3 ms·

"I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veraco

"I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.

isostatic 8y ago
> point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
- who-knows95 8y ago
  if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.
watwut 8y ago
1.)The laws are certainly structured the way this is illegal. If in USA, unauthorised access and tampering as even quite extreme possible punishments. World is full of easy to exploit security bugs are everywhere around and that changes nothing on anything. The only exceptional thing is popularity. Bug hunters work with prior agreement, they don't access devices owned by third parties without it. When they do they anonymize and hisr themselves. They do indeed fear legal and go through steps to protect themselves. They complain about these processes like all the time. 2.) Dude, the hacker giraffe wrote that he had anxiety attacks due to his activities even before all this. He also wrote he could not sleep due to persistent fear that every noise is swat team knocking. He wrote that he won't touch computer and will seek job without them. I am sceptical about feasibility of the last one. I don't know whether youtuber is good or bad person. He is definitely irresponsible when he encourages teenagers to do what giraffe did. Giraffe did everyone good service writing that letter, so really go read it. It might be fun and games for PewDiePie, but is not for giraffe. So let's hope he won't get caught affecting him even more, that his past activities are not too bad and that he learns from experience. 3.) This is exactly what compelled me to answer. These things have very real serious consequences, but due to the way we talk about it people don't realize until is too late. Go lob for change of laws, but don't say they don't exist to kids who might believe you.
- who-knows95 8y ago
  1.) so you quote both the Serious Crime Act 2007 and the Computer Misuse Act 1990. both of these are UK laws, and don't apply to giraffe, as he's from the Midwest USA. he wasn't bug hunting? he was showing users they are exposed to the internet so they could fix it! 2.) yes, i don't blame him, what was meant to be a harmless exercise in google scanning, has lead to people throwing death threats at him, and threatening law suits. he didn't encourage any reckless actions, i see Felix as quite a rational guy. i have read the chromecast hack, and the printer one, have you? i doubt he will, and if he does a simple defence could be made to fight for his case in court. 3.) i don't know if you are talking about me or felix? i doubt felix has a firm grasp on computer hacking law, but like i said he didn't tell them to do that, in fact he's stayed at arms length. the actions giraffe took don't fall foul of the UK law, idk about american. i'm pretty much done with this exchange, and who ever has been down-voting my comments.

isostatic 8y ago

> point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.

who-knows95 8y ago
if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.

watwut 8y ago

1.)The laws are certainly structured the way this is illegal. If in USA, unauthorised access and tampering as even quite extreme possible punishments. World is full of easy to exploit security bugs are everywhere around and that changes nothing on anything. The only exceptional thing is popularity. Bug hunters work with prior agreement, they don't access devices owned by third parties without it. When they do they anonymize and hisr themselves. They do indeed fear legal and go through steps to protect themselves. They complain about these processes like all the time. 2.) Dude, the hacker giraffe wrote that he had anxiety attacks due to his activities even before all this. He also wrote he could not sleep due to persistent fear that every noise is swat team knocking. He wrote that he won't touch computer and will seek job without them. I am sceptical about feasibility of the last one. I don't know whether youtuber is good or bad person. He is definitely irresponsible when he encourages teenagers to do what giraffe did. Giraffe did everyone good service writing that letter, so really go read it. It might be fun and games for PewDiePie, but is not for giraffe. So let's hope he won't get caught affecting him even more, that his past activities are not too bad and that he learns from experience. 3.) This is exactly what compelled me to answer. These things have very real serious consequences, but due to the way we talk about it people don't realize until is too late. Go lob for change of laws, but don't say they don't exist to kids who might believe you.

who-knows95 8y ago
1.) so you quote both the Serious Crime Act 2007 and the Computer Misuse Act 1990. both of these are UK laws, and don't apply to giraffe, as he's from the Midwest USA. he wasn't bug hunting? he was showing users they are exposed to the internet so they could fix it! 2.) yes, i don't blame him, what was meant to be a harmless exercise in google scanning, has lead to people throwing death threats at him, and threatening law suits. he didn't encourage any reckless actions, i see Felix as quite a rational guy. i have read the chromecast hack, and the printer one, have you? i doubt he will, and if he does a simple defence could be made to fight for his case in court. 3.) i don't know if you are talking about me or felix? i doubt felix has a firm grasp on computer hacking law, but like i said he didn't tell them to do that, in fact he's stayed at arms length. the actions giraffe took don't fall foul of the UK law, idk about american. i'm pretty much done with this exchange, and who ever has been down-voting my comments.