Live data from Hacker News

Please do not take down the Sality botnet

seclists.org

11–20 of 148 posts

Re: Please do not take down the Sality botnet

#11
I would love to hear a lawyers opinion on whether the OP has any legal case whatsoever if his "not suggestions" are ever used, his identity is identified, and someone decides they want to throw the book at him.

Basically, if some DA decides this is modern day vigalanteism, a step removed - could the OP ever defend himself in court?

Re: Please do not take down the Sality botnet

#12

Does anyone know exactly why it's illegal to take down Sality?

While yes this is technically illegal, honest question does the letter of the law stand in a situation where those "wronged" by the infraction are themselves in the wrong? From a legal standpoint, charges would have to be brought against you by someone, and I doubt that anyone who sustained damage from this situation (the bot network's owner) would have the ability to demonstrate such a thing without substantially incriminating themselves.

From a purely philosophical standpoint, you could take a utilitarian approach ala J.S. Mill and say that it would do the greatest quality of good to the greatest number of people to take such action. Granted at the point we're discussing philosophy, we're outside the judicial process which is all that's up for debate here.

Re: Please do not take down the Sality botnet

#13
post #4

Does anyone know exactly why it's illegal to take down Sality?

the c&c servers are sites hacked by the owners of the botnet. you would have to hack them yourself and upload your own payload to take down peers

What if one of the site owners 'fixed' their server? That'd be nice and legal, wouldn't it?

Re: Please do not take down the Sality botnet

#14
post #11

I would love to hear a lawyers opinion on whether the OP has any legal case whatsoever if his "not suggestions" are ever used, his identity is identified, and someone decides they want to throw the book at him. Basically, if some DA decides this is modern day vigalanteism, a step removed - could the OP ever defend himself in court?

I think the OP might be in difficulties in that event (totally not a layer, just guessing).

But perhaps the OP felt it was less risky this way not just for legal reasons, but because it's easier to send one email anonymously than to carry out the whole operation without being traced.

Or maybe he or she had other stuff to do.

Re: Please do not take down the Sality botnet

#16
post #11

I would love to hear a lawyers opinion on whether the OP has any legal case whatsoever if his "not suggestions" are ever used, his identity is identified, and someone decides they want to throw the book at him. Basically, if some DA decides this is modern day vigalanteism, a step removed - could the OP ever defend himself in court?

Not a lawyer. But this would never come to pass - no DA would have the brains let alone the skill or political will to prosecute. Also, seems like a freedom of speech issue. Otherwise it would be difficult for educators to discuss computer security. In fact, I'm pretty sure he could even do away with all of the "non-suggestion" text and still be fine.

If I say, "I think you should hack website X, humanity will be better off for it" that's just my opinion. I can even say, "I think you should empty all of Goldman Sach's bank accounts and use the proceeds to buy up endangered rain forest land in Brazil." As long as I'm not materially facilitating the commission of the crime, I'm just another guy on the internet with an opinion.

Edit: After reviewing http://en.wikipedia.org/wiki/Freedom_of_speech_by_country#ci... I'm coming to the conclusion that the above is pretty far from accurate in any country. Apparently freedom of speech has been under serious assault for decades. Which is sort of sickening, but also a fact of life.

Re: Please do not take down the Sality botnet

#18
post #11

I would love to hear a lawyers opinion on whether the OP has any legal case whatsoever if his "not suggestions" are ever used, his identity is identified, and someone decides they want to throw the book at him. Basically, if some DA decides this is modern day vigalanteism, a step removed - could the OP ever defend himself in court?

Not a lawyer. But this would never come to pass - no DA would have the brains let alone the skill or political will to prosecute. Also, seems like a freedom of speech issue. Otherwise it would be difficult for educators to discuss computer security. In fact, I'm pretty sure he could even do away with all of the "non-suggestion" text and still be fine. If I say, "I think you should hack website X, humanity will be bet…

Law student. These sort of situations have been considered by the people that write criminal laws.

If you recommend a crime to someone and then they do it then you're a party to that offence (http://laws-lois.justice.gc.ca/eng/acts/C-46/page-6.html#h-5 [Canadian Criminal Code, but I assume US is quite similar on this]).

There are a variety of ways to become a party to a crime, and then you're as guilty as the rest of 'em.

Re: Please do not take down the Sality botnet

#19
post #6

Does anyone know exactly why it's illegal to take down Sality?

Because technically the methods used (i.e. SQL injection) are illegal if you dont own the equipment your using it on. Also he is a civilian and does not have any power or jurisdiction to do so.

Slightly off-topic: Is SQL injection itself illegal? Because I was under the impression that only using SQL injection to gain unauthorized access to someone else's computer (like the OP is suggesting) was illegal.

Re: Please do not take down the Sality botnet

#20
post #11

I would love to hear a lawyers opinion on whether the OP has any legal case whatsoever if his "not suggestions" are ever used, his identity is identified, and someone decides they want to throw the book at him. Basically, if some DA decides this is modern day vigalanteism, a step removed - could the OP ever defend himself in court?

Not a lawyer. But this would never come to pass - no DA would have the brains let alone the skill or political will to prosecute. Also, seems like a freedom of speech issue. Otherwise it would be difficult for educators to discuss computer security. In fact, I'm pretty sure he could even do away with all of the "non-suggestion" text and still be fine. If I say, "I think you should hack website X, humanity will be bet…

Providing the files needed is a little bit more in terms of actively participating than just saying "wouldn't it be nice."
Post reply on HN