Catch Adrian... if you can.

http://www.securityfocus.com/news/6888

"FBI agents armed with a federal arrest warrant out of New York were searching for Adrian Lamo Thursday, SecurityFocus has confirmed. "

"Lamo frequently stays at his parents' home, but he was not there at the time of the FBI's visit, and has not returned since. His mother contacted the Federal Public Defender's office in Sacramento, which has agreed to handle his surrender. "

"Until now, his cooperation and transparency have kept him from being prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser. Some companies have even professed gratitude for his efforts: In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. "


He's an idol. And he's being chased down. Any thoughts?

haha add an "r" to lamo :P

Im sorry but he's gotta be pretty stupit to compromise a system and then go tell the company about it and expect to be viewed as a guardian angel...I know it'll piss the hell out of me ..Ild be gratefull ofcourse for finding the exploits, nontheless pissed off.

However I dont think he desrves a heavy sentence. Probation with community service at best..

Just my opinion,,

who's this "her" you speak of gunit?

typo

Yea, lets fill our jails with hackers and people caught with drugs, while the rapists and murderers go free because there isnt any room. Great idea!

Hell at least he helped them find it. He could have found the holes and used it for his own play time. I dont think hes lame on the simple fact that he helped them close a hole he found. And also he hasnt been using these for HIS advantage. Hes notified them instead and had them close it.

Kinda like hackers did back in the day. "Hey admin, patch your box, heres how:" LOL.

I think its a great shame that the New York Times couldnt see the benifits of someone with ethics finding and reporting theres vunerablitys,

I really think its about pride, I think the Network admins were annoyed that someone with no fixed address, who travels the country, was capable of this. Instead of the Network admins who were blatently uncapable of accepting they were wrong and working with him

Hopefully the judge when he is found will acknowledge that what he was doing was infact right, if against the law.

Hopefully he can get somepeople he worked with on other security jobs to stand up for him

i2c

Quote:

---

Originally posted here by gore
Yea, lets fill our jails with hackers and people caught with drugs, while the rapists and murderers go free because there isnt any room. Great idea!

---

meh... i don't think you put the drug users in the right area, they are just as bad as rapists/murderers, as they:

a. kill/rape people more often when using drugs
b. get the youth involved
c. use drug money for bad ****, such as policitical influence
d. kill people FOR drugs
e. drugs are bad, mmkay

Here is another example why the laws dealing with "hacking" should be more flexible. Here is a guy, although crappy in the way he went about it, who exposed vulnerabilities and then assisted in fixing them. At the same time, there are others out there who clearly do the exact opposite yet each of them are getting pinched with the same charges.

I sure hope that our fearless leaders begin to educate themselves before throwing more worthless legislation on the table when clearly there are major strides to be made with existing laws.

--my 2 cents

:)

Hey i2C,

If I break into your house, without your knowldge, and rummage through your personal belongings and then a month later call you up and tell you

"Oh hi, you dont know me, but I took the liberty to break into your house the other day and I noticed your house is not as secure as you think, and oh by the way, dont worry I didnt steal anything. Im just going around the neighborhood and attempting to break into people's homes without their permission, just to help them and identify which ones are unsecure"

Would you be pissed off?? Come on man....What gives,,sure I agree with you, his intensions were maybe honest,,,But he still broke the law and what he did was illegal and dumb.

just an opinion,,,

Quote:

---

Originally posted here by er0k


meh... i don't think you put the drug users in the right area, they are just as bad as rapists/murderers, as they:

a. kill/rape people more often when using drugs
b. get the youth involved
c. use drug money for bad ****, such as policitical influence
d. kill people FOR drugs
e. drugs are bad, mmkay

---

=o

Ok, your stating things you arent to sure of.

One, people kill for drugs and **** like that and are violent because of drugs because:

THERE NOT LEGAL ANYMORE.

The same with alcohol, when it was against the law for a while, what happened? The Mob started bringing it in and violence broke out everywhere. Look at the US, this country is more strict on drugs than any other, and look at our crime rate to any other countries.

People wouldnt get murdered for drugs if they were legal and could be bought. People getting raped? I think not, its ok in America to get drunk and beat your wife, but smoking opium and relaxing is sooooo bad right?

