TexasCHLforum.com

RottenApple wrote:

n5wd wrote:The problem is that he did NOT break into anyone's computer - he used an ATT server set up to provide EXACTLY the information that he collected. He merely wrote a PHP script that harvested the information and saved it, instead of using it only for the Ipad's own use, as ATT intended. When you start your Ipad (if it's an ATT 3G-enabled Ipad) you're accessing the exact same server he did. The only difference is that you're only doing it once, and you're not saving someone else's information.

And that's where you are mistaken. He DID break into someone's computer.... AT&T's. If he had discovered the flaw and informed Apple/AT&T about it without gathering any data, THEN he wouldn't have broken any laws. But, as someone else already stated, he wouldn't have gotten any "fame" over it. Now he's reaping what he sowed.

BTW, a long, long time ago, when I was working as a programmer, my partners and I discovered a minor security flaw in RedHat 4.x (I forget exactly what version it was). We informed the RedHat community (since its open source) and then worked on a patch for it. Several other programmers confirmed it and also wrote patches. Ours was the most elegant fix and was incorporated into the next official build. We didn't call the media or anyone else about it and almost know one knew (outside the RH community) new about it at the time. And today I doubt anyone but us even remembers it!

Before entering the New Jersey courthouse to face his sentencing on March 18, 2013, Andrew Auernheimer (Weev) gave a short speech to the press and to his friends. Auernheimer was sentenced to 41 months in prison followed by three years supervised release.

Auernheimer revealed a security flaw in AT&T's iPad user database, allowing him to scrape the data from 114,000 iPad users. The information was later on given to a journalist. In January 2011, the FBI did an investigation and filed a criminal complaint.

Auernheimer was convicted on conspiracy to access a computer without authorization (18 U.S.C. § 1030(a)(2)(C), part of the Computer Fraud and Abuse Act of 1986) and fraud in connection with personal information (18 U.S.C. § 1028(a)(7)).