4 ms·

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone

by xupybd 11y ago

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

ambiate 11y ago
CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;" A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world. This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA. Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.
- xupybd 11y ago
  Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.
Godel_unicode 11y ago
Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs. https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA)#Access https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...

by xupybd 11y ago

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

ambiate 11y ago

CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;" A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world. This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA. Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.

xupybd 11y ago
Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.

Godel_unicode 11y ago

Oh yeah. The "default password==consent" argument has not worked well. This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs. https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA)#Access https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...