Swiss security provocateur who leaked Intel secrets indicted by US authorities
(2021/03/19)
- Reference: 1616129985
- News link: https://www.theregister.co.uk/2021/03/19/till_kottmann_indicted/
- Source link:
The US Department of Justice says a grand jury has indicted Swiss security provocateur Till Kottmann over multiple exploits and attempts at fraud, and authorities have quickly moved to rule out free speech as a defence.
Readers may remember Kottman [1]pointed out holes in a security skills assessment website run by Deloitte, [2]dropped 20GB of Intel secrets onto the web and shamed the security of DevOps tool SonarQube by releasing third-party code created with the project. Kottman’s name was also [3]linked to the [4]mass p0wnage of video camera outfit Verkada.
[5]
The DoJ now [6]alleges Kottman did all that and more, including:
Illegally accessing computers belonging to a security device manufacturer located in the Western District of Washington and stealing proprietary data
Improperly used the credentials of an employee of a “manufacturer of tactical equipment” and accessed the manufacturer’s source code databases
Hacked a Washington state agency and a U.S. government contractor and stole source code related to various web applications
Attacked an automobile manufacturer and a financial investment company.
[7]
Kottman justified cracking systems and leaking info as whistleblowing rather than a criminal activity.
In 2020 Kottman explained that thinking to The Register as follows:
I do a lot of leaks and releases. My overall motivation is to free information, and I am just very curious. I also love exposing and looking at the (often horrible) things you can find in proprietary code.
The DoJ’s announcement features a canned quote from Acting U.S. Attorney Tessa M. Gorman, to the effect that: “Stealing credentials and data, and publishing source code and proprietary and sensitive information on the web is not protected speech–it is theft and fraud”.
The [8]indictment [PDF] alleges Kottman’s activities went beyond merry pranking and moved into attempts to defraud victims for personal gain.
Maker of SonarQube defends DevOps product's security after source code leaks blamed on bad configurations [9]READ MORE
[10]
The USA has an [11]extradition treaty with Switzerland , which rather increases the chances that Kottman will soon see the inside of a US courtroom. ®
Get our [12]Tech Resources
[1] https://www.theregister.com/2020/11/05/deloitte_hacker_test/
[2] https://www.theregister.com/2020/08/06/intel_nda_source_code_leak/
[3] https://www.theregister.com/2021/03/15/in_brief_security/
[4] https://www.theregister.com/2021/03/10/150k_cctv_cameras_verkada_breach/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.justice.gov/usao-wdwa/press-release/file/1377536/download
[9] https://www.theregister.com/2020/08/04/sonarsource_defends_sonarqube_after_leaks/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.congress.gov/congressional-report/104th-congress/executive-report/32/1
[12] https://whitepapers.theregister.com/
Readers may remember Kottman [1]pointed out holes in a security skills assessment website run by Deloitte, [2]dropped 20GB of Intel secrets onto the web and shamed the security of DevOps tool SonarQube by releasing third-party code created with the project. Kottman’s name was also [3]linked to the [4]mass p0wnage of video camera outfit Verkada.
[5]
The DoJ now [6]alleges Kottman did all that and more, including:
Illegally accessing computers belonging to a security device manufacturer located in the Western District of Washington and stealing proprietary data
Improperly used the credentials of an employee of a “manufacturer of tactical equipment” and accessed the manufacturer’s source code databases
Hacked a Washington state agency and a U.S. government contractor and stole source code related to various web applications
Attacked an automobile manufacturer and a financial investment company.
[7]
Kottman justified cracking systems and leaking info as whistleblowing rather than a criminal activity.
In 2020 Kottman explained that thinking to The Register as follows:
I do a lot of leaks and releases. My overall motivation is to free information, and I am just very curious. I also love exposing and looking at the (often horrible) things you can find in proprietary code.
The DoJ’s announcement features a canned quote from Acting U.S. Attorney Tessa M. Gorman, to the effect that: “Stealing credentials and data, and publishing source code and proprietary and sensitive information on the web is not protected speech–it is theft and fraud”.
The [8]indictment [PDF] alleges Kottman’s activities went beyond merry pranking and moved into attempts to defraud victims for personal gain.
Maker of SonarQube defends DevOps product's security after source code leaks blamed on bad configurations [9]READ MORE
[10]
The USA has an [11]extradition treaty with Switzerland , which rather increases the chances that Kottman will soon see the inside of a US courtroom. ®
Get our [12]Tech Resources
[1] https://www.theregister.com/2020/11/05/deloitte_hacker_test/
[2] https://www.theregister.com/2020/08/06/intel_nda_source_code_leak/
[3] https://www.theregister.com/2021/03/15/in_brief_security/
[4] https://www.theregister.com/2021/03/10/150k_cctv_cameras_verkada_breach/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.justice.gov/usao-wdwa/press-release/file/1377536/download
[9] https://www.theregister.com/2020/08/04/sonarsource_defends_sonarqube_after_leaks/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFSEVMzW3VQD5BJ5t10zYQAAAAU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.congress.gov/congressional-report/104th-congress/executive-report/32/1
[12] https://whitepapers.theregister.com/
Re: Meanwhile, the Solarwinds crackers ...
Version 1.0
And when the NSA leaked Intel secrets ... what happened then?
Extradition treaty?
Dinanziame
Switzerland generally does not extradite its own citizens. When necessary, they prefer to leave the sentencing to their own justice system.
They also sometimes refuse extraditing Polish-French movie directors.
Re: Extradition treaty?
ortunk
However the banks will extradite the money as soon as they are notified of death of a numbered account owner.
Re: Extradition treaty?
olij
And Switzerland is doing as most countries - they do not extradite their own citizens.
Meanwhile, the Solarwinds crackers ...
... won't see the inside of a courtroom anywhere.
Sometimes justice is about who you can catch; this is the guy they Kott.