4 ms·

I don't see why an investigation into excessive logging requires running queries on a database.

lcnPylGDnU4H9OF 3y ago
If they connect with a desktop application, said application might run some queries against `INFORMATION_SCHEMA` in order to display schemas, tables, and columns. If the investigation is open-ended enough ("we have no idea so just figure it out"), then it might seem reasonable to connect to the database to see what it's about. It's already hard to see the malice in their actions but it's harder still when I consider that they immediately alerted the company who made the error. Even more when I consider that the company fixed the error. This developer did the company a favor and they had charges filed against them over it.
- formerly_proven 3y ago
  This is a high profile case because they went public with it, but I assure you, stuff like this happens a lot more frequently than you might think (the public can attend court proceedings in that country, but they are neither published nor publicized for the vast, vast majority of cases). It's why anyone remotely familiar with the legal situation (not just in germany, many countries have similarly broad laws, like CFAA or the Computer Misuse Act) will tell you to never ever, ever do vulnerability disclosure yourself to the responsible party.
  - ptx 3y ago
    What should you do instead? How would someone familiar with the legal situation disclose a vulnerability?
- hnbad 3y ago
  It doesn't have to be malicious, it can just be negligent. What he did was essentially digital trespass. He assumed the database only contained data for his client but he knew the database was hosted and operated by the vendor and did not ask for permission to access it. Instead he analyzed the software (in the most basic way, i.e. opening it in a text editor and looking for plaintext strings) to retrieve credentials and used those for accessing the third-party system without permission. It's of course ridiculous that the police and prosecution called this "decompilation" but I agree with them to a point: the password didn't spontaneously fall in his lap, he deliberately went out to look for it in the software itself, even if he found it in the most trivial way possible. And then he decