6 ms·

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.

marcod 3y ago
While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable. If some less ethical hackers got a hold of that data, much worse things could have happened. * that's the biggest red flag. A company saying 100% obviously has very little actual security expertise. PS: I'm a big fan of Germany's https://www.ccc.de/en/ https://www.ccc.de/en/ who have pulled many such hacks against some of the biggest tech companies.
- skshfksjdj 3y ago
  Incentives usually have unintended consequences. The laws that would apply to unsolicited pentesting make it undesirable to perform it. Thus, society as a whole is less secure because someone wants to protect companies from hacking.
  - marcod 3y ago
    Yes, same with the more general "whistleblowers". Unethical companies will always try to punish those who expose them.
- dahwolf 3y ago
  Devil's advocate: I get into your home by bypassing (poor) security. I take pictures and make copies of anything inside. Then I publicly announce the breach and demand that you fix your security based on a deadline I made up. Then I say "trust me, bro" when I promise to never reveal the data I stole. Nobody would find any of that moral. The analogy breaks down because your home is not a place where sensitive data of lots of people is stored. But even then if you'd do the same thing in a physical place where this would be the case, you'd simply be arrested, if not (accidentally) shot. I do agree that these security researchers are ultimately doing a good thing, but they should not be this naive and aggressive about it.
  - bluepod4 3y ago
    Yeah, I sort of get your point. > So we did what any good security researcher does: We responsibly disclosed what we found. We wrote a detailed vulnerability disclosure report. We suggested remediations. And we proactively agreed not to talk about our findings publicly before an embargo date to give them time to fix the issues. Then we sent them the report via email. This is why the whole “I can’t believe my classmates threatened legal action” line of thinking doesn’t make sense. They weren’t acting like classmates themselves. They were acting like professionals. I imagine the embargo date wasn’t well-received. It’s also interesting that they listed all of the steps they followed that a “good security researcher” would do. So why didn’t they start with communication first before trying to hack the system? Good security researchers do that. (Not all of the time, obviously.) > Well, a me and few security-minded friends were drawn like moths to a flame when we heard that. Our classmates were posting quite sensitive stories on Fizz, and we wanted to make sure their information was secure. > So one Friday night… And this is where the “good-faith security research” line of reasoning broke down for me. Think about the wording. To my ears/eyes, those sentences above seem like a carefully crafted but still flimsy excuse. It’s like a lie that you tell yourself over and over so much that you end up believing it. It seems like the researchers just wanted to have some fun on a Friday night (like he said). (And there’s nothing wrong with that. But to characterize it as only doing “good faith security research” seems like a stretch.) I guess I’m saying that I’m just not convinced. I don’t buy it. But I get it. Articles need to be written. Talks needs to be given. (And yes, I do believe that Fizz didn’t need to threaten legal action.)
    - bawolff 3y ago
      > So why didn’t they start with communication first before trying to hack the system? Good security researchers do that. (Not all of the time, obviously.) I don't think that is true. I think it would be very unusual for an independent (not a pentester) security researcher to communicate anything before they have any findings. > It seems like the researchers just wanted to have some fun on a Friday night (like he said). (And there’s nothing wrong with that. But to characterize it as only doing “good faith security research” seems like a stretch.) I don't get it. Good faith research is fun. Most people don't get into the industry because they hate the work. I don't even understand what you are trying to imply was in their mind that would disqualify their actions from being in good faith.
paganel 3y ago
> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. I was looking for a comment like this. You couldn't pay me enough to do this sort of thing in this day and age (unless working for a DoD or 3-letter agency contractor, which would have my back covered), nevermind to do it pro bono or bona fide or whatever it is that these guys had in mind (either way, it looks like they were not paid to do it). This sort of action might still have been sort of ok-ish in the late '00s, maybe going into 2010, 2011, but when the Russian/Chinese/North Korean/Iranian cyber threats became real (plus the whole Snowden fiasco) then related laws began to change (both in the US and in Europe) and doing this sort of stuff with no-one to back you up for real (forget the EFF) meant that the one doing it would be asking for trouble in a big way.
px43 3y ago
A security researcher checking on Firestore permissions is basically the equivalent of an electrician walking into a grocery store and noticing sparking wires dangling and taped awkwardly, and imminent fire hazards that could result in catastrophic damages to people shopping at the store. It is absolutely the right, and IMO, the duty, of security researchers to test every website, app, product and service that they use regularly to ensure the continued safety of the general public. This is too important of a field to have a "not my problem" attitude of just ignoring egregious security vulnerabilities so they can be exploited by criminals.
negidius 3y ago
As a user, I definitely welcome it. It's necessary precisely because companies like this lie about their security practices and endanger their users. The question isn't whether it should be done, but whether it should be done anonymously or openly.
talideon 3y ago
You may want to read this, as it explains why no mea culpa was necessary: https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-... TL;DR: it was good faith security research, and the US DoJ doesn't prosecute that.
- theptip 3y ago
  Thanks, that does change the expectations a bit. Personally I'd still probably not engage in unsolicited (still illegal by the letter of the law) pentesting with just the promise that the DoJ won't prosecute as long as they agree it was in good faith. But I agree that pinkie promise does make it a bit less risky.
Jka9rhnDJos 3y ago
> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. Because bug bounties?
- theptip 3y ago
  Bug bounties are not “unsolicited”.
trailbits 3y ago
What about due diligence? If you're about to send and store sensitive information with a service, a service that claims to be 100% secure.... shouldn't you have the right to verify that the security is up to snuff? These researchers weren't attempting to harm anybody. What's wrong with kicking the tires?
sussmannbaka 3y ago
It’s both sane and welcome. the alternative to unsolicited testing is your app getting owned and your customer data being sold and you being sued into oblivion. unsolicited. Your vulnerability doesn’t cease to exist because you don’t want people to look at it.

