9 ms·

TBH I definitely wouldn't want my employees going around and hacking competitors in their free time. Too much potential liability. I can see giving a star perfo

TBH I definitely wouldn't want my employees going around and hacking competitors in their free time. Too much potential liability. I can see giving a star performer a chance if it's their first time doing it and if they'd already come clean about it to the other party, but otherwise I'd probably cut my losses. It's one thing if it's a designated, well-vetted free for all, like Project Zero, with clear legal approval. It's another thing for a regular employee to be hacking competitors -- that begins to look like industrial espionage. And even GPZ doesn't hack banks.

guelo 5y ago
Imagine not wanting curious people on your staff.
- asdfasgasdgasdg 5y ago
  Curiosity is very important, but it is not the most important quality a person can have in all contexts. Wisdom comes to mind as one that is more important sometimes.
  - Aachen 5y ago
    Wisdom is knowing stuff. Politics is something else.
    - ILMostro7 5y ago
      Unfortunately, you gotta have the wisdom to recognize the politics and thereby protect yourself. To know when it's just not worth it. Sad but true
    - ipaddr 5y ago
      Knowledge is knowing stuff wisdom is knowing when and when not to apply that knowledge.
- belval 5y ago
  You can be curious without being reckless.
  - stavros 5y ago
    Agreed, use a trusted VPN.
    - belval 5y ago
      I'm sure you meant it in jest, but yeah, if you are going to do something illegal at least try to cover your tracks. Naivety is not a virtue.
      - stavros 5y ago
        It was only half in jest.
- mypalmike 5y ago
  Do you want staff to be curious enough to... Let's see... Run queries on your customer database to find out their friends' account balances?
  - educaysean 5y ago
    Why did you immediately jump to a malicious scenario? Is that what you imagine curious people do?
    - mypalmike 5y ago
      No. My point is that curiosity is valuable, but so is integrity. The scenario I presented is around the same level of malicious as pen testing a competitor's new credit card API. Specifically, both are potentially criminal acts of illegal computer access (by current laws in the US), and both have negligible impact on their victims.
kortex 5y ago
Eh, I agree it was kind of a dumb move, but there's no reason he shouldn't be able to have a snoop around. This wasn't "hacking" in the exploit sense. Web scraping, poking and prodding at APIs (yes even "private" ones), indexing a user ID, looking at source code, injecting your own code (e.g. modifying client js), redirecting some requests, none of these are hacking or exploitation, they are literally how the technologies of TCP/IP, HTTP, the web, and web browsers are meant to work. I'm not sure where the line of "trying to break security" it, but none of the above count. Even accidentally blasting some endpoint with automated garbage. Intent matters.
- mike00632 5y ago
  Well... his man-in-the-middle was a false attestation of identity to gain unauthorized access. That is pretty much the definition of hacking. The app would have otherwise encrypted the traffic and they wouldn't have been able to 'poke around'.
  - kortex 5y ago
    That doesn't sound like they were using SSL for authorization. SSL (in the usual use case) just ensures the client to server connection. You can e.g. use special installed certs for accessing VPNs, but I don't think that's the situation here. It just seems like the client was expecting some domain name to serve some endpoints, and he just MITM them to proxy it to his own servers. That's not hacking because here SSL isn't being used for authorization. The bottom line is the resource permissions weren't scoped right, like at all, and no amount of SSL is gonna fix it - that's what logins and tokens and oauth and that whole dance are for. Sorry, endpoints aren't doors of a house, where "waltzing in just because it's unlocked is breaking and entering." They are protocols. Merely "talking" to open protocols is/should not be a crime.
    - tptacek 5y ago
      Whether or not you think it should be a crime has absolutely nothing to do with whether it is. In this case, you're pretty much dead wrong. There's no "this is how the open protocol" works exception to CFAA. A case will turn on your intent, and the standard to which you'll be held is "what a normal person on a jury would think to do with their browser", not "what people on HN think is reasonable to do with a browser".
roastedpeacock 5y ago
The kinds of assignments involved with GPZ also shy away from server-side applications ran by other companies. Maybe doing approved bug-bounty research in a competitors webapp is a safer proposition.
unethical_ban 5y ago
You're probably correct from a liability perspective, but from a hiring perspective in that space, you probably want the kind of personality that is driven to do such things working for you.
- tsimionescu 5y ago
  If by "such things" you mean trying to see how your competitor implements their product, no, that is certainly not the kind of personality you want to work for you (assuming you are not some unethical hack like Uber, of course).
Benjammer 5y ago
If this (not infosec) person was doing this type of security probing during work hours using work equipment, I could see them being fired even if they are hacking on the company’s own product. You’re not paid as a competitive intelligence analyst and security researcher, regardless of your “personal interests,” you’re paid to work on a product to make the company more money. Furthermore, if you start unpacking the mobile app of a bank and doing actual pen testing analysis in the wild hitting their prod servers, even accidentally, you seriously need to understand the situation you are putting yourself in, regardless of where you work.
- aldebran 5y ago
  This is the part I’m stunned about. So many in this thread don’t see the liability of unpacking a competitors app and poking around their APIs. Forget CC fraud. This opens up liability for IP theft. Even if the other company doesn’t win the case it is going to create a shitstorm that might potentially give them free PR. “Look our new product is so good their devs are reverse engineering our innovation to copy us” Forget what this person found out. Going and unpacking the app and using private APIs itself was a dumb move regardless of what happened after. People can be idealistic and talk about intent but it really is a bad move that opens all kinds of liabilities.
