Anonymous hacker group: Two jailed for cyber attacks

http://www.bbc.co.uk/news/uk-21187632

Two men who carried out cyber attacks for the Anonymous hacking group have been jailed.

The two men carried out distributed denial of service, or DDoS, attacks which paralyse computer systems by flooding them with online requests.

First time anyone has been jailed over such attacks.

[Qtx]

Brit mastermind of Anonymous PayPal attack gets 18 months' porridge.

A British member of the hacking group Anonymous was jailed today for orchestrating attacks that knocked PayPal, Visa and Mastercard offline.

Christopher Weatherhead, 22, who used the online nickname "Nerdo" and was described by prosecutors as "a high-level operator", was sent down for 18 months by Southwark Crown Court. Ashley Rhodes, 28, an Anonymous crony, was jailed for seven months.

http://www.theregister.co.uk/2013/01...ncing_payback/

It is interesting as he didn't actually carry out the attacks. He got 18 months for inciting/organising it.

Not sure if it has been made public yet but he was using trucrypt encryption on his computer there is some new law in relation to withholding encryption keys.

I am in two minds over this. First I think there needs to be consequences to their actions. Too many of these people are kids playing at being self-styled revolutionaries, believing they are part of some higher cause and revealing in that status. They think they're untouchable and outwitting the state and corporations. Yet what they do is the internet equivalent of vandalism and protest. For these reasons I think it's important that the message is sent that you're not untouchable on the Internet and you are committing crimes.

On the other hand I wonder about the need to send him to a prison. Surely there is a better way to punish a violentless crime from a first offender than that? A suspended sentence and community service maybe?

[danielf]

Originally Posted by Damien

On the other hand I wonder about the need to send him to a prison. Surely there is a better way to punish a violentless crime from a first offender than that? A suspended sentence and community service maybe?

The ones they attacked included payment site PayPal, costing it £3.5m.

The Ministry of Sound estimated the cost of the attack on its sites as £9,000, while the International Federation of the Phonographic Industry's costs were more than £20,000 and the British Phonographic Industry's more than £4,000.

The financial impact on MasterCard and Visa were not revealed to the court, although Weatherhead once boasted online at having caused £1m worth of damage to MasterCard.

A few million quid of vandalism deserves a bit more than a slap on the wrist imo.

Originally Posted by Damien

I am in two minds over this. First I think there needs to be consequences to their actions. Too many of these people are kids playing at being self-styled revolutionaries, believing they are part of some higher cause and revealing in that status. They think they're untouchable and outwitting the state and corporations. Yet what they do is the internet equivalent of vandalism and protest. For these reasons I think it's important that the message is sent that you're not untouchable on the Internet and you are committing crimes.

On the other hand I wonder about the need to send him to a prison. Surely there is a better way to punish a violentless crime from a first offender than that? A suspended sentence and community service maybe?

Given the overcrowding in prisons i am very surprised at this sentence but on the other hand sometimes making an example of them is better in the long run

[Qtx]

Originally Posted by Damien

Yet what they do is the internet equivalent of vandalism and protest. For these reasons I think it's important that the message is sent that you're not untouchable on the Internet and you are committing crimes.

On the other hand I wonder about the need to send him to a prison. Surely there is a better way to punish a violentless crime from a first offender than that? A suspended sentence and community service maybe?

Protesting isn't a crime although it seems to be getting that way. If you want to make even a small gathering to protest you have to run it via the police and have their say so in London.

Intent and damage to business may have played a part in his sentence although when compared to the community service people get for serious assualt and other nasty crimes, the sentence is shocking. A guy in America just a sentence of 3.5 years for putting some camcorder films online. You could kill someone by drink driving and get less time in jail than both cases above.

I spoke with the guy who got 18 months well before the court case started and he is an intelligent guy. The prison sentence is going to change his life in a big way. You can argue he went too far or that he was very passionate at what he believed in. This was all down to Paypal stopping donations to Wikileaks via its service due to political pressure in the US. How else does one show their unhappiness that financial control of an organisation can be strangled by one american company that has a monopoly on online payments?

I think many feel powerless as they watch things happens. They are different people to those that just don't care and get on with their life. It is the protester types which do make a difference. Women would not be able to vote for example without these kind of people making a noise.

Just as there is a fine line between genius and madness, there is a fine line between legitimate protester and criminal protester. Who decides where the line is? Usually some judge somewhere.

[techguyone]

Maybe Truecrypt isn't up to the job anymore, I havent heard much about Encryption lately, but computers are getting increasingly powerful (Moores Law) maybe some of the old standards of encryption can now be beaten by todays tech.

Originally Posted by Qtx

Brit mastermind of Anonymous PayPal attack gets 18 months' porridge.



http://www.theregister.co.uk/2013/01...ncing_payback/

It is interesting as he didn't actually carry out the attacks. He got 18 months for inciting/organising it.

Not sure if it has been made public yet but he was using trucrypt encryption on his computer there is some new law in relation to withholding encryption keys.

that is not that new a law. You break the law if requested to decrypt information on your or other devices if you refuse

Its the key disclosure law dated 2006 ( good old google lol)

---------- Post added at 12:11 ---------- Previous post was at 12:10 ----------

Originally Posted by martyh

Given the overcrowding in prisons i am very surprised at this sentence but on the other hand sometimes making an example of them is better in the long run

due to the short sentence the very fact you mention he may get released with a tag in a very short period of time

Originally Posted by tizmeinnit

due to the short sentence the very fact you mention he may get released with a tag in a very short period of time

Quite possibly so why bother with a custodial sentence at all ,especially given that he would most likely serve his sentence in a low security prison or even open prison

Originally Posted by martyh

Quite possibly so why bother with a custodial sentence at all ,especially given that he would most likely serve his sentence in a low security prison or even open prison

agreed

[Qtx]

Originally Posted by techguyone

Maybe Truecrypt isn't up to the job anymore, I havent heard much about Encryption lately, but computers are getting increasingly powerful (Moores Law) maybe some of the old standards of encryption can now be beaten by todays tech.

Truecrypts implemented encryptions are still strong but I would guess the big agencies can crack it given enough time. It is still no easy feat even with their dedicated cracking machines. Forensic investigators would ideally get to the machine before it is powered off in the hope to get the cryptographic keys from memory. Failing that, from a hibernation file has been written to disk which has a dump of what was in memory, which of course contains the keys for on the fly decryption. The implementation of encryption is often the weak spot rather then the encryption method.

Originally Posted by Qtx

Truecrypts implemented encryptions are still strong but I would guess the big agencies can crack it given enough time. It is still no easy feat even with their dedicated cracking machines. Forensic investigators would ideally get to the machine before it is powered off in the hope to get the cryptographic keys from memory. Failing that, from a hibernation file has been written to disk which has a dump of what was in memory, which of course contains the keys for on the fly decryption. The implementation of encryption is often the weak spot rather then the encryption method.

you have to give up the keys or else they wave the big book at you

[Qtx]

Originally Posted by tizmeinnit

that is not that new a law. You break the law if requested to decrypt information on your or other devices if you refuse

Its the key disclosure law dated 2006 ( good old google lol)[COLOR="Silver"]

Time flys by so fast these days

Truecrypts file structure and encryption implementation is supposed to give plausible deniability. There can be another encrypted container inside another. You can give the keys to decrypt the container and it is not possible to know if there is another container inside or not. It is not possible to prove there is another encrypted volume in there although the cops will likely assume you do.

The guy above gave the authorities his truecrypt key in the end. He wished he hadn't. Encryption and the law are going to clash big time in the next 5 to 10 years.

---------- Post added at 13:12 ---------- Previous post was at 13:10 ----------

Originally Posted by tizmeinnit

you have to give up the keys or else they wave the big book at you

Sometimes the big book may be smaller than the sentence you could be facing.

Originally Posted by Qtx

Time flys by so fast these days

Truecrypts file structure and encryption implementation is supposed to give plausible deniability. There can be another encrypted container inside another. You can give the keys to decrypt the container and it is not possible to know if there is another container inside or not. It is not possible to prove there is another encrypted volume in there although the cops will likely assume you do.

The guy above gave the authorities his truecrypt key in the end. He wished he hadn't. Encryption and the law are going to clash big time in the next 5 to 10 years.

---------- Post added at 13:12 ---------- Previous post was at 13:10 ----------



Sometimes the big book may be smaller than the sentence you could be facing.

good point well made

[Sirius]

Originally Posted by danielf

A few million quid of vandalism deserves a bit more than a slap on the wrist imo.

It does, i hate it when people think being lenient to people who commit crime that have a big impact should be the order of the day.