6 ms·

Does anyone know exactly why it's illegal to take down Sality?

jbri 15y ago
The "takedown" technique presented works by exploiting the botnet's functionality to have all the machines remove themselves from the botnet - actually carrying out the removal requires you to hack into at least one third-party server, and it would probably count as gaining unauthorized access to each of the machines in the botnet as well.
micaeked 15y ago
the c&c servers are sites hacked by the owners of the botnet. you would have to hack them yourself and upload your own payload to take down peers
- aptwebapps 15y ago
  What if one of the site owners 'fixed' their server? That'd be nice and legal, wouldn't it?
jroll 15y ago
Sounds like the author figured out a SQL injection vulnerability in the website the bot downloads logos from, and a way to give the removal tool as the image in a way that infects Sality itself. This would distribute the removal tool very quickly. The hacking of the website seems to be the legal issue here.
lewi 15y ago
Because technically the methods used (i.e. SQL injection) are illegal if you dont own the equipment your using it on. Also he is a civilian and does not have any power or jurisdiction to do so.
- ertdfgcb 15y ago
  Slightly off-topic: Is SQL injection itself illegal? Because I was under the impression that only using SQL injection to gain unauthorized access to someone else's computer (like the OP is suggesting) was illegal.
  - azelfrath 15y ago
    You can do SQLi against your own database 24x7 and you'd be just fine in the eyes of the law.
colbyolson 15y ago
Is that network yours? No? Then it's illegal. It's an interesting way to have someone do the dirty work. I would love to see a postmortem writeup.
- derefr 15y ago
  Is "breaking into" a shanty town built on my neighbourhood's various front lawns illegal?
  - Tsagadai 15y ago
    In many countries, yes.
meepmorp 15y ago
Presumably because it involves exploiting a SQL injection attack on one or more control servers, and then using the control servers to install software on thousands of other people's computers without their knowledge or consent.
jonknee 15y ago
It's illegal in a similar manner to robbing a drug cartel--getting arrested is probably the least of your concerns. No one will step forward to law enforcement over it, but organized crime has their own law enforcement.
pluies_public 15y ago
Messing with other people's computers in any form without their information and consent is usually prohibited by law. A slightly broken analogy would be breaking into a house to remove a hornets nest. Even if you do it carefully and not do any damage and what you do is beneficial for the community as a whole, it's contrary to the law.
- piggity 15y ago
  If my neighbours hornets nest had killer hornets that were biting all the children in the neighbourhood and the police / council refused to do anything; then it'd be a damned shame if someone neatly removed the hornets nest. Of course that wouldn't make it any more legal; but your defence would have a field day with the prosecution I'd imagine. IANAL but I've watched the first double episode of The Firm, and I reckon I've got a pretty good grasp on how the law works now!
  - Frelette 15y ago
    Except that: we aren't 'ENTERING YOUR COMPUTER CASE'... we are removing code that you are running to infect other computers. There is no world equivalent, ridiculously phrased analogy that applies. You might want to just stay off the internet if you are afraid. Here's another example of fearful users, frozen into not doing anything: http://ddkportraits.com/2012/02/why-i-tearfully-deleted-my-pinterest-inspiration-boards/ http://ddkportraits.com/2012/02/why-i-tearfully-deleted-my-p...
  - polymatter 15y ago
    I'm curious now. What if my neighbours house was on fire? That fire threatens the whole neighbourhood. Surely I can protect my property by attempting to put out the fire. Do firefighters have indeminty for attempting to put out fires? What about volunteer firefighters? Obviously I consider a house on fire to be analagous to an infected computer, but I do have some protection putting out a fire right? Nobody would sue me for fire damage (as long as I'm reasonable etc).
    - DanBC 15y ago
brokentone 15y ago
While yes this is technically illegal, honest question does the letter of the law stand in a situation where those "wronged" by the infraction are themselves in the wrong? From a legal standpoint, charges would have to be brought against you by someone, and I doubt that anyone who sustained damage from this situation (the bot network's owner) would have the ability to demonstrate such a thing without substantially incriminating themselves. From a purely philosophical standpoint, you could take a utilitarian approach ala J.S. Mill and say that it would do the greatest quality of good to the greatest number of people to take such action. Granted at the point we're discussing philosophy, we're outside the judicial process which is all that's up for debate here.
- jacalata 15y ago
  'where those wronged by the infraction are themselves in the wrong' - it is certainly possible for this to be a crime, consider killing a burglar.
deleted 15y ago
[deleted]

jbri 15y ago

The "takedown" technique presented works by exploiting the botnet's functionality to have all the machines remove themselves from the botnet - actually carrying out the removal requires you to hack into at least one third-party server, and it would probably count as gaining unauthorized access to each of the machines in the botnet as well.

