18 ms·

When your classmates threaten you with felony charges

470 points by epoch_100 3y ago

ryandrake 3y ago
> One Friday night, we decided to explore whether Fizz was really “100% secure” like they claimed. Well, dear reader, Fizz was not 100% secure. In fact, they hardly had any security protections at all. It's practically a given that the actual security (or privacy) of a software is inversely proportional to its claimed security and how loud those claims are. Also, the companies that pay the least attention to security are always the ones who later, after the breach, say "We take security very seriously..."
borkt 3y ago
[flagged]
- archgoon 3y ago
  [flagged]
  - archgoon 3y ago
    [dead]
- epoch_100 3y ago
  Heh. That's not very nice. If it feels stilted, that's probably because I wrote this primarily to be spoken. But ChatGPT was not involved.
  - version_five 3y ago
    I read it and I'm pretty much the most critical person I know, I didn't see any problem with the style, I don't know what that guy's talking about.
  - danielvf 3y ago
    Yeah, don't worry about the above complaint. The writing is just fine.
- Pannoniae 3y ago
  I don't think the writing is bad, but even if so, not everyone is good at languages. They got the point across, didn't they?
- trostaft 3y ago
  Perhaps before killing someone with a comment, you should provide examples to back up your vitriol? The guidelines were reposted a mere four days ago... The writing felt fine to me, if a bit terse.
- kjjw 3y ago
  [flagged]
seiferteric 3y ago
How can you legally threaten someone and not face consequences, but if you threaten someone with physical violence you can go to jail?
- tantalor 3y ago
  https://en.wikipedia.org/wiki/Monopoly_on_violence https://en.wikipedia.org/wiki/Monopoly_on_violence
- dundarious 3y ago
  Your sentiment is silly. In general, with important caveats I will not state here, you can of course voice a threat to do an action that is legal (file a lawsuit), and may not voice a threat to do an action that is illegal (physical assault).
  - seiferteric 3y ago
    I'm not even suggesting it has to happen at a legal level, but perhaps at a professional level, I would think any lawyer writing baseless threatening letters to people should be subject to losing there license.
    - kube-system 3y ago
      Writing a demand letter that leans in favor of your client's interests is not only okay, it is the standard course of action for a civil dispute. https://www.law.cornell.edu/wex/demand_letter https://www.law.cornell.edu/wex/demand_letter
      - seiferteric 3y ago
        Perhaps they shouldn't. If we lived in a world where lawyers were more cautions about what they attached there name to out of concern for losing their license we would probably be better off. Less bullying by corporations with lots of money etc. No problems with demand letters for legitimate issues that are well supported by evidence though.
SenAnder 3y ago
> And at the end of their threat they had a demand: don’t ever talk about your findings publicly. Essentially, if you agree to silence, we won’t pursue legal action. Legally, can this cover talking to e.g. state prosecutors and the police as well? Because claiming to be "100% secure", knowing you are not secure, and your users have no protection against spying from you or any minimally competent hacker, is fraud at minimum, but closer to criminal wiretapping, since you're knowingly tricking your users into revealing their secrets on your service, thinking they are "100% secure". That this ended "amicably" is frankly a miscarriage of justice - the Fizz team should be facing fraud charges.
- SoftTalker 3y ago
  They could be legitimately ignorant of their security vulnerabilities. That might go to negligence more than fraud.
  - deleted 3y ago
    [deleted]
  - SenAnder 3y ago
    They could not have been ignorant of storing non-anonymous, plain-text messages. Even if we don't count that as insecure, they can only appeal to ignorance/negligence up until the point the security researchers informed them of their vulnerabilities. After that, that they continued their "100% secure" marketing on one side, while threatening researchers into silence on the other, is plainly malicious.
- manicennui 3y ago
  I don't think the demands of Fizz have much legal standing. We care more about corporations than citizens in the US. Advertising in the US is full of false claims. We ignore this because we pretend like words have no meaning.
  - sleepybrett 3y ago
    there is a carve out in the law for 'puffery', ie exaggerations. So 'the best hamburger in town' would be puffery.
mewse-hn 3y ago
Crazy story. The Stanford daily article has copies of the lawyer letters back and forth, they are intense - and we wouldn't be able to read them if the EFF didn't step up. https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...
wang_li 3y ago
Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.
- SenAnder 3y ago
  Look at it from a consumer rights angle. A product is advertised as having some feature ("100% security" in this case), but nobody is allowed to test (even without causing any harm) if that is true. It's effectively legalizing fraud for a big chunk of computer security. Sure fraud itself is technically still illegal, but so is exposing it.
- edwinjm 3y ago
  If they don't do it, criminals will do it. I know what my preference is.
  - InSteady 3y ago
    No, let's bury our heads in the sand while being sure to handicap (and treat as hostile) the only group of people who seem to care and have the expertise to do something about this giant mess we are in with regards to consumer, patient, and citizen data security.
- Buttons840 3y ago
  Meanwhile companies leak the private data of millions of people and nothing happens. If a curious kid does a port scan police will smash down doors. People will face decades in prison. If a negligent company leaks the private data of every single American, well, gee, what could we have done more, we had that one company do an audit and they didn't find anything and, gee, we're just really sorry, so lets all move on and here's a free year of credit monitoring which you may choose to continue paying us for at the end of the free year.
- InSteady 3y ago
jbombadil 3y ago
I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negative consequences if what they write is not allowed. At most a court deems that piece invalid, but that's it. The onus is on the reader to know (which tends to be a much weaker party). Same here. Why can a company send a threatening letter ("you'll go 20 years to federal prison for this!!"), when it's clearly false? Shouldn't there be an onus on the writer to ensure that what they write is reasonable? And if it's absurdly and provably wrong, shouldn't there be some negative consequences more than "oh, nevermind"?
- bdowling 3y ago
  It's a balance between encouraging people to stand up for their rights on one hand and discouraging filing of frivolous lawsuits on the other. The American system is "everyone pays their own legal fees", which encourages injured parties to file. The U.K. on the other hand is a "loser pays both parties' legal fees" (generally), which discourages a lot of plaintiffs from filing, even when they have been significantly harmed.
- LastTrain 3y ago
  There can be consequences, but you have to be able to demonstrate you have been harmed. So, in what way have you been harmed by such a threat, and what is just compensation? How much will it cost to hire a lawyer to sue for compensation, and what are your chances of success? These are the same kinds of questions the entity sending the threatening letter asked themselves as well. If you think it is unfair because they have more resources, well that is more of a general societal problem - if you have more money you have access to better justice in all forms.
- fallingknife 3y ago
  That's not the language they use. It will be more like "your actions may violate (law ref) and if convicted, penalties may be up to 20 years in prison." And how do you keep people from saying that? It's basically a statement of fact. If you have a problem with this, then your issue is with Congress for writing such a vague law.
sublinear 3y ago
> Stay calm. I can’t tell you how much I wanted to curse out the Fizz team over email. But no. We had to keep it professional — even as they resorted to legal scare tactics. Your goal when you get a legal threat is to stay out of trouble. To resolve the situation. That’s it. The temporary satisfaction of saying “fuck you” isn’t worth giving up the possibility of an amicable resolution. Maybe it's because I'm getting old, but it would never cross my mind to take any of this personally. If they're this bad at security, this bad at marketing, and then respond to a fairly standard vulnerability disclosure with legal threats it's pretty clear they have no idea what they're doing. Being the "good guy" can sometimes be harder than being the "bad guy", but suppressing your emotions is a basic requirement for being either "guy".
- ngai_aku 3y ago
  > If they're this bad at security, this bad at marketing, and then respond to a fairly standard vulnerability disclosure with legal threats it's pretty clear they have no idea what they're doing. And yet, according to the linked article in the Stanford Daily, they received $4.5 million in funding
