Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

181–190 of 350 posts

Re: When your classmates threaten you with felony charges

#181

Post by adolph »

epoch_100 wrote: post #103
bawolff wrote: post #95

Earlier quoted context omitted.

> After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained Ignoring the legalities of it all, this step crosses a line morally imo.

Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/

Did you check with the target before you "checked whether we could set `isAdmin` to `true` on our existing accounts?"

If you did not get consent from a subject, you are not a researcher. If you see a door and check to see if it is unlocked without its owner authorizing you to do so, you are on the ethical side of burglary even if you didn't burgle.

Helpfully the "technical writeup" post links to "industry best practices" [0] which include:

If you are carrying out testing under a bug bounty or similar program, the organisation may have established safe harbor policies, that allow you to legally carry out testing, as long as you stay within the scope and rules of their program. Make sure that you read the scope carefully - stepping outside of the scope and rules may be a criminal offence.

The ethically poor behavior of Fizz doesn't mitigate your own.

0. https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability...

Re: When your classmates threaten you with felony charges

#182

Post by dragonwriter »

winter_blue wrote: post #83

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect th…

> If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm

No, it wouldn’t. Anonymity can be penetrated, and the more incentive people have to do so, the more likely it will be.

Re: When your classmates threaten you with felony charges

#183

Post by tptacek »

dahfizz wrote: post #165
yebyen wrote: post #148

Earlier quoted context omitted.

> The reason people don't tell you their database password on Hacker News is because of countries that don't have that law, I assume. That's silly, the reason people protect themselves is so that they are protected. Legal protection is another different kind of protection, but I think it's a deep stretch to argue that one can remove all the technical protections and still keep access to the CFAA and obtain meaningful…

The term "protected computer" is defined in the CFAA act[1]. Basically its any computer used by a bank, the federal government, or used in interstate commerce. This is just a quirk of the US system of government. If it doesn't fit those criteria, its going to be up to the state to prosecute based on the state's own version of the cfaa. [1] https://www.law.cornell.edu/definitions/uscode.php?width=840...

In practice, "protected computer" means "any computer".

Re: When your classmates threaten you with felony charges

#184

Post by [deleted] »

AnthonyMouse wrote: post #123
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

> this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist This seems like a problem with the existing law, if that's how it works. It puts the amount of "damages" in the hands of the "victim" who can choos…

[deleted]

Re: When your classmates threaten you with felony charges

#185

Post by adolph »

shkkmo wrote: post #99
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

I don't think you have the pattern of facts correct (unless you have access to more information than what is in linked the Stanford Daily article). > At the time, Fizz used Google’s Firestore database product to store data including user information and posts. Firestore can be configured to use a set of security rules in order to prevent users from accessing data they should not have access to. However, Fizz did not…

https://news.ycombinator.com/item?id=37297823#37298972

Really what happened is we checked whether we could set `isAdmin` to `true` on our existing accounts, and... we were able to. Adi's more technical writeup has details: https://saligrama.io/blog/post/firebase-insecure-by-default/

Re: When your classmates threaten you with felony charges

#186

Post by tptacek »

runnerup wrote: post #167
tptacek wrote: post #149

Earlier quoted context omitted.

This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…

> You can be convicted of breaking & entering through an open door. This definitely must vary by state. At least in Michigan that would just be trespassing. I know, because I had some very in-depth conversations with my lawyer about whether I had committed trespassing or B&E while exploring steam tunnels underneath a university. In my case, B&E couldn't apply because the door was unlocked. I also committed no other c…

You're totally right. The more accurate thing to say is "you could be convicted of residential burglary by walking through an open door if the prosecution could convince a jury you did so with the intent to commit a further crime".

Re: When your classmates threaten you with felony charges

#187

Post by dahwolf »

marcod wrote: post #124
theptip wrote: post #112

Earlier quoted context omitted.

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.

While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable. If some less ethical hackers got a hold of that data, much worse things could have happened. * that's the biggest red flag. A company saying 100% obviously has very little actual security expertise. PS: I'm a big fan o…

Devil's advocate:

I get into your home by bypassing (poor) security. I take pictures and make copies of anything inside. Then I publicly announce the breach and demand that you fix your security based on a deadline I made up. Then I say "trust me, bro" when I promise to never reveal the data I stole.

Nobody would find any of that moral. The analogy breaks down because your home is not a place where sensitive data of lots of people is stored. But even then if you'd do the same thing in a physical place where this would be the case, you'd simply be arrested, if not (accidentally) shot.

I do agree that these security researchers are ultimately doing a good thing, but they should not be this naive and aggressive about it.

Re: When your classmates threaten you with felony charges

#188

Post by dahfizz »

darkarmani wrote: post #146
dgunay wrote: post #126

Earlier quoted context omitted.

Not a lawyer ofc, but I would not expect that line of reasoning to hold up in court as I wouldn't expect "the door was unlocked, your honor" to excuse trespassing.

So every URL is a trespass unless you have explicit permission? If you say the protocol determines authorization, then the Fizz protocol granted them authorization. I don't have a clear answer here because it is messy.

Its not all or nothing. The law is literally decided on a case by case basis.

Going to the home page of a public website is clearly authorized access. Creating admin users for yourself on someone else's server without permission is clearly unauthorized access. Any judge or jury would agree.

Re: When your classmates threaten you with felony charges

#189

Post by negidius »

dahfizz wrote: post #144
alasdair_ wrote: post #132

Earlier quoted context omitted.

This is such a horrible standard. Imagine I put up a web server and only intend myself to access it. I put no security on the pages. Is Google guilty of a CFAA violation for visiting the site?

The law is not a computer program. It sometimes relies on the ambiguity of human language, and uses human judges & juries to make reasonable decisions within that ambiguity. I think, in your scenario, you would have a hard time convincing a jury that Google's access to your computer is unauthorized.

The same argument could be made about the security research in the article. I think the majority of potential juror would never find someone guilty or liable for this, but there is always the risk that you are unlucky and end up with 12 who would.

Re: When your classmates threaten you with felony charges

#190

Post by otterley »

tptacek wrote: post #63
hermannj314 wrote: post #58

I realize it is quick to be against Fizz, but I thought ethical hacking required prior permission. Am I to understand you can attempt to hack any computer to gain unauthorized access without prior approval? That doesn't seem legal at all. Whether or not there was a vulnerability, was the action taken actually legal under current law? I don't see anything indicating for or against in the article. Just posturing that "…

(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.

I disagree with (a). Activities can be deemed ethical or unethical, and those norms are presumably reflected in our laws (as unauthorized hacking is). When they're not constrained by law (as certain publication and experimentation practices aren't), then they are constrained by social convention.
Post reply on HN