4 ms·
my first thought is, no surprise this is being described by someone with a visibly non-American domain, as this would be a fairly textbook breach of CFAA, right
by roywiggins 8y ago
my first thought is, no surprise this is being described by someone with a visibly non-American domain, as this would be a fairly textbook breach of CFAA, right?
- penagwin 8y agoMy understanding (disclaimer, not a lawyer) would be yes this would be a violation. However the group of people who connect to random MySQL servers is going to be almost exclusively black-hat. This would be akin to "But officer he stole my drugs", sure they committed a crime but in reporting it you implicated yourself.
- deleted 8y ago[deleted]
- kevin_thibedeau 8y agoThe connection is initiated by someone who isn't authorized for your server. Don't see anything fraudulent in requesting a file they are free to ignore.
- tantalor 8y agoConsider how happy the district attorney will be if the "someone" in your scenario is a federal agent. I eagerly await your entrapment defense argument.
- kevin_thibedeau 8y agoThey were breaking the law by trying to hack my computer with malicious SQL.
- roywiggins 8y agoThe FBI has not been yet been significantly deterred by courts: https://www.wired.com/2016/05/history-fbis-hacking/ https://www.wired.com/2016/05/history-fbis-hacking/ If they have a search warrant for your server and you hack back, you're liable to have a bad time.
- bigiain 8y agoI guess there some interesting technicalities in the phrase "your server" there. You might _think_ that ec2 instance is "your server", but the FBI are unlikely to serve you with that warrant. I'd guess it'll go to Amazon, who may or may not care about whether you even know of its existence. (Especially if the warrant is for someone else with a VPS on the same piece of hardware that "your server" is on...)
- meowface 8y agoYou can say someone stole your bike so you broke into their house to steal it back, but it doesn't negate that you also committed a crime. I think law enforcement would probably be pretty unlikely to bother charging someone popping a few cybercriminals who stumbled across their honeypot, but they could charge you if they want to.
- bigiain 8y agoI'd be _reasonably_ comfortable doing just that. Cracking passwords in that file and using those credentials to log in to someone else's box is a _loooooong_ way over the line though...
- roywiggins 8y agoTell that to weev. His case was only overturned on a technicality. His conviction was for enumerating an unsecured API by sending requests that the server was free to ignore. https://www.washingtonpost.com/news/the-switch/wp/2014/04/11/hackertroll-weev-will-walk-free-but-the-court-didnt-rule-on-the-main-issue/ https://www.washingtonpost.com/news/the-switch/wp/2014/04/11...
- bigiain 8y agoThere is a technical difference here though. weev was actively initiating that connection to somebody else's server. In this case, the honeypot is sitting idly, and _responding_ to someone else's connection (in a manner that's clearly unauthorised), and it's responding with something valid but unexpected. Not that I'd want my lawyer having to explain that difference to a jury...
- yxhuvud 8y agoThat part is fine. Actually trying out the passwords found in received files may however not be OK.