  - ratg13 5y ago
    Personally I don't think what he did was wrong. I think the moral of the story is don't do non-work related things on your work computer. It shifts the liability from the individual to the company.
    - meetups323 5y ago
      But also don't do work related things on your non-work computer. Investigating the source code of your company's competitor's products is absolutely work related.
    - Benjammer 5y ago
      The thing that is kind of baffling to me about so many people in this comment section is that they think their personal opinion about the ethics of what he did has any bearing on anything. That's not how the legal system works at all. To quote Tom Scott, a youtuber, "I'm not telling you how it should be, I'm just telling you how it is."
ummonk 5y ago
Yeah aside from the hacking there are potential copyright issues if he’s digging too deep in reverse engineering the competitor’s app.
- Aachen 5y ago
  Also when none of it ever leaves their own computer? It seemed to me like they were poking around for curiosity, not to publish any dirty laundry substantial enough to be a reverse engineering or copyright issue.
  - tsimionescu 5y ago
    Yes, also then. If company A's app and company B's app happen to have some code in common, but one of company A's employees is found to have reverse engineered company B's app, then company B has a very nice case for suing company A for copyright violations. Now, if you do it and no one finds out, that's one thing. But telling your manager (worse case, in an email!) becomes a potential liability, as the company has to keep such records and provide them to the other party in case of a suit.
Aachen 5y ago
> I definitely wouldn't want my employees going around and hacking competitors in their free time. Where do you work? Just so I know where not to apply.
- justin_oaks 5y ago
  Hey now, they said they wouldn't want their employees doing it, not that they'd forbid employees doing what they will with their free time.
- jahewson 5y ago
  This is both a conflict of interest and could bring the employer into disrepute. Many employment contract rightfully forbid such actions, free time or not.
- mypalmike 5y ago
  Please name a company where you would expect such behavior to be encouraged. Genuinely curious.
  - tsimionescu 5y ago
    Uber? They care little for other laws, so I would be surprised if they cared for this one ethical standard.
  - Aachen 5y ago
    "Encouraged" is different from prohibited / it being a firing offense. I just checked with my employer. To make sure I represented the situation accurately, here is what I wrote (I applied the situation to our line of business, IT security, and replaced credit cards with another type of authorization token to make it realistic for us): > if <name of actual competitor> releases a hosted password manager, where you store all your secrets on their servers, would <our company name> condone me looking at the internals of that application in private time, or does <our name> rather think that's a liability risk? The answer started with, and I quote: "not a problem". My employer did request advance warning (they expected me to actually have such plans it seems; I clarified afterwards this was completely hypothetical for a HN comment) such that, in case it's controversial, they can warn the competitor ahead of time and say it's just my private opinion, but that's just a request and sounds reasonable to me.
meetups323 5y ago
If I went to my manager telling them I was hacking a competitor's infrastructure and accessing competitor PII & proprietary IP, I'd fully expect to be fired on the spot. And they're the most laissez faire manager I know.
- Aeolun 5y ago
  Depends on how you raise it right? “I was trying to research how X built their app, to see if there was anything we could or should do in there, and I think I found a huge security vulnerability.”
  - deleted 5y ago
    [deleted]
  - aldebran 5y ago
    This is still problematic. This runs the risk of IP theft claims. Additionally when you download and use any app, there’s probably somewhere in the TOS about not trying to reverse engineer anything. You’re probably breaking that at minimum.
    - Aeolun 5y ago
      Well, chances are that I’m not trying to use their app in the first place if I’m working at their competitor, so I’m not sure if that should bother you.
  - tsimionescu 5y ago
    > to see if there was anything we could or should do in there That right there is where the company lawyers get called, and all of your contributions to the company code base start being reviewed and ways to remove the most recent ones start being contemplated. It is extremely easy to run afoul of copyright if your employees go around reading your competitor's source code. You may well have a dedicated team that does this, but you'll be keeping a very clear paper trail proving they never came anywhere close to your code base directly.
jonathankoren 5y ago
> I can see giving a star performer a chance No. A million times no. You do not use double standards. It kills morale, because it's immoral. Anyway, a top performer, should know when to walk away and contact security and legal. If I found this. I would immediately have contacted my manager, and our security team, and see if our security would advise legal. Then we'd immediately contact OtherCo's security team. If you find a security flaw, you have to immediately report. You DO NOT "explore" someone else's machine. It goes sideways too easily, and people always want to get the cops involved. Your number one duty is to protect yourself.
- robocat 5y ago
  > Your number one duty is to protect yourself. Which may involve not informing your own manager or security team, depending on context? I wonder if he would have been caught if he hadn’t told his own company?
  - jonathankoren 5y ago
    Cover up is never the solution.
    - Aeolun 5y ago
      It’s literally the least painful solution for the individual involved. If they guy hadn’t reported it to his company nobody would have know he was the once exploring their API and he’d be home free.
      - jonathankoren 5y ago
        It literally just takes someone to do an log inspection, and then he’s super screwed.
      - borski 5y ago
        Until it is uncovered and the individual is now screwed twice; once for doing it, and once for covering it up, at which point the company can now potentially claim gross negligence if they become liable.
precommunicator 5y ago
And what makes you think you have or should have any control over what your employees doing in their free time?