- kdmccormick 3y ago
  > Maybe it's because I'm getting old Yup, that's it :) These kids are either in college or just graduated. They were smart enough to get themselves legal help before saying anything stupid, which is impressive. Cut them some slack!
  - sublinear 3y ago
    My ego has probably by now rewritten my memories to match who I am today. This situation seems like it would have had me and my friends laughing, not scared. Brains are weird.
f0e4c2f7 3y ago
I feel like this article reflects an overall positive change in the way disclosure is handled today. Back in the 90s this was the sort of thing every company did. Companies would threaten lawsuits, or disclosure in the first place seemed legally dubious. Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. Sure you still get some of that today. An especially old fashioned company, or in this case naive college students but overall things have shifted quite dramatically in favor of disclosure. Dedicated middle men who protect security researcher's identities, Large enterprises encouraging and celebrating disclosure, six figure bug bounties, even the laws themselves have changed to be more friendly to security researchers. I'm sure it was quite unpleasant to go through this for the author, but it's a nice reminder that situations like this are now somewhat rare as they used to be the norm (or worse).
- formerly_proven 3y ago
  > Suggestions of anonymous email accounts and that sort of thing. This is still the way to go even in many western countries.
- _greim_ 3y ago
  I wonder if this was the students' attempt to protect their future careers as much as anything—"keep quiet about this or else"—especially given the issues were quickly fixed. In that sense it differs from the classic 90s era retaliation. From the students' POV it was probably quite terrifying. I wouldn't discount intervention by wealthy parents either, but of course I know nothing of the situation or the people involved.
- lamontcg 3y ago
  The problem is that it is still entirely illegal to do this kind of hacking without any permission. The fact that a lot of companies have embraced bug bounties and encourage this kind of stuff against them unfortunately teaches "kids" that this kind of thing is perfectly legal/moral/ethical/etc. As this story shows though you're really rolling the dice, even though it worked out in this case. > Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. This is probably still a better idea if you don't have the cooperation of the target of the hack via some stated bug bounty program. But that doesn't help the security researcher "make a name" for themselves. And you're basically admitting to the fact that you trespassed, even if all you did was the equivalent of walking through an unlocked door and verifying that you could look inside their refrigerator. The fact that it may play out in the court of public opinion that you were helping to expose the lies of a corporation doesn't change the fact than in the actual courts you are guilty of a crime.
JakeAl 3y ago
In short, if they are a company and are not 100% secure and they say they are then they are committing fraud. The person doing the testing is providing the evidence for a legal case and no amount of legal threats change that.
icameron 3y ago
The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information....Moreover, the database was entirely editable — it was possible for anyone to edit posts, karma values, moderator status, and so on." That's wild!
- iancarroll 3y ago
  This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase. I am not sure what happened to it after that.
  - yismail 3y ago
    If I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if user.email == collection.email.
    - justrealist 3y ago
      Doing authorization within firestore breaks down instantly outside of toy applications.
  - jacquesm 3y ago
    I think deleting a scooter is against some law of conservation :)
  - singleshot_ 3y ago
    One interesting thing about the statute of limitations is “the discovery rule.” For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right? No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until they do. Accordingly, if the scooter company read a post today about a hack that happened “a long time ago” and therein discovered their loss, the statute of limitations would begin to tick today and the hacker could be in legal jeopardy for two more years.
simonw 3y ago
I found this story about the same situation (linked from the OP) easier to follow: https://saligrama.io/blog/post/firebase-insecure-by-default/ https://saligrama.io/blog/post/firebase-insecure-by-default/
- epoch_100 3y ago
  Adi's writeup is great, and goes much more into the technical detail than my transcript. I really recommend everyone checks out his post.
SoftTalker 3y ago
A private individual or company cannot file criminal/felony charges. Those are filed by a County Prosecutor, District Attorney, State Attorney, etc after being convinced of probable cause. They could threaten to report you to the police or such authorities, but they would have to turn over their evidence to them and to you and open all their relevant records to you via discovery. > Get a lawyer Yes, if they're seriously threatening legal action they already have one.
- epoch_100 3y ago
  Yes, threatening to report is what was really happening here. But in their effort to scare us, they elided much of that process. From our perspective it was "watch out, you might face felony charges if you don't agree to silence".
  - deleted 3y ago
    [deleted]
- aidenn0 3y ago
  Isn't threatening to report someone to the authorities if you don't do something extortion?
  - gingerrr 3y ago
    As the linked article notes, it's explicitly against the California State Bar Code of Conduct to condition criminal proceedings on requiring a civil outcome, so while not technically illegal it's censurable - that's against the attorneys who threatened, not the clients they represent.
    - aidenn0 3y ago
      What I'm pondering is how what happened in TFA is different from a situation like: 1. I (legally) gather evidence of a neighbor committing a criminal action; e.g. take a picture of them selling illicit drugs. 2. I threaten to send the evidence to the authorities unless they pay me money. That seems like blackmail to me, which is illegal under both state and federal law. The only difference I can think of is the consideration. If the consideration must be property for it to count as blackmail, then what about this situation: 1. I'm engaged in a civil dispute with my neighbor 2. I gather evidence of them committing a criminal action 3. I threaten to reveal the evidence unless they settle in my favor Does that magically become legal because no money exchanges hands?
hitekker 3y ago
Interestingly, Ashton Cofer and Teddy Solomon of Fizz tried some PR damage control when their wrongdoing came to light https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/#comment-6034722532 https://stanforddaily.com/2022/11/01/opinion-fizz-previously.... Their response was weak and it seems like they've refused to comment on the debacle since then.
- mustacheemperor 3y ago
  Per the Stanford Daily article linked in the OP [0], they have also removed the statement addressing this incident and supposed improvements from their website. >Although Fizz released a statement entitled “Security Improvements Regarding Fizz” on Dec. 7, 2021, the page is no longer navigable from Fizz’s website or Google searches as of the time of this article’s publication. And, it seems likely the app still stores personally identifiable information about its "anonymous" users' activity. > Moreover, we still don’t know whether our data is internally anonymized. The founders told The Daily last year that users are identifiable to developers. Fizz’s privacy policy implies that this is still the case I suppose the 'developers' may include the same founders who have refused to comment on this, removed their company's communications about it, and originally leveraged legal threats over being caught marketing a completely leaky bucket as a "100% secure social media app." Can't say I'm in a hurry to put my information on Fizz.
  - omoikane 3y ago
    "Security Improvments Regarding Fizz": https://web.archive.org/web/20220204044213/https://fizzsocial.app/_/securityimprovements.html https://web.archive.org/web/20220204044213/https://fizzsocia... What I was looking for was if they really had a page that claimed "100% secure", but I don't think that was captured by archive.org
lxe 3y ago
There should be harsher penalties for lawyers like Hopkins & Carley for threatening security researchers and engaging in unprofessional conduct like this.
tptacek 3y ago
I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained * The researchers were not given permission to do this testing If that fact pattern holds, then unless there's a California law governing this that I'm not aware of --- and even then, federal supremacy moots it, right? --- I think they did straightforwardly violate the CFAA, contra the claim in their response. At least three things mitigate their legal risk: 1. It's very clear from their disclosure and behavior after disclosing that they were in good faith conducting security research, making them an unattractive target for prosecution. 2. It's not clear that they did any meaningful damage (this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist), meaning there wouldn't have been much to prosecute. 3. Fizz's lawyers fucked up and threatened a criminal prosecution in order to obtain a valuable concession fro the researchers, which, as EFF points out, violates a state bar rule. I think the good guys prevailed here, but I'm wary of taking too many lessons from this; if this hadn't been "Fizz", but rather the social media features of Dunder Mifflin Infinity, the outcome might have been gnarlier.
- kjjw 3y ago
  [flagged]
- hnav 3y ago
  I think intent matters for actually securing an indictment and conviction, if for example they can prove that you exfiled their user data (this happened to Weev who noticed an ordinal ID in a URL and enumerated all possible URLs) they could actually get the feds to bust you. But you're right, if they're big enough they could try to come after your regardless at the risk of turning the security research community against them.
- emilecantin 3y ago
hermannj314 3y ago
I realize it is quick to be against Fizz, but I thought ethical hacking required prior permission. Am I to understand you can attempt to hack any computer to gain unauthorized access without prior approval? That doesn't seem legal at all. Whether or not there was a vulnerability, was the action taken actually legal under current law? I don't see anything indicating for or against in the article. Just posturing that "ethical hacking" is good and saying you are secure when you aren't is bad. None of that seems relevant to the actual question of what the law says.
- tptacek 3y ago
  (a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.
  - wedn3sday 3y ago
    (a) all hacking is unethical? (b) the database was running in the cloud, not on any computer they controlled. (c) everyone's an asshole here
    - some_furry 3y ago
      > all hacking is unethical? No, that's not what tptacek said. "Ethical hacking" is from the same vein as "responsible disclosure". These are weasel words that are used to demean security researchers who don't kiss the vendors' ass. As a security researcher, my ethical obligation is not to the vendors of the software. It's to the users. Ethically speaking, I don't care if my research makes the vendor look bad, hurts their sales, makes their PR team sad, etc. I similarly don't care if my research makes the vendor look good. Are the users better protected by my research? If yes, ethical. If not, unethical. Terms like "ethical hacking" are used to stilt the conversation in the favor of vendors. > the database was running in the cloud, not on any computer they controlled. If it's running in the Cloud, but in your Cloud account, it's morally equivalent to running on Your Machine. I'm not sure how the law will interpret anything, but given a compelling counter-argument, I don't imagine lawyers will argue differently. > everyone's an asshole here Yeah.
kjjw 3y ago
[flagged]
helaoban 3y ago
Don't you have to ask for permission to be white-hat?
- jerf 3y ago
  I'd suggest reading tptacek's comment: https://news.ycombinator.com/item?id=37298589 https://news.ycombinator.com/item?id=37298589 which does not 100% address your exact question, but gets close. As disclaimed, tptacek is not a lawyer, but has a lot of experience in this space and I'd still take it as a first pass answer. Personally, I don't see it as worth it to pursue a company that does not hang out some sort of public permission to poke at them. The upside is minimal and the downside significant. Note this is a descriptive statement, not a normative statement. In a perfect world... well, in a perfect world there'd be no security vulnerabilities to find, but... in a perfect world sure you'd never get in trouble for poking through and immediately backing off, but in the real world this story just happens too often. Takes all the fun right out of it. YMMV.
monksy 3y ago
Commentary on the journalism: Fantastic for calling Fizz out. "Fizz did not protect their users’ data. What happened next?" This isn't a "someone hacked them". It's that Fizz failed to do what they promised. I'm still curious to hear if the vulnerability has been tested to see if it's been resolved.
- InSteady 3y ago
  I think in a follow-up article by the Stanford Daily they said the app creators have gotten a few million in funding and lots of professional help, including to fix security issues. Although it still looks like user data is not fully anonymized internally like they had previously claimed.
jccalhoun 3y ago
This sounds a lot less interesting than the title makes it out to be. Is the fact that it is a "classmate" really relevant? Would the events have happened differently if it was another company with no connection to the school?
winter_blue 3y ago
This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect their anonymity while doing all 3 of these. If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm, but also effectively killed off a company that shouldn't exist – since all of Buzz/Fizz users would likely abandon it as consequence.
- AnimalMuppet 3y ago
  So your solution for possibly being prosecuted for something marginal is to do several things for which it would be much more reasonable to be prosecuted? That seems like a rather unwise solution to the problem. It's especially unwise because you now give the company a massive incentive to hire real forensics specialists to try to track you down. You're placing a lot of faith in your ability to remain anonymous under that level of scrutiny.
- pc86 3y ago
  "To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.
  - meepmorp 3y ago
    Well, at that point, the legal threats stop being baseless. Problem solved!
- jstarfish 3y ago
  > The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and [4] protect their anonymity while doing all 3 of these. Aaron Swartz only did (1). Failing at (4) didn't end so well for him. I get that you're frustrated but encouraging others to make martyrs of themselves is cowardice. If some dumb kid tries this and their opsec isn't bulletproof, they're fucked. Put your own skin in the game and do it yourself if your convictions are that strong.
wedn3sday 3y ago
Maybe its just my Oppositional Defiant Disorder talking, but I would have nuked their db after that bs threat.
- rootusrootus 3y ago
  > Maybe its just my Oppositional Defiant Disorder talking Is that the clinical term for Internet Tough Guy? I imagine deleting the DB would almost certainly lead to actual CFAA consequences. Which kinda suck, as I recall.
  - xigency 3y ago
    Yeah, it’s unwise, but also a fair warning. If you threaten someone who has leverage over you, you might find your own problems escalated. Not everyone behaves perfectly rationally under pressure.
dfxm12 3y ago
Anyone can make a threat. There's a bit of smarts needed to classify a "threat" as credible or not. Only really a law enforcement officer can credibly bring charges against you. Unfortunately, we live in a society where someone with more money than you can use the courts to harass you, so you even if you don't fear illegitimate felony charges, you can get pretty much get sued for any reason at any time, which brings with it consequences if you don't have a lawyer to deal with it. So I understand why someone might be scared in this situation, and luckily they were able to find someone to work with them, pro bono. I really wish the law had some pro-active mechanism for dealing with this type of legal bullying.
deleted 3y ago
[deleted]
pie_R_sqrd 3y ago
Interesting. My school has a very similar platform, SideChat, which I doubt is much different. Makes me wonder how much they know about me, as I was permanently banned last year for questioning the validity of "gender-affirming care."
- Zone3513 3y ago
  [flagged]
deleted 3y ago
[deleted]
xeromal 3y ago
Thank the lord for the EFF.
Buttons840 3y ago
