"Keys open doors" ?

[dr.walrus]

I'm not sure how circumventing security and providing that information to law-abiding PS3 owners and potential criminals with indifference is generalization. Likewise, I'm not sure how/why you are well informed on US prostitution laws () but nobody is being generalized in a manner similar to your example. Geohot opened the locked door, the hacker committed the crime, and sony happens to own the PSN that was hacked using geohots security breach.

Access to what? A device he already owns.

Cars are generally constructed of off-the-shelf and custom parts, most of which were not manufactured by the company that designed/assembled the car. They are also generally not proprietary. However, if you took apart a proprietary security system in the car, figured out how to bypass it, made that info available to criminals who use it to steal cars...that would be a similar scenario. You would be an accessory to the theft. Freedom of speech/press may or may not be a valid defense depending on a lot of factors.

Access to devices people already own... Where is the theft? It's a potential, unproven intervening act - there are plenty of reasons you would want to do it. It's a generalised argument because all he's doing is explaining how to get system level access to a device you already own.

Judicial review (in the US) only determines whether or not something is unconstitutional. They also don't bother with small-time cases like this. They tend to concern themselves with such things as the validity of a law that potentially affects the outcome of current cases. Also, I'm not sure that they ever create new laws based on their decisions. So, we're stuck with nothing. Both sides will continue to disagree perpetually.

In my view, this argument is clearly a constitutional issue. Is a gun shop an accessory to a murder? Is a telephone manufacturer an accessory to a terrorist attack organised over a phone?

An 'accessory' implies a particular participant, not a generalised one. One thing that's incredibly important in this case is the fact that his exploit was the ability to use the device for a purpose other than what it was intended. It was not deisgned to circumvent copyright laws.

Most laws are in place to protect the community from the individual. All of the rights of the individual terminate when they intersect with the rights of anyone else. For example, if someone came to your home to preach their agenda and you make it known that you do not want to hear it, their freedom of speech ends until they leave your property. They have no right to force you to hear what they want to say. This also applies to some degree in public places.
If your actions negatively impact millions of innocent people, the legality of said actions should be questioned. Due to the negative impact being the loss of access to the PSN, nobody is going to take it seriously...

The entire purpose of the constitution is to protect the rights of the individual!

How is the shutting down of the PSN relevant?

As far as I know, nobody is exempted from the law due to their profession with the exception of certain government employees and even then only under certain conditions.

Different exemptions for different professions in general. For example, as a systems admin, the DPA (data protection act) in the UK allowed me to view all private records in a social services database, because I had to see records to fix them, while social workers had access restricted only to appropriate cases. Vets can cut open animals with knives, while I ... I would be severely prosecuted...

[dr.walrus]

Maybe an example will make me clearer:

The US constitution allows individual freedoms, in a very strong and specific way. It allows people to publish and say whatever they want, up to and including books like this.

Now, if it's legal to publish bomb-making books (he's not an accessory because he's not giving bomb-making advice to an individual...), how does a 21 year old american publishing information simply on how to get system level access to a gaming console end up looking down the barrel of a multi-million dollar lawsuit?

[x88x]

Vets can cut open animals with knives, while I ... I would be severely prosecuted...

And surgeons can cut open people with knives...but crazy sh** always happens whenever I try that.

(disclaimer: kidding; I've never done that..just in case someone took that the wrong way..)

Now, if it's legal to publish bomb-making books (he's not an accessory because he's not giving bomb-making advice to an individual...), how does a 21 year old american publishing information simply on how to get system level access to a gaming console end up looking down the barrel of a multi-million dollar lawsuit?

/\ That exactly. It's legal for me to tear apart and publish vulnerabilities and exploits for computer software. It's legal for me to tear apart and publish vulnerabilities and exploits for mobile phone software and firmware. It's legal for me to tear apart and publish vulnerabilities in locks and other physical security systems. Hell, that's how the security industry works. We figured out a long time ago that developing security solutions in secret doesn't work. The strongest, most robust, most trusted security systems, both software and hardware (ie, locks, etc), are either open source or have detailed designs and schematics published by the manufacturer. Quite a few security companies even set bounties on their own products...as do quite a few computer software companies.