Have you EVER heard of someone smoking pot or opium beating there wife? No, they hug them and eat some tacos and go to bed. If the US made pot and opium legal we prolly wouldnt have so many crimes happening everyday, people would be to stoned and happy to go kill anyone.

Quote:

---

Originally posted here by gunit0072003
Hey i2C,

If I break into your house, without your knowldge, and rummage through your personal belongings and then a month later call you up and tell you

"Oh hi, you dont know me, but I took the liberty to break into your house the other day and I noticed your house is not as secure as you think, and oh by the way, dont worry I didnt steal anything. Im just going around the neighborhood and attempting to break into people's homes without their permission, just to help them and identify which ones are unsecure"

Would you be pissed off?? Come on man....What gives,,sure I agree with you, his intensions were maybe honest,,,But he still broke the law and what he did was illegal and dumb.

just an opinion,,,

---

Wheres the proof he looked around? And you cant think about it like a house because your family isnt sitting in your ****in PC case man. HUGE difference.

hey gore,

Are we talking about proving that he did it, or stating the fact that he did and wether to prosecute him or not for doing so??? Two different arguments man!!!

And sure you can think of it as a house. He may not be able to physically harm you by breaking into your PC, but he can cause monetary damage (which these days to a company is worth more than a human life)..And also, what is the value of your personal privacy worth to you?

he escaped and is living in my basement for a day until some hippies come in a 1962 vw bus to take him to the underground.

this kid hacks company's and helps them fix any security holes before some other hacker steals CC#'s ,passwords, takes down the site and or what ever else they want to do. and some overly pridefull admin takes it personaly because he thought his site was UNHACKABLE gets pissed off that someone might just have a little more knowledge that him and now the kid faces jail time what a joke the company should be thanking Adrian for catching the problem before someone less ethical did!! just my thoughts!

Quote:

---

Originally posted here by gunit0072003
hey gore,

Are we talking about proving that he did it, or stating the fact that he did and wether to prosecute him or not for doing so??? Two different arguments man!!!

And sure you can think of it as a house. He may not be able to physically harm you by breaking into your PC, but he can cause monetary damage (which these days to a company is worth more than a human life)..And also, what is the value of your personal privacy worth to you?

---

Lol, reminds me of the Anti Flag song "Im being watched by the CIA"

What are they going to tell people? I jerk off alot and do drugs?

Yea what he did may have been wrong but I duno, I guess its just the fact that he didnt destroy anythnig and he did tell and help the guys secure the holes when he didnt have too. If I was an admin and there were holes in my system Id want to know and I would prolly thank him for pointing them out and helping me fix them.

I dont think of it as a house though because he wasnt putting anyone in any direct harm. Walking into someones house, its smoething they live in, a computer is something they work on. And besides, I didnt break into websites with a browser but I can Thank God that I'm not in prison from **** I did back in my learning days about 2 years ago when I got into an IRC chat server with by best friend. All we did was see if we could, and then we made chats based on the ones for that server. Im talking about www.bolt.com

They know we have chats and **** but they really dont mind, Iv talked to the staff myself, and even though thay dont like it they arent mad or banning us. (That and the fact that the only way to use them on IRC is to use there java client in a webpage and that doesnt work to good with Linux). They are actually nice about it.

I have messaged them a few times with helping to fix up the servers because they lag horribly and run Apache tomcat on Windows 2000 and I tried helping them to fix it up a bit. They appreciated me helping but never did anything.

And yet, he could have started a security consulting buisness....contacted the companies and said that on routine browesing to identify problems, that he found these holes in their system. Then charged them massive amounts of money to identify anf fix the problems, and every one would have been happy.
Strange what is illegal forn one person, is perfectly legitimate buisness practices for anouther.

Do you have any idea how much it costs to start a business? You get tax breaks in the US but you need money to do that. After Im outta college Ill be doing that to but I know itll costs alot already. You cant just start up a business because you feel like it if you dont have the money.

