Hacker sentenced

this posting is for all the guys out there into the practice of "learning" by trying to break/hack into a network they aren't authorized to. 9 years....!!!

Quote:

---

CHARLOTTE, N.C. — One of three Michigan men who hacked into the national computer system of Lowe's hardware stores and tried to steal customers' credit-card information was sentenced Wednesday to nine years in an American federal prison.

The U.S. government said it is the longest prison term ever handed down in a U.S. computer crime case.

Brian Salcedo, 21, of Whitmore Lake, Mich., pleaded guilty in August to conspiracy and other hacking charges.

Mr. Salcedo's sentence, imposed by U.S. District Judge Lacy Thornburg, exceeds that given to the hacker Kevin Mitnick, who spent more than five and a half years behind bars, according to a U.S. Justice Department Web site that tracks cyber-crime prosecutions.

"I think the massive amount of potential loss that these defendants could have imposed was astounding, so that's what caused us to seek a substantial sentence against Mr. Salcedo," federal prosecutor Matthew Martens said.

Two other men are awaiting sentencing in the Lowe's case. One of them, Adam Timmins, became one of the first people convicted of "wardriving," in which hackers go around with an antenna, searching for vulnerable wireless Internet connections.

Prosecutors said the three men tapped into the wireless network of a Lowe's store in Southfield, Mich., used that connection to enter the chain's central computer system in North Wilkesboro, N.C., and installed a program to capture credit-card information.

Lowe's officials said the men did not obtain any such information.

The case was prosecuted in Charlotte because it is home to an FBI cyber-crime task force.

Mr. Mitnick led the FBI on a three-year manhunt that ended in 1995 and is said to have cost companies millions of dollars by stealing their software and altering computer information. Victims included Motorola, Novell, Nokia and Sun Microsystems.

---

Nice one but next time, put your source as a link to be legal.

Hacker sentenced / Associated Press

http://abcnews.go.com/Technology/wir...C-RSSFeeds0312

hope the link works.

21 + 9 = ~ 30 yrs when he gets out. that's not that bad. still plenty of time to start a new life.

Quote:

---

Originally posted here by secure_lockdown
still plenty of time to start a new life.

---

Maybe somebody else's life... after a sentence in a federal prison of this length it's not a lot that he'll be able to do IMO.

This is more than learning. He had malicious intent in his penetration of the network. While I might be arguing pro-Lamo, I won't do it for this guy. It wasn't just unauthorized entry or maybe information retrieval... this was CC fraud and he might've done more if he had time.

However knowing how drug dealers and rapists sometimes get lighter sentences I can't help but fell rage at how an activity that's so easily misunderstood can give rise to such sentences... Money talks in the world, and money talks loudest in the US. What he did was wrong... but was it this bad?

Setting examples sometimes doesn't deter others... it makes them join together.

Quote:

---

this posting is for all the guys out there into the practice of "learning" by trying to break/hack into a network they aren't authorized to. 9 years....!!!

---

Actually, I think you meant to say:

This posting is for all the guys out there into the practice of stealing credit card numbers by trying to break/crack into a network they aren't authorized to.

The rest of us not here to try and practice stealing credit card numbers will continue on about their buisness.

Quote:

---

Originally posted here by poohsuntzu
Actually, I think you meant to say:

This posting is for all the guys out there into the practice of stealing credit card numbers by trying to break/crack into a network they aren't authorized to.

The rest of us not here to try and practice stealing credit card numbers will continue on about their buisness.

---

i side with you poohsuntzu, believe me, but the issues here and problem is (as has been debated on this forum many times before), ...

GOOD LUCK trying to convince someone that you *weren't* trying to steal credit card info or you didn't have malicious intent.

remember, *you* are the un-invited/un-authorized party and *they* are the ones with the proof that you where where you shouldn't have been. and no one is going to gave a $hit when was the last time the local sys. admin patched what.

the point of my post is, this stuff doesn't get get punished by a little slap on the wrist anymore.

'tried to steal' this part is shaky to me. I'm glad I know people that intend to become lawyers and have a good grounding in computers and things associated with them. How was this intent proven in a court of law?