I'd also like to point out that both of the other seventh generation gaming consoles have had similar system-level-access hacks, but neither Microsoft nor Nintendo (for all their lawsuit-happy habits) reacted anywhere near this level of ridiculousness. Heck, Microsoft even hired one of the most prolific hardware hackers from those communities (Johnny Lee). The biggest (technical) problem that caused Sony to flip out so hard is that they use the same authentication keys for everything. Seriously...everything...game validation, system updates, PSN authentication, firmware checks, payment processing....everything. That's like using the same username and password everywhere online...or using the same key for your house, car, place of business, and safety deposit box. It's just really bad policy, regardless of how secure you think your system is, and it's why the fallout has been so bad. You break one component and suddenly the entire PS3/PSN infrastructure is an open book.

There's a security concept known as 'defense in depth'. Basically, it starts from the assumption that no one point of defense is perfect, and never can be. So instead of relying entirely on one point of defense, multiple layers are set at strategic points. Anyone who has played Risk knows that if you gather all your troops at the perimeter, it may be a very strong defense, but once it falls at any point (and it inevitably will), your entire territory is left defenseless. It's the same thing in real life in any security situation. In the case of the PS3, they put all their defense hanging on this one key. And when that one key was compromised, their entire infrastructure was defenseless. The sad thing is that this could have been very easily avoided if they had just followed standard security practices and separated roles. One key for firmware checks, one key for system updates, one key for game authentication, etc. Even just sticking with the one authentication system wouldn't bee so bad as long as it was a proven strong one. Most of the internet would go down if an easily exploitable vulnerability in RSA were discovered, but since it's a proven secure and reliable authentication method, it's deemed an acceptable risk. So too with Sony. If their authentication system is a proven secure and reliable system, using one authentication system is an acceptable risk....using the same key to unlock every door is not. It's like fitting 9-pin, dual-side, high security locks to every door in a college dorm....and then giving every student a grandmaster key.

[mDust]

Access to what? A device he already owns.

Access to devices people already own... Where is the theft? It's a potential, unproven intervening act - there are plenty of reasons you would want to do it. It's a generalised argument because all he's doing is explaining how to get system level access to a device you already own.

Picking a lock to gain unlawful access to a building is illegal. Having one person pick the lock and a different person enter the building is somehow not? That's why we have defined the principal, accessory, etc. Hacking security on an electronic device so someone else could do the dirty work is not different. It does not matter if it was geohots intention or not. Sonys incompetence does not somehow make it OK either.

An 'accessory' implies a particular participant, not a generalised one. One thing that's incredibly important in this case is the fact that his exploit was the ability to use the device for a purpose other than what it was intended. It was not deisgned to circumvent copyright laws.

Geohot circumvented the security that prevented a lot of different things, one being copyright violation via piracy. He showed others how to circumvent the security as well. It would not have been a problem if the PSN was not involved. Hack your standalone device all you want.

The entire purpose of the constitution is to protect the rights of the individual!

How is the shutting down of the PSN relevant?

No. The constitution protects 'the people' from the government by distributing power amongst 3 separate entities. Most laws (having nothing whatsoever to do with the constitution) also protect 'the people' from the acts of a few/single unruly people.
How is the shutting down of the PSN relevant? Through the actions of geohot and other hackers, crimes were committed which unjustly forced the shutdown of the network while inconveniencing millions of innocent people and likely causing a huge loss of revenue for hundreds of companies involved with the PSN. I stated that the legality of said actions should be questioned.

Different exemptions for different professions in general. For example, as a systems admin, the DPA (data protection act) in the UK allowed me to view all private records in a social services database, because I had to see records to fix them, while social workers had access restricted only to appropriate cases. Vets can cut open animals with knives, while I ... I would be severely prosecuted...

I doubt if there are laws that prevent you from performing a legitimate operation on your dog. If you are mutilating your dog for some sick pleasure, then yes, you would be severely prosecuted. Likewise, if you somehow know enough to save someones life, through say an emergency tracheotomy, and you perform it flawlessly, there is no law against it. If you start randomly slashing with a knife...you'll be incarcerated for sure. You can't advertise or charge money for your services without a medical license though.

The US constitution allows individual freedoms, in a very strong and specific way. It allows people to publish and say whatever they want, up to and including books like this.

