4 ms·

If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been

by FDSGSG 6y ago

If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been a hack?

sbarre 6y ago
I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.
- FDSGSG 6y ago
  The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?
  - strogonoff 6y ago
    IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
  - sbarre 6y ago
    It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.

by FDSGSG 6y ago

If this wasn't a hack, would a SQL injection have been a hack? Where do you draw the line? What if they had exploited the heartbleed bug, would that have been a hack?

sbarre 6y ago

I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.

FDSGSG 6y ago
The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?
- strogonoff 6y ago
  IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
- sbarre 6y ago
  It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.