Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

51–60 of 350 posts

Re: When your classmates threaten you with felony charges

#51

Post by formerly_proven »

f0e4c2f7 wrote: post #17

I feel like this article reflects an overall positive change in the way disclosure is handled today. Back in the 90s this was the sort of thing every company did. Companies would threaten lawsuits, or disclosure in the first place seemed legally dubious. Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. Sure you still get s…

> Suggestions of anonymous email accounts and that sort of thing.

This is still the way to go even in many western countries.

Re: When your classmates threaten you with felony charges

#52

Post by morpheuskafka »

icameron wrote: post #22

The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information.…

A few years ago I found that HelloTalk (a language learning pen-pal app) stored the actual GPS coordinates of users in a SQLite that you can find in your iOS backup. The maps in-app showed only a general location (pin disappeared at a certain zoom).

You could also bypass the filter preventing searching for over 18 if you are under/under if you are over, and paid-only filters like location, gender, etc. by rewriting the requests with a mitmproxy (paid status is not checked server-side).

Re: When your classmates threaten you with felony charges

#54

Post by dudus »

iancarroll wrote: post #30
icameron wrote: post #22

The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information.…

This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…

It is common. But before you curse at Google here. This is VERY well documented. When you create a database the UI screams at you that it's in dev mode, that security has not been setup etc.... if you keep ignoring the database will eventually close itself down automatically.

So this is entirely on the dev team to blame.

Re: When your classmates threaten you with felony charges

#55

Post by henriquez »

singleshot_ wrote: post #48
iancarroll wrote: post #30

Earlier quoted context omitted.

This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase…

One interesting thing about the statute of limitations is “the discovery rule.” For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right? No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until the…

Does this apply to criminal or just civil?

Re: When your classmates threaten you with felony charges

#56

Post by LastTrain »

jbombadil wrote: post #11

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…

There can be consequences, but you have to be able to demonstrate you have been harmed. So, in what way have you been harmed by such a threat, and what is just compensation? How much will it cost to hire a lawyer to sue for compensation, and what are your chances of success? These are the same kinds of questions the entity sending the threatening letter asked themselves as well. If you think it is unfair because they have more resources, well that is more of a general societal problem - if you have more money you have access to better justice in all forms.

Re: When your classmates threaten you with felony charges

#57

Post by tptacek »

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here:

* Fizz appears to be a client/server application (presumably a web app?)

* The testing the researchers did was of software running on Fizz's servers

* After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained

* The researchers were not given permission to do this testing

If that fact pattern holds, then unless there's a California law governing this that I'm not aware of --- and even then, federal supremacy moots it, right? --- I think they did straightforwardly violate the CFAA, contra the claim in their response.

At least three things mitigate their legal risk:

1. It's very clear from their disclosure and behavior after disclosing that they were in good faith conducting security research, making them an unattractive target for prosecution.

2. It's not clear that they did any meaningful damage (this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist), meaning there wouldn't have been much to prosecute.

3. Fizz's lawyers fucked up and threatened a criminal prosecution in order to obtain a valuable concession fro the researchers, which, as EFF points out, violates a state bar rule.

I think the good guys prevailed here, but I'm wary of taking too many lessons from this; if this hadn't been "Fizz", but rather the social media features of Dunder Mifflin Infinity, the outcome might have been gnarlier.

Re: When your classmates threaten you with felony charges

#58

Post by hermannj314 »

I realize it is quick to be against Fizz, but I thought ethical hacking required prior permission.

Am I to understand you can attempt to hack any computer to gain unauthorized access without prior approval? That doesn't seem legal at all.

Whether or not there was a vulnerability, was the action taken actually legal under current law? I don't see anything indicating for or against in the article. Just posturing that "ethical hacking" is good and saying you are secure when you aren't is bad. None of that seems relevant to the actual question of what the law says.

Re: When your classmates threaten you with felony charges

#59

Post by fallingknife »

jbombadil wrote: post #11

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negativ…

That's not the language they use. It will be more like "your actions may violate (law ref) and if convicted, penalties may be up to 20 years in prison." And how do you keep people from saying that? It's basically a statement of fact. If you have a problem with this, then your issue is with Congress for writing such a vague law.
Post reply on HN