4 ms·
I have a half off topic question: how are you doing this in light of the CFAA and what happened to Aaron? I truly wonder.
by chx 8y ago
I have a half off topic question: how are you doing this in light of the CFAA and what happened to Aaron? I truly wonder.
- bendd 8y agoWhy would he, (neo), have any target from the law on his back? He wasn't sharing or selling the information. LocationSmart should be the ones getting fucked.
- txcwpalpha 8y agoUnder the ridiculously broad scope of the CFAA, that doesn't matter. The CFAA can be (and has been) twisted to prosecute people that do anything to a computer system that they do not own if the system owner could even remotely perceive said action as harmful. It's been used in the past to prosecute security researchers for accessing publicly available websites because the website owners claimed that they weren't "meant" to be public, they were only publicly accessible to make it easier for the actually "authorized" people to access them. Even doing something like an nmap or a simple ping against a server that you're "not supposed to" could put a target on your back from an overzealous prosecutor. See https://www.theguardian.com/technology/2014/may/29/us-cybercrime-laws-security-researchers https://www.theguardian.com/technology/2014/may/29/us-cyberc...
- chatmasta 8y agoIf we want to be really pedantic here, didn’t LocationSmart violate the CFAA? Their system queried the location of users’ devices without their consent. Does tower triangulation count as accessing the device?
- roywiggins 8y agoI believe the flow of info goes: phone--carrier--LocationSmart. The carrier determines the location of the phone because it's a cell phone. The Carrier provides the information to LocationSmart. There's no querying of the devices by LocationSmart per se.
- codedokode 8y agoTelecoms, not LocationSmart, are to blame here. They made an API providing access to location information without any supervision.
- nneonneo 8y agoI discovered the bug yesterday, followed responsible disclosure with US CERT (based at CMU, so we got things moving very quickly there), and the bug is now fixed. If the CFAA bars legitimate security research like this, then we would all be truly fucked.
- apetresc 8y agoWait, yesterday? And the fix is already deployed to production today? That's either some truly impressive engineering from a company that made a freshman-year-level security mistake, or whatever patch they put in place to fix this is just as leaky as the original bugged version and it's just a matter of time.
- gowld 8y agoTheory: Devops disabled the security flag on the JSON API, in order to perform integration tests, then didn't enabled it until reminded.
- zodPod 8y agoThis for sure! My theory has also been that it's possible they literally just needed to add "if (subscriptionApproved) {" to the top. Not exactly a ton of code!
- nneonneo 8y agoThey just killed the try page entirely. It's now a redirect to the home page. Hopefully they don’t try to bring that page back up without fixing all the bugs...
- tptacek 8y agoCFAA probably does bar research like this; your right to test something for security flaws technically ends where someone else's server hardware begins. In reality, the optics of this vulnerability are so bad that you are vanishingly unlikely to take any legal shit for it. But be careful extrapolating from it. If you have questions about the legality of this kind of testing (and you should): consult a lawyer. Small price to pay. It's a good find. Congrats.