4 ms·
> Their CFAA claim can only cover unauthorized access to WhatsApp’s servers – but NSO didn’t hack those servers; the servers just fulfilled their normal job of
by sterlind 7y ago
> Their CFAA claim can only cover unauthorized access to WhatsApp’s servers – but NSO didn’t hack those servers; the servers just fulfilled their normal job of acting as a relay for WhatsApp messages,
By that logic a website provider wouldn't have standing if they suffered an XSS attack (though any affected users would), which is interesting.
IANAL, but it looks like the CFAA defines offenses in terms of the "protected computer" that was accessed - for instance, unauthorized access to that computer, or stealing information from that computer, or damages that computer.
That seems weird, but the alternative would be weirder: if every computer in the chain were a violation, the ISP for each hop of the network connection would have standing together. It's hard to make a case that WhatsApp is different from a regular router which might also pass malicious messages.
- meowface 7y agoThat's debatable. Also, it depends if it's persistent, reflected, or DOM-based XSS. Persistent XSS would be more likely to be considered an attack against the server/application, though I could see the counterargument as well. Reflected could go either way, and DOM-based would be the least likely to be considered a server attack.