Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

121–130 of 350 posts

Re: When your classmates threaten you with felony charges

#121

Post by some_furry »

wedn3sday wrote: post #87
tptacek wrote: post #63

Earlier quoted context omitted.

(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.

(a) all hacking is unethical? (b) the database was running in the cloud, not on any computer they controlled. (c) everyone's an asshole here

> all hacking is unethical?

No, that's not what tptacek said.

"Ethical hacking" is from the same vein as "responsible disclosure". These are weasel words that are used to demean security researchers who don't kiss the vendors' ass.

As a security researcher, my ethical obligation is not to the vendors of the software. It's to the users.

Ethically speaking, I don't care if my research makes the vendor look bad, hurts their sales, makes their PR team sad, etc. I similarly don't care if my research makes the vendor look good.

Are the users better protected by my research? If yes, ethical. If not, unethical.

Terms like "ethical hacking" are used to stilt the conversation in the favor of vendors.

> the database was running in the cloud, not on any computer they controlled.

If it's running in the Cloud, but in your Cloud account, it's morally equivalent to running on Your Machine. I'm not sure how the law will interpret anything, but given a compelling counter-argument, I don't imagine lawyers will argue differently.

> everyone's an asshole here

Yeah.

Re: When your classmates threaten you with felony charges

#122

Post by pc86 »

winter_blue wrote: post #83

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect th…

"To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.

Re: When your classmates threaten you with felony charges

#123

Post by AnthonyMouse »

tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

> this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist

This seems like a problem with the existing law, if that's how it works.

It puts the amount of "damages" in the hands of the "victim" who can choose to spend arbitrary amounts of resources (trivial in the scope of a large bureaucracy but large in absolute amount), providing a perverse incentive to waste resources in order to vindictively trigger harsh penalties against an imperfect actor whose true transgression was to embarrass them.

And it improperly assigns the cost of such measures, even to the extent that they're legitimate, to the person who merely brought their attention to the need for them. If you've been operating a publicly available service with a serious vulnerability you still have to go through everything and evaluate the scope of the compromise regardless of whether or not this person did anything inappropriate, in case someone else did. The source of that cost was their own action in operating a vulnerable service -- they should still be incurring it even if they discovered the vulnerability themselves, but not before putting it in production.

The damages attributable to the accused should be limited to the damage they actually caused, for example by using access to obtain customer financial information and committing credit card fraud.

Re: When your classmates threaten you with felony charges

#124

Post by marcod »

theptip wrote: post #112
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.

While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable.

If some less ethical hackers got a hold of that data, much worse things could have happened.

* that's the biggest red flag. A company saying 100% obviously has very little actual security expertise.

PS: I'm a big fan of Germany's https://www.ccc.de/en/ who have pulled many such hacks against some of the biggest tech companies.

Re: When your classmates threaten you with felony charges

#125

Post by xigency »

rootusrootus wrote: post #92
wedn3sday wrote: post #88

Maybe its just my Oppositional Defiant Disorder talking, but I would have nuked their db after that bs threat.

> Maybe its just my Oppositional Defiant Disorder talking Is that the clinical term for Internet Tough Guy? I imagine deleting the DB would almost certainly lead to actual CFAA consequences. Which kinda suck, as I recall.

Yeah, it’s unwise, but also a fair warning. If you threaten someone who has leverage over you, you might find your own problems escalated. Not everyone behaves perfectly rationally under pressure.

Re: When your classmates threaten you with felony charges

#126

Post by dgunay »

emilecantin wrote: post #94
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

Not a lawyer ofc, but I would not expect that line of reasoning to hold up in court as I wouldn't expect "the door was unlocked, your honor" to excuse trespassing.

Re: When your classmates threaten you with felony charges

#127

Post by consoomer »

In my opinion, they went too far and exposed themselves by telling the company.

In all honesty, nothing good usually comes from that. If you wanted the truth to be exposed, they would have been better off exposing it anonymously to the company and/or public if needed.

It's one thing to happen upon a vulnerability in normal use and report it. It's a different beast to gain access to servers you don't own and start touching things.

Re: When your classmates threaten you with felony charges

#128

Post by jrockway »

dahfizz wrote: post #117
emilecantin wrote: post #94

Earlier quoted context omitted.

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls.

If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you read the database, it could be argued that you're exceeding your authorized access. The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume.

Re: When your classmates threaten you with felony charges

#129

Post by datacruncher01 »

Best advice I can give someone is never do security research for a company without expressed written consent to do so and document everything as agreed to.

Payouts for finding bugs when there isn't an already established process are either not going to be worth your time or will be seen as malicious activity.

Re: When your classmates threaten you with felony charges

#130

Post by rictic »

xeromal wrote: post #109
emilecantin wrote: post #94

Earlier quoted context omitted.

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

What's with the _ in your sentences?

Ascii convention to emphasize text, similar to doing the same thing with asterisks. Markdown later used this syntax for italics and bold, which popularized it further.
Post reply on HN