Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

161–170 of 350 posts

Re: When your classmates threaten you with felony charges

#161

Post by jrockway »

yebyen wrote: post #148
jrockway wrote: post #128

Earlier quoted context omitted.

That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls. If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you re…

> The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume. That's silly, the reason people protect themselves is so that they are protected. Legal protection is another different kind of protection, but I think it's a deep stretch to argue that one can remove all the technical protections and still keep access to the CFAA and obtain meaningful…

> That's silly

Yeah, of course ;)

> In the tradition of US property law, I think you need to do the bare minimum of posting "NO TRESPASSING" signs at the border

I guess the law went for an allowlist instead of a denylist this time. Plus one point on their security audit!

> protected computer

As an aside, sometimes I wonder why people make threats like "you must not link to this site without permission". It's like saying "you must not look at my house as you walk by it". You can ask, but it's Not A Thing. I worry that the language could potentially confuse a court someday. (Or that it already did.)

Re: When your classmates threaten you with felony charges

#162

Post by ipaddr »

notpushkin wrote: post #133
MajimasEyepatch wrote: post #73

Earlier quoted context omitted.

There is obviously such a thing as going too far, but it's kind of hard to draw a clear line. In a good faith context, laws and precedents can change quickly, sometimes based on the whim of a judge, and there are many areas of law where there is no clear precedent or where guidance is fuzzy. In those cases, it's important to have severability so that entire contracts don't have to be renegotiated because one small cl…

> At the end of the day, documents like this are written by lawyers in legalese that's not designed for ordinary people. Does it have to be this way?

Without a common language with exact meaning for phrases that are accepted by both parties contracts would be impossible to enforce and become useless.

Re: When your classmates threaten you with felony charges

#163

Post by lcnPylGDnU4H9OF »

dahfizz wrote: post #117
emilecantin wrote: post #94

Earlier quoted context omitted.

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

I wonder if they're conflating CFAA with DMCA 1201[0]. They're similar in subject, even if they are actually about different things.

[0] https://www.law.cornell.edu/uscode/text/17/1201

Re: When your classmates threaten you with felony charges

#164

Post by tptacek »

yebyen wrote: post #158
tptacek wrote: post #149

Earlier quoted context omitted.

This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…

I don't think it's that simple. The prosecution will have to prove the intent to commit a crime. If it looks like a service that should require authorization, and the door is swinging wide open, I think there's a decent argument to be made that you can't prove a reasonable neighbor's intent wasn't to perform a welfare check, and with no criminal intent there is no crime of burglary. If my neighbor leaves his door ope…

The crime in this case is accessing software running on someone else's computer without their authorization. The "someone else" in this case vehemently objects to the access at issue. The burden of proof is on the prosecution, but their argument is compelling enough that it's the defendant who'd have to do the explaining.

No: you will not get convicted checking on your neighbor. Everybody involved in that fact pattern will believe that you at the time believed it was OK for you to peek into their house. Now change the fact pattern slightly: you're not a neighbor at all, but rather some random person walking down the street. A lot less clear, right?

Anyways that's what these cases are often about: the defendant's state of mind.

Note here that this is a Firebase app, so while it's super obvious to me that issuing an INSERT or UPDATE on a SQL database would cross a line, jiggling the JSON arguments to a Firebase API call to flip a boolean is less problematic, since that's how you test these things. The problem in the SQL case is that as soon as you're speaking SQL, you know you've game-overed the application; you stop there.

Re: When your classmates threaten you with felony charges

#165

Post by dahfizz »

yebyen wrote: post #148
jrockway wrote: post #128

Earlier quoted context omitted.

That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls. If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you re…

> The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume. That's silly, the reason people protect themselves is so that they are protected. Legal protection is another different kind of protection, but I think it's a deep stretch to argue that one can remove all the technical protections and still keep access to the CFAA and obtain meaningful…

The term "protected computer" is defined in the CFAA act[1].

Basically its any computer used by a bank, the federal government, or used in interstate commerce.

This is just a quirk of the US system of government. If it doesn't fit those criteria, its going to be up to the state to prosecute based on the state's own version of the cfaa.

[1] https://www.law.cornell.edu/definitions/uscode.php?width=840...

Re: When your classmates threaten you with felony charges

#166

Post by Buttons840 »

wang_li wrote: post #8

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.

Meanwhile companies leak the private data of millions of people and nothing happens.

If a curious kid does a port scan police will smash down doors. People will face decades in prison.

If a negligent company leaks the private data of every single American, well, gee, what could we have done more, we had that one company do an audit and they didn't find anything and, gee, we're just really sorry, so lets all move on and here's a free year of credit monitoring which you may choose to continue paying us for at the end of the free year.

Re: When your classmates threaten you with felony charges

#167

Post by runnerup »

tptacek wrote: post #149
yebyen wrote: post #137

Earlier quoted context omitted.

It is true that leaving your door unlocked does not give burglars permission to burgle you, but how is an open door different than a closed door? Legally, I think it's also true that an open door looks more like an invitation to enter (and it's different from burglary to simply poke your head in the door, see if anything is wrong, and not breaking or taking anything) If an API is served on a public network and your c…

This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…

> You can be convicted of breaking & entering through an open door.

This definitely must vary by state. At least in Michigan that would just be trespassing. I know, because I had some very in-depth conversations with my lawyer about whether I had committed trespassing or B&E while exploring steam tunnels underneath a university. In my case, B&E couldn't apply because the door was unlocked. I also committed no other crimes besides simple trespassing.

Re: When your classmates threaten you with felony charges

#168

Post by sleepybrett »

Buttons840 wrote: post #120

> And then, one day, they sent us a threat. A crazy threat. I remember it vividly. I was just finishing a run when the email came in. And my heart rate went up after I stopped running. That’s not what’s supposed to happen. They said that we had violated state and federal law. They threatened us with civil and criminal charges. 20 years in prison. They really just threw everything they could at us. And at the end of t…

We need personal data protection laws in this country so that as an individual after a data breach at wherever I can personally sue them for damages. Potentially very significant damages if they leak a full dossier like a credit reporting agency.

If that happens the whole calculus of bug bounties changes immediately.

Re: When your classmates threaten you with felony charges

#169

Post by paganel »

theptip wrote: post #112
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.

> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do.

I was looking for a comment like this. You couldn't pay me enough to do this sort of thing in this day and age (unless working for a DoD or 3-letter agency contractor, which would have my back covered), nevermind to do it pro bono or bona fide or whatever it is that these guys had in mind (either way, it looks like they were not paid to do it).

This sort of action might still have been sort of ok-ish in the late '00s, maybe going into 2010, 2011, but when the Russian/Chinese/North Korean/Iranian cyber threats became real (plus the whole Snowden fiasco) then related laws began to change (both in the US and in Europe) and doing this sort of stuff with no-one to back you up for real (forget the EFF) meant that the one doing it would be asking for trouble in a big way.

Re: When your classmates threaten you with felony charges

#170

Post by tptacek »

sleepybrett wrote: post #157
tptacek wrote: post #63

Earlier quoted context omitted.

(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.

(a) what if a company hires an external red team to hack their shit, would that not be 'ethical hacking'?

No, because there's no such thing as "ethical hacking"; that's a marketing term invented by vendors to constrain researchers. You'd call what you're talking about "pentesting" or "red teaming". How you'd know you had a clownish pentest vendor would be if they themselves called it "ethical hacking".
Post reply on HN