Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I don’t even understand what they are.

Should a prosecutor be allowed to prosecute a case if he doesn't understand the actions taken by the prosecuted?

How can he be sure that a crime has been commited?

> He had to download the entire iOS system

I guess the prosecutor has downloaded the entire iOS system to his Iphone. I guess he doesn't know that he has done that.



This hack didn't rely on doing anything with iOS other than sniffing the traffic iOS sent to AT&T. I think what they were attempting to say was that Xcode's iOS simulator may've been employed.

Another interesting fact: weev did not actually write or run the script that harvested the data, or talk to AT&T's servers. That was all Daniel "JacksonBrown" Spitler, who was sentenced to 18 months of probation. weev simply shared the list of harvested data with Gawker, under the condition that it be redacted if published, as proof that the leak had occurred.

Think about that; the guy who actually did the hacking got probation. The guy who simply alerted the media to the hacking got 41 months.

Source: I am Nick "Rucas" Price, member of Goatse Security, and I am mentioned numerous times in the federal criminal complaint.


I just did the same attack using WeevTech against att servers. Witness: picture of a 32gb iphone https://2.ecom.attccc.com/catalog/en/skus/images/apple-iphon...


> Should a prosecutor be allowed to prosecute a case if he doesn't understand the actions taken by the prosecuted?

Yes.

There's no reason a prosecutor needs to understand the details of exploit development in order to prosecute a case related to it. A hyperbolic comparison would be to claim a prosecutor needs to be able to build a nuke if they were to prosecute someone who built one in their garage. A more apt comparison might be:

Suppose Weev was the first person to discover bleach+ammonia = toxic gas. The prosecution is trying to demonstrate that this was done intentionally, using techniques that are well beyond the average person. An equivalent quote would be

> "He had to purify the ammonia. He had to use a centrifuge. He had to do all sorts of things—I don’t even understand what they are."


But if he doesn't know what a centrifuge is, then how does he know that most people wouldn't know how to use one? Maybe he's an outlier...

Also, I don't think anyone is saying the prosecutor should be an expert at infosec, but he should at least know enough about the supposed crimes committed to know whether or not they are crimes.

To extend your nuke analogy, he needn't know how to build a nuke, but he should know or learn what a nuke is and he should know or have someone tell him whether the garage nuke was actually a nuke and, if so, how dangerous it was.


So kind of like a science fair student that builds a nuclear reactor by using the material from a smoke detector, and sensitive enough test equipment to demonstrate that a micro chain reaction took place? To someone with appropriate knowledge, this would be nothing special -- but to the general public, "Nuclear Reactor!!! Lock him up!!!"


Nothing about this case has anything to do with exploit development.


Shouldn't a prosecutor either recuse themselves, or at least consult subject-matter experts before proceeding with a prosecution over a subject about which they admittedly have insufficient knowledge? Is that not part of a lawyer's or at least a prosecutor's code of professional conduct?


It is, though defense attorneys and judges rarely call them on this since it is a bridge-burner. Once you do this, you can be pretty sure they're acting within the rules/ethical obligations in future dealings, but you're also less likely to get good deals from them since they're much less willing to negotiate. This matters since most criminal defendants actually are guilty (and admit it!) and don't want to go to trial.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: