4 ms·

sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products

sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.

watwut 8y ago
Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.
- who-knows95 8y ago
  the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
  - watwut 8y ago
    They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
    - who-knows95 8y ago
      "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
      - isostatic 8y ago
        > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
        who-knows95 8y ago
        if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.

sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.

watwut 8y ago

Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.

who-knows95 8y ago
the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
- watwut 8y ago
  They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
  - who-knows95 8y ago
    "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
    - isostatic 8y ago
      > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
      - who-knows95 8y ago
        if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.