Quote:

---

Lamo believes the arrest warrant is for his most high-profile hack. Early last year he penetrated the New York Times, after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

---

So if I read it correctly he understood what he was doing and he's smart enough to not get caught already. Besides I really dislike the "lamer and "scriptkiddy" stamps, I think that is enough to say he's not just someone with malicous intends. He did it for ethical reasons and because it was appearantly so ****ing easy. You could almost say with them open proxies at the times server (or something) it was just exposed to the internet like it was "just normal" to view the information.
I guess the FBI is doing what it's ment to be doing, but it's an ethical question to say if he was wrong or right. He didn't have to actually browse the information, but with his past things he shows he did it to help them secure their stuff. He's like a "hacker' described in all texts from 20 years ago. The hacker wich is addicted to information and thinks it should be free for all, after wich this one even had the guts to tell the people what he did with the intend to help them.

Quote:

---

In a telephone interview, Lamo said he was in California, but does not plan to turn himself in until after conferring with the attorney. The hacker was quick-witted and seemingly in good humor, with only a trace of nervousness in his voice. He quipped about the proper etiquette of being arrested by the FBI, and suggested jokingly that SecurityFocus should purchase the publication rights to a favorite photo. He said he was in the company of a camera crew producing a television documentary on hackers.

---

edit:
quotes from http://www.theregister.co.uk/content/55/32673.html

Quote:

---

Originally posted here by gore
Do you have any idea how much it costs to start a business? You get tax breaks in the US but you need money to do that. After Im outta college Ill be doing that to but I know itll costs alot already. You cant just start up a business because you feel like it if you dont have the money.

---

Actually, dependent upon the state you are residing in, it can cost little or no money. Of course if you wish to protect yourself and incorperate, then it does get rather expensive. Approximently $2500 or so for basic incorperation.
Yes, I am very aware of the costs, since I have an incorperated buisness.

Personally I think what he did was a great thing. Back in my days of "questionable" computer activities, there were some shopping cart programs that would rather easily display CC information. We're talking everything Billing Address CC Number, the lil security number on the back of the card, even what they had ordered from the company. In my boredom I'd go around and see which companies running that shopping cart software (Google <file>.cgi) and see if they were vulnerable. I'd contact the company and notify them if they were, I figure if I was buying from them, I wouldn't want my information available to anyone who wanted to spend a lil time getting it. I'd tell them to fix the hole or in 30 days I'd tell everyone they were vulnerable to it. For the most part they would thank me, occasionally they'd be *****s and threaten legal action, but it never happened, but they did all fix their systems....

If a person is doing good, they should be praised for it. If they do something malicious, then it's a problem. Think of it like this. You are walking down the road, you see a guy raping a girl, so you step in and end up beating the **** outta the guy. No one's gonna charge you, you were doing the right thing. However if you are walking down the road and beat the **** outta the guy just because he's standing there, you're gonna be in trouble.

That isn't exactly true...if you step in and beat the **** out of the guy....he may press charges against you for doing so. The cops may be all for it, but that doesn't mean they condone it or could let you get away with it. Lamo went out and actively looked for these problems, which if you relate it to the rapist argument this could make him out to be a vigilante....which law enforcement really does not look upon very well.

In the end the yo yo that is the topic of this thread did alot of auditing of computer systems without a written contract or agreement. That is stupid, and could have got him in trouble even if he worked for the companies involved (look at the case with the guy at Intel doing password auditing without permission). Unless you have permission in writing, they can come after you. If you do it without the companies permission and without taking the proper steps for you to be covered legally...they SHOULD come after you. You could very well take out a mission critical system and cost them alot of money.

If you want to be an info sec professional, be a professional. Don't just play one on TV...

This is a coin that has and always will have two sides.

Heads: The internet and networks in general are not the place they were in past years. The information stored in todays networks are worth vast amounts money and store information vital to the economics and security of individuals,companies and countries. Businesses have the right to conduct their affairs in a regulated and safe environment or they cannot conduct business. This aint the Wild West anymore boys. You simply cannot infringe on the time,money and property of others and expect no represcussions legal or otherwise.

