Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

151–160 of 350 posts

Re: When your classmates threaten you with felony charges

#151

Post by Buttons840 »

mentalpiracy wrote: post #78
jbombadil wrote: post #11

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…

> I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". This concept of severability exists in basically all contracts, and is generally limited to sections that are not fundamental to the nature of the agreement. (The extent of what qualifies as fundamental is, as you said, up to a court to interpret.) In your specific…

> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated

In a right-to-work state, what protections can an individual realistically expect to receive from a contract?

Re: When your classmates threaten you with felony charges

#152

Post by ipaddr »

mentalpiracy wrote: post #78
jbombadil wrote: post #11

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…

> I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". This concept of severability exists in basically all contracts, and is generally limited to sections that are not fundamental to the nature of the agreement. (The extent of what qualifies as fundamental is, as you said, up to a court to interpret.) In your specific…

But then your dismal will be governed by common law which could mean years of back pay depending on where you live.

Re: When your classmates threaten you with felony charges

#153

Post by AnthonyMouse »

tptacek wrote: post #142
AnthonyMouse wrote: post #123

Earlier quoted context omitted.

> this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist This seems like a problem with the existing law, if that's how it works. It puts the amount of "damages" in the hands of the "victim" who can choos…

A forensics investigation is usually required by insurers. It's not an arbitrary amount of money, it's just an amount you're not happy with. I understand why you feel that way, but it's not the way the law works.

Services can negotiate the terms of their insurance contract or even choose whether or not to carry insurance. They agree to these terms and know the implications, and again, if the need for the investigation is legitimate then they should be conducting it regardless of how the vulnerability is uncovered.

> it's not the way the law works.

Which is problematic.

Re: When your classmates threaten you with felony charges

#154

Post by tptacek »

darkarmani wrote: post #146
dgunay wrote: post #126

Earlier quoted context omitted.

Not a lawyer ofc, but I would not expect that line of reasoning to hold up in court as I wouldn't expect "the door was unlocked, your honor" to excuse trespassing.

So every URL is a trespass unless you have explicit permission? If you say the protocol determines authorization, then the Fizz protocol granted them authorization. I don't have a clear answer here because it is messy.

It depends on how you uncovered the URL and what's behind it: your intent, which is most of what matters here.

Re: When your classmates threaten you with felony charges

#155

Post by dahfizz »

yebyen wrote: post #137
dahfizz wrote: post #117

Earlier quoted context omitted.

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

It is true that leaving your door unlocked does not give burglars permission to burgle you, but how is an open door different than a closed door? Legally, I think it's also true that an open door looks more like an invitation to enter (and it's different from burglary to simply poke your head in the door, see if anything is wrong, and not breaking or taking anything) If an API is served on a public network and your c…

Yes, I think your description is perfectly reasonable. You could make a convincing argument that the researchers poked their head in to an open door. The fact that the law requires you to steal data or otherwise cause damages would support this idea.

I just wanted to argue against the idea that an unprotected computer is fair game for hacking. Morally and legally, it is not.

Re: When your classmates threaten you with felony charges

#156

Post by marcod »

skshfksjdj wrote: post #150
marcod wrote: post #124

Earlier quoted context omitted.

While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable. If some less ethical hackers got a hold of that data, much worse things could have happened. * that's the biggest red flag. A company saying 100% obviously has very little actual security expertise. PS: I'm a big fan o…

Incentives usually have unintended consequences. The laws that would apply to unsolicited pentesting make it undesirable to perform it. Thus, society as a whole is less secure because someone wants to protect companies from hacking.

Yes, same with the more general "whistleblowers". Unethical companies will always try to punish those who expose them.

Re: When your classmates threaten you with felony charges

#157

Post by sleepybrett »

tptacek wrote: post #63
hermannj314 wrote: post #58

I realize it is quick to be against Fizz, but I thought ethical hacking required prior permission. Am I to understand you can attempt to hack any computer to gain unauthorized access without prior approval? That doesn't seem legal at all. Whether or not there was a vulnerability, was the action taken actually legal under current law? I don't see anything indicating for or against in the article. Just posturing that "…

(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.

(a) what if a company hires an external red team to hack their shit, would that not be 'ethical hacking'?

Re: When your classmates threaten you with felony charges

#158

Post by yebyen »

tptacek wrote: post #149
yebyen wrote: post #137

Earlier quoted context omitted.

It is true that leaving your door unlocked does not give burglars permission to burgle you, but how is an open door different than a closed door? Legally, I think it's also true that an open door looks more like an invitation to enter (and it's different from burglary to simply poke your head in the door, see if anything is wrong, and not breaking or taking anything) If an API is served on a public network and your c…

This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…

I don't think it's that simple. The prosecution will have to prove the intent to commit a crime. If it looks like a service that should require authorization, and the door is swinging wide open, I think there's a decent argument to be made that you can't prove a reasonable neighbor's intent wasn't to perform a welfare check, and with no criminal intent there is no crime of burglary.

If my neighbor leaves his door open (in the winter, say), and I have cause to believe that something is wrong based on that, is a jury going to convict me for going in there to check on them? It really sounds like that's what was done here.

I guess creating an admin account while I'm in there is a bit like making a key for myself while I look around. That might be over the line. But without that step, I'm not sure how you can have proved that something was even wrong...

I'll go read the article now.

Re: When your classmates threaten you with felony charges

#159

Post by Buttons840 »

lamontcg wrote: post #97
f0e4c2f7 wrote: post #17

I feel like this article reflects an overall positive change in the way disclosure is handled today. Back in the 90s this was the sort of thing every company did. Companies would threaten lawsuits, or disclosure in the first place seemed legally dubious. Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. Sure you still get s…

The problem is that it is still entirely illegal to do this kind of hacking without any permission. The fact that a lot of companies have embraced bug bounties and encourage this kind of stuff against them unfortunately teaches "kids" that this kind of thing is perfectly legal/moral/ethical/etc. As this story shows though you're really rolling the dice, even though it worked out in this case. > Discussions in forums…

Yeah, when it comes to cyber-security, we put our national security at risk so companies can avoid being embarrassed. (See my rant in another comment.)

Re: When your classmates threaten you with felony charges

#160

Post by tptacek »

epoch_100 wrote: post #103
bawolff wrote: post #95

Earlier quoted context omitted.

> After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained Ignoring the legalities of it all, this step crosses a line morally imo.

Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/

Yeah, Firebase makes this much more of a gray area than a SQL database would, where you'd know instantly as soon as you issued an INSERT or an UPDATE that you were doing something unauthorized. The writeup is solid, you seem like you took most of the normal precautions a professional team would. The story has the right ending!
Post reply on HN