guelo 5y ago

Imagine not wanting curious people on your staff.

asdfasgasdgasdg 5y ago
Curiosity is very important, but it is not the most important quality a person can have in all contexts. Wisdom comes to mind as one that is more important sometimes.
- Aachen 5y ago
  Wisdom is knowing stuff. Politics is something else.
  - ILMostro7 5y ago
    Unfortunately, you gotta have the wisdom to recognize the politics and thereby protect yourself. To know when it's just not worth it. Sad but true
  - ipaddr 5y ago
    Knowledge is knowing stuff wisdom is knowing when and when not to apply that knowledge.
belval 5y ago
You can be curious without being reckless.
- stavros 5y ago
  Agreed, use a trusted VPN.
  - belval 5y ago
    I'm sure you meant it in jest, but yeah, if you are going to do something illegal at least try to cover your tracks. Naivety is not a virtue.
    - stavros 5y ago
      It was only half in jest.
mypalmike 5y ago
Do you want staff to be curious enough to... Let's see... Run queries on your customer database to find out their friends' account balances?
- educaysean 5y ago
  Why did you immediately jump to a malicious scenario? Is that what you imagine curious people do?
  - mypalmike 5y ago
    No. My point is that curiosity is valuable, but so is integrity. The scenario I presented is around the same level of malicious as pen testing a competitor's new credit card API. Specifically, both are potentially criminal acts of illegal computer access (by current laws in the US), and both have negligible impact on their victims.

kortex 5y ago

Eh, I agree it was kind of a dumb move, but there's no reason he shouldn't be able to have a snoop around. This wasn't "hacking" in the exploit sense. Web scraping, poking and prodding at APIs (yes even "private" ones), indexing a user ID, looking at source code, injecting your own code (e.g. modifying client js), redirecting some requests, none of these are hacking or exploitation, they are literally how the technologies of TCP/IP, HTTP, the web, and web browsers are meant to work. I'm not sure where the line of "trying to break security" it, but none of the above count. Even accidentally blasting some endpoint with automated garbage. Intent matters.