> And then, one day, they sent us a threat. A crazy threat. I remember it vividly. I was just finishing a run when the email came in. And my heart rate went up after I stopped running. That’s not what’s supposed to happen. They said that we had violated state and federal law. They threatened us with civil and criminal charges. 20 years in prison. They really just threw everything they could at us. And at the end of their threat they had a demand: don’t ever talk about your findings publicly. Essentially, if you agree to silence, we won’t pursue legal action. We had five days to respond. This during a time when thousands or millions have their personal data leaked every other week, over and over, because companies don't want to cut into their profits. Researchers who do the right thing face legal threats of 20 years in prison. Companies who cut corners on security face no consequences. This seems backwards. Remember when a journalist pressed F12 and saw that a Missouri state website was exposing all the personal data of every teacher in the state (including SSN, etc). He reported the security flaw responsibly and it was embarrassing to the State so the Governor attacked him and legally harassed him. https://arstechnica.com/tech-policy/2021/10/missouri-gov-calls-journalist-who-found-security-flaw-a-hacker-threatens-to-sue/ https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal... I once saw something similar. A government website exposing the personal data of licensed medical professionals. A REST API responded with all their personal data (including SSN, address, etc), but the HTML frontend wouldn't display it. All the data was just an unauthenticated REST call away, for thousands of people in the state. What did I do? I just closed the tab and never touched the site again. It wasn't worth the personal risk to try to do the right thing so I just ignored it and for all I know all those people had their data stolen multiple times over because of this security flaw. I found the flaw as part of my job at the time, I don't remember the details anymore. It has probably been fixed by now. Our legal system made it a huge personal risk to do the right thing, so I didn't do the right thing. Which brings me to my point. We need strong protections for those who expose security flaws in good faith. Even if someone is a grey hat and has done questionable things as part of their "research", as long as they report their security findings responsibly, they should be protected. Why have we prioritized making things nice and convenient for the companies over all else? If every American's data gets stolen in a massive breach, it's so sad, but there's nothing we can do (shrug). If one curious user or security research pokes an app and finds a flaw, and they weren't authorized to do so, OMG!, that person needs to go to jail for decades, how dare they press F12!!!1 This is a national security issue. While we continue to see the same stories of massive breaches in the news over and over and over, and some of us get yet another free year of monitoring that credit agencies don't commit libel against us, just remember that we put the convenience of companies above all else. They get to opt-in to having their security tested, and over and over they fail us. Protect security researchers, and make it legal to test the security of an app even if the owning company does not consent. </rant>
consoomer 3y ago
In my opinion, they went too far and exposed themselves by telling the company. In all honesty, nothing good usually comes from that. If you wanted the truth to be exposed, they would have been better off exposing it anonymously to the company and/or public if needed. It's one thing to happen upon a vulnerability in normal use and report it. It's a different beast to gain access to servers you don't own and start touching things.
datacruncher01 3y ago
Best advice I can give someone is never do security research for a company without expressed written consent to do so and document everything as agreed to. Payouts for finding bugs when there isn't an already established process are either not going to be worth your time or will be seen as malicious activity.
deleted 3y ago
[deleted]
1970-01-01 3y ago
Ethically, they did the good thing by challenging the "100% secure" claim. Legally, they were hacking (without permission). Very high praise to the EFF for getting them out of trouble. Go donate.
pityJuke 3y ago
Wait, they are a company called Fizz, that was formerly called Buzz [0]? Talk about on the nose. [0]: https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...
- justincredible 3y ago
  [dead]
withinrafael 3y ago
The article asserts "there are an increasing number of resources available to good-faith security researchers who face legal threats". Is there an example of such, outside of the EFF? How do beginners find them?
causality0 3y ago
Unless you're looking to earn a bounty, always disclose testing of this type anonymously. Clean device, clean wi-fi, new accounts. That way if they threaten you instead of thanking you you can just drop the exploit details publicly and wash your hands of it.
aa_is_op 3y ago
tl;dr?
nickdothutton 3y ago
The story has greatly reduced value without knowing who the individuals behind Fizz really are. So that we can avoid doing business with them. It would be different if Fizz was a product of a megacorporation. “Keep calm” and “be responsible” and “speak to a lawyer” are things I class as common sense. The gold nugget I was looking for was the red flashing shipwreck bouy/marker over the names.
- meepmorp 3y ago
  Ashton Cofer and Teddy Solomon, according to this article: https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...
asynchronous 3y ago
TLDR on the actual hack, they forgot to set Firebase security rules, yet again. How do devs forget this step before raising 4.5 million in seed funding?
c4mpute 3y ago
That's why you always do anonymous immediate full disclosure. Nothing else is ethically viable. Nothing else protects the researcher.
utopcell 3y ago
Given the aggressive response from this company, it is less likely that it will become the target of any security researchers in the future (who wants the hassle ?). That by itself makes their app less secure in the long term. Also, who'd want to support founders with this "I will destroy you!, even though you helped me improve my system" mentality ? I wouldn't be surprised if this startup dies off from this info. Kudos to Cooper, Miles and Aditya for seeing this through.
- gnicholas 3y ago
  Alternatively, it will attract the attention of less-noble researchers who won't bother with responsible disclosure rules — they'll just leak data or tinker with the system. But I agree that well-intentioned security researchers will be less likely to look into this platform.
davesque 3y ago
I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline before you "go public?" Wouldn't that be something you do later on if it appears that they're just blowing you off and won't do anything about it? I don't think this applies to the reporter in this case, but it does seem like there's a bit of a trend in security research lately to capitalize on the publicity of finding a vulnerability for one's own personal branding. That feels a bit disingenuous. Not that the appropriate response would be to threaten someone with legal action.
- Cheezewheel 3y ago
  Do you disagree that Users might be entitled to know when a corporation is misusing their private, sensitive information? What is ethical does not begin and end with the corporations best interest, the users whose private information is being mishandled are the victims here, let us not lose perspective.
  - InSteady 3y ago
    Users who have been falsely assured that their data is both totally anonymous and "100% secure." On the other hand, assuming the app creators we in far over their heads when it comes to proper security, I have to wonder if they started off cordially and then freaked out a short while later because after trying, they realized there was no possible way for them to correct the issue in the given timeline. So in desperation they resorted to something drastic (and arguably unethical) to cover their asses.
- pie_flavor 3y ago
  It doesn't give them any wiggle room to lead you on, it doesn't give you any wiggle room to say 'unacceptable or I blow the whistle tomorrow', it removes your judgement of the situation from the disclosure entirely. It is the safest option for people who are great at finding things worth disclosing but not so great at situation-judging. It's not about personal branding, it's about protecting the users of the app. Either the app fixes the vulnerability so the users are no longer in danger, or the users are made aware that they are in danger.
tamimio 3y ago
Attitude like that from companies/developers/etc. are the reason why a lot of white-hat security researchers are in fact grey-hat.
lightedman 3y ago
Those classmates committed felony extortion with their threat, just as an aside. That would've been a better legal threat to put on them as a offensive move, instead of using the EFF. "Sure you can attempt to have me jailed but your threat is clear-cut felony extortion. See you in the jail cell right there with me!"
kordlessagain 3y ago
More like fizzle.
michaelmrose 3y ago
Do you think that someone less ethically minded could have resolved the issue more simply by redirecting their landing page to a warning that the site was insecure and shutting it down incurring near zero personal risk of retaliation and letting people make an informed choice about continuing to use the site. This is wholly and obviously illegal but so is the described ethical hacking. You have adopted a complex nuanced strategy to minimize harm to all parties. This is great morally but as far as I can tell its only meaningful legally insofar as it makes folks less likely to go after you nothing about it makes your obviously illegal actions legal so if you are going to openly flout the law it makes sense to put less of a target on your back while you are breaking the law.
noam_compsci 3y ago
Makes me so happy to know EFF and ethical hackers like this exist. I know they can’t test every app and every situation, but that there are hobbyists like this is such a testimony to humanity.