micaeked 15y ago

the c&c servers are sites hacked by the owners of the botnet. you would have to hack them yourself and upload your own payload to take down peers

aptwebapps 15y ago
What if one of the site owners 'fixed' their server? That'd be nice and legal, wouldn't it?

jroll 15y ago

Sounds like the author figured out a SQL injection vulnerability in the website the bot downloads logos from, and a way to give the removal tool as the image in a way that infects Sality itself. This would distribute the removal tool very quickly. The hacking of the website seems to be the legal issue here.

lewi 15y ago

Because technically the methods used (i.e. SQL injection) are illegal if you dont own the equipment your using it on. Also he is a civilian and does not have any power or jurisdiction to do so.

ertdfgcb 15y ago
Slightly off-topic: Is SQL injection itself illegal? Because I was under the impression that only using SQL injection to gain unauthorized access to someone else's computer (like the OP is suggesting) was illegal.
- azelfrath 15y ago
  You can do SQLi against your own database 24x7 and you'd be just fine in the eyes of the law.

colbyolson 15y ago

Is that network yours? No? Then it's illegal. It's an interesting way to have someone do the dirty work. I would love to see a postmortem writeup.

derefr 15y ago
Is "breaking into" a shanty town built on my neighbourhood's various front lawns illegal?
- Tsagadai 15y ago
  In many countries, yes.

meepmorp 15y ago

Presumably because it involves exploiting a SQL injection attack on one or more control servers, and then using the control servers to install software on thousands of other people's computers without their knowledge or consent.

jonknee 15y ago

It's illegal in a similar manner to robbing a drug cartel--getting arrested is probably the least of your concerns. No one will step forward to law enforcement over it, but organized crime has their own law enforcement.

pluies_public 15y ago

Messing with other people's computers in any form without their information and consent is usually prohibited by law. A slightly broken analogy would be breaking into a house to remove a hornets nest. Even if you do it carefully and not do any damage and what you do is beneficial for the community as a whole, it's contrary to the law.

piggity 15y ago
If my neighbours hornets nest had killer hornets that were biting all the children in the neighbourhood and the police / council refused to do anything; then it'd be a damned shame if someone neatly removed the hornets nest. Of course that wouldn't make it any more legal; but your defence would have a field day with the prosecution I'd imagine. IANAL but I've watched the first double episode of The Firm, and I reckon I've got a pretty good grasp on how the law works now!
- Frelette 15y ago
  Except that: we aren't 'ENTERING YOUR COMPUTER CASE'... we are removing code that you are running to infect other computers. There is no world equivalent, ridiculously phrased analogy that applies. You might want to just stay off the internet if you are afraid. Here's another example of fearful users, frozen into not doing anything: http://ddkportraits.com/2012/02/why-i-tearfully-deleted-my-pinterest-inspiration-boards/ http://ddkportraits.com/2012/02/why-i-tearfully-deleted-my-p...
- polymatter 15y ago
  I'm curious now. What if my neighbours house was on fire? That fire threatens the whole neighbourhood. Surely I can protect my property by attempting to put out the fire. Do firefighters have indeminty for attempting to put out fires? What about volunteer firefighters? Obviously I consider a house on fire to be analagous to an infected computer, but I do have some protection putting out a fire right? Nobody would sue me for fire damage (as long as I'm reasonable etc).
  - DanBC 15y ago

brokentone 15y ago

While yes this is technically illegal, honest question does the letter of the law stand in a situation where those "wronged" by the infraction are themselves in the wrong? From a legal standpoint, charges would have to be brought against you by someone, and I doubt that anyone who sustained damage from this situation (the bot network's owner) would have the ability to demonstrate such a thing without substantially incriminating themselves. From a purely philosophical standpoint, you could take a utilitarian approach ala J.S. Mill and say that it would do the greatest quality of good to the greatest number of people to take such action. Granted at the point we're discussing philosophy, we're outside the judicial process which is all that's up for debate here.

jacalata 15y ago
'where those wronged by the infraction are themselves in the wrong' - it is certainly possible for this to be a crime, consider killing a burglar.

deleted 15y ago

[deleted]