5 ms·

The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an

by MRD85 7y ago

The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an unlocked car in a bad neighbourhood and no one holds them accountable. Most people understand the concept of an unlocked car, not many understand that he didn't do anything special to hack his school db. He just strolled right in.

julvo 7y ago
Exactly, it's like leaving your customers' cars unlocked in a bad neighborhood
scoot 7y ago
Like keeping your unlocked filing cabinet on the front porch...
fyfy18 7y ago
I did this when I was at high school with a friend. Basically the place had a shared Windows file system, and the only thing that prevented everyone from viewing it was that it was hidden in the UI. On the drive was lots of data, including some applications in PDF format - completely unprotected - full of personal information of minors. At the time we had recently covered data protection in IT class, so we wrote up a document explaining what we did, and why it was bad, and gave copies to a few people in prominent positions (principle, head of IT, IT teacher) as well as posting it (with instructions redacted) on an internal message board. Well of course they didn't take it very well. They threatened to expel us and call the cops, and suspended us for a week until they decided what to do. In the end a well written warning from my friend's parent made them drop the issue and let us back in. I doubt they did anything to change the "security".
hjk05 7y ago
> he didn't do anything special to hack... Someone who snatched a purse out the hand of someone else isn’t “doing anything special” either. The illegality doesn’t hinge on the difficulty of the action. Why is that so hard to grasp for technical crowds? If you find a car with the keys in the ignition and the door unlocked, you won’t get away with driving it a block down the road by telling the judge: “Oh, but it was obviously insecure, and I was just testing to see if I could steal it”.
- ryanmarsh 7y ago
  This is more like walking up to the bank at night and jiggling the door handle then telling everyone it’s unlocked and the alarm isn’t on.
  - ajross 7y ago
    The author straight up admits to scraping the database! That's clearly a point at which "Hm... I think this is insecure, can I actually pull this?" turns into criminal behavior.
    - pbhjpbhj 7y ago
      I think this is where analogies between physical theft/trespass and digital access break down. Pressing the handle down, maybe even opening a door, but not walking in and not taking anything. No theft, no trespass. AFAIK in my local laws trespass requires entry and theft requires carrying-off. Indeed -- apparently -- you're legally allowed to enter abandoned properties if you don't break-in. That to me is equivalent to access, maybe even duplication (proving access with no 'alarms'), of digital data. When it becomes immoral is when you use that data, or make it available for use by others. Of course the CMA(UK)/CFAA(USA) don't see things this way they both seem to make the equivalent of 'looking in the direction of a door and noticing it's open' into an illegal act.
      - ajross 7y ago
        > When it becomes immoral is when you use that data, or make it available for use by others. That's logically consistent but shockingly permissive. And to be frank, I don't believe for a second this is really a principled opinion on your part, it's an excuse. You'll get behind the hacker linked on HN out of solidarity or for some other personal reason (maybe you hate schools, or java). You'd never forgive someone for walking in and lifting your photo history due to a security lapse by Facebook, even if they never "used" the data nor "made it available for use by others". And that is why this behavior is criminal. Be real.
deleted 7y ago
[deleted]
powercf 7y ago
The car analogy would be: He saw a car He tried the doors until he found one that was open He climbed in and searched everywhere until he found personal information about other users of the system Even though the security of this system was poor, he still (probably) broke the law. There are plenty of opportunities for people with some knowledge of IT to abuse their power, but it's our responsibility not to do so.
- nfoz 7y ago
  He looked in the window of a car and saw tons of users' personal information -- visible through the window! Any criminal could walk by and copy the info, privately, without anyone knowing. Maybe some criminals already have. I think the important thing we miss with car/physical crime analogies is that cybercrime can be so invisible. Nothing is missing, nothing is taken... but users private data is lost. So if an organization is doing something terribly naive like publishing passwords to userdata in plaintext... it's disgusting for our society to punish the wrong people, the people pointing out the flaws rather than the ones who cause them. All the really malicious entities came and went and will never be caught. They put private information into a JSON file accessible by an HTTPS GET, the only password being one that they put in plaintext onto everyone's phones. My analogy: They put the private information onto a billboard, but you can only see the billboard from a particular vantage point in a public park.
  - treis 7y ago
    >He looked in the window of a car and saw tons of users' personal information -- visible through the window! The information was still behind a door that you had to unlock. They just unwittingly sent keys to everyone.
    - nfoz 7y ago
      If everyone has a key, it’s not really locked. I guess a key is a legal metaphor and not an actual physical device. Huh.
nkrisc 7y ago
Not only are they leaving it unlocked, they are handing the keys to anyone who downloads the app.
manfredo 7y ago
He downloaded the apk and extracted the database key from it. This is probably beyond the means of >98% of people of people. To be fair there have been instances were literally just editing the route on a URL to view a different document has resulted in hacking charges, I wouldn't go to such great lengths to defend this guy. If you go up to someone's house and look under their welcome mat and find a key, is it okay to unlock the door and stroll in with the rationale that the poor security counts as consent to enter?

