Congressman Weiner's inappropriate tweet

[Neally]

Again, all of those things could be handled by 1) going to an IT person to check for viruses, and 2) changing all of the passwords.

And then calling the police to report his account was hacked.

Please, right wing hysteria does not end when events are brought to a rational conclusion.

Weiner did this to himself with his evasive answers and lack of rational response in reporting it to the police. It's the gift that keeps on giving. Again, "It's been reported to the police" and clear, unequivocal answers to "is that a picture of you?" and this would be history.

"As detailed in the postings, the Palin hack didn’t require any real skill. Instead, the hacker simply reset Palin’s password using her birthdate, ZIP code and information about where she met her spouse — the security question on her Yahoo account, which was answered (Wasilla High) by a simple Google search."

I missed the part about password cracking ? I guess using google can be considered hacking in some circles ...

Wrong. Coming up with someones password by whatever means is "cracking" and accessing their account is "hacking" regardless of the means used to discover the password or the skill involved.

No, it wasn't. Read up on it.

My point is that the Palin incident could have been pulled off by someone with almost no computer knowledge whatsoever. All you needed for that was basic familiarity with Yahoo e-mail and the ability to use Google.

Wrong, it's still considered hacking. See above.

That is technically hacking her account, even if a keygen was not used. That is 'hacking' her email account.

Correct!

Yup. Just guessing someones password can qualify as "hacking".

Correct!

 

[I Am The Scum]

Wrong, it's still considered hacking. See above.

Okay, if you want to broaden "hacking" this much, then that's fine. Let's go with that. But now, let's reword the criticism.

Does the supposed plot to frame Weiner involve some sort of computer expert? In all likelihood, no. It could have been done by some random moron. This is not profound, nor is it unlikely.

 

[JoeTheJuggler]

And then calling the police to report his account was hacked.

Which police department should one call?

I'm sure my local city police department would have no clue of what to do. Nor would the state troopers.

Do you call the police department where the servers that have the account information are located? The police department where a suspected hacker lives?

 

[Unabogie]

So the next step is to test how secret the yFrog email is. Over at LGF, they have a post up about the method yFrog uses.

http://littlegreenfootballs.com/page/248630_yfrog_secret_email_addresses_a

I tried 24 fresh new accounts, the last 3 are 2 personal accounts and the test at the cannonfire blog post.
Right off the bat, notice we already have a dupe: "lusion", which kind of indicates yfrog uses a very simple and small dictionary.
The next interesting generated words are:
* g[udom], d[udom], t[udom]
Which obviously is "udom" with a variation on the first letter.
A common pattern seems to be that there are variations of prefixes and then the last sequences of the word are repeated.
* gu[ness], na[ness], ba[ness]
* my[ment], do[ment], he[ment]
* lu[sion], zoo[sion] (there's also voot[ion] but maybe that's another sequence)
* jan[ist], tif[ist], gyj[ist]
* jin[ity], batu[ity], jag[ity]
You see the patterns. We're either dealing with a static dictionary, or a very simple algorithm that is at least reusing the postfix part of the word. The prefix may also be reused, if it's randomly putting together strings.
It's pretty scandalous than an app would use an email address for security, but it's even worse that said email address is so easily guessed. In my small test of 27, I got 1 repeat and found many repated substrings. It wouldn't take much effort for an attacker to do this, specially since he/she just has to send a set of these combinations via email and wait for one to hit.

Now, the next question, considering that the exploit found by cannonfire, and replicated by us here at JREF, actually works, is why Rep. Weiner is giving the answers he is giving. I'll admit that he's handling this in an odd and evasive way. And just because his account could have been easily hacked does not mean that it WAS hacked, only that hacking is not an obscure remote possibility. From his answers, he's at the least hedging his bets that the photo is of him.

Of note: The person who "found" this Tweet had bragged two weeks earlier about a "photo scandal" of a "leftie politician" about to break. This foreknowledge, combined with apparently unique ability to see the Tweet in question when it was posted, strongly suggests he's the guy who posted the image. If someone hacked Weiner's computer and got hold of this image, the next step would be posting it somewhere. I think there's more to this story. (And I admit I find the hacking part of it interesting -- the scandal part, not so much)

 

[TheL8Elvis]

Wrong. Coming up with someones password by whatever means is "cracking" and accessing their account is "hacking" regardless of the means used to discover the password or the skill involved.

Password_cracking^WP seems to disagree with your definition...

Also, for example, coming up with someones password by, say, pretending to be the help desk desk, would be Social_engineering_(security)^WP, not 'cracking.'