Now, if it's legal to publish bomb-making books (he's not an accessory because he's not giving bomb-making advice to an individual...), how does a 21 year old american publishing information simply on how to get system level access to a gaming console end up looking down the barrel of a multi-million dollar lawsuit?

Have you read the Anarchist Cookbook? I have. It's a joke. The author clearly had no idea what he was talking about. He's just 'some guy' and not an actual authority on any subject. Trying any of the 'projects' puts the reader and anyone stupid enough to be standing in the immediate area in danger, and nobody else. Therefore, it's not in one of the 'gray areas' I mentioned before. Publishing a book or document containing proprietary security codes is, however, in a gray area. You won't find any officially published articles concerning the specifics of hacking any device or software, you won't find any articles saying 'put the bomb here in x or y building', nor will you find 'stab the target here, here, and here to confirm the kill'. Publication in any specificity of illegal acts or even questionably legal acts is itself questionably legal. It's one type of gray area that our first amendment often does not cover...that's where the various conspiracy charges stem from. Federal law does not require the crime to be committed for conspiracy charges to be pressed (thoughtcrime anyone?), however, many states do require the plan to be at least partially implemented. We can't say or publish ANYTHING we want. I cannot imagine the ensuing chaos if we actually could...

I'd also like to point out that both of the other seventh generation gaming consoles have had similar system-level-access hacks, but neither Microsoft nor Nintendo (for all their lawsuit-happy habits) reacted anywhere near this level of ridiculousness. Heck, Microsoft even hired one of the most prolific hardware hackers from those communities (Johnny Lee). The biggest (technical) problem that caused Sony to flip out so hard is that they use the same authentication keys for everything. Seriously...everything...game validation, system updates, PSN authentication, firmware checks, payment processing....everything. That's like using the same username and password everywhere online...or using the same key for your house, car, place of business, and safety deposit box. It's just really bad policy, regardless of how secure you think your system is, and it's why the fallout has been so bad. You break one component and suddenly the entire PS3/PSN infrastructure is an open book.

Yeah, Sony f-ed up thoroughly and are partially at fault due to incompetence, but that doesn't exonerate geohot or the hackers that took advantage of his hack. Sony tried to get the exploitation taken down through the threat of legal action. Geohot was a smart-ass punk and impolitely refused. I'm not really sure what Sony did that was so ridiculous other than to try and get the court to decide who was right. The only ridiculousness that I see is that after all of this, no conclusion was reached.

[dr.walrus]

Picking a lock to gain unlawful access to a building is illegal. Having one person pick the lock and a different person enter the building is somehow not? That's why we have defined the principal, accessory, etc. Hacking security on an electronic device so someone else could do the dirty work is not different. It does not matter if it was geohots intention or not. Sonys incompetence does not somehow make it OK either.

How any analogy in relation to doors to someone else's property makes sense to giving people access to electronics they already own is beyond me!

Geohot circumvented the security that prevented a lot of different things, one being copyright violation via piracy. He showed others how to circumvent the security as well. It would not have been a problem if the PSN was not involved. Hack your standalone device all you want.

System level access? I'm really not seeing this...

No. The constitution protects 'the people' from the government by distributing power amongst 3 separate entities. Most laws (having nothing whatsoever to do with the constitution) also protect 'the people' from the acts of a few/single unruly people.

And the bill of rights? The first amendment? The second? The third......?

How is the shutting down of the PSN relevant? Through the actions of geohot and other hackers, crimes were committed which unjustly forced the shutdown of the network while inconveniencing millions of innocent people and likely causing a huge loss of revenue for hundreds of companies involved with the PSN. I stated that the legality of said actions should be questioned.

There is absolutely NO chain of causation here. This is what should be classified under law as an 'intervening act' - he did not hack the PSN and is no way responsible.

I doubt if there are laws that prevent you from performing a legitimate operation on your dog. If you are mutilating your dog for some sick pleasure, then yes, you would be severely prosecuted. Likewise, if you somehow know enough to save someones life, through say an emergency tracheotomy, and you perform it flawlessly, there is no law against it. If you start randomly slashing with a knife...you'll be incarcerated for sure. You can't advertise or charge money for your services without a medical license though.

There are definitely laws, I'd be dumped straight onto the police for animal cruelty.

