had to stop working still get paid. So that’s counted as a loss, which it is.

This guy isn’t a white-hat, hes just some self serving ass-hole who got caught.

Ok, so maybe my one question is who does the testing for government systems? The citizens who it is meant to work for, or the people who run it and have the least to lose if it found insecure?
A good case in point:

A person who works for a company probes it, finds numerous problems with it's info-tech systems, reports it, and gets fired.

A person who works in gov't, probes a gov't system, and then reports it, and then gets a disciplinary action for it.

So, who's responsibility is it, the admin, who don't know their a** from a hole in the ground(Not all admins are like this, I'm not labeling all of them this way), or a security consious person who happens to not work for the IT department?

true wht happen to government site does affect us all, in some way and if you wanted to look out for your interests, there's always the anonymous phone call DukArchon. too many people use this like blackmail, to try to get jobs, promotions even laptops.

As far as gov. puters go the Admins there are the worst in the business. Often they are put in the network admin job cause tehy are usless everywhere else. I have report numerous problems with our local network and been repremanded for "looking where I shouldn't be" on numerous ocassions. Just my two cents worth but I don't think its worth trying to help anyone solve their obvious sercurity holes unless asked to and this is coming from someone who had to learn the hard way.

Maybe the bottom line on this subject, whether we like it or not, is something like; everyone has a job to do. Most of those jobs have a chain of command, and somewhere up the line a very sensitive high-ranking supervisor who sits at the round table each morning for the CEO's briefing. If the (military here) IT Colonel gets a case of the a$$ from some dude in the cooks galley who happens to be a clever system type who hacks the system and brags about it, you can bet the Col. will get the first and last shot off and the hacker will learn what a general court martial is. Change that military Col. to a county commissioner in charge of whatever-system-gets-whacked, and you can bet he'll be at the prosecutor's office in ten minutes flat, screaming for the warrant to be hand-carried to the judge by the sheriff who will be required to make an arrest before the ink is dry on the paper. Some things are as constant as day and night.... and self-preservation techniques by the top cat in any organization are somewhere up around the top of the list. Anyway, most of us have noticed something like that. :D