Additionally, if you came up to my desk and accessed my account because I had my user name and password on a sticky note on my monitor, you would not have 'hacked' my account - you would have accessed my account without proper authorization.

I suppose the exact definitions are a moot point except as it applies to the laws in the particular jurisdiction, should Congressman Weiner decide to involve the authorities.

It still seems to me that:
1) it's a picture of him, based on non-denials
2) the most plausible excuse I can come up with for his current unwillingness to involve the authorities (whomever the proper authority is in this case) is that it would involve the possibility of something more embarrassing being revealed during an investigation of his laptop/computer equipment.

Does someone really want to defend the idea the he thought it worth the time/expense to hire his own people to examine his computer(s), but he doesn't feel it's worth involving the proper authorities because (insert_plausible_reason_here ) ?

 

[A'isha]

One extremely important weakness in this argument:



Here's a real yfrog email address:



Now, if you have that zyxor bit, it would seem to be relatively trivial to post a picture to Tom's account. But the question is how somebody would know that. As you can see when you click the pix that Tom posted, it does not show up. If you go to the link that came from his twitter feed, you see the first part of the email address but not those five letters that come afterwards. I assume you got unabogie's email address at yfrog privately, but you can see the problem there; presumably Congressman Weiner was not giving out his yfrog email address. Getting those five characters could be pretty tough; if we assume they are only letters, there are about 11 million combinations. So it looks like we are back to those nefarious haxxors.

Apparently, it's not as difficult as it seems to figure out the five-letter code yfrog assigns. See here for a description of someone testing how yfrog assigns the code. Of 27 new yfrog accounts this person set up, the same code was was assigned to two of them.

EDIT: Rachel Maddow even reports on how a test attempt to guess the yfrog email code succeeded in someone figuring it out and using the exploit to post a pic and tweet on an account they didn't know the full yfrog email for.

 

[Ziggurat]

apparently unique ability to see the Tweet in question when it was posted

I've already explained that part. When a tweet is addressed to someone with the @, then by default the only people who see it are people who follow BOTH the sender and the recipient. Which would have been... hardly anyone, in this case. It's possible to change your twitter account settings so that such messages show up even if you're only following the sender, but very few people do.

 

[sadhatter]

Anyone else think this may just be a huge mistake?

He sent a perfectly normal picture but transposed letters and the file was titled " wiener pic" instead of " weiner pic."

 

[Brainster]

Apparently, it's not as difficult as it seems to figure out the five-letter code yfrog assigns. See here for a description of someone testing how yfrog assigns the code. Of 27 new yfrog accounts this person set up, the same code was was assigned to two of them.

EDIT: Rachel Maddow even reports on how a test attempt to guess the yfrog email code succeeded in someone figuring it out and using the exploit to post a pic and tweet on an account they didn't know the full yfrog email for.

Like I said, we're back to those nefarious haxxors. And we still don't have an explanation as to why Weiner doesn't simply say, I did not have brief relations with that underwear.

 

[Unabogie]

Like I said, we're back to those nefarious haxxors. And we still don't have an explanation as to why Weiner doesn't simply say, I did not have brief relations with that underwear.

Again, why was the guy who discovered the tweet bragging about a soon to be "exposed" sex scandal involving pictures two weeks ago?

 

[TraneWreck]

And then calling the police to report his account was hacked.

Hilarious. You are a comedian.

Weiner did this to himself with his evasive answers and lack of rational response in reporting it to the police. It's the gift that keeps on giving. Again, "It's been reported to the police" and clear, unequivocal answers to "is that a picture of you?" and this would be history.

It's history anyway, no one will be talking about it next week, but once again, you're off in fantasy land. Once that picture was sent, there was no possible response that would have kept Breitbart and other right wing numbskulls from pimping this story. Because the legacy of "Drudge chooses the news" still holds, CNN and MSNBC and obviously Fox were going to air this, regardless of Weiner's response.

As I said, ACORN, Planned Parenthood and Shirley Sherrod all handled their situations EXACTLY as you're recommending Weiner handle this one. It didn't stop the right wing scandal whoring. Nothing will.

 

[A'isha]

Like I said, we're back to those nefarious haxxors. And we still don't have an explanation as to why Weiner doesn't simply say, I did not have brief relations with that underwear.

Weiner's bizarre actions and non-denials are why I'm 50/50 right now as to whether he actually did it, or someone used the yfrog exploit to frame him.