470 points by epoch_100 3y ago

> One Friday night, we decided to explore whether Fizz was really “100% secure” like they claimed. Well, dear reader, Fizz was not 100% secure. In fact, they hardly had any security protections at all. It's practically a given that the actual security (or privacy) of a software is inversely proportional to its claimed security and how loud those claims are. Also, the companies that pay the least attention to security are always the ones who later, after the breach, say "We take security very seriously..."

borkt 3y ago

[flagged]

archgoon 3y ago
[flagged]
- archgoon 3y ago
  [dead]
epoch_100 3y ago
Heh. That's not very nice. If it feels stilted, that's probably because I wrote this primarily to be spoken. But ChatGPT was not involved.
- version_five 3y ago
  I read it and I'm pretty much the most critical person I know, I didn't see any problem with the style, I don't know what that guy's talking about.
- danielvf 3y ago
  Yeah, don't worry about the above complaint. The writing is just fine.
Pannoniae 3y ago
I don't think the writing is bad, but even if so, not everyone is good at languages. They got the point across, didn't they?
trostaft 3y ago
Perhaps before killing someone with a comment, you should provide examples to back up your vitriol? The guidelines were reposted a mere four days ago... The writing felt fine to me, if a bit terse.
kjjw 3y ago
[flagged]

seiferteric 3y ago

How can you legally threaten someone and not face consequences, but if you threaten someone with physical violence you can go to jail?

tantalor 3y ago
https://en.wikipedia.org/wiki/Monopoly_on_violence https://en.wikipedia.org/wiki/Monopoly_on_violence
dundarious 3y ago
Your sentiment is silly. In general, with important caveats I will not state here, you can of course voice a threat to do an action that is legal (file a lawsuit), and may not voice a threat to do an action that is illegal (physical assault).
- seiferteric 3y ago
  I'm not even suggesting it has to happen at a legal level, but perhaps at a professional level, I would think any lawyer writing baseless threatening letters to people should be subject to losing there license.
  - kube-system 3y ago
    Writing a demand letter that leans in favor of your client's interests is not only okay, it is the standard course of action for a civil dispute. https://www.law.cornell.edu/wex/demand_letter https://www.law.cornell.edu/wex/demand_letter
    - seiferteric 3y ago
      Perhaps they shouldn't. If we lived in a world where lawyers were more cautions about what they attached there name to out of concern for losing their license we would probably be better off. Less bullying by corporations with lots of money etc. No problems with demand letters for legitimate issues that are well supported by evidence though.

SenAnder 3y ago

> And at the end of their threat they had a demand: don’t ever talk about your findings publicly. Essentially, if you agree to silence, we won’t pursue legal action. Legally, can this cover talking to e.g. state prosecutors and the police as well? Because claiming to be "100% secure", knowing you are not secure, and your users have no protection against spying from you or any minimally competent hacker, is fraud at minimum, but closer to criminal wiretapping, since you're knowingly tricking your users into revealing their secrets on your service, thinking they are "100% secure". That this ended "amicably" is frankly a miscarriage of justice - the Fizz team should be facing fraud charges.

SoftTalker 3y ago
They could be legitimately ignorant of their security vulnerabilities. That might go to negligence more than fraud.
- deleted 3y ago
  [deleted]
- SenAnder 3y ago
  They could not have been ignorant of storing non-anonymous, plain-text messages. Even if we don't count that as insecure, they can only appeal to ignorance/negligence up until the point the security researchers informed them of their vulnerabilities. After that, that they continued their "100% secure" marketing on one side, while threatening researchers into silence on the other, is plainly malicious.
manicennui 3y ago
I don't think the demands of Fizz have much legal standing. We care more about corporations than citizens in the US. Advertising in the US is full of false claims. We ignore this because we pretend like words have no meaning.
- sleepybrett 3y ago
  there is a carve out in the law for 'puffery', ie exaggerations. So 'the best hamburger in town' would be puffery.

mewse-hn 3y ago

Crazy story. The Stanford daily article has copies of the lawyer letters back and forth, they are intense - and we wouldn't be able to read them if the EFF didn't step up. https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...

wang_li 3y ago

Yet another example of someone security "testing" someone else's servers/systems without permission. That's called hacking. Doesn't matter if you have "good faith" or not. It's not your property and you don't get to access it in ways the owners don't desire you to access it without being subject to potential civil and criminal enforcement against you.

SenAnder 3y ago
Look at it from a consumer rights angle. A product is advertised as having some feature ("100% security" in this case), but nobody is allowed to test (even without causing any harm) if that is true. It's effectively legalizing fraud for a big chunk of computer security. Sure fraud itself is technically still illegal, but so is exposing it.
edwinjm 3y ago
If they don't do it, criminals will do it. I know what my preference is.
- InSteady 3y ago
  No, let's bury our heads in the sand while being sure to handicap (and treat as hostile) the only group of people who seem to care and have the expertise to do something about this giant mess we are in with regards to consumer, patient, and citizen data security.
Buttons840 3y ago
Meanwhile companies leak the private data of millions of people and nothing happens. If a curious kid does a port scan police will smash down doors. People will face decades in prison. If a negligent company leaks the private data of every single American, well, gee, what could we have done more, we had that one company do an audit and they didn't find anything and, gee, we're just really sorry, so lets all move on and here's a free year of credit monitoring which you may choose to continue paying us for at the end of the free year.
InSteady 3y ago

jbombadil 3y ago

I don't understand why in both contracts and legal communication (particularly threatening one), there is little to no consequence for the writing party to get things right. I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". The employer is basically trying to enforce their rules (reasonable), but they have no negative consequences if what they write is not allowed. At most a court deems that piece invalid, but that's it. The onus is on the reader to know (which tends to be a much weaker party). Same here. Why can a company send a threatening letter ("you'll go 20 years to federal prison for this!!"), when it's clearly false? Shouldn't there be an onus on the writer to ensure that what they write is reasonable? And if it's absurdly and provably wrong, shouldn't there be some negative consequences more than "oh, nevermind"?

bdowling 3y ago
It's a balance between encouraging people to stand up for their rights on one hand and discouraging filing of frivolous lawsuits on the other. The American system is "everyone pays their own legal fees", which encourages injured parties to file. The U.K. on the other hand is a "loser pays both parties' legal fees" (generally), which discourages a lot of plaintiffs from filing, even when they have been significantly harmed.
LastTrain 3y ago
There can be consequences, but you have to be able to demonstrate you have been harmed. So, in what way have you been harmed by such a threat, and what is just compensation? How much will it cost to hire a lawyer to sue for compensation, and what are your chances of success? These are the same kinds of questions the entity sending the threatening letter asked themselves as well. If you think it is unfair because they have more resources, well that is more of a general societal problem - if you have more money you have access to better justice in all forms.
fallingknife 3y ago
That's not the language they use. It will be more like "your actions may violate (law ref) and if convicted, penalties may be up to 20 years in prison." And how do you keep people from saying that? It's basically a statement of fact. If you have a problem with this, then your issue is with Congress for writing such a vague law.

sublinear 3y ago

> Stay calm. I can’t tell you how much I wanted to curse out the Fizz team over email. But no. We had to keep it professional — even as they resorted to legal scare tactics. Your goal when you get a legal threat is to stay out of trouble. To resolve the situation. That’s it. The temporary satisfaction of saying “fuck you” isn’t worth giving up the possibility of an amicable resolution. Maybe it's because I'm getting old, but it would never cross my mind to take any of this personally. If they're this bad at security, this bad at marketing, and then respond to a fairly standard vulnerability disclosure with legal threats it's pretty clear they have no idea what they're doing. Being the "good guy" can sometimes be harder than being the "bad guy", but suppressing your emotions is a basic requirement for being either "guy".