In terms of the emergency surgery, I can only inform you in terms of UK law. An operation is legally an assault, and one can not legally consent to an assault occasioning harm (i.e. the cut, ignoring the positive effect) except in specific circumstances. One of these is surgery. This is how a surgeon is legally protected. However, one can only consent to this if performed by a legally qualified practitioner.

An emergency tracheotomy would almost certainly be covered under self-defence laws - laws that apply to defending others, including in this case, the patient.

Have you read the Anarchist Cookbook? I have. It's a joke. The author clearly had no idea what he was talking about...

It provides many functional instructions for making bombs. Plenty of teenagers lost hands because of the book. It's worth reading about the history of the book and the author's story, it's interesting how he tried to ban his own book..

Publishing a book or document containing proprietary security codes is, however, in a gray area. You won't find any officially published articles concerning the specifics of hacking any device or software, you won't find any articles saying 'put the bomb here in x or y building', nor will you find 'stab the target here, here, and here to confirm the kill'.

a) there are plenty of books like that
b) he didn't suggest people steal. he didn't suggest people do anything illegal. He released codes that had the theoretical potential to be used maliciously.

Publication in any specificity of illegal acts or even questionably legal acts is itself questionably legal. It's one type of gray area that our first amendment often does not cover...that's where the various conspiracy charges stem from. Federal law does not require the crime to be committed for conspiracy charges to be pressed (thoughtcrime anyone?), however, many states do require the plan to be at least partially implemented. We can't say or publish ANYTHING we want. I cannot imagine the ensuing chaos if we actually could...

"To break into that house, smash the door glass, reach in, turn the lock" - This instruction is not illegal. It's not even questionably legal. It's completely legal.

Giving thost instructions to a man in a hoodie outside a house at 3am is quite probably a crime. It's all about the context, much like exactly where I'm carrying my crowbar, knife or whatever.

Yeah, Sony f-ed up thoroughly and are partially at fault due to incompetence, but that doesn't exonerate geohot or the hackers that took advantage of his hack. Sony tried to get the exploitation taken down through the threat of legal action. Geohot was a smart-ass punk and impolitely refused. I'm not really sure what Sony did that was so ridiculous other than to try and get the court to decide who was right. The only ridiculousness that I see is that after all of this, no conclusion was reached.

Court cases deal with unresolvable disputes. This clearly wasn't one.

[x88x]

Geohot circumvented the security that prevented a lot of different things, one being copyright violation via piracy. He showed others how to circumvent the security as well. It would not have been a problem if the PSN was not involved. Hack your standalone device all you want.

First off, I have yet to see any line of causation demonstrated between Hotz's hack and the PSN downtime. To my understanding, the PSN attack was (as I stated a couple pages back) the result of an attack on an internal Sony database server that was accessed after attackers gained access to Sony's internal network through a poorly maintained webserver.

Second, the main thing that Sony was taking issue with was Hotz publishing his findings. The only tools that he released were specifically designed to hack standalone devices to run alternate firmware that allowed a different OS to be run on the device. As far as I can tell, that fits firmly within the realm of "Hack your standalone device all you want."

Publishing a book or document containing proprietary security codes is, however, in a gray area. You won't find any officially published articles concerning the specifics of hacking any device or software, you won't find any articles saying 'put the bomb here in x or y building', nor will you find 'stab the target here, here, and here to confirm the kill'. Publication in any specificity of illegal acts or even questionably legal acts is itself questionably legal. It's one type of gray area that our first amendment often does not cover...that's where the various conspiracy charges stem from. Federal law does not require the crime to be committed for conspiracy charges to be pressed (thoughtcrime anyone?), however, many states do require the plan to be at least partially implemented. We can't say or publish ANYTHING we want. I cannot imagine the ensuing chaos if we actually could...