mike00632 5y ago
Well... his man-in-the-middle was a false attestation of identity to gain unauthorized access. That is pretty much the definition of hacking. The app would have otherwise encrypted the traffic and they wouldn't have been able to 'poke around'.
- kortex 5y ago
  That doesn't sound like they were using SSL for authorization. SSL (in the usual use case) just ensures the client to server connection. You can e.g. use special installed certs for accessing VPNs, but I don't think that's the situation here. It just seems like the client was expecting some domain name to serve some endpoints, and he just MITM them to proxy it to his own servers. That's not hacking because here SSL isn't being used for authorization. The bottom line is the resource permissions weren't scoped right, like at all, and no amount of SSL is gonna fix it - that's what logins and tokens and oauth and that whole dance are for. Sorry, endpoints aren't doors of a house, where "waltzing in just because it's unlocked is breaking and entering." They are protocols. Merely "talking" to open protocols is/should not be a crime.
  - tptacek 5y ago
    Whether or not you think it should be a crime has absolutely nothing to do with whether it is. In this case, you're pretty much dead wrong. There's no "this is how the open protocol" works exception to CFAA. A case will turn on your intent, and the standard to which you'll be held is "what a normal person on a jury would think to do with their browser", not "what people on HN think is reasonable to do with a browser".

roastedpeacock 5y ago

The kinds of assignments involved with GPZ also shy away from server-side applications ran by other companies. Maybe doing approved bug-bounty research in a competitors webapp is a safer proposition.

unethical_ban 5y ago

You're probably correct from a liability perspective, but from a hiring perspective in that space, you probably want the kind of personality that is driven to do such things working for you.

tsimionescu 5y ago
If by "such things" you mean trying to see how your competitor implements their product, no, that is certainly not the kind of personality you want to work for you (assuming you are not some unethical hack like Uber, of course).

Benjammer 5y ago

If this (not infosec) person was doing this type of security probing during work hours using work equipment, I could see them being fired even if they are hacking on the company’s own product. You’re not paid as a competitive intelligence analyst and security researcher, regardless of your “personal interests,” you’re paid to work on a product to make the company more money. Furthermore, if you start unpacking the mobile app of a bank and doing actual pen testing analysis in the wild hitting their prod servers, even accidentally, you seriously need to understand the situation you are putting yourself in, regardless of where you work.

aldebran 5y ago
This is the part I’m stunned about. So many in this thread don’t see the liability of unpacking a competitors app and poking around their APIs. Forget CC fraud. This opens up liability for IP theft. Even if the other company doesn’t win the case it is going to create a shitstorm that might potentially give them free PR. “Look our new product is so good their devs are reverse engineering our innovation to copy us” Forget what this person found out. Going and unpacking the app and using private APIs itself was a dumb move regardless of what happened after. People can be idealistic and talk about intent but it really is a bad move that opens all kinds of liabilities.
- ratg13 5y ago
  Personally I don't think what he did was wrong. I think the moral of the story is don't do non-work related things on your work computer. It shifts the liability from the individual to the company.
  - meetups323 5y ago
    But also don't do work related things on your non-work computer. Investigating the source code of your company's competitor's products is absolutely work related.
  - Benjammer 5y ago
    The thing that is kind of baffling to me about so many people in this comment section is that they think their personal opinion about the ethics of what he did has any bearing on anything. That's not how the legal system works at all. To quote Tom Scott, a youtuber, "I'm not telling you how it should be, I'm just telling you how it is."

ummonk 5y ago

Yeah aside from the hacking there are potential copyright issues if he’s digging too deep in reverse engineering the competitor’s app.