ngai_aku 3y ago
> If they're this bad at security, this bad at marketing, and then respond to a fairly standard vulnerability disclosure with legal threats it's pretty clear they have no idea what they're doing. And yet, according to the linked article in the Stanford Daily, they received $4.5 million in funding
kdmccormick 3y ago
> Maybe it's because I'm getting old Yup, that's it :) These kids are either in college or just graduated. They were smart enough to get themselves legal help before saying anything stupid, which is impressive. Cut them some slack!
- sublinear 3y ago
  My ego has probably by now rewritten my memories to match who I am today. This situation seems like it would have had me and my friends laughing, not scared. Brains are weird.

f0e4c2f7 3y ago

I feel like this article reflects an overall positive change in the way disclosure is handled today. Back in the 90s this was the sort of thing every company did. Companies would threaten lawsuits, or disclosure in the first place seemed legally dubious. Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. Sure you still get some of that today. An especially old fashioned company, or in this case naive college students but overall things have shifted quite dramatically in favor of disclosure. Dedicated middle men who protect security researcher's identities, Large enterprises encouraging and celebrating disclosure, six figure bug bounties, even the laws themselves have changed to be more friendly to security researchers. I'm sure it was quite unpleasant to go through this for the author, but it's a nice reminder that situations like this are now somewhat rare as they used to be the norm (or worse).

formerly_proven 3y ago
> Suggestions of anonymous email accounts and that sort of thing. This is still the way to go even in many western countries.
_greim_ 3y ago
I wonder if this was the students' attempt to protect their future careers as much as anything—"keep quiet about this or else"—especially given the issues were quickly fixed. In that sense it differs from the classic 90s era retaliation. From the students' POV it was probably quite terrifying. I wouldn't discount intervention by wealthy parents either, but of course I know nothing of the situation or the people involved.
lamontcg 3y ago
The problem is that it is still entirely illegal to do this kind of hacking without any permission. The fact that a lot of companies have embraced bug bounties and encourage this kind of stuff against them unfortunately teaches "kids" that this kind of thing is perfectly legal/moral/ethical/etc. As this story shows though you're really rolling the dice, even though it worked out in this case. > Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing. This is probably still a better idea if you don't have the cooperation of the target of the hack via some stated bug bounty program. But that doesn't help the security researcher "make a name" for themselves. And you're basically admitting to the fact that you trespassed, even if all you did was the equivalent of walking through an unlocked door and verifying that you could look inside their refrigerator. The fact that it may play out in the court of public opinion that you were helping to expose the lies of a corporation doesn't change the fact than in the actual courts you are guilty of a crime.

JakeAl 3y ago

In short, if they are a company and are not 100% secure and they say they are then they are committing fraud. The person doing the testing is providing the evidence for a legal case and no amount of legal threats change that.

icameron 3y ago

The Stanford Daily article says “At the time, Fizz used Google’s Firestore database product to store data including user information and posts...Fizz did not have the necessary security rules set up, making it possible for anyone to query the database directly...phone numbers and/or email addresses for all users were fully accessible, and that posts and upvotes were directly linkable to this identifiable information....Moreover, the database was entirely editable — it was possible for anyone to edit posts, karma values, moderator status, and so on." That's wild!

iancarroll 3y ago
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able to get admin access to an electric scooter company by updating my Firebase user to have isAdmin set to true, and then I accidentally deleted the scooter I was renting from Firebase. I am not sure what happened to it after that.
- yismail 3y ago
  If I recall correctly, you can set your firebase rules such that a user can only read/write/delete certain collections based on conditions such as if user.email == collection.email.
  - justrealist 3y ago
    Doing authorization within firestore breaks down instantly outside of toy applications.
- jacquesm 3y ago
  I think deleting a scooter is against some law of conservation :)
- singleshot_ 3y ago
  One interesting thing about the statute of limitations is “the discovery rule.” For example, say the statute of limitations for 18 USC 1030 is two years. If a person hypothetically stole a scooter by hacking, two years later, they would be in the clear, right? No. The discovery rule says that if a damaged party, for good reason, does not immediately discover their loss, the statutes of limitations is paused until they do. Accordingly, if the scooter company read a post today about a hack that happened “a long time ago” and therein discovered their loss, the statute of limitations would begin to tick today and the hacker could be in legal jeopardy for two more years.

simonw 3y ago

I found this story about the same situation (linked from the OP) easier to follow: https://saligrama.io/blog/post/firebase-insecure-by-default/ https://saligrama.io/blog/post/firebase-insecure-by-default/

epoch_100 3y ago
Adi's writeup is great, and goes much more into the technical detail than my transcript. I really recommend everyone checks out his post.

SoftTalker 3y ago

A private individual or company cannot file criminal/felony charges. Those are filed by a County Prosecutor, District Attorney, State Attorney, etc after being convinced of probable cause. They could threaten to report you to the police or such authorities, but they would have to turn over their evidence to them and to you and open all their relevant records to you via discovery. > Get a lawyer Yes, if they're seriously threatening legal action they already have one.

epoch_100 3y ago
Yes, threatening to report is what was really happening here. But in their effort to scare us, they elided much of that process. From our perspective it was "watch out, you might face felony charges if you don't agree to silence".
- deleted 3y ago
  [deleted]
aidenn0 3y ago
Isn't threatening to report someone to the authorities if you don't do something extortion?
- gingerrr 3y ago
  As the linked article notes, it's explicitly against the California State Bar Code of Conduct to condition criminal proceedings on requiring a civil outcome, so while not technically illegal it's censurable - that's against the attorneys who threatened, not the clients they represent.
  - aidenn0 3y ago
    What I'm pondering is how what happened in TFA is different from a situation like: 1. I (legally) gather evidence of a neighbor committing a criminal action; e.g. take a picture of them selling illicit drugs. 2. I threaten to send the evidence to the authorities unless they pay me money. That seems like blackmail to me, which is illegal under both state and federal law. The only difference I can think of is the consideration. If the consideration must be property for it to count as blackmail, then what about this situation: 1. I'm engaged in a civil dispute with my neighbor 2. I gather evidence of them committing a criminal action 3. I threaten to reveal the evidence unless they settle in my favor Does that magically become legal because no money exchanges hands?

hitekker 3y ago

Interestingly, Ashton Cofer and Teddy Solomon of Fizz tried some PR damage control when their wrongdoing came to light https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/#comment-6034722532 https://stanforddaily.com/2022/11/01/opinion-fizz-previously.... Their response was weak and it seems like they've refused to comment on the debacle since then.

mustacheemperor 3y ago
Per the Stanford Daily article linked in the OP [0], they have also removed the statement addressing this incident and supposed improvements from their website. >Although Fizz released a statement entitled “Security Improvements Regarding Fizz” on Dec. 7, 2021, the page is no longer navigable from Fizz’s website or Google searches as of the time of this article’s publication. And, it seems likely the app still stores personally identifiable information about its "anonymous" users' activity. > Moreover, we still don’t know whether our data is internally anonymized. The founders told The Daily last year that users are identifiable to developers. Fizz’s privacy policy implies that this is still the case I suppose the 'developers' may include the same founders who have refused to comment on this, removed their company's communications about it, and originally leveraged legal threats over being caught marketing a completely leaky bucket as a "100% secure social media app." Can't say I'm in a hurry to put my information on Fizz.
- omoikane 3y ago
  "Security Improvments Regarding Fizz": https://web.archive.org/web/20220204044213/https://fizzsocial.app/_/securityimprovements.html https://web.archive.org/web/20220204044213/https://fizzsocia... What I was looking for was if they really had a page that claimed "100% secure", but I don't think that was captured by archive.org

lxe 3y ago

There should be harsher penalties for lawyers like Hopkins & Carley for threatening security researchers and engaging in unprofessional conduct like this.