I suppose the analogy of a thief being in your house was something used... if somebody's in your house then he probbaly wants to steal all the stuff you own... Maybe we should hold all drivers accountable for possibly speeding if they drive a sportscar and fine them as the leave the lot...

Quote:

---

Originally posted here by hypronix
However knowing how drug dealers and rapists sometimes get lighter sentences I can't help but fell rage at how an activity that's so easily misunderstood can give rise to such sentences... Money talks in the world, and money talks loudest in the US. What he did was wrong... but was it this bad?

Setting examples sometimes doesn't deter others... it makes them join together.

---

Drug dealers shouldn't be put behind bars in the first place. Neither should rapists. Rapists should be shot, Dealers should be given a lisence.

Quote:

---

'tried to steal' this part is shaky to me. I'm glad I know people that intend to become lawyers and have a good grounding in computers and things associated with them. How was this intent proven in a court of law?

I suppose the analogy of a thief being in your house was something used... if somebody's in your house then he probbaly wants to steal all the stuff you own... Maybe we should hold all drivers accountable for possibly speeding if they drive a sportscar and fine them as the leave the lot...

---

Yea i would like to know what proof they used to prove they wanted to steal the numbers because it just says that they put a prog but what did this program actually do maybe it was a keylogger or a backdoor or rootkit any of those could be interpreted as trying to steal any thing you wanted so maybe they didn’t want the card numbers but its their would agents a prosecutor and when you get a jury who don’t know windows from Linux or the difference that using firefox would make instead of IE how are you going to suspect them to actually make a competent decision on this matter.

I would much rather have mine and 1000 other peoples credit card numbers be stolen (and they can all be canceled once we find bad charges on our cards) than be assualted, raped, involuntarily manslaughtered, and various other bad things. So why do people using COMPUTERS to steal CC's get more of a sentence than the people who commit those crimes, and why do people who steal CC not using computers get lesser sentences?

Quote:

---

"I think the massive amount of potential loss that these defendants could have imposed was astounding, so that's what caused us to seek a substantial sentence against Mr. Salcedo," federal prosecutor Matthew Martens said.

---

You mean to say that they were caught before they did any damage and he still got 9 years ??!!!

Quote:

---

Originally posted here by hypronix
[B]'tried to steal' this part is shaky to me.

---

i agree. that smells very "fishy" to me. so they didn't catch him red handed - otherwise they would have said he "was" stealing.

so what are we talking about here? does a port scan constitute an "attempt to steal"?

what are *you* going to do if a CIO says it does? i heard of CIO's who have no problem attempting to get you the electic chair if you attempt that sort of thing in their hospitals where they are charged with protecting patients' medical information. extreme ---> i think so!

but then again, they do pink slip doctors for breach of acceptable use policy.

gore

rapeists should be deballed...turned into a strumboni *spelling?*...then they deserve to be beaten almost to death with a very large painfull object....then droped into a pool of acid....you can tell who i hate more than Bush

drug dealers...drugs arnt good my friend...but its that persons life....he may do with it what he/she pleases....aslong as it isnt rape

oo, don't get me started on the war against drugs. Biggest waste of tax money and prison space EVER. What the hell is the point of sending someone to prison for 10 years for having pot on them when right after they get released they go smoke again? Why even send them to prison for that long? Put them in rehab for 2 years, get them over the drug, give them 500 bucks (much cheaper than 8 years worth of food and heating we would pay them) so they don't start sellling again, and hope that they do the right thing.

War on drugs? The only war on drugs is the war the government pulls over our eyes.
[soap box]
No, i dont think the US gov is out to get us. In fact i think they do a good job at keeping us nice and happy, by not letting us know the details.....I dont have proof, just my theory, but i think the government regulates the selling of drugs for profit, and makes a few 'big busts' here and there to make it seem as tho there is a war going on
[/soap box]

that being said...
9 years for unauthorized access, but no damage done (stealing the CC#'s or using them, or ident. theft) VS less than 9 years for raping or assault or robbery......

yea, theres something seriously wrong here.

its called money....

newayz, Im in no way supporting this dude, but im definatly against the 9 year sentance

-z3

Okay maybe I was harsh on the drug dealers [given the content of my pockets now, thanks to such a person :)]. As for what I think a good sentence for rapists is... believe me, it exceeds what I would give a 'passion murder'. But there's a lot of bullshit surrounding the issue, if a girl accuses a teacher of sexual innuendo/assault he'll have a hell of a time proving he's innocent... while going through a job suspension etc.

