3 ms·

Totally just curious. The law for "exceeds authorized access" is 20 years in prison. I think uber has a bug fixing program. Maybe sendgrid does? Do the DNS

Totally just curious. The law for "exceeds authorized access" is 20 years in prison. I think uber has a bug fixing program. Maybe sendgrid does? Do the DNS carriers? Does his ISP? I read the law. If one of these companies refutes access - this guy is facing 20 years [1]? W(why)TF do people do this? The US government is notoriously creative in these prosecutions [3]. Companies refute access all the time to not look like idiots EVEN WITH a bounty program. [2]. If I came across this I wouldn't be blogging about it for 10k? [1] "(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—(C) information from any protected computer;" (C) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 20 years, or both, in the case of—" https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [2] http://motherboard.vice.com/blog/facebook-is-refusing-to-pay-a-bug-bounty-to-the-researcher-who-hacked-zuck http://motherboard.vice.com/blog/facebook-is-refusing-to-pay... [3] https://en.wikipedia.org/wiki/Aaron_Swartz https://en.wikipedia.org/wiki/Aaron_Swartz

tyingq 10y ago
Uber's bug bounty program seems like explicit permission to me. The twist here, as you mention, is that it is sendgrid's infrastructure. Chasing bug bounties does seem a bit risky in this "cloud" era where it's not just one entity running the targeted service.
- beejiu 10y ago
  It is not listed as an in-scope domain on Uber's bug bounty policy. You would have to argue that the access was unintentional - that you believed you had authorization to access the server from Uber and that Uber had the ability to assign that authorization on behalf of SendGrid.
  - tyingq 10y ago
    That is a bit tricky. You could argue that the MX records for a domain that is "in scope" (www.uber.com) are in play. They don't specifically say you can only follow CNAME and A records...and you do have to follow CNAME for some of the listed domains.
    - otakucode 10y ago
      Unfortunately, the law simply does not care about technical details. If you were being prosecuted for this sort of thing and you brought and expert witness or testified yourself about a technical justification such as this, you would be accused of attempting to bamboozle the court with fancy technical wording and it would not go well for you. You might even get found to be in contempt of court. Even the very simple fact that 1% of DNA tests have been shown to be false due to sample contamination and other factors is not permitted to be mentioned in court when DNA matches are being used to prosecute someone as this is too technical. Cases which involve computers fare even worse.
      - tyingq 10y ago
        I'm sure a lawyer would find some non technical analogy to help explain the concept. It isn't a trick...Some of the approved domains have no IP addresses directly associated with them. You have to traverse a reference to another domain name, not on the list, to get to an actual IP address. Now if that traversal is by something called a CNAME or something called an MX, does it matter?
  - uraniumhacker 10y ago
    The scope of Uber's bug bounty program was updated after this report was submitted so that does not count.
bboreham 10y ago
Author appears to be in Nepal, which has no extradition treaty with the USA.

tyingq 10y ago

Uber's bug bounty program seems like explicit permission to me. The twist here, as you mention, is that it is sendgrid's infrastructure. Chasing bug bounties does seem a bit risky in this "cloud" era where it's not just one entity running the targeted service.

beejiu 10y ago
It is not listed as an in-scope domain on Uber's bug bounty policy. You would have to argue that the access was unintentional - that you believed you had authorization to access the server from Uber and that Uber had the ability to assign that authorization on behalf of SendGrid.
- tyingq 10y ago
  That is a bit tricky. You could argue that the MX records for a domain that is "in scope" (www.uber.com) are in play. They don't specifically say you can only follow CNAME and A records...and you do have to follow CNAME for some of the listed domains.
  - otakucode 10y ago
    Unfortunately, the law simply does not care about technical details. If you were being prosecuted for this sort of thing and you brought and expert witness or testified yourself about a technical justification such as this, you would be accused of attempting to bamboozle the court with fancy technical wording and it would not go well for you. You might even get found to be in contempt of court. Even the very simple fact that 1% of DNA tests have been shown to be false due to sample contamination and other factors is not permitted to be mentioned in court when DNA matches are being used to prosecute someone as this is too technical. Cases which involve computers fare even worse.
    - tyingq 10y ago
      I'm sure a lawyer would find some non technical analogy to help explain the concept. It isn't a trick...Some of the approved domains have no IP addresses directly associated with them. You have to traverse a reference to another domain name, not on the list, to get to an actual IP address. Now if that traversal is by something called a CNAME or something called an MX, does it matter?
- uraniumhacker 10y ago
  The scope of Uber's bug bounty program was updated after this report was submitted so that does not count.

bboreham 10y ago

Author appears to be in Nepal, which has no extradition treaty with the USA.