tptacek 3y ago

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity they obtained * The researchers were not given permission to do this testing If that fact pattern holds, then unless there's a California law governing this that I'm not aware of --- and even then, federal supremacy moots it, right? --- I think they did straightforwardly violate the CFAA, contra the claim in their response. At least three things mitigate their legal risk: 1. It's very clear from their disclosure and behavior after disclosing that they were in good faith conducting security research, making them an unattractive target for prosecution. 2. It's not clear that they did any meaningful damage (this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist), meaning there wouldn't have been much to prosecute. 3. Fizz's lawyers fucked up and threatened a criminal prosecution in order to obtain a valuable concession fro the researchers, which, as EFF points out, violates a state bar rule. I think the good guys prevailed here, but I'm wary of taking too many lessons from this; if this hadn't been "Fizz", but rather the social media features of Dunder Mifflin Infinity, the outcome might have been gnarlier.

kjjw 3y ago
[flagged]
hnav 3y ago
I think intent matters for actually securing an indictment and conviction, if for example they can prove that you exfiled their user data (this happened to Weev who noticed an ordinal ID in a URL and enumerated all possible URLs) they could actually get the feds to bust you. But you're right, if they're big enough they could try to come after your regardless at the risk of turning the security research community against them.
emilecantin 3y ago

hermannj314 3y ago

I realize it is quick to be against Fizz, but I thought ethical hacking required prior permission. Am I to understand you can attempt to hack any computer to gain unauthorized access without prior approval? That doesn't seem legal at all. Whether or not there was a vulnerability, was the action taken actually legal under current law? I don't see anything indicating for or against in the article. Just posturing that "ethical hacking" is good and saying you are secure when you aren't is bad. None of that seems relevant to the actual question of what the law says.

tptacek 3y ago
(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.
- wedn3sday 3y ago
  (a) all hacking is unethical? (b) the database was running in the cloud, not on any computer they controlled. (c) everyone's an asshole here
  - some_furry 3y ago
    > all hacking is unethical? No, that's not what tptacek said. "Ethical hacking" is from the same vein as "responsible disclosure". These are weasel words that are used to demean security researchers who don't kiss the vendors' ass. As a security researcher, my ethical obligation is not to the vendors of the software. It's to the users. Ethically speaking, I don't care if my research makes the vendor look bad, hurts their sales, makes their PR team sad, etc. I similarly don't care if my research makes the vendor look good. Are the users better protected by my research? If yes, ethical. If not, unethical. Terms like "ethical hacking" are used to stilt the conversation in the favor of vendors. > the database was running in the cloud, not on any computer they controlled. If it's running in the Cloud, but in your Cloud account, it's morally equivalent to running on Your Machine. I'm not sure how the law will interpret anything, but given a compelling counter-argument, I don't imagine lawyers will argue differently. > everyone's an asshole here Yeah.

kjjw 3y ago

[flagged]

helaoban 3y ago

Don't you have to ask for permission to be white-hat?

jerf 3y ago
I'd suggest reading tptacek's comment: https://news.ycombinator.com/item?id=37298589 https://news.ycombinator.com/item?id=37298589 which does not 100% address your exact question, but gets close. As disclaimed, tptacek is not a lawyer, but has a lot of experience in this space and I'd still take it as a first pass answer. Personally, I don't see it as worth it to pursue a company that does not hang out some sort of public permission to poke at them. The upside is minimal and the downside significant. Note this is a descriptive statement, not a normative statement. In a perfect world... well, in a perfect world there'd be no security vulnerabilities to find, but... in a perfect world sure you'd never get in trouble for poking through and immediately backing off, but in the real world this story just happens too often. Takes all the fun right out of it. YMMV.

monksy 3y ago

Commentary on the journalism: Fantastic for calling Fizz out. "Fizz did not protect their users’ data. What happened next?" This isn't a "someone hacked them". It's that Fizz failed to do what they promised. I'm still curious to hear if the vulnerability has been tested to see if it's been resolved.

InSteady 3y ago
I think in a follow-up article by the Stanford Daily they said the app creators have gotten a few million in funding and lots of professional help, including to fix security issues. Although it still looks like user data is not fully anonymized internally like they had previously claimed.

jccalhoun 3y ago

This sounds a lot less interesting than the title makes it out to be. Is the fact that it is a "classmate" really relevant? Would the events have happened differently if it was another company with no connection to the school?

winter_blue 3y ago

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect their anonymity while doing all 3 of these. If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm, but also effectively killed off a company that shouldn't exist – since all of Buzz/Fizz users would likely abandon it as consequence.

AnimalMuppet 3y ago
So your solution for possibly being prosecuted for something marginal is to do several things for which it would be much more reasonable to be prosecuted? That seems like a rather unwise solution to the problem. It's especially unwise because you now give the company a massive incentive to hire real forensics specialists to try to track you down. You're placing a lot of faith in your ability to remain anonymous under that level of scrutiny.
pc86 3y ago
"To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.
- meepmorp 3y ago
  Well, at that point, the legal threats stop being baseless. Problem solved!
jstarfish 3y ago
> The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and [4] protect their anonymity while doing all 3 of these. Aaron Swartz only did (1). Failing at (4) didn't end so well for him. I get that you're frustrated but encouraging others to make martyrs of themselves is cowardice. If some dumb kid tries this and their opsec isn't bulletproof, they're fucked. Put your own skin in the game and do it yourself if your convictions are that strong.

wedn3sday 3y ago

Maybe its just my Oppositional Defiant Disorder talking, but I would have nuked their db after that bs threat.

rootusrootus 3y ago
> Maybe its just my Oppositional Defiant Disorder talking Is that the clinical term for Internet Tough Guy? I imagine deleting the DB would almost certainly lead to actual CFAA consequences. Which kinda suck, as I recall.
- xigency 3y ago
  Yeah, it’s unwise, but also a fair warning. If you threaten someone who has leverage over you, you might find your own problems escalated. Not everyone behaves perfectly rationally under pressure.

dfxm12 3y ago

Anyone can make a threat. There's a bit of smarts needed to classify a "threat" as credible or not. Only really a law enforcement officer can credibly bring charges against you. Unfortunately, we live in a society where someone with more money than you can use the courts to harass you, so you even if you don't fear illegitimate felony charges, you can get pretty much get sued for any reason at any time, which brings with it consequences if you don't have a lawyer to deal with it. So I understand why someone might be scared in this situation, and luckily they were able to find someone to work with them, pro bono. I really wish the law had some pro-active mechanism for dealing with this type of legal bullying.

deleted 3y ago

[deleted]

pie_R_sqrd 3y ago

Interesting. My school has a very similar platform, SideChat, which I doubt is much different. Makes me wonder how much they know about me, as I was permanently banned last year for questioning the validity of "gender-affirming care."

Zone3513 3y ago
[flagged]

deleted 3y ago

[deleted]

xeromal 3y ago

Thank the lord for the EFF.

