31 ms·

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this p

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

abrookewood 11y ago
My thoughts exactly ... and he posted the IP addresses, passwords & usernames of the sites he was able to access. Stupid.
xupybd 11y ago
>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?
- ambiate 11y ago
  CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;" A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world. This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA. Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.
  - xupybd 11y ago
    Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.
- Godel_unicode 11y ago
  Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs. https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA)#Access https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...
WillieStevenson 11y ago
My apologies. I have blocked out the content to prevent any further harm.
sneak 11y ago
The phrase "responsible disclosure" exists only to frame full and public disclosure as irresponsible, which it is not. It is victim blaming to lay the tyranny of the state at the feet of those who are doing research and publishing unredacted results, even if this specific author is indeed a moron.
ploxiln 11y ago
And also, the fact that billions of people could theoretically do what this guy did, is why the cfaa etc. is stupid. If you need to keep billions from making naughty voltage patterns to their modem ... you're doomed. You're just gonna have to fix the cfaa.
im3w1l 11y ago
On a tangent, how will the next generation of hackers learn the ropes? Will they be hopelessly outclassed by their foreign peers?
- Godel_unicode 11y ago
  More or less the same way we did? Reading about vulnerabilities, reviewing metasploit modules, fuzzing applications on your local box, reading hack post-mortems (all of which is SOOO much easier than it used to be). They will also have the huge leg-up of being able to download vm images like Kali and DamnVulnerable{Linux, WebApp} to practice with/on. When I think about how much time I spent early in my career hand-rolling a vulnerable machine so I could try out some new msf module, only to crash my laptop when it executed and have to start over... This myth that everyone learned by hacking actual websites etc, and therefore this is the only (or even the best) way to learn needs to die in fire. Lots of elite practitioners learned their craft without doing anything that would be considered remotely illegal.

abrookewood 11y ago

My thoughts exactly ... and he posted the IP addresses, passwords & usernames of the sites he was able to access. Stupid.

xupybd 11y ago

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

ambiate 11y ago
CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;" A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world. This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA. Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.
- xupybd 11y ago
  Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.
Godel_unicode 11y ago
Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs. https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA)#Access https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...

WillieStevenson 11y ago

My apologies. I have blocked out the content to prevent any further harm.

sneak 11y ago

The phrase "responsible disclosure" exists only to frame full and public disclosure as irresponsible, which it is not. It is victim blaming to lay the tyranny of the state at the feet of those who are doing research and publishing unredacted results, even if this specific author is indeed a moron.

ploxiln 11y ago

And also, the fact that billions of people could theoretically do what this guy did, is why the cfaa etc. is stupid. If you need to keep billions from making naughty voltage patterns to their modem ... you're doomed. You're just gonna have to fix the cfaa.

im3w1l 11y ago

On a tangent, how will the next generation of hackers learn the ropes? Will they be hopelessly outclassed by their foreign peers?

Godel_unicode 11y ago
More or less the same way we did? Reading about vulnerabilities, reviewing metasploit modules, fuzzing applications on your local box, reading hack post-mortems (all of which is SOOO much easier than it used to be). They will also have the huge leg-up of being able to download vm images like Kali and DamnVulnerable{Linux, WebApp} to practice with/on. When I think about how much time I spent early in my career hand-rolling a vulnerable machine so I could try out some new msf module, only to crash my laptop when it executed and have to start over... This myth that everyone learned by hacking actual websites etc, and therefore this is the only (or even the best) way to learn needs to die in fire. Lots of elite practitioners learned their craft without doing anything that would be considered remotely illegal.