6 ms·

Facebook's calling his employer could be slanderous, possibly even criminal harassment. Between stories like this demonstrating companies' apparent lack of und

by Zikes 11y ago

Facebook's calling his employer could be slanderous, possibly even criminal harassment. Between stories like this demonstrating companies' apparent lack of understanding of whitehat infosec, and Weev's incarceration demonstrating the American legal system's apparent lack of understanding of whitehat infosec, it's hard to believe people still participate in such endeavors.

teraflop 11y ago
I don't see anything in the description of that call that qualifies as either slander (which requires a false statement of fact) or harassment (which requires a pattern of repeated contact intended to cause emotional distress).
- guard-of-terra 11y ago
  If bringing unrelated parties to dialogue in the background is not harrasment, then what is? Imagine I will contact your significant other over your comment on HN. Would not you be deeply disturbed even if I do it just once? Bonus points for frivolous legal threats on my side.
  - CapitalistCartr 11y ago
    "If bringing unrelated parties to dialogue in the background is not harrasment (sic), then what is?" Exactly what parent said, " . . . a pattern of repeated contact intended to cause emotional distress". Yes, doing as you said would be deeply disturbing, but it wouldn't be harassment.
  - tptacek 11y ago
    Nobody is arguing that this person shouldn't be disturbed. But that doesn't make it "criminal harassment". Unfortunately --- and this is not a normative argument, so please don't wig out --- the criminal action here is the researcher's. Nobody's been prosecuted, but could they have been? YES.
tptacek 11y ago
No, it can't be either of those things.
- FireBeyond 11y ago
  What possible motivation did Facebook have for contacting the company with whom this person had a contract employee relationship with, other than to implicitly threaten problems for both? There was no implication that he was doing this other than on his own, and he had cleared it with his employer. Presumably he didn't email Facebook with a corporate email account, and presumably his employer wasn't in a position where Facebook's first assumption would be "corporate espionage! (which was voluntarily reported to a bug bounty program)" - that's disingenuous. No, it was "We're bigger than you and we have the power to fuck with your life and livelihood", and nothing more.
  - tptacek 11y ago
    To ensure that this person deleted the credentials they had taken from the server they popped with the RCE, obviously. Again: read the timeline. He submitted a finding with AWS creds taken from the server he popped on October 22 --- on December 1, more than a month after Facebook shut the server down. He took AWS creds from a Facebook server and saved them on his laptop for more than a month. WHY?
    - FireBeyond 11y ago
      Then threaten him with legal action (not that I necessarily condone this - I will say that I did like your breakdown down thread to providing another perspective and balance). It's neither harassment or slander, but it could be tortious business interference, where one party induces a second party to break a contract with a third party. His contract employers are neither his parents or legal guardians - who have no more power to "ensure" this as anyone else. As a corollary to this - this is exactly why it's illegal for debt collectors to call your friends and family to "encourage" them, or you by humiliation, to pay up.
      - 11y ago
zenincognito 11y ago
Also remember that the story we have here is a one sided narration from a bug bounty researcher. The story tells us his side of things but what specifically Facebook perceived as threat is still unknown ? Why would a CSO get involved unless they specifically think that the data has been accessed violating the goodwill of the bug bounty research in the first place.
- Zikes 11y ago
  That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right? Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.
  - lettergram 11y ago
    It almost seems like Facebook wanted to know about the issue, but not have to update the keys.
- yeukhon 11y ago
  He claims he had access to so many credentials. That's a P1 security protocol. You can't just let a manager to handle it. Your executive boss, CSO, has to step in.
- tvmalsv 11y ago
  > Why would a CSO get involved unless they specifically think that the data has been accessed... The most likely reason I can think of is that he was getting some heat from some other C*O. Edit: Now that Alex's side of the story has been released, his actions don't seem out of line (assuming it's reasonably accurate, and I have no reason to suspect it isn't). While my explanation is still a valid answer, I agree with the parent. Sounds like he was just doing his job. Though it would be interesting to listen to the audio of the conference call....
camel_gopher 11y ago
Or likely tortious interference - https://en.wikipedia.org/wiki/Tortious_interference https://en.wikipedia.org/wiki/Tortious_interference

by Zikes 11y ago

teraflop 11y ago

I don't see anything in the description of that call that qualifies as either slander (which requires a false statement of fact) or harassment (which requires a pattern of repeated contact intended to cause emotional distress).