Buttons840 3y ago

> And then, one day, they sent us a threat. A crazy threat. I remember it vividly. I was just finishing a run when the email came in. And my heart rate went up after I stopped running. That’s not what’s supposed to happen. They said that we had violated state and federal law. They threatened us with civil and criminal charges. 20 years in prison. They really just threw everything they could at us. And at the end of their threat they had a demand: don’t ever talk about your findings publicly. Essentially, if you agree to silence, we won’t pursue legal action. We had five days to respond. This during a time when thousands or millions have their personal data leaked every other week, over and over, because companies don't want to cut into their profits. Researchers who do the right thing face legal threats of 20 years in prison. Companies who cut corners on security face no consequences. This seems backwards. Remember when a journalist pressed F12 and saw that a Missouri state website was exposing all the personal data of every teacher in the state (including SSN, etc). He reported the security flaw responsibly and it was embarrassing to the State so the Governor attacked him and legally harassed him. https://arstechnica.com/tech-policy/2021/10/missouri-gov-calls-journalist-who-found-security-flaw-a-hacker-threatens-to-sue/ https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal... I once saw something similar. A government website exposing the personal data of licensed medical professionals. A REST API responded with all their personal data (including SSN, address, etc), but the HTML frontend wouldn't display it. All the data was just an unauthenticated REST call away, for thousands of people in the state. What did I do? I just closed the tab and never touched the site again. It wasn't worth the personal risk to try to do the right thing so I just ignored it and for all I know all those people had their data stolen multiple times over because of this security flaw. I found the flaw as part of my job at the time, I don't remember the details anymore. It has probably been fixed by now. Our legal system made it a huge personal risk to do the right thing, so I didn't do the right thing. Which brings me to my point. We need strong protections for those who expose security flaws in good faith. Even if someone is a grey hat and has done questionable things as part of their "research", as long as they report their security findings responsibly, they should be protected. Why have we prioritized making things nice and convenient for the companies over all else? If every American's data gets stolen in a massive breach, it's so sad, but there's nothing we can do (shrug). If one curious user or security research pokes an app and finds a flaw, and they weren't authorized to do so, OMG!, that person needs to go to jail for decades, how dare they press F12!!!1 This is a national security issue. While we continue to see the same stories of massive breaches in the news over and over and over, and some of us get yet another free year of monitoring that credit agencies don't commit libel against us, just remember that we put the convenience of companies above all else. They get to opt-in to having their security tested, and over and over they fail us. Protect security researchers, and make it legal to test the security of an app even if the owning company does not consent. </rant>

consoomer 3y ago

In my opinion, they went too far and exposed themselves by telling the company. In all honesty, nothing good usually comes from that. If you wanted the truth to be exposed, they would have been better off exposing it anonymously to the company and/or public if needed. It's one thing to happen upon a vulnerability in normal use and report it. It's a different beast to gain access to servers you don't own and start touching things.

datacruncher01 3y ago

Best advice I can give someone is never do security research for a company without expressed written consent to do so and document everything as agreed to. Payouts for finding bugs when there isn't an already established process are either not going to be worth your time or will be seen as malicious activity.

deleted 3y ago

[deleted]

1970-01-01 3y ago

Ethically, they did the good thing by challenging the "100% secure" claim. Legally, they were hacking (without permission). Very high praise to the EFF for getting them out of trouble. Go donate.

pityJuke 3y ago

Wait, they are a company called Fizz, that was formerly called Buzz [0]? Talk about on the nose. [0]: https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...

justincredible 3y ago
[dead]

withinrafael 3y ago

The article asserts "there are an increasing number of resources available to good-faith security researchers who face legal threats". Is there an example of such, outside of the EFF? How do beginners find them?

causality0 3y ago

Unless you're looking to earn a bounty, always disclose testing of this type anonymously. Clean device, clean wi-fi, new accounts. That way if they threaten you instead of thanking you you can just drop the exploit details publicly and wash your hands of it.

aa_is_op 3y ago

tl;dr?

nickdothutton 3y ago

The story has greatly reduced value without knowing who the individuals behind Fizz really are. So that we can avoid doing business with them. It would be different if Fizz was a product of a megacorporation. “Keep calm” and “be responsible” and “speak to a lawyer” are things I class as common sense. The gold nugget I was looking for was the red flashing shipwreck bouy/marker over the names.

meepmorp 3y ago
Ashton Cofer and Teddy Solomon, according to this article: https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again/ https://stanforddaily.com/2022/11/01/opinion-fizz-previously...

asynchronous 3y ago

TLDR on the actual hack, they forgot to set Firebase security rules, yet again. How do devs forget this step before raising 4.5 million in seed funding?

c4mpute 3y ago

That's why you always do anonymous immediate full disclosure. Nothing else is ethically viable. Nothing else protects the researcher.

utopcell 3y ago

Given the aggressive response from this company, it is less likely that it will become the target of any security researchers in the future (who wants the hassle ?). That by itself makes their app less secure in the long term. Also, who'd want to support founders with this "I will destroy you!, even though you helped me improve my system" mentality ? I wouldn't be surprised if this startup dies off from this info. Kudos to Cooper, Miles and Aditya for seeing this through.

gnicholas 3y ago
Alternatively, it will attract the attention of less-noble researchers who won't bother with responsible disclosure rules — they'll just leak data or tinker with the system. But I agree that well-intentioned security researchers will be less likely to look into this platform.

davesque 3y ago

I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline before you "go public?" Wouldn't that be something you do later on if it appears that they're just blowing you off and won't do anything about it? I don't think this applies to the reporter in this case, but it does seem like there's a bit of a trend in security research lately to capitalize on the publicity of finding a vulnerability for one's own personal branding. That feels a bit disingenuous. Not that the appropriate response would be to threaten someone with legal action.

Cheezewheel 3y ago
Do you disagree that Users might be entitled to know when a corporation is misusing their private, sensitive information? What is ethical does not begin and end with the corporations best interest, the users whose private information is being mishandled are the victims here, let us not lose perspective.
- InSteady 3y ago
  Users who have been falsely assured that their data is both totally anonymous and "100% secure." On the other hand, assuming the app creators we in far over their heads when it comes to proper security, I have to wonder if they started off cordially and then freaked out a short while later because after trying, they realized there was no possible way for them to correct the issue in the given timeline. So in desperation they resorted to something drastic (and arguably unethical) to cover their asses.
pie_flavor 3y ago
It doesn't give them any wiggle room to lead you on, it doesn't give you any wiggle room to say 'unacceptable or I blow the whistle tomorrow', it removes your judgement of the situation from the disclosure entirely. It is the safest option for people who are great at finding things worth disclosing but not so great at situation-judging. It's not about personal branding, it's about protecting the users of the app. Either the app fixes the vulnerability so the users are no longer in danger, or the users are made aware that they are in danger.

tamimio 3y ago

Attitude like that from companies/developers/etc. are the reason why a lot of white-hat security researchers are in fact grey-hat.

lightedman 3y ago

Those classmates committed felony extortion with their threat, just as an aside. That would've been a better legal threat to put on them as a offensive move, instead of using the EFF. "Sure you can attempt to have me jailed but your threat is clear-cut felony extortion. See you in the jail cell right there with me!"

kordlessagain 3y ago

More like fizzle.

michaelmrose 3y ago

Do you think that someone less ethically minded could have resolved the issue more simply by redirecting their landing page to a warning that the site was insecure and shutting it down incurring near zero personal risk of retaliation and letting people make an informed choice about continuing to use the site. This is wholly and obviously illegal but so is the described ethical hacking. You have adopted a complex nuanced strategy to minimize harm to all parties. This is great morally but as far as I can tell its only meaningful legally insofar as it makes folks less likely to go after you nothing about it makes your obviously illegal actions legal so if you are going to openly flout the law it makes sense to put less of a target on your back while you are breaking the law.

noam_compsci 3y ago

Makes me so happy to know EFF and ethical hackers like this exist. I know they can’t test every app and every situation, but that there are hobbyists like this is such a testimony to humanity.