5 ms·
This is an important caveat; the issue at hand is looking for vulnerabilities on other people's machines, not in other people's software. If it is running on yo
by borski 5y ago
This is an important caveat; the issue at hand is looking for vulnerabilities on other people's machines, not in other people's software. If it is running on your machine (read: not SaaS), reverse away.
Releasing the exploit, on the other hand, is a different story (don't do that)
- SCHiM 5y agoIs releasing the exploit problematic you think? In a legal sense?
- borski 5y agoI am not a lawyer, but for example, cracking a game is against the EULA and likely illegal. Releasing a cracker is much worse.
- tptacek 5y agoIt depends on how you got the bug. If you test something on your own machine and find a vulnerability, you're fine publishing it (modulo you may be civilly liable if a binding contract prevents you from doing that kind of research --- a pretty rare case). If you find a vulnerability in someone's SAAS application running on their server and publish it, the publication itself probably isn't unlawful --- the problem you'll have is that you've also published evidence that you committed a federal crime.
- borski 5y agoTo be clear: I meant releasing an exploit, not a bug. Per my understanding, there is a distinct difference between releasing a bug (that you found in software on your own machine) vs. releasing a tool that exploits that bug.
- tptacek 5y agoI don't really think that's true either, though obviously it has to be at least a little riskier to release an exploit; like, a fact pattern that has actually happened before is "someone writes an exploit, and a friend uses that exploit to steal a bunch of credit cards; the exploit writer is culpable as a co-conspirator". But just releasing an exploit by itself is I think --- NOT A LAWYER, TALK TO A LAWYER --- pretty safe. This also comes up in discussions about exploit markets: you can sell an exploit to a bounty program, or to Zerodium or whatever, but people always think you can make more (for instance, if it's some dumb SQLI, more than the $0 the public exploit markets will pay you for it) by selling "on the dark web". But if you're selling a bug that only lets you exploit some specific SAAS application "on the dark web" to some anonymous criminal (or someone a jury will think you should have known was a criminal), you're taking a chance that a prosecutor will make a case that you took money to facilitate a specific crime that they're now going to charge you with.
- borski 5y agoYeah, I’m not totally certain, and I suspect intent matters. My example was that cracking a game is illegal, but releasing a cracker is much much worse. And, again, IANAL.
- tptacek 5y agoPart of it is that there's a specific law criminalizing copy protection bypasses (the DMCA), but it also includes an explicit exemption for security research.