guard-of-terra 11y ago
If bringing unrelated parties to dialogue in the background is not harrasment, then what is? Imagine I will contact your significant other over your comment on HN. Would not you be deeply disturbed even if I do it just once? Bonus points for frivolous legal threats on my side.
- CapitalistCartr 11y ago
  "If bringing unrelated parties to dialogue in the background is not harrasment (sic), then what is?" Exactly what parent said, " . . . a pattern of repeated contact intended to cause emotional distress". Yes, doing as you said would be deeply disturbing, but it wouldn't be harassment.
- tptacek 11y ago
  Nobody is arguing that this person shouldn't be disturbed. But that doesn't make it "criminal harassment". Unfortunately --- and this is not a normative argument, so please don't wig out --- the criminal action here is the researcher's. Nobody's been prosecuted, but could they have been? YES.

tptacek 11y ago

No, it can't be either of those things.

FireBeyond 11y ago
What possible motivation did Facebook have for contacting the company with whom this person had a contract employee relationship with, other than to implicitly threaten problems for both? There was no implication that he was doing this other than on his own, and he had cleared it with his employer. Presumably he didn't email Facebook with a corporate email account, and presumably his employer wasn't in a position where Facebook's first assumption would be "corporate espionage! (which was voluntarily reported to a bug bounty program)" - that's disingenuous. No, it was "We're bigger than you and we have the power to fuck with your life and livelihood", and nothing more.
- tptacek 11y ago
  To ensure that this person deleted the credentials they had taken from the server they popped with the RCE, obviously. Again: read the timeline. He submitted a finding with AWS creds taken from the server he popped on October 22 --- on December 1, more than a month after Facebook shut the server down. He took AWS creds from a Facebook server and saved them on his laptop for more than a month. WHY?
  - FireBeyond 11y ago
    Then threaten him with legal action (not that I necessarily condone this - I will say that I did like your breakdown down thread to providing another perspective and balance). It's neither harassment or slander, but it could be tortious business interference, where one party induces a second party to break a contract with a third party. His contract employers are neither his parents or legal guardians - who have no more power to "ensure" this as anyone else. As a corollary to this - this is exactly why it's illegal for debt collectors to call your friends and family to "encourage" them, or you by humiliation, to pay up.
    - 11y ago

zenincognito 11y ago

Also remember that the story we have here is a one sided narration from a bug bounty researcher. The story tells us his side of things but what specifically Facebook perceived as threat is still unknown ? Why would a CSO get involved unless they specifically think that the data has been accessed violating the goodwill of the bug bounty research in the first place.

Zikes 11y ago
That's true, there could be large portions of the story that are omitted or inaccurate. We may never even get the full story. Assuming the story as stated is truthful or even plausible, what options do whitehat hackers have to defend themselves in such a scenario? I mean the whole point seems to be to try to penetrate a secure system, and the consequences of that action seems to be fairly obvious from the start. If a whitehat hacker is successful, that carries with it the inherent potential that they will have some sort of access to some sort of sensitive data, right? Surely telling Facebook "I was able to access these exact things" means he expected Facebook to update passwords and change keys accordingly, making the possibility that he retained those keys moot.
- lettergram 11y ago
  It almost seems like Facebook wanted to know about the issue, but not have to update the keys.
yeukhon 11y ago
He claims he had access to so many credentials. That's a P1 security protocol. You can't just let a manager to handle it. Your executive boss, CSO, has to step in.
tvmalsv 11y ago
> Why would a CSO get involved unless they specifically think that the data has been accessed... The most likely reason I can think of is that he was getting some heat from some other C*O. Edit: Now that Alex's side of the story has been released, his actions don't seem out of line (assuming it's reasonably accurate, and I have no reason to suspect it isn't). While my explanation is still a valid answer, I agree with the parent. Sounds like he was just doing his job. Though it would be interesting to listen to the audio of the conference call....

camel_gopher 11y ago

Or likely tortious interference - https://en.wikipedia.org/wiki/Tortious_interference https://en.wikipedia.org/wiki/Tortious_interference