But "hacking" yfrog to learn the email address that you can use to post a pic to someone else's account and make it look like they tweeted it, when they had no involvement at any step of the process, is apparently really easy to do.

Or was, since yfrog has disabled that feature now.

Again, why was the guy who discovered the tweet bragging about a soon to be "exposed" sex scandal involving pictures two weeks ago?

Especially when, if what Ziggurat says is true, this guy bragging for weeks about a soon to be exposed sex scandal involving pictures was one of the only people following both the representative and the college student on Twitter, which allowed him to see the tweet with the image link.

This whole thing is a suspicious mess, and I honestly have no idea what's going on.

 

[Ziggurat]

Especially when, if what Ziggurat says is true, this guy bragging for weeks about a soon to be exposed sex scandal involving pictures was one of the only people following both the representative and the college student on Twitter, which allowed him to see the tweet with the image link.

That's not quite right. You can only see such tweets if you follow both parties, IF your settings are the default settings. You can change your settings so that you see those tweets even if you only follow the sender, but very few people do. I do not know, and do not claim to know, whether that guy was following both parties or whether he had changed his settings.

 

[TraneWreck]

That's not quite right. You can only see such tweets if you follow both parties, IF your settings are the default settings. You can change your settings so that you see those tweets even if you only follow the sender, but very few people do. I do not know, and do not claim to know, whether that guy was following both parties or whether he had changed his settings.

I'm no twitter wizard, I don't even have an account, but when I read someone's twitter feed, I can see the @_______'s even though I'm following neither party.

Is there a difference between the way public and private feeds work? Because Weiner's is most definitely public. I can load that feed and see @______'s right now.

 

[A'isha]

That's not quite right. You can only see such tweets if you follow both parties, IF your settings are the default settings. You can change your settings so that you see those tweets even if you only follow the sender, but very few people do. I do not know, and do not claim to know, whether that guy was following both parties or whether he had changed his settings.

Ah. I don't use Twitter myself.

 

[Neally]

Which police department should one call?

I'm sure my local city police department would have no clue of what to do. Nor would the state troopers.

Do you call the police department where the servers that have the account information are located? The police department where a suspected hacker lives?

How about the Capital Police, then the FBI either of which could refer you to the proper authorities if they wouldn't handle it. In either case, Weiner didn't use the "I don't know who to call" excuse. All he had to do is place a call to any police authority, and say so. Instead he does this phony, "I don't want to make a federal case out of this", when in fact it very well could be a federal case if in fact his account was hacked.

 

[Unabogie]

How about the Capital Police, then the FBI either of which could refer you to the proper authorities if they wouldn't handle it. In either case, Weiner didn't use the "I don't know who to call" excuse. All he had to do is place a call to any police authority, and say so. Instead he does this phony, "I don't want to make a federal case out of this", when in fact it very well could be a federal case if in fact his account was hacked.

But if his account wasn't hacked and this is simply a flaw in the yfrog system, what would be the crime? Emailing a picture to yfrog? It's not obscene. It's just something a married guy shouldn't be sending.

 

[Ziggurat]

I'm no twitter wizard, I don't even have an account, but when I read someone's twitter feed, I can see the @_______'s even though I'm following neither party.

Two things: first, starting a message with @____ is different than having a @____ within the message. The second, and perhaps more relevant to your observation, is addressed below:

http://blog.twitter.com/2008/05/how-replies-work-on-twitter-and-how.html

There is an @ Replies setting you can find under Settings / Notices:
[image]
This has nothing to do with @replies directed to you. This is about what @replies you see from people you follow. The default—@ replies to the people I'm following—is probably what you have it set on (98% of people do). That means, if you're following me, but not following @veronica, you wouldn't see the tweet above (unless you went to my profile).

That hilighted bit seems to be what you're observing. I don't use twitter, so that page is where I'm getting my information from. So I guess there's a third way that people could have found the message, but I don't know how often people actually go to his profile page rather than just follow his feed. Possibly not very often.

 

[JohnnyG]

Which police department should one call?

http://www.justice.gov/criminal/cybercrime/reporting.htm

In case knowing how to find this information is too much to ask of a federal lawmaker with 10+ years experience and his legal advisors, I'm sure the local police department has a copy of this information.

 

[Neally]

But if his account wasn't hacked and this is simply a flaw in the yfrog system, what would be the crime? Emailing a picture to yfrog? It's not obscene. It's just something a married guy shouldn't be sending.

The issue is his suspicious handling of the matter. The picture itself is just a brief bit of congress critter humor. Weiner has unnecessarily brought the focus to this by his apparent attempts to hide the truth.