4 ms·

I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a mann

by sbarre 6y ago

I think this comes down to an oft-repeated discussion of what we (society) consider the "proper" securing of data. If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Personally I think an SQL injection still falls under the above. Securing public endpoints against long-known and easily mitigated vulnerabilities is 100% the company's responsibility.. There is no "we couldn't have prevented this" bullshit defense in that case.

FDSGSG 6y ago
The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?
- strogonoff 6y ago
  IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
- sbarre 6y ago
  It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.

by sbarre 6y ago

FDSGSG 6y ago

The company probably deserves punishment for negligence, but that should have zero impact on how we view the actions of the "hacker". >If a company leaves data available in a manner that is accessible without using any kind of vulnerability, but rather allows the unintended (ab)use of a poorly implemented service, then that's not a "hack", that's on the company, and they should be held accountable. Is it "theft" if you leave your keys in your car and I take it?

strogonoff 6y ago
IMO the “car with keys inside” analogy is not great for poorly implemented infosec. The latter is both more benign (no physical property directly stolen) and at the same time worse (the scale means multitudes of people will become vulnerable to further attacks, identity theft, doxxing and so on, rather than just one person losing the means of movement). It’s just different qualitatively. What should have impact on how we view the actions of a hacker is the context of said actions, not just the “hacking” part. If the hacker exploited company’s infosec negligence to profit in some way (say, by selling the data), or irresponsibly disclosed the data or the vulnerability possibly causing harm to affected users, it is one thing. Otherwise, the same sequence of hacker’s actions that exploits the vulnerability does not compare to stealing a car with keys inside—it is (another faulty analogy warning) more like looking at a car through some magical looking glass that highlights the keys left inside by the owner.
sbarre 6y ago
It certainly is.. but now let's go talk to your insurance company and see how they feel about covering the loss.