Aachen 5y ago
Also when none of it ever leaves their own computer? It seemed to me like they were poking around for curiosity, not to publish any dirty laundry substantial enough to be a reverse engineering or copyright issue.
- tsimionescu 5y ago
  Yes, also then. If company A's app and company B's app happen to have some code in common, but one of company A's employees is found to have reverse engineered company B's app, then company B has a very nice case for suing company A for copyright violations. Now, if you do it and no one finds out, that's one thing. But telling your manager (worse case, in an email!) becomes a potential liability, as the company has to keep such records and provide them to the other party in case of a suit.

Aachen 5y ago

> I definitely wouldn't want my employees going around and hacking competitors in their free time. Where do you work? Just so I know where not to apply.

justin_oaks 5y ago
Hey now, they said they wouldn't want their employees doing it, not that they'd forbid employees doing what they will with their free time.
jahewson 5y ago
This is both a conflict of interest and could bring the employer into disrepute. Many employment contract rightfully forbid such actions, free time or not.
mypalmike 5y ago
Please name a company where you would expect such behavior to be encouraged. Genuinely curious.
- tsimionescu 5y ago
  Uber? They care little for other laws, so I would be surprised if they cared for this one ethical standard.
- Aachen 5y ago
  "Encouraged" is different from prohibited / it being a firing offense. I just checked with my employer. To make sure I represented the situation accurately, here is what I wrote (I applied the situation to our line of business, IT security, and replaced credit cards with another type of authorization token to make it realistic for us): > if <name of actual competitor> releases a hosted password manager, where you store all your secrets on their servers, would <our company name> condone me looking at the internals of that application in private time, or does <our name> rather think that's a liability risk? The answer started with, and I quote: "not a problem". My employer did request advance warning (they expected me to actually have such plans it seems; I clarified afterwards this was completely hypothetical for a HN comment) such that, in case it's controversial, they can warn the competitor ahead of time and say it's just my private opinion, but that's just a request and sounds reasonable to me.

meetups323 5y ago

If I went to my manager telling them I was hacking a competitor's infrastructure and accessing competitor PII & proprietary IP, I'd fully expect to be fired on the spot. And they're the most laissez faire manager I know.

Aeolun 5y ago
Depends on how you raise it right? “I was trying to research how X built their app, to see if there was anything we could or should do in there, and I think I found a huge security vulnerability.”
- deleted 5y ago
  [deleted]
- aldebran 5y ago
  This is still problematic. This runs the risk of IP theft claims. Additionally when you download and use any app, there’s probably somewhere in the TOS about not trying to reverse engineer anything. You’re probably breaking that at minimum.
  - Aeolun 5y ago
    Well, chances are that I’m not trying to use their app in the first place if I’m working at their competitor, so I’m not sure if that should bother you.
- tsimionescu 5y ago
  > to see if there was anything we could or should do in there That right there is where the company lawyers get called, and all of your contributions to the company code base start being reviewed and ways to remove the most recent ones start being contemplated. It is extremely easy to run afoul of copyright if your employees go around reading your competitor's source code. You may well have a dedicated team that does this, but you'll be keeping a very clear paper trail proving they never came anywhere close to your code base directly.

jonathankoren 5y ago

> I can see giving a star performer a chance No. A million times no. You do not use double standards. It kills morale, because it's immoral. Anyway, a top performer, should know when to walk away and contact security and legal. If I found this. I would immediately have contacted my manager, and our security team, and see if our security would advise legal. Then we'd immediately contact OtherCo's security team. If you find a security flaw, you have to immediately report. You DO NOT "explore" someone else's machine. It goes sideways too easily, and people always want to get the cops involved. Your number one duty is to protect yourself.

robocat 5y ago
> Your number one duty is to protect yourself. Which may involve not informing your own manager or security team, depending on context? I wonder if he would have been caught if he hadn’t told his own company?
- jonathankoren 5y ago
  Cover up is never the solution.
  - Aeolun 5y ago
    It’s literally the least painful solution for the individual involved. If they guy hadn’t reported it to his company nobody would have know he was the once exploring their API and he’d be home free.
    - jonathankoren 5y ago
      It literally just takes someone to do an log inspection, and then he’s super screwed.
    - borski 5y ago
      Until it is uncovered and the individual is now screwed twice; once for doing it, and once for covering it up, at which point the company can now potentially claim gross negligence if they become liable.

precommunicator 5y ago

And what makes you think you have or should have any control over what your employees doing in their free time?