marcod 3y ago

While what you say is true, I feel strongly that it shouldn't be. It is morally right to show if a product that is used by many fellow students is marketed as "100% secure"* is in fact very vulnerable. If some less ethical hackers got a hold of that data, much worse things could have happened. * that's the biggest red flag. A company saying 100% obviously has very little actual security expertise. PS: I'm a big fan of Germany's https://www.ccc.de/en/ https://www.ccc.de/en/ who have pulled many such hacks against some of the biggest tech companies.

skshfksjdj 3y ago
Incentives usually have unintended consequences. The laws that would apply to unsolicited pentesting make it undesirable to perform it. Thus, society as a whole is less secure because someone wants to protect companies from hacking.
- marcod 3y ago
  Yes, same with the more general "whistleblowers". Unethical companies will always try to punish those who expose them.
dahwolf 3y ago
Devil's advocate: I get into your home by bypassing (poor) security. I take pictures and make copies of anything inside. Then I publicly announce the breach and demand that you fix your security based on a deadline I made up. Then I say "trust me, bro" when I promise to never reveal the data I stole. Nobody would find any of that moral. The analogy breaks down because your home is not a place where sensitive data of lots of people is stored. But even then if you'd do the same thing in a physical place where this would be the case, you'd simply be arrested, if not (accidentally) shot. I do agree that these security researchers are ultimately doing a good thing, but they should not be this naive and aggressive about it.
- bluepod4 3y ago
  Yeah, I sort of get your point. > So we did what any good security researcher does: We responsibly disclosed what we found. We wrote a detailed vulnerability disclosure report. We suggested remediations. And we proactively agreed not to talk about our findings publicly before an embargo date to give them time to fix the issues. Then we sent them the report via email. This is why the whole “I can’t believe my classmates threatened legal action” line of thinking doesn’t make sense. They weren’t acting like classmates themselves. They were acting like professionals. I imagine the embargo date wasn’t well-received. It’s also interesting that they listed all of the steps they followed that a “good security researcher” would do. So why didn’t they start with communication first before trying to hack the system? Good security researchers do that. (Not all of the time, obviously.) > Well, a me and few security-minded friends were drawn like moths to a flame when we heard that. Our classmates were posting quite sensitive stories on Fizz, and we wanted to make sure their information was secure. > So one Friday night… And this is where the “good-faith security research” line of reasoning broke down for me. Think about the wording. To my ears/eyes, those sentences above seem like a carefully crafted but still flimsy excuse. It’s like a lie that you tell yourself over and over so much that you end up believing it. It seems like the researchers just wanted to have some fun on a Friday night (like he said). (And there’s nothing wrong with that. But to characterize it as only doing “good faith security research” seems like a stretch.) I guess I’m saying that I’m just not convinced. I don’t buy it. But I get it. Articles need to be written. Talks needs to be given. (And yes, I do believe that Fizz didn’t need to threaten legal action.)
  - bawolff 3y ago
    > So why didn’t they start with communication first before trying to hack the system? Good security researchers do that. (Not all of the time, obviously.) I don't think that is true. I think it would be very unusual for an independent (not a pentester) security researcher to communicate anything before they have any findings. > It seems like the researchers just wanted to have some fun on a Friday night (like he said). (And there’s nothing wrong with that. But to characterize it as only doing “good faith security research” seems like a stretch.) I don't get it. Good faith research is fun. Most people don't get into the industry because they hate the work. I don't even understand what you are trying to imply was in their mind that would disqualify their actions from being in good faith.

