6 ms·

So, this guy is bragging about committing a felony, right? (I think it's a very neat hack and that he shouldn't have to be worried, but... am I right? Is this

So, this guy is bragging about committing a felony, right? (I think it's a very neat hack and that he shouldn't have to be worried, but... am I right? Is this in fact a felony? Less?)

vinhboy 15y ago
I hope not. He hasn't done anything at all. Unless its used maliciously. Like, if he went into CNN comments and posted a link that forced users to repost his comment, steal passwords, etc... Otherwise this is almost like me telling you to post javascript:alert('you are ugly'); in your browser.
jeltz 15y ago
Hmm, what crime would that be? He has not sabotaged anything on the vulnerable websites, he has not used it to gain access to any data, and he has not used it to impersonate or trick anyone.
- llimllib 15y ago
  I'm reading the laws now... It seems that "unauthorized access" itself, may be a crime which he has committed? Also, the laws vary by state and I'm having trouble figuring out what the federal laws are. Obviously, he didn't commit any fraud or steal any information, and I can't imagine anyone would want to prosecute him. edit: it looks like he's probably relatively in the clear on this? Most of the laws seem to require intent, fraud, or thievery. It's all very confusing. edit 2: downvotes? I'm sorry for worrying that our laws and legal system sucks?
  - kemayo 15y ago
    A lot would depend on how "access" is defined, I imagine. What I did was provide input to a publicly accessible script on their server. I didn't have to "break in" to anything to do so, or to find out about it. So it'd hinge on whether or not using someone's website in a way they didn't intend you to counts as being "unauthorized access". Standard case of "most persuasive lawyer wins".
    - tptacek 15y ago
      In other words, "you lose". I say that in a spirit of helpfulness, not snark.
    - rhizome 15y ago
      Look up the Lori Drew Myspace bullying case, exceeding TOU was most of the prosecution's strategy, and it almost worked.
  - jeltz 15y ago
    Possibly but I doubt it. He has only made people access their own web browsers, so while there might be a case for unauthorized access it seems very weak to me.
driverdan 15y ago
No, exposing public security holes is not a crime.
- tptacek 15y ago
  That's a point that can be very expensive to make. The line is blurry. You're unlikely to cross it testing for XSS (particularly this reflected stuff). But it can be easy to cross it looking for (and, particularly, at) SQL injection or authorization bypass. You should be extremely cautious testing other people's sites for security vulnerabilities.
tptacek 15y ago
I wish people would stop downmodding you to lightgrey just because they don't like what you're saying, because while "committing a felony" is a somewhat breathless way to word this, it's not absolutely false: you can conceivably be prosecuted for doing stuff like this. In Lynch's case, he's fantastically unlikely to get into anything more than PR trouble over telling people about an XSS bug. But people have gotten into real trouble over what they thought was benign investigation. Web developers put a lot of effort into making web apps feel like they're running on your own computer, but under the law, when you click around on a web app, you are interacting with someone else's property.
- llimllib 15y ago
  Thanks... I really did mean that as a question, I should have been clearer.

So, this guy is bragging about committing a felony, right? (I think it's a very neat hack and that he shouldn't have to be worried, but... am I right? Is this in fact a felony? Less?)

vinhboy 15y ago

I hope not. He hasn't done anything at all. Unless its used maliciously. Like, if he went into CNN comments and posted a link that forced users to repost his comment, steal passwords, etc... Otherwise this is almost like me telling you to post javascript:alert('you are ugly'); in your browser.

jeltz 15y ago

Hmm, what crime would that be? He has not sabotaged anything on the vulnerable websites, he has not used it to gain access to any data, and he has not used it to impersonate or trick anyone.

llimllib 15y ago
I'm reading the laws now... It seems that "unauthorized access" itself, may be a crime which he has committed? Also, the laws vary by state and I'm having trouble figuring out what the federal laws are. Obviously, he didn't commit any fraud or steal any information, and I can't imagine anyone would want to prosecute him. edit: it looks like he's probably relatively in the clear on this? Most of the laws seem to require intent, fraud, or thievery. It's all very confusing. edit 2: downvotes? I'm sorry for worrying that our laws and legal system sucks?
- kemayo 15y ago
  A lot would depend on how "access" is defined, I imagine. What I did was provide input to a publicly accessible script on their server. I didn't have to "break in" to anything to do so, or to find out about it. So it'd hinge on whether or not using someone's website in a way they didn't intend you to counts as being "unauthorized access". Standard case of "most persuasive lawyer wins".
  - tptacek 15y ago
    In other words, "you lose". I say that in a spirit of helpfulness, not snark.
  - rhizome 15y ago
    Look up the Lori Drew Myspace bullying case, exceeding TOU was most of the prosecution's strategy, and it almost worked.
- jeltz 15y ago
  Possibly but I doubt it. He has only made people access their own web browsers, so while there might be a case for unauthorized access it seems very weak to me.

driverdan 15y ago

No, exposing public security holes is not a crime.

tptacek 15y ago
That's a point that can be very expensive to make. The line is blurry. You're unlikely to cross it testing for XSS (particularly this reflected stuff). But it can be easy to cross it looking for (and, particularly, at) SQL injection or authorization bypass. You should be extremely cautious testing other people's sites for security vulnerabilities.

tptacek 15y ago

I wish people would stop downmodding you to lightgrey just because they don't like what you're saying, because while "committing a felony" is a somewhat breathless way to word this, it's not absolutely false: you can conceivably be prosecuted for doing stuff like this. In Lynch's case, he's fantastically unlikely to get into anything more than PR trouble over telling people about an XSS bug. But people have gotten into real trouble over what they thought was benign investigation. Web developers put a lot of effort into making web apps feel like they're running on your own computer, but under the law, when you click around on a web app, you are interacting with someone else's property.

llimllib 15y ago
Thanks... I really did mean that as a question, I should have been clearer.