by MRD85 7y ago

julvo 7y ago

Exactly, it's like leaving your customers' cars unlocked in a bad neighborhood

scoot 7y ago

Like keeping your unlocked filing cabinet on the front porch...

fyfy18 7y ago

I did this when I was at high school with a friend. Basically the place had a shared Windows file system, and the only thing that prevented everyone from viewing it was that it was hidden in the UI. On the drive was lots of data, including some applications in PDF format - completely unprotected - full of personal information of minors. At the time we had recently covered data protection in IT class, so we wrote up a document explaining what we did, and why it was bad, and gave copies to a few people in prominent positions (principle, head of IT, IT teacher) as well as posting it (with instructions redacted) on an internal message board. Well of course they didn't take it very well. They threatened to expel us and call the cops, and suspended us for a week until they decided what to do. In the end a well written warning from my friend's parent made them drop the issue and let us back in. I doubt they did anything to change the "security".

hjk05 7y ago

> he didn't do anything special to hack... Someone who snatched a purse out the hand of someone else isn’t “doing anything special” either. The illegality doesn’t hinge on the difficulty of the action. Why is that so hard to grasp for technical crowds? If you find a car with the keys in the ignition and the door unlocked, you won’t get away with driving it a block down the road by telling the judge: “Oh, but it was obviously insecure, and I was just testing to see if I could steal it”.

ryanmarsh 7y ago
This is more like walking up to the bank at night and jiggling the door handle then telling everyone it’s unlocked and the alarm isn’t on.
- ajross 7y ago
  The author straight up admits to scraping the database! That's clearly a point at which "Hm... I think this is insecure, can I actually pull this?" turns into criminal behavior.
  - pbhjpbhj 7y ago
    I think this is where analogies between physical theft/trespass and digital access break down. Pressing the handle down, maybe even opening a door, but not walking in and not taking anything. No theft, no trespass. AFAIK in my local laws trespass requires entry and theft requires carrying-off. Indeed -- apparently -- you're legally allowed to enter abandoned properties if you don't break-in. That to me is equivalent to access, maybe even duplication (proving access with no 'alarms'), of digital data. When it becomes immoral is when you use that data, or make it available for use by others. Of course the CMA(UK)/CFAA(USA) don't see things this way they both seem to make the equivalent of 'looking in the direction of a door and noticing it's open' into an illegal act.
    - ajross 7y ago
      > When it becomes immoral is when you use that data, or make it available for use by others. That's logically consistent but shockingly permissive. And to be frank, I don't believe for a second this is really a principled opinion on your part, it's an excuse. You'll get behind the hacker linked on HN out of solidarity or for some other personal reason (maybe you hate schools, or java). You'd never forgive someone for walking in and lifting your photo history due to a security lapse by Facebook, even if they never "used" the data nor "made it available for use by others". And that is why this behavior is criminal. Be real.

deleted 7y ago

[deleted]

powercf 7y ago

The car analogy would be: He saw a car He tried the doors until he found one that was open He climbed in and searched everywhere until he found personal information about other users of the system Even though the security of this system was poor, he still (probably) broke the law. There are plenty of opportunities for people with some knowledge of IT to abuse their power, but it's our responsibility not to do so.

nfoz 7y ago
He looked in the window of a car and saw tons of users' personal information -- visible through the window! Any criminal could walk by and copy the info, privately, without anyone knowing. Maybe some criminals already have. I think the important thing we miss with car/physical crime analogies is that cybercrime can be so invisible. Nothing is missing, nothing is taken... but users private data is lost. So if an organization is doing something terribly naive like publishing passwords to userdata in plaintext... it's disgusting for our society to punish the wrong people, the people pointing out the flaws rather than the ones who cause them. All the really malicious entities came and went and will never be caught. They put private information into a JSON file accessible by an HTTPS GET, the only password being one that they put in plaintext onto everyone's phones. My analogy: They put the private information onto a billboard, but you can only see the billboard from a particular vantage point in a public park.
- treis 7y ago
  >He looked in the window of a car and saw tons of users' personal information -- visible through the window! The information was still behind a door that you had to unlock. They just unwittingly sent keys to everyone.
  - nfoz 7y ago
    If everyone has a key, it’s not really locked. I guess a key is a legal metaphor and not an actual physical device. Huh.

nkrisc 7y ago

Not only are they leaving it unlocked, they are handing the keys to anyone who downloads the app.

manfredo 7y ago

He downloaded the apk and extracted the database key from it. This is probably beyond the means of >98% of people of people. To be fair there have been instances were literally just editing the route on a URL to view a different document has resulted in hacking charges, I wouldn't go to such great lengths to defend this guy. If you go up to someone's house and look under their welcome mat and find a key, is it okay to unlock the door and stroll in with the rationale that the poor security counts as consent to enter?