While probably good advice in US it's very sad of affairs it gets repeated. It's not something we should have in civilized society. If people learn to just refuse to talk in routine situations then both trust and ability to investigate goes down a lot. It's also terrible advice in some other countries where failure to cooperate and answer questions could be used against you.
I don't think "you're such a talented criminal, would you like a job?" coming from a federal agent is terribly trustworthy. It was previously used to catch the Half Life 2 hacker back in '04, although granted he basically did it to himself.
At the very least, it would seem like a bad idea to sign something like that without a lawyer, who I assume wasn't involved because, well, what lawyer would say "yeah, go ahead and sign a confession in exchange for an informal verbal job offer"?
IMHO, the really baffling part is why the hell he thought bragging to his coworkers was a great idea. Close friends I could maybe understand, but office randos?
Where I'm from it is possible by bruteforce with some providers. The cards are purely recognized by a number, this number can be used to check the balance on the card on their website. The numbers er not random, but in series, so all it takes is a card writer and finding a number with an active card with money on it.
I suppose it is possible. I just checked sheetz gift cards and the value you enter online is 19digits and incremented. However in the past I examined sheetz cards and the value on track2 of the mag strip was different than the incremented 19digit card code. If a provider did use the same value, you could increment, guess, and write
This guy is an idiot. Maybe he's very good technically, but this isn't even good policework. This is straight out of the troll method of questioning [1].
[1]
"Detritus was particularly good when it came to asking questions. He had three basic ones. They were the direct (“Did you do it?”), the persistent (“Are you sure it wasn’t you that done it?”), and the subtle (“It was you what done it, wasn’t it?”). " -- Terry Pratchett, Feet of Clay
Amateurs all around. Obviously the DHS can't trust him: who hacks gift cards at night then rolls into work at General Dynamics? It's not like anyone else can trust him, either: he's obviously dumb enough to be an informant (does he still not have a lawyer?), and he's likely not to shake that ever.
If anything, the story boils down to 22-year-old Mason grad loses his General Dynamics job through mindless bragging & to-be-expected snitching
Most likely DHS won't be able to use this guy as a federal informant now that this article is out. Did he think that crying to the press would give him some kind of immunity to prosecution?
I was an early 2000's script kid who got in a lot of hot water over my actions. Then three years later, right before I was to go off to college, two FBI agent showed up at my house to offer me a job. They went about it in an extremely sketchy way that made me very uncomfortable. I said no and called a lawyer.
The big thing I learned from that whole situation is that you should say as little as possible to law enforcement without a lawyer present.
TBH it was 2003 and I'm a little light on the actual details. As I remember it it was to work for the FBI but now that you mention it it is more likely that I would have been acting as an agent.
the majority of comments on this thread are off with there suspicions of foul play on the "hackers" part.
the details from the article mostly add up. there is information missing that could confirm this (review of skill-set showing competency in side channel attacks, perhaps a followup on the DAPRA grant) but the general attack described could be possible. also intelligence agencies looking for snitches should be read as an agent fishing for a spy. A special type of spy with technical skills. It might be that after hitting the first "go higher him and bring him into our RED_or_Black team" later the agency got cold feet or countered and as a result they could only offer him the more arms-length freelance type of position where you work on blackbox projects while remaining independent but also have the alternate task to feed information about the community. This. Happens. This is the modus.
The only thing I do not get is when they were still looking to higher and put him close rather than the arms-length position, why the "would have to move to Seattle" requirement? And this sparks my attention because pre-snowden I knew several security analysts in Redmond that doubled as consultants for Gov. I wonder if Gov eventually just setup shop there?
This is the most important point of the whole article.
A recruitment pitch would start with: 'we will grant you life-long immunity from prosecution regarding anything you have done in relation to these hacks' - for that would be the ultimate sales pitch, one the government would have no problem using: work with us, or else
It is highly unlikely they would consider anyone who breaks the law for a job. DC doesn't work that way, typically. Trustworthiness is a more sought after quality than any other. If you even have bad credit or smoked a joint in the last year you won't be getting any secret clearances anytime soon, let alone if you committed a major crime.
It's a catch 22, though. People with hacking skills are, by their very nature, sitting in the edges of legal territory. Sure, some stay completely white, but is using the card to do test at Dunkin Donuts full-on black hat? Loading friends cards is where he ultimately crossed the line, IMO (a part he says was mis-transcribed).
Yes. Using the card to steal from Dunkin Doughnuts counts as black hat.
If he purchased a single cup of coffee 1 time, I'd have some sympathy for him, but that's not what happened. Instead, he helped his friends steal hundreds if not thousands of dollars in products and services.
I believe you can get clearance if you smoked in the past but have given up. I seem recall one senior government guy saying they might have to reconsider the issue of dope smoking
Yes you can, someone close to me has a TS/SCI clearance and in their past they have smoked a lot of weed. It's all about how you act recently when it comes to drugs AFAIK.
If the government ends up prosecuting him, it will be a massively idiotic move on their part. It's already bad enough that they've withdrawn their job offer. To use a war analogy, this situation is similar to your army shooting a surrendering enemy at the end of a battle, thereby ensuring that no future enemies will want to surrender and will instead fight to the death. You gain a short run benefit at the expense of destroying your reputation.
Offering him a job under false pretenses and then prosecuting him creates a big disincentive for any future hackers to a) talk to government officials who approach under seemingly benevolent circumstances and b) even want to work for the government at all if it pulls scummy moves like this.
The job offer is a pretty obvious lie. Full government jobs don't pay $150,000+ until you get to an extremely senior level [+] (private contractors do pay that much, but DHS certainly can't extend job offers on behalf of a private contractor). I think it says quite a bit about the ego and/or ignorance of this person if they thought they were so special that they would be offered this type of job...
It's worth noting that it's likely that sub-contractors working for private-sector firms (contracted to provide services to alphabet-agencies) earn this much.
Snowden was apparently earning ~$200k at Dell then took a pay cut to ~$122k to work at Booz-Allen. There's some controversy about his claims in that respect, but I believe them -- they would have to pay competitively or else they'd be a considerable disadvantage in the tech/infosec arms race.
Given who was at his door though, I agree: this wasn't a legit job offer.
Let there be no mistake about it: they were/are to build a case against him. Simply telling your co-workers about a hack that you could have easily made up to impress them isn't even enough evidence for a search warrant, let alone an arrest. The fact that he played into the not-so-clever ruse that DHS used on him so naively is a perfect example of the difference between intellectual and real-world intelligence. Any 10 year old from a bad neighborhood would have known not to say anything to the agents, yet he sat there, with his family looking on, essentially saying "yes, please take away my future" with every word he said and wrote.
On a side note...
>He also has dabbled with other “black hat” hacks, such as code that allowed him to win Web auctions with low-ball bids.
This was mentioned in passing, but it would be interesting to find out what technique he claims to have used to accomplish this.
Sounds like run of the mill "bid sniping" software, designed to bid on an auction at the last possible millisecond. (The thinking being that auctions with existing bids attract other bids.)
You may be right - it didn't really include enough details to judge, but based upon the nature of his other activities I was thinking his technique might have been more intriguing. Who knows. When he is arrested maybe it will come out in court documents.
One way I thought of to win penny auctions on sites such as quibids, is to find the IP addresses of your opponents and DDOS them. But I don't know of any way to do the first step through quibids.
49 comments
[ 5.5 ms ] story [ 128 ms ] threadhttp://www.archives.gov/research/military/ww2/photos/images/...
It sounds more like DHS caught someone doing social engineering, hired him to help them catch hackers, and this is what he came up with.
At the very least, it would seem like a bad idea to sign something like that without a lawyer, who I assume wasn't involved because, well, what lawyer would say "yeah, go ahead and sign a confession in exchange for an informal verbal job offer"?
So many stupid smart people out there.
Disappointed, but not surprised, that the given example is incorrect - Micro3oft.com would have fit.
http://www3.amherst.edu/~jcook15/ascii-binary-chart.gif
A token value is stored on the card which maps to a number in the backend, where they keep state. The value on the card is static..
It also sounds like his motivations are criminal.. Otherwise he would have stopped before stealing hundreds of dollars
The problem is it's all on camera
I am an engineer. I made God's temple. I will rule the world.
[1] "Detritus was particularly good when it came to asking questions. He had three basic ones. They were the direct (“Did you do it?”), the persistent (“Are you sure it wasn’t you that done it?”), and the subtle (“It was you what done it, wasn’t it?”). " -- Terry Pratchett, Feet of Clay
If anything, the story boils down to 22-year-old Mason grad loses his General Dynamics job through mindless bragging & to-be-expected snitching
A common theme in pretty much every case I've ever read about a busted blackhat involves bragging in some ridiculous context. I'd believe this.
The big thing I learned from that whole situation is that you should say as little as possible to law enforcement without a lawyer present.
Say you're exercising your right to remain silent, ask for a lawyer, and then -- and this is the critical bit -- STOP TALKING. [1]
[1] https://www.aclu.org/drug-law-reform-immigrants-rights-racia...
the details from the article mostly add up. there is information missing that could confirm this (review of skill-set showing competency in side channel attacks, perhaps a followup on the DAPRA grant) but the general attack described could be possible. also intelligence agencies looking for snitches should be read as an agent fishing for a spy. A special type of spy with technical skills. It might be that after hitting the first "go higher him and bring him into our RED_or_Black team" later the agency got cold feet or countered and as a result they could only offer him the more arms-length freelance type of position where you work on blackbox projects while remaining independent but also have the alternate task to feed information about the community. This. Happens. This is the modus.
The only thing I do not get is when they were still looking to higher and put him close rather than the arms-length position, why the "would have to move to Seattle" requirement? And this sparks my attention because pre-snowden I knew several security analysts in Redmond that doubled as consultants for Gov. I wonder if Gov eventually just setup shop there?
A recruitment pitch would start with: 'we will grant you life-long immunity from prosecution regarding anything you have done in relation to these hacks' - for that would be the ultimate sales pitch, one the government would have no problem using: work with us, or else
If he purchased a single cup of coffee 1 time, I'd have some sympathy for him, but that's not what happened. Instead, he helped his friends steal hundreds if not thousands of dollars in products and services.
Offering him a job under false pretenses and then prosecuting him creates a big disincentive for any future hackers to a) talk to government officials who approach under seemingly benevolent circumstances and b) even want to work for the government at all if it pulls scummy moves like this.
[+] http://en.wikipedia.org/wiki/Senior_Executive_Service_(Unite...
Snowden was apparently earning ~$200k at Dell then took a pay cut to ~$122k to work at Booz-Allen. There's some controversy about his claims in that respect, but I believe them -- they would have to pay competitively or else they'd be a considerable disadvantage in the tech/infosec arms race.
Given who was at his door though, I agree: this wasn't a legit job offer.
On a side note...
>He also has dabbled with other “black hat” hacks, such as code that allowed him to win Web auctions with low-ball bids.
This was mentioned in passing, but it would be interesting to find out what technique he claims to have used to accomplish this.