6 ms·

In 2008, in Poland, a guy was accused of breaking past security of a computer system, by putting "' or 1=1" in an input field of a website. He was acquitted, an

by jwilk 9y ago

In 2008, in Poland, a guy was accused of breaking past security of a computer system, by putting "' or 1=1" in an input field of a website. He was acquitted, and the court famously stated that "you can't break past something that doesn't exist".¹ Ideally, this kind of logic should work in other countries; but I'm not very optimistic. ¹ http://prawo.vagla.pl/node/8154 http://prawo.vagla.pl/node/8154 (in Polish, sorry!)

scarmig 9y ago
That makes for a good soundbite, but it's not actually useful. You could say that about any exploit: if you get past security using it, security didn't exist, but you're still potentially doing something worth criminalizing. I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial.
- sverige 9y ago
  > You could say that about any exploit: if you get past security using it, security didn't exist, but you're still potentially doing something worth criminalizing. Criminalizing the act of exploiting someone's shitty security reminds me of how banks transfer the responsibility for their failure to properly vet the identity of someone they loan money to by calling it "identity theft." If you design a website that solicits people to submit personally identifiable information, you should be the one held accountable when that information is vulnerable, and especially when it is utterly trivial to access it (such as in this case).
  - scarmig 9y ago
    There can be multiple parties responsible. If someone steals a bunch of Social Security numbers using SQLI on an insecure website and sells them on the black market, should the intruder be held criminally responsible? Yes, in my book. That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage.
    - bb88 9y ago
      > That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. The minimum companies need to do is notify the affected consumers. I think we can all agree on this. > Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage. From a market perspective, as long as PII has intrinsic black-market value, people will want it. The government could tax the amount of PII a company might store, say, but the black-market wouldn't pay the tax, anyway. Removing value from PII would mean removing convenience for the sake of security. So I can't get loans/credit card applications online anymore, etc.
  - dogma1138 9y ago
    Does the quality of the locks on your doors should mandate the severity of the crime if some one breaks in?
    - StanislavPetrov 9y ago
      If you are storing the property of others behind your door and you fail to properly secure the door you bear responsibility for that negligence aside and apart from the guilt of the thief.
      - dpwm 9y ago
        Right. I have an analogy I prefer in many of the cases where there is a clear smell of gross negligence, which does seem to be most. Consider if a bank that takes safety deposits has accidentally given open access to their vault to the street and none of their employees or customers seem to have noticed. You will get people oblivious, you'd imagine you'd get thieves in there, but you may get people just poking their head in in sheer wonder. Then you're going to get people who are slightly more curious as to how this bewilderment came to be. I have been that latter person on two occasions. Once when a friend was restoring an e-commerce site from a backup (including customer details) and didn't initially see what was wrong with the backup being publicly accessible until I pointed out there was a link to it where the home page might once have been. The second involved a university network outsourced to a multinational engineering firm; a DHCP server; Windows Vista's DHCP client; the DHCP broadcast bit and a power outage. I can't remember the specifics but I realised that I could restore connectivity to people who had mysteriously lost it by responding to their DHCP requests after relaying them to the real DHCP server and repeating the response as a broadcast. I was naturally cautious and gained permission from the laptop owners. I only realised the implications of what I could have done to everybody affected on the network after the fact. If anybody ever wants a real-world example of how a MITM attack can be carried out by somebody other than a network admin, consider what would happen if your DHCP server didn't respond in the expected way and the client was waiting for a broadcast. It is only recently that I realise how exposed I was. I had no ill intent, but was merely seeking a better understanding of the world as opportunities arose. The latter experience is deeply important on a personal level as it turned coding from something vaguely interesting but too difficult to do anything useful into something more like a microscope, telescope or oscilloscope to me. The problem is that intent is hard to measure. In the mock trial that plays out in my head from time to time, was I poking my head around or casing the joint? I believe that the evidence could have pointed to either.
  - currymj 9y ago
    at the same time, it's possible for the website to do absolutely everything right and still lose a lot of information. one reasonable solution is just to say tough luck, it's still your fault, and then every company dealing with sensitive information buys data-breach insurance, with the insurance company helping to vet and improve their systems and processes if they want. this arrangement is pretty common and i could imagine it becoming legally mandatory. even if there's a real unavoidable zero day, still hold the company liable, make them use their insurance, and then let the insurance company sue whoever is really at fault to recover their losses.
  - dTal 9y ago
    >Criminalizing the act of exploiting someone's shitty security reminds me of how banks transfer the responsibility for their failure to properly vet the identity of someone they loan money to by calling it "identity theft." Mitchell and Webb did a great sketch calling out exactly this: https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY "Sounds a bit more like a bank robbery..."
- gerdesj 9y ago
  "but you're still potentially doing something worth criminalizing." I had a bit of a think about this. We have an input field, something that invites anything that one might type into it. The input field might constrain what is typed in and the programme behind it might decide to believe the content or not. Does the input field make it clear that it considers some sorts of input as invalid? I can't recall seeing any login related field that specified its input requirements - that is sometimes part of the "security"(through obscurity) of such things. IT related security as it relates to logins might be unfairly compared to a front door and keys and other physical security devices. However, few of us have access to enough steel and concrete and other fancy materials for physical security to make this comparison stand. We do have access to wealth of IT security which is freely available. It is bloody complicated but freely available. You do need to be able to sift the good advice from the bad but it is available. The final bit of the puzzle revolves around responsible disclosure. This is not something you see in the world of safes and front doors. It is an established industry practice in IT, in an industry that is very, very young but one which moves very, very quickly. Even if the login fields specify that unauth. access is naughty I would argue that given that the tools are freely available and that any reasonably competent developer should be able to sanitise input, then you can't complain if someone types in complete crap. IT is still discovering Engineering but it has so many more resources for instruction and guidance than bridge builders and boiler makers had in the early days and it moves so fast. Do you have any idea how dangerous steam trains were in the early days? Steam is a bloody powerful thing under pressure. Do you have any idea about resonance and concrete cancer? IT is still having its Tacoma Narrows and ... hah ... Millenium Bridge (hard found lessons can be ignored to this day) things happen. I'm no lawyer but I suspect the world of m'learned friends will catch up eventually. Until then we will read of silliness like this.
  - the8472 9y ago
    To play the pointy-haired advocate: However, few of us have access to enough engineers and security experts and other fancy computer wizards for digital security to make this comparison not stand. We do have access to the legal system which is freely available.
    - 9y ago
- pixelbash 9y ago
  > I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial. This would also very useful for more generalised whistle-blowing too..
zokier 9y ago
For general SQL injection attacks I can kinda buy the idea "you can't break past something that doesn't exist", but in this case specifically the SQL injection was used to break a login form. The login form definitely both existed and is something I'd consider security measure. A contrived analogy, but it feels like acquitting a burglar because instead of picking the lock he just smashed the door in.
- gitgud 9y ago
  A better analogy could be he was going to pick the lock and found the door wasn't even closed. In either case, the intent of the individual was obviously to get into the system without their knowledge. Which sadly means they have the right to prosecute him in most legal systems. Would he have been better off asking them first?
  - lamontcg 9y ago
    If my door is open that isn't an invitation for you to come and sit down on my couch and start watching the football game...
    - gitgud 9y ago
      I like this, but imagine the door is open and you call out and nobody is home. Is it wrong to walk through the door and investigate this concerning situation? Even without an explicit invitation? Either way, if the intent of the individual is malicious then a judge would most likely rule against them.
lamontcg 9y ago
Your house and car locks are likely easily picked so anyone breaking into your car or home likewise shouldn't be found guilty of anything. All that security theater is fictitious so therefore laws against violating it shouldn't have any basis.

by jwilk 9y ago

scarmig 9y ago

That makes for a good soundbite, but it's not actually useful. You could say that about any exploit: if you get past security using it, security didn't exist, but you're still potentially doing something worth criminalizing. I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial.

sverige 9y ago
> You could say that about any exploit: if you get past security using it, security didn't exist, but you're still potentially doing something worth criminalizing. Criminalizing the act of exploiting someone's shitty security reminds me of how banks transfer the responsibility for their failure to properly vet the identity of someone they loan money to by calling it "identity theft." If you design a website that solicits people to submit personally identifiable information, you should be the one held accountable when that information is vulnerable, and especially when it is utterly trivial to access it (such as in this case).
- scarmig 9y ago
  There can be multiple parties responsible. If someone steals a bunch of Social Security numbers using SQLI on an insecure website and sells them on the black market, should the intruder be held criminally responsible? Yes, in my book. That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage.
  - bb88 9y ago
    > That's entirely on top of the website operator. There should be some liability there, IMO, but it's unclear to me how much. The minimum companies need to do is notify the affected consumers. I think we can all agree on this. > Though I wouldn't mind a world where all personal data is viewed like a form of radioactive waste to be avoided at all costs, it's not obvious that that's what our legal system should encourage. From a market perspective, as long as PII has intrinsic black-market value, people will want it. The government could tax the amount of PII a company might store, say, but the black-market wouldn't pay the tax, anyway. Removing value from PII would mean removing convenience for the sake of security. So I can't get loans/credit card applications online anymore, etc.
- dogma1138 9y ago
  Does the quality of the locks on your doors should mandate the severity of the crime if some one breaks in?
  - StanislavPetrov 9y ago
    If you are storing the property of others behind your door and you fail to properly secure the door you bear responsibility for that negligence aside and apart from the guilt of the thief.
    - dpwm 9y ago
      Right. I have an analogy I prefer in many of the cases where there is a clear smell of gross negligence, which does seem to be most. Consider if a bank that takes safety deposits has accidentally given open access to their vault to the street and none of their employees or customers seem to have noticed. You will get people oblivious, you'd imagine you'd get thieves in there, but you may get people just poking their head in in sheer wonder. Then you're going to get people who are slightly more curious as to how this bewilderment came to be. I have been that latter person on two occasions. Once when a friend was restoring an e-commerce site from a backup (including customer details) and didn't initially see what was wrong with the backup being publicly accessible until I pointed out there was a link to it where the home page might once have been. The second involved a university network outsourced to a multinational engineering firm; a DHCP server; Windows Vista's DHCP client; the DHCP broadcast bit and a power outage. I can't remember the specifics but I realised that I could restore connectivity to people who had mysteriously lost it by responding to their DHCP requests after relaying them to the real DHCP server and repeating the response as a broadcast. I was naturally cautious and gained permission from the laptop owners. I only realised the implications of what I could have done to everybody affected on the network after the fact. If anybody ever wants a real-world example of how a MITM attack can be carried out by somebody other than a network admin, consider what would happen if your DHCP server didn't respond in the expected way and the client was waiting for a broadcast. It is only recently that I realise how exposed I was. I had no ill intent, but was merely seeking a better understanding of the world as opportunities arose. The latter experience is deeply important on a personal level as it turned coding from something vaguely interesting but too difficult to do anything useful into something more like a microscope, telescope or oscilloscope to me. The problem is that intent is hard to measure. In the mock trial that plays out in my head from time to time, was I poking my head around or casing the joint? I believe that the evidence could have pointed to either.
- currymj 9y ago
  at the same time, it's possible for the website to do absolutely everything right and still lose a lot of information. one reasonable solution is just to say tough luck, it's still your fault, and then every company dealing with sensitive information buys data-breach insurance, with the insurance company helping to vet and improve their systems and processes if they want. this arrangement is pretty common and i could imagine it becoming legally mandatory. even if there's a real unavoidable zero day, still hold the company liable, make them use their insurance, and then let the insurance company sue whoever is really at fault to recover their losses.
- dTal 9y ago
  >Criminalizing the act of exploiting someone's shitty security reminds me of how banks transfer the responsibility for their failure to properly vet the identity of someone they loan money to by calling it "identity theft." Mitchell and Webb did a great sketch calling out exactly this: https://www.youtube.com/watch?v=-c57WKxeELY https://www.youtube.com/watch?v=-c57WKxeELY "Sounds a bit more like a bank robbery..."
gerdesj 9y ago
"but you're still potentially doing something worth criminalizing." I had a bit of a think about this. We have an input field, something that invites anything that one might type into it. The input field might constrain what is typed in and the programme behind it might decide to believe the content or not. Does the input field make it clear that it considers some sorts of input as invalid? I can't recall seeing any login related field that specified its input requirements - that is sometimes part of the "security"(through obscurity) of such things. IT related security as it relates to logins might be unfairly compared to a front door and keys and other physical security devices. However, few of us have access to enough steel and concrete and other fancy materials for physical security to make this comparison stand. We do have access to wealth of IT security which is freely available. It is bloody complicated but freely available. You do need to be able to sift the good advice from the bad but it is available. The final bit of the puzzle revolves around responsible disclosure. This is not something you see in the world of safes and front doors. It is an established industry practice in IT, in an industry that is very, very young but one which moves very, very quickly. Even if the login fields specify that unauth. access is naughty I would argue that given that the tools are freely available and that any reasonably competent developer should be able to sanitise input, then you can't complain if someone types in complete crap. IT is still discovering Engineering but it has so many more resources for instruction and guidance than bridge builders and boiler makers had in the early days and it moves so fast. Do you have any idea how dangerous steam trains were in the early days? Steam is a bloody powerful thing under pressure. Do you have any idea about resonance and concrete cancer? IT is still having its Tacoma Narrows and ... hah ... Millenium Bridge (hard found lessons can be ignored to this day) things happen. I'm no lawyer but I suspect the world of m'learned friends will catch up eventually. Until then we will read of silliness like this.
- the8472 9y ago
  To play the pointy-haired advocate: However, few of us have access to enough engineers and security experts and other fancy computer wizards for digital security to make this comparison not stand. We do have access to the legal system which is freely available.
  - 9y ago
pixelbash 9y ago
> I think a better solution would be to legally protect anyone that's honestly reporting a vulnerability; make companies liable for those vulnerabilities; offer a failsafe reporting mechanism to the government in place of the company, in case they just ignore it; and guarantee that reporting a vulnerability can't ever be used against you in any kind of criminal or civil trial. This would also very useful for more generalised whistle-blowing too..

zokier 9y ago

For general SQL injection attacks I can kinda buy the idea "you can't break past something that doesn't exist", but in this case specifically the SQL injection was used to break a login form. The login form definitely both existed and is something I'd consider security measure. A contrived analogy, but it feels like acquitting a burglar because instead of picking the lock he just smashed the door in.

gitgud 9y ago
A better analogy could be he was going to pick the lock and found the door wasn't even closed. In either case, the intent of the individual was obviously to get into the system without their knowledge. Which sadly means they have the right to prosecute him in most legal systems. Would he have been better off asking them first?
- lamontcg 9y ago
  If my door is open that isn't an invitation for you to come and sit down on my couch and start watching the football game...
  - gitgud 9y ago
    I like this, but imagine the door is open and you call out and nobody is home. Is it wrong to walk through the door and investigate this concerning situation? Even without an explicit invitation? Either way, if the intent of the individual is malicious then a judge would most likely rule against them.

lamontcg 9y ago

Your house and car locks are likely easily picked so anyone breaking into your car or home likewise shouldn't be found guilty of anything. All that security theater is fictitious so therefore laws against violating it shouldn't have any basis.