paganel 3y ago

> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. I was looking for a comment like this. You couldn't pay me enough to do this sort of thing in this day and age (unless working for a DoD or 3-letter agency contractor, which would have my back covered), nevermind to do it pro bono or bona fide or whatever it is that these guys had in mind (either way, it looks like they were not paid to do it). This sort of action might still have been sort of ok-ish in the late '00s, maybe going into 2010, 2011, but when the Russian/Chinese/North Korean/Iranian cyber threats became real (plus the whole Snowden fiasco) then related laws began to change (both in the US and in Europe) and doing this sort of stuff with no-one to back you up for real (forget the EFF) meant that the one doing it would be asking for trouble in a big way.

px43 3y ago

A security researcher checking on Firestore permissions is basically the equivalent of an electrician walking into a grocery store and noticing sparking wires dangling and taped awkwardly, and imminent fire hazards that could result in catastrophic damages to people shopping at the store. It is absolutely the right, and IMO, the duty, of security researchers to test every website, app, product and service that they use regularly to ensure the continued safety of the general public. This is too important of a field to have a "not my problem" attitude of just ignoring egregious security vulnerabilities so they can be exploited by criminals.

negidius 3y ago

As a user, I definitely welcome it. It's necessary precisely because companies like this lie about their security practices and endanger their users. The question isn't whether it should be done, but whether it should be done anonymously or openly.

talideon 3y ago

You may want to read this, as it explains why no mea culpa was necessary: https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-... TL;DR: it was good faith security research, and the US DoJ doesn't prosecute that.

theptip 3y ago
Thanks, that does change the expectations a bit. Personally I'd still probably not engage in unsolicited (still illegal by the letter of the law) pentesting with just the promise that the DoJ won't prosecute as long as they agree it was in good faith. But I agree that pinkie promise does make it a bit less risky.

Jka9rhnDJos 3y ago

> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. Because bug bounties?

theptip 3y ago
Bug bounties are not “unsolicited”.

trailbits 3y ago

What about due diligence? If you're about to send and store sensitive information with a service, a service that claims to be 100% secure.... shouldn't you have the right to verify that the security is up to snuff? These researchers weren't attempting to harm anybody. What's wrong with kicking the tires?

sussmannbaka 3y ago

It’s both sane and welcome. the alternative to unsolicited testing is your app getting owned and your customer data being sold and you being sued into oblivion. unsolicited. Your vulnerability doesn’t cease to exist because you don’t want people to look at it.