4 ms·

Does anyone know if this kind of white hat stuff has been tested by law? Because it seems in the realm of possibility that if a large botnet hits you and your

by avaer 9y ago

Does anyone know if this kind of white hat stuff has been tested by law? Because it seems in the realm of possibility that if a large botnet hits you and your responses crash a bunch of computers you could do serious time for trying it. I'm hoping there's precedent against this...

ianai 9y ago
A better outcome for an infected machine is complete failure than silent intrusion. The person then definitely knows something is wrong, AV software or not.
microcolonel 9y ago
I don't think there's a law against serving obscenely large files on the web, at least nowhere except Germany.
- komali2 9y ago
  >I don't think there's a law against... Connecting to a server...( A lot) Putting random strings into forms...( A lot) Moving your money between banks... (In different countries) Buying stocks... (With insider knowledge) A simple act doesn't spell the whole story, and fraud, computer crime, etc laws are written vaguely enough for a country to prosecute someone " sending large files."
ajarmst 9y ago
He's got a pretty good defence in that all he's really doing is filtering requests and serving up a really large file to some of them. No active agency, and no executable code. If merely loading a large file crashes a computer, that's arguably the fault of the browser and/or OS.
- shakna 9y ago
  Intent really matters, especially in cases like these. He's serving up files deliberately, knowing they will likely cause problems. Microsoft doesn't take the fall for malware, even if its a fault in SMB or the like. The intent is damage.
  - ajarmst 9y ago
    That's a good point, although I think the innocuosness of the action would be at least a mitigating factor. I wouldn't expect MS to take any blame, but the "damage" being due to faults in the OS or browser would also be mitigating---a minor rearend collision on a Ford Pinto could cause it to explode because of a design flaw, but the driver of the other car wouldn't be charged with arson. (Afterthought: he might be if he rammed it deliberately, so I guess that supports your thesis rather than mine)
  - deleted 9y ago
    [deleted]
  - ajarmst 9y ago
    Probably his best defence is the fact that it's really unlikely that the attackers would ever swear a complaint or testify. Kind of a "robbing drug dealers problem". I'd be more worried about being targeted by a massive DDOS.
    - colechristensen 9y ago
      What if their intent is to find things to sue for?
      - hobs 9y ago
        They have a term for that, its "vexatious litigant." If you do this enough, the court generally makes it hard to get counsel, will make you get your lawsuits approved by a judge ahead of time, and more.
        0xfeba 9y ago
        eg. Jack Thompson
  - jfoutz 9y ago
    They're probably already committing a felony accessing the computer. The scan is an intent to transmit malware. If that's true, you could make a pretty good fleeing felon argument.
vbezhenar 9y ago
There are laws allowing person to shoot intruder in their house. And I can't serve nulls from my own web server? That would be ridiculous.
- blunte 9y ago
  Do you have an NRA?
- test1235 9y ago
  From what I've read, in some parts of America it seems okay to shoot at intruders running away from your house, which I find unreasonable. A farmer here in UK stirred up a whole load of shit when he shot two burglars [1] trying to escape from his property. [1] https://en.wikipedia.org/wiki/Tony_Martin_(farmer) https://en.wikipedia.org/wiki/Tony_Martin_(farmer)
  - rmc 9y ago
    The UK (or English?) law about self defence is "back to the wall", i.e. you can invoke leathal force to defend your own life when your back is against the wall, when you have no other option, and no way to escape. In other words, if you can retreat from the situation, then you must retreat. Some places in the USA have "stand your ground" laws. These say you aren't required to retreat, that you can "stand your ground", that you can use (legally) leathal force without requiring that your back is against the wall.
    - rocqua 9y ago
      As I recall, stand your ground laws, based on castle doctrine, means that "but you could have fled your own home" does not invalidate self-defence. I think you are still required to retreat when on the street. As for people running away, the only way I see self defence working is when they still pose an 'imminent threat to life' which seems rather hard to argue.
      - test1235 9y ago

by avaer 9y ago

ianai 9y ago

A better outcome for an infected machine is complete failure than silent intrusion. The person then definitely knows something is wrong, AV software or not.

microcolonel 9y ago

I don't think there's a law against serving obscenely large files on the web, at least nowhere except Germany.

komali2 9y ago
>I don't think there's a law against... Connecting to a server...( A lot) Putting random strings into forms...( A lot) Moving your money between banks... (In different countries) Buying stocks... (With insider knowledge) A simple act doesn't spell the whole story, and fraud, computer crime, etc laws are written vaguely enough for a country to prosecute someone " sending large files."

ajarmst 9y ago

He's got a pretty good defence in that all he's really doing is filtering requests and serving up a really large file to some of them. No active agency, and no executable code. If merely loading a large file crashes a computer, that's arguably the fault of the browser and/or OS.

shakna 9y ago
Intent really matters, especially in cases like these. He's serving up files deliberately, knowing they will likely cause problems. Microsoft doesn't take the fall for malware, even if its a fault in SMB or the like. The intent is damage.
- ajarmst 9y ago
  That's a good point, although I think the innocuosness of the action would be at least a mitigating factor. I wouldn't expect MS to take any blame, but the "damage" being due to faults in the OS or browser would also be mitigating---a minor rearend collision on a Ford Pinto could cause it to explode because of a design flaw, but the driver of the other car wouldn't be charged with arson. (Afterthought: he might be if he rammed it deliberately, so I guess that supports your thesis rather than mine)
- deleted 9y ago
  [deleted]
- ajarmst 9y ago
  Probably his best defence is the fact that it's really unlikely that the attackers would ever swear a complaint or testify. Kind of a "robbing drug dealers problem". I'd be more worried about being targeted by a massive DDOS.
  - colechristensen 9y ago
    What if their intent is to find things to sue for?
    - hobs 9y ago
      They have a term for that, its "vexatious litigant." If you do this enough, the court generally makes it hard to get counsel, will make you get your lawsuits approved by a judge ahead of time, and more.
      - 0xfeba 9y ago
        eg. Jack Thompson
- jfoutz 9y ago
  They're probably already committing a felony accessing the computer. The scan is an intent to transmit malware. If that's true, you could make a pretty good fleeing felon argument.

vbezhenar 9y ago

There are laws allowing person to shoot intruder in their house. And I can't serve nulls from my own web server? That would be ridiculous.

blunte 9y ago
Do you have an NRA?
test1235 9y ago
From what I've read, in some parts of America it seems okay to shoot at intruders running away from your house, which I find unreasonable. A farmer here in UK stirred up a whole load of shit when he shot two burglars [1] trying to escape from his property. [1] https://en.wikipedia.org/wiki/Tony_Martin_(farmer) https://en.wikipedia.org/wiki/Tony_Martin_(farmer)
- rmc 9y ago
  The UK (or English?) law about self defence is "back to the wall", i.e. you can invoke leathal force to defend your own life when your back is against the wall, when you have no other option, and no way to escape. In other words, if you can retreat from the situation, then you must retreat. Some places in the USA have "stand your ground" laws. These say you aren't required to retreat, that you can "stand your ground", that you can use (legally) leathal force without requiring that your back is against the wall.
  - rocqua 9y ago
    As I recall, stand your ground laws, based on castle doctrine, means that "but you could have fled your own home" does not invalidate self-defence. I think you are still required to retreat when on the street. As for people running away, the only way I see self defence working is when they still pose an 'imminent threat to life' which seems rather hard to argue.
    - test1235 9y ago