Tails: These are not just the 'homes' of individuals whose security is at risk. These are institutions both private as well as public whose information NEEDS to be protected for the safety of clients,citizens and countless others. I think if someone told you that a company/institution or otherwise, whom is entrusted with sensitve information about you, your family and countless others was accesible to anyone at anytime, and that the people to whom you entrusted this information are the very people giving it away, you would also be a little pissed off. The bearers of this information are not often as motivated to admit the truth about the security of this information as the individual at risk, for a variety of reasons most of them relating to money. A bank will never tell you your money isn't safe with them. Microsoft will never tell you they are spying on you. If you can't trust the FBI and Microsoft, who can you trust?

-Maestr0

He just called techTV and announced he had talked to the authorities and decided to turn himself in. literally, just now, i saw it live on the air. anyway I for one admire him. like the article said, the hacks he did usually involved no more than a normal web browser, and he did it for all the right reasons. It would've been smart to have asked permission first, but lets face it, how many of them would have given it? I don't equate his "crimes" to breaking into someone's house, routing around, then later telling you your house has vulnerabilities, its more like walking down the street, noticing your door is wide open, and calling you to tell you to close it.

Hey x acidreign x,

He did a lot more than ""noticing your door is wide open, and calling you to tell you to close it.""

Read the article...Here's an excerpt:


" Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter. "

He not only "noticed your door is wide open ", he helped himself into the house, and took it upon himself to see what else you have in your house that is unsecure...rummaging through personal belongings.... then
" he told you about it"


Maestr0 made a very good point, the house analogy is poor one, it was a lot worse than breaking into a house

"these are not just the 'homes' of individuals whose security is at risk. These are institutions both private as well as public whose information NEEDS to be protected for the safety of clients,citizens and countless others"

Just an opinion!!!!!!

cheers.

Quote:

---

Originally posted by: gunit
He did a lot more than ""noticing your door is wide open, and calling you to tell you to close it.""

---

All of the things you listed are standard proceedure once you get into a big company. He did that for effect. He did it to show the company he was hacking the expanse of what one could do in a matter of minutes - which is literally devistate and cripple the company if a malacious attacker ever found out.

Using your house-anology:
Imagine you have a house, and in this house you have a wallet and a safe with important valubles in it.
I, Adrian, would break into the front door. Big deal you say, anybody determined enough will and can do it. But my, Adrian's, point is not just breaking down the door, for you, the company, underestimate the power now invested in me.
I'll walk to your wallet, tell you how much money you have, describe your family pictures, and tell you important numbers, then i'll walk and break open your safe, and tell you that if I wanted, I could take all of this with me.

...But I, Adrian, will not take your stuff. BUT!, all hope is not lost. Here's a list of things to protect yourself. I'll work with you, if you cooperate (because I know I will) to fix and solve these problems - because if you have them, imagine how many other people have them.


I respect Adrian. I won't praise him, nor bash him, however. But people like Adrian are essential to the ongoing evolution of internet security. And besides, it makes it more fun for people like me who try (in vain) to keep up or get ahead of where Adrian is at right now.


Just my two cents.

I have to agree with gunit
At the end of the day he did not do it with all good intentions. He did it because he got off on it nothing more nothing less. So does this mean we can just break any law and say we were proving a point? Where do you draw the line?
It looks to me like he was only saying look at me aren t i cool look what i did. He may be smart but he certainly wouldn t know how a wise man feels.

I disagree with the naysayers on this one. I have followed up on Lamo since he was sleeping here and there because he knew he was being tracked and have followed techtv's coverage. I think that him turning himself in is a good thing. I also think that he did wrong (in a way). In a way I believe he was being an intelligent curious person letting these big companies know that they should fix these problems. He could have not let them know what he was doing and thieved his way around a lot of things. Some people do bad things and don't get caught. This guy was the guy telling people hey look I could do this much to your computer and here's how I do it instead of just doing it and taking what he can and going away.

Update on Lamer... err... Lamo

Quote:

---

'Homeless hacker' surrenders

By Declan McCullagh
Staff Writer, CNET News.com
September 9, 2003, 12:18 PM PT

Adrian Lamo, the so-called homeless hacker, surrendered Tuesday to face two federal criminal charges of electronic breaking and entering.
Lamo, 22, turned himself in at the U.S. courthouse in Sacramento, Calif., ending a five-day manhunt during which FBI agents staked out his family's home in the Sacramento suburbs and his defense attorney negotiated the surrender with federal prosecutors.

---

Continue reading here.