As far as drugs go I agree on the large with The Grunt and z31200n3 on their points. The bog busts the gov't gets in are usually the competition ;). The theory behind why we aren't supposed to like drug users is that they are anti-social and commit crimes to get money for their drugs. But while the dealer is in jail another one moves on that turf, addicts do the same and nothing is solved.

Money is everything, now more than ever I think. No need to further divert this discussion on that topic... hit me up on IRC if I'm not away and I should always be up for the chat :)

Back to the cybercrime at hand... it's hard to prove they were going to steal CC numbers as it is hard to prove they weren't. But given the general misunderstanding of terms and ideologies between hackers, crackers, spammers and what have you, it seems that the cyberspace is the new weapon for mass fear. The reason for which these people get bigger sentences than somebody that goes into the bank and pops a few hostages and waht have you? Most of the 'cybercriminals' at large and operating do not go for the showlights. They operate in the quiet humming of a computer's fan and PSU somewhere in a basement or parking lot and for some reason they seem very ethereal for the laymen. And when one is caught it seems he's getting the dive for all the problems had by numerous websites and servers that say they've been hacked [when a lot of times it's a bad admin's fault on an unpatched system that could snatch more worms off the web than Symantec could every file in their database].

But there's no point for us to rant about this here on AO... there are other places, better suited for subversive chats and subversive actions.

Cheers!

Quote:

---

there are other places, better suited for subversive chats and subversive actions.

---

Soviet russia?

*cha ching!*

I'll be here all night, and try out the rasberry punch over in the corner before you take to the floor gentlemen

Quote:

---

Originally posted here by poohsuntzu
Soviet russia?

---

If you say so... nowhere is free, but someplaces there's a better illusion of freedom and privacy than in others.

However once Russia became a union of Soviets there was little subversive action... more in the lines of a paranoid dictator than anything else.

Major companies who do not secure 802.11 wireless should have
their IT departments fired!!!
Running Netstumbler on a drive to the store shows how some
corp. IT departments are ignoring big holes in their networks.....

I guess security and 802.11 is an oxymoron.......

Another note: Your Dr's Office may also run unsecure 802.11 wi-fi.

Companies who don't secure their wireless network most likely do not have an IT department rahter it's someone running a cash register that wears the "IT" hat and thinks the package that says "secure wireless transfer" is accurate.

Quote:

---

Maybe somebody else's life... after a sentence in a federal prison of this length it's not a lot that he'll be able to do IMO.

---

Kevin M. owns a security company and travels the world giving speeches. lol.

Quote:

---

At two of the stores -- in Long Beach, California and Gainseville, Florida -- Botbyl and Salcedo modified a proprietary piece of software called "tcpcredit" that Lowe's uses to process credit card transactions, building in a virtual wiretap that would store customer's credit card numbers where the hackers could retrieve them later.

---

Source: http://www.securityfocus.com/news/9281

I don't know about you guys, but that sure sounds like a case of "tried to steal" to me.

Something I think you all may be overlooking is that Salcedo was already on probation for computer crimes. This guy is a criminal. He deserves to be put away for a while. However, I do believe that their reasoning that with his activities he *could have* stolen > $2.5 million and therefore should receive a bigger penalty is over the line. If I go out and kick someone's ass with my Taekwondo skills the arguement could be made that I *could have* killed them so should I be charged with murder instead of assault? Intent aside, what did he acually do? Charge him with that and give him the max sentence.

my $.02

I feel its not right for any company to hold personnal information like that, the fact that they where attempting to steel the info is even more reason company shouldnt hold information like that. Im glad those kids got 9 years it will set an example to all others.