Hmmm, what about this?
http://www.amazon.com/Hacking-Xbox-I...5602854&sr=8-1
ooh, or this?
http://www.amazon.com/Game-Console-H...5602854&sr=8-3
Or any of these?
http://www.amazon.com/Reversing-Secr...5602854&sr=8-4
http://www.amazon.com/Hacking-Xbox-I...5602854&sr=8-8
http://www.amazon.com/Hacking-PSP-Cu...602854&sr=8-10
http://www.amazon.com/Game-Console-H...602854&sr=8-11
http://www.amazon.com/Gray-Hat-Pytho...5602978&sr=8-3
http://www.amazon.com/Malware-Analys...5602978&sr=8-6
http://www.amazon.com/Rootkit-Arsena...5602978&sr=8-7
http://www.amazon.com/Hacking-Art-Ex...602978&sr=8-10
http://www.amazon.com/Sockets-Shellc...602978&sr=8-12
http://www.amazon.com/Shellcoders-Ha...5603032&sr=8-1
http://www.amazon.com/Guide-Kernel-E...5603032&sr=8-3
http://www.amazon.com/Writing-Securi...603032&sr=8-10
http://www.amazon.com/Buffer-Overflo...603032&sr=8-13
http://www.amazon.com/Web-Applicatio...=pd_rhf_shvl_2
http://www.amazon.com/Windows%C2%AE-...=pd_rhf_shvl_4
http://www.amazon.com/Rootkits-Subve...=pd_rhf_shvl_5
http://www.amazon.com/Penetration-Te...pd_rhf_shvl_12
I can do this all day, dude.


Or, since you mentioned physical attack techniques, how about these?
http://www.amazon.com/Balisong-Letha...5603394&sr=1-1
http://www.amazon.com/Street-Lethal-...5603394&sr=1-2
http://www.amazon.com/Your-Body-Ulti...5603394&sr=1-3
http://www.amazon.com/Krav-Maga-Esse...5603793&sr=1-3
http://www.amazon.com/Taekwondo-Mast...5603891&sr=1-1
http://www.amazon.com/Karate-Complet...5603899&sr=1-3
Or, hell, this.
http://www.amazon.com/Atlas-Human-An...5603475&sr=1-1
What about the millions of martial arts dojos around the world? Did you think none of them taught any information or techniques that could be lethal?

The simple truth of the matter is that this kind of information is not hard to come by and is published all the time by very reputable individuals and companies. Censorship of information in the US is a very serious matter and it takes a lot to get any information banned from the public knowledge.

Sony tried to get the exploitation taken down through the threat of legal action. Geohot was a smart-ass punk and impolitely refused.

Let's be honest here...that information was never going away even if he had complied. As we always like to say, once you put something on the internet, it never goes away. ...besides, if I had been in his position I wouldn't have taken it down either, just on principle. People in general do not respond to dubious legal threats from giant corporations in ways that benefit those corporations....especially the type of people who tend to get into hardware hacking.

[AmEv]

This is a prime example of why we need a "heated, not flaming debates" section.......

tldr

[dr.walrus]

Personally, I really liked his rap song...

Bizarrely, in his rap, he makes a point. If it is such a security issue - why is he facing a civil suit, not a criminal one?

[x88x]

If it is such a security issue - why is he facing a civil suit, not a criminal one?

Because a) I doubt he broke any laws, but more importantly, b) in the US, criminal cases have to be proven "beyond the shadow of a doubt", whereas civil cases just have to have a "preponderance of evidence". Upshot of that is that it's a lot harder to successfully prosecute a criminal case than a civil case. Also, I might be wrong about this, but I don't think criminal cases can be brought by individual 'persons' (which, thanks to weird wording in some law or another, includes corporations).

[dr.walrus]

Because a) I doubt he broke any laws, but more importantly, b) in the US, criminal cases have to be proven "beyond the shadow of a doubt", whereas civil cases just have to have a "preponderance of evidence". Upshot of that is that it's a lot harder to successfully prosecute a criminal case than a civil case. Also, I might be wrong about this, but I don't think criminal cases can be brought by individual 'persons' (which, thanks to weird wording in some law or another, includes corporations).

It was a rhetorical question . What I'm saying is, if he's an accessory to someone committing a crime, that would make him a criminal. That isn't the case here. As such, what we're probably looking at is a tort case: Sony needs to prove damages to make a monetary claim; else all they could request is an injunction. Due to the closed nature of the settlement, we'll never know...

The different levels of evidence are the same under UK law. Under rare circumstances in the UK, criminal cases can be brought by private individuals, but large companies who are aggrieved will push for a criminal case to be made - often successfully, because they have a lot of money invested in lawyers who can make the right noise