11 ms·

If something like this happens to you - where you gain unauthorized access inadvertently to something - I'd be careful. Under the CFAA you can be charged crimin

If something like this happens to you - where you gain unauthorized access inadvertently to something - I'd be careful. Under the CFAA you can be charged criminally and the penalties are severe. So for example, if the OP was to casually drop a few photos the camera took and a badly worded warning in their mailbox trying to help, the 'victim' could report it to the police and an inexperienced DA might try to bag their first cyber prosecution. I'd definitely not contact the customer. Contact the vendor instead with an email and immediately remove your own access to the system. That way you have it on record (the email) and mention in the email you immediately revoked your own access. The CFAA is a blunt and clumsy instrument that tends to injure bystanders. Here's an extract from the CFAA: Whoever having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

sandworm101 10y ago
That;s the wrong part of the CFAA. I doubt the CFAA even applies. >..accessed a computer without authorization... AND having obtained information .... determined ... to require protection against ... disclosure for reasons of national defense ... [AND]... willfully communicates ... to any person not entitled to receive it... Unless in the control room of a nuclear power plant, that part doesn't criminalize taking a pic via someone else's webcam.
- downandout 10y ago
  The CFAA applies here. His right to access the cloud service legally expired the moment he returned the camera. I wouldn't want to see such a prosecution, but there is almost no question that he has technically violated the CFAA by accessing the cloud service after his right to access it was legally terminated.
  - tmptmp 10y ago
    Why did the cloud provider not revoke his access once his account was expired? Is not the cloud provider also guilty here?
    - y4mi 10y ago
      an employee is afaik also liable if he deletes customer data after he's been let go but his credentials hadn't been revoked yet. shouldn't that be essentially the same thing?
      - EdHominem 10y ago
        No, because accidentally loading the page at a cached URL that just happens to show you something sensitive takes no intent. Logging into work to delete data to hurt them shows malicious intent. But in today's legal climate, both people are dirty hackers despite neither actually performing any hacking.
    - ggggtez 10y ago
      Nope. Being insecure isn't a crime.
    - downandout 10y ago
      Under the CFAA, the burden isn't on the service provider to block access. They can be as incompetent as they'd like. It's up to the person accessing the service to not exceed their access rights - and in this case he had no access rights. Simply put, the guy that bought the cameras acquired access rights to the view the camera stream through the cloud service with his purchase. When he returned them, those rights expired. By logging back into the service and viewing the stream from cameras he knew he had returned, he exceeded his access rights.
tptacek 10y ago
Not that I'm arguing for criminal charges, but if you exploit an oversight in the design of a webcam to take pictures of someone else's house, you aren't a "bystander."
- EdHominem 10y ago
  Reloading a page isn't exploiting it though. That's normal use. With a bar that low it becomes a game of you reading the minds of the implementors. "Oh, maybe they didn't think that anyone would bookmark a URL, etc. Maybe they want me to go to page X, which may or may not link to this anymore...?" It'd be better for everyone (judges) to assume that they meant to make the service entirely unprotected. Then innocent page-reloaders wouldn't go to jail and people could sue the company for their marketing lies, etc.
  - tptacek 10y ago
    Since CFAA defines no strict-liability crimes, simply reloading a page is extraordinarily unlikely to get you charged.
    - EdHominem 10y ago
      That's gamed though. It's supposed to be criminal intent but prosecutors routinely bend it to be intent to perform any action during which a crime may have happened. (I did not intend to trespass on your land, though of course I did intend to go for the walk in the first place...) I can intentionally call your documents department and "guess a URL" without breaking the law, but if I do it on your webserver that same legal intent is turned around and used a proof of criminality. Leaving me with guessing "well, there's a document there in the public folder but maybe they don't want me to see it." Of course, this is all about malicious and inconsistent prosecution. For you and I it's a theoretical game, but Weev could go back to jail for relying on convention to guess that index.html is public. We need an actual technological bar otherwise our security industry becomes an ass-covering exercise.
      - 10y ago
brink 10y ago
> The CFAA is a blunt and clumsy instrument that tends to injure bystanders. I feel you. It's because of 1984's CFAA law that I was thrown in jail with a felony charge for rick-rolling my school.
- felipellrocha 10y ago
  Uuuuh. Could you add more details to this story?
  - brink 10y ago
    Long story short - used a rainbow table against the Windows XP SAM file to get the password that they used globally - including the login credentials for modifying the content in their CMS for their website. As a joke, we threw Rick Astley up on the main page. The next day, they brought the site down, scoured the logs for my IP address and pressed felony charges against me (Made possible by the CFAA). It's all good now though, after a lot of explaining the judge eventually dropped the case.
    - ceejayoz 10y ago
      Sending someone a link that turns out to go to Rick Astley is rick-rolling. Cracking a password, accessing a CMS, and defacing a site is slightly more than just "rick-rolling my school". Yes, it probably should have resulted in a suspension, not a felony charge. No, it's not as benign as you implied.
      - roywiggins 10y ago
        I escalated access to my school district's webserver and accidentally took it down. For some reason I was trying to close the hole I had used; instead, I default denied all access. Whoops. I explained what happened to a teacher, he called in the IT group, my change was reverted and nothing was ever spoken about it again. I also hacked the online grade review site, which was trivially hackable (javascript password protection, wtf), told a teacher, nothing happened to fix it (or to damage me) and I dropped the issue. Both of those were done in attempt to be altruistic but technically both were completely illegal. Since no administrator ever found out, no cops were ever called and no prosecutorial discretion was in play, but I wouldn't want to bet I'd have been "let off", which is sort of terrifying.
zaroth 10y ago
If a cloud provider mistakenly provides access to someone else's content, the end-user has not violated the CFAA. I have not heard of anyone charged for this alone. Not to mention, I'm not sure CFAA protects private computers / webcams in any case, only "protected computers". Additionally, I'm not sure if this would be a violation of the Wiretap Act as an "interception" either, even if it was intentionally used to spy on the new owner of the device. Federal law is somewhat lacking in this regard.

sandworm101 10y ago

That;s the wrong part of the CFAA. I doubt the CFAA even applies. >..accessed a computer without authorization... AND having obtained information .... determined ... to require protection against ... disclosure for reasons of national defense ... [AND]... willfully communicates ... to any person not entitled to receive it... Unless in the control room of a nuclear power plant, that part doesn't criminalize taking a pic via someone else's webcam.

downandout 10y ago
The CFAA applies here. His right to access the cloud service legally expired the moment he returned the camera. I wouldn't want to see such a prosecution, but there is almost no question that he has technically violated the CFAA by accessing the cloud service after his right to access it was legally terminated.
- tmptmp 10y ago
  Why did the cloud provider not revoke his access once his account was expired? Is not the cloud provider also guilty here?
  - y4mi 10y ago
    an employee is afaik also liable if he deletes customer data after he's been let go but his credentials hadn't been revoked yet. shouldn't that be essentially the same thing?
    - EdHominem 10y ago
      No, because accidentally loading the page at a cached URL that just happens to show you something sensitive takes no intent. Logging into work to delete data to hurt them shows malicious intent. But in today's legal climate, both people are dirty hackers despite neither actually performing any hacking.
  - ggggtez 10y ago
    Nope. Being insecure isn't a crime.
  - downandout 10y ago
    Under the CFAA, the burden isn't on the service provider to block access. They can be as incompetent as they'd like. It's up to the person accessing the service to not exceed their access rights - and in this case he had no access rights. Simply put, the guy that bought the cameras acquired access rights to the view the camera stream through the cloud service with his purchase. When he returned them, those rights expired. By logging back into the service and viewing the stream from cameras he knew he had returned, he exceeded his access rights.

tptacek 10y ago

Not that I'm arguing for criminal charges, but if you exploit an oversight in the design of a webcam to take pictures of someone else's house, you aren't a "bystander."

EdHominem 10y ago
Reloading a page isn't exploiting it though. That's normal use. With a bar that low it becomes a game of you reading the minds of the implementors. "Oh, maybe they didn't think that anyone would bookmark a URL, etc. Maybe they want me to go to page X, which may or may not link to this anymore...?" It'd be better for everyone (judges) to assume that they meant to make the service entirely unprotected. Then innocent page-reloaders wouldn't go to jail and people could sue the company for their marketing lies, etc.
- tptacek 10y ago
  Since CFAA defines no strict-liability crimes, simply reloading a page is extraordinarily unlikely to get you charged.
  - EdHominem 10y ago
    That's gamed though. It's supposed to be criminal intent but prosecutors routinely bend it to be intent to perform any action during which a crime may have happened. (I did not intend to trespass on your land, though of course I did intend to go for the walk in the first place...) I can intentionally call your documents department and "guess a URL" without breaking the law, but if I do it on your webserver that same legal intent is turned around and used a proof of criminality. Leaving me with guessing "well, there's a document there in the public folder but maybe they don't want me to see it." Of course, this is all about malicious and inconsistent prosecution. For you and I it's a theoretical game, but Weev could go back to jail for relying on convention to guess that index.html is public. We need an actual technological bar otherwise our security industry becomes an ass-covering exercise.
    - 10y ago

brink 10y ago

> The CFAA is a blunt and clumsy instrument that tends to injure bystanders. I feel you. It's because of 1984's CFAA law that I was thrown in jail with a felony charge for rick-rolling my school.

felipellrocha 10y ago
Uuuuh. Could you add more details to this story?
- brink 10y ago
  Long story short - used a rainbow table against the Windows XP SAM file to get the password that they used globally - including the login credentials for modifying the content in their CMS for their website. As a joke, we threw Rick Astley up on the main page. The next day, they brought the site down, scoured the logs for my IP address and pressed felony charges against me (Made possible by the CFAA). It's all good now though, after a lot of explaining the judge eventually dropped the case.
  - ceejayoz 10y ago
    Sending someone a link that turns out to go to Rick Astley is rick-rolling. Cracking a password, accessing a CMS, and defacing a site is slightly more than just "rick-rolling my school". Yes, it probably should have resulted in a suspension, not a felony charge. No, it's not as benign as you implied.
    - roywiggins 10y ago
      I escalated access to my school district's webserver and accidentally took it down. For some reason I was trying to close the hole I had used; instead, I default denied all access. Whoops. I explained what happened to a teacher, he called in the IT group, my change was reverted and nothing was ever spoken about it again. I also hacked the online grade review site, which was trivially hackable (javascript password protection, wtf), told a teacher, nothing happened to fix it (or to damage me) and I dropped the issue. Both of those were done in attempt to be altruistic but technically both were completely illegal. Since no administrator ever found out, no cops were ever called and no prosecutorial discretion was in play, but I wouldn't want to bet I'd have been "let off", which is sort of terrifying.

zaroth 10y ago

If a cloud provider mistakenly provides access to someone else's content, the end-user has not violated the CFAA. I have not heard of anyone charged for this alone. Not to mention, I'm not sure CFAA protects private computers / webcams in any case, only "protected computers". Additionally, I'm not sure if this would be a violation of the Wiretap Act as an "interception" either, even if it was intentionally used to spy on the new owner of the device. Federal law is somewhat lacking in this regard.