4 ms·
Are there any legal implications for doing this? Was going to do something similar with Redis and MongoDB.
by heydonovan 10y ago
Are there any legal implications for doing this? Was going to do something similar with Redis and MongoDB.
- matt_wulfeck 10y agoAnonymous read access was once akin to a website. You could host a newsletter or some source code. An open FTP server doesn't necessarily mean a misconfiguration. This is not the same for something like redis or mongo. You could try and prove otherwise one day to a judge but that would be your battle and I don't suggest it.
- minxomat 10y agoIf your question is concerning US or German (/EU) law and how it affects scanning, you can drop me an email (minxomat@gmail.com) and I can give you some insights.
- deleted 10y ago[deleted]
- achillean 10y agoThis might be a useful starting point: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/ Shodan crawls for most nosql/ queueing software including mongodb and redistribution. And related to OP: we also crawl for FTP and attempt anonymous as well as a few other things to better understand FTP deployments on the Internet.
- hannob 10y agoPeople do internet-wide scans all the time, for black hat and white hat reasons. I'm not aware of anyone doing this for research purposes ever having seen any legal consequences. But you usually get some angry emails to your abuse address. Of course this doesn't mean that some court somewhere may think this is illegal. But it's a common and widespread practice.
- djhworld 10y agoI'm wondering where the legal boundary lies though, port scanning might be a grey area but mostly fine. Connecting to an FTP service (i.e. logging in), even just for 5 or so seconds....I'm not so sure. Especially when big companies with lax security and aggressive lawyers might see this is as a "hacking attempt"
- colejohnson66 10y agoThe law (in the US) pretty much defines hacking as accessing a system you don't have authorization to access. Very vague. Even a second of access to something you don't have permission to do is illegal.