7 ms·

My understanding is that 'incrementing an integer' is illegal and may result in jail time. Maybe they used graphql and their api expectantly allowed access to

by itake 5y ago

My understanding is that 'incrementing an integer' is illegal and may result in jail time. Maybe they used graphql and their api expectantly allowed access to data that it shouldn't of had access too? [0] - https://www.techdirt.com/2013/09/30/dojs-insane-argument-against-weev-hes-felon-because-he-broke-rules-we-made-up/ https://www.techdirt.com/2013/09/30/dojs-insane-argument-aga...

ensignavenger 5y ago
That decision was vacated on appeal- https://arstechnica.com/tech-policy/2014/04/appeals-court-reverses-hackertroll-weev-conviction-and-sentence/ https://arstechnica.com/tech-policy/2014/04/appeals-court-re...
- deleted 5y ago
  [deleted]
- slavboj 5y ago
  On jurisdictional grounds, not the DOJ interpretation of the CFAA.
  - ensignavenger 5y ago
    That is true, but the court also expressed skepticism on the CFAA interpretation- but since the jurisdiction was wrong, they didn't need to make a ruling on the CFAA. I am unaware of any case going to trial using that interpretation of the CFAA since, though.
    - rosndo 5y ago
      > I am unaware of any case going to trial using that interpretation of the CFAA since Which interpretation would that be? That unauthorized access is illegal?
      - Talanes 5y ago
        That making a server request and having that server request answered counts as unauthorized access.
        rosndo 5y ago
        That’s been litigated over and over again. Some requests, performed with malicious intent, do in fact count as unauthorized access.
deleted 5y ago
[deleted]
asdfasgasdgasdg 5y ago
It's not the incrementing the integer that was the problem. It was the knowingly accessing records that you know you shouldn't have access to. If judyrecords had a method of crawling pages that involves incrementing integers, that isn't a problem on its own. If they were using that method with a good faith belief that they were accessing data they had the right to access, that's fact is what makes it an entirely different scenario than what happened with weev.
- deleted 5y ago
  [deleted]
- corey_moncure 5y ago
  What does "shouldn't have access to" mean? The web server has a permissions system that determines what access level to grant in response to any request. If you are granted access to a valid request then what other interpretation can there be apart from the server decided you "should have" access?
  - asdfasgasdgasdg 5y ago
    > What does "shouldn't have access to" mean? It means that the stakeholders of the system, normally its owners, do not mean for you to have access. Here's one way you can estimate whether the owners intend that you should have access: Imagine an in-person conversation with the owner or controller of the data, or their most knowledgeable representative. If you asked them verbally whether you may access the data, and they said "no," then you "shouldn't" have access to the data. > If you are granted access to a valid request then what other interpretation can there be . . . See above. This is also the interpretation that will be relevant in court if you are sued or arrested, so mark it carefully.
  - rosndo 5y ago
    I remember an old HN comment about this, but can’t find it right now. It went something like this (but obviously worded far more eloquently): Hackers love to think that they’re captain Kirk outsmarting the computer, but real life isn’t Star Trek and judges are very much humans and don’t look kindly on such stunts. A reasonable person would know that you aren’t authorized to dump AT&Ts customer database by incrementing an integer on their site.
infogulch 5y ago
IMO the standard should consider both industry best practice for securing sensitive data in proportion to the sensitivity, as well as intent. Like it's harder to argue breaking and entering if you secure a door with a bent clothes hangar or carabiner vs a padlock, even a bad one. (Clarifications welcome.) Incrementing integers are like the carabiner, a botched JWT token implementation might be like a bad padlock, etc.
- rosndo 5y ago
  > Like it's harder to argue breaking and entering if you secure a door with a bent clothes hangar or carabiner vs a padlock, even a bad one. It’s not. How (and if) the door is locked makes no difference whatsoever.
rosndo 5y ago
Huge difference between this and weevs case. weev did what he did knowingly and maliciously. Intent matters, weev knew his access wasn’t authorized. Judyrecords didn’t know they were accessing non-public data by incrementing the integer, weev did.

by itake 5y ago

ensignavenger 5y ago

That decision was vacated on appeal- https://arstechnica.com/tech-policy/2014/04/appeals-court-reverses-hackertroll-weev-conviction-and-sentence/ https://arstechnica.com/tech-policy/2014/04/appeals-court-re...

deleted 5y ago
[deleted]
slavboj 5y ago
On jurisdictional grounds, not the DOJ interpretation of the CFAA.
- ensignavenger 5y ago
  That is true, but the court also expressed skepticism on the CFAA interpretation- but since the jurisdiction was wrong, they didn't need to make a ruling on the CFAA. I am unaware of any case going to trial using that interpretation of the CFAA since, though.
  - rosndo 5y ago
    > I am unaware of any case going to trial using that interpretation of the CFAA since Which interpretation would that be? That unauthorized access is illegal?
    - Talanes 5y ago
      That making a server request and having that server request answered counts as unauthorized access.
      - rosndo 5y ago
        That’s been litigated over and over again. Some requests, performed with malicious intent, do in fact count as unauthorized access.

deleted 5y ago

[deleted]

asdfasgasdgasdg 5y ago

It's not the incrementing the integer that was the problem. It was the knowingly accessing records that you know you shouldn't have access to. If judyrecords had a method of crawling pages that involves incrementing integers, that isn't a problem on its own. If they were using that method with a good faith belief that they were accessing data they had the right to access, that's fact is what makes it an entirely different scenario than what happened with weev.

deleted 5y ago
[deleted]
corey_moncure 5y ago
What does "shouldn't have access to" mean? The web server has a permissions system that determines what access level to grant in response to any request. If you are granted access to a valid request then what other interpretation can there be apart from the server decided you "should have" access?
- asdfasgasdgasdg 5y ago
  > What does "shouldn't have access to" mean? It means that the stakeholders of the system, normally its owners, do not mean for you to have access. Here's one way you can estimate whether the owners intend that you should have access: Imagine an in-person conversation with the owner or controller of the data, or their most knowledgeable representative. If you asked them verbally whether you may access the data, and they said "no," then you "shouldn't" have access to the data. > If you are granted access to a valid request then what other interpretation can there be . . . See above. This is also the interpretation that will be relevant in court if you are sued or arrested, so mark it carefully.
- rosndo 5y ago
  I remember an old HN comment about this, but can’t find it right now. It went something like this (but obviously worded far more eloquently): Hackers love to think that they’re captain Kirk outsmarting the computer, but real life isn’t Star Trek and judges are very much humans and don’t look kindly on such stunts. A reasonable person would know that you aren’t authorized to dump AT&Ts customer database by incrementing an integer on their site.

infogulch 5y ago

IMO the standard should consider both industry best practice for securing sensitive data in proportion to the sensitivity, as well as intent. Like it's harder to argue breaking and entering if you secure a door with a bent clothes hangar or carabiner vs a padlock, even a bad one. (Clarifications welcome.) Incrementing integers are like the carabiner, a botched JWT token implementation might be like a bad padlock, etc.

rosndo 5y ago
> Like it's harder to argue breaking and entering if you secure a door with a bent clothes hangar or carabiner vs a padlock, even a bad one. It’s not. How (and if) the door is locked makes no difference whatsoever.

rosndo 5y ago

Huge difference between this and weevs case. weev did what he did knowingly and maliciously. Intent matters, weev knew his access wasn’t authorized. Judyrecords didn’t know they were accessing non-public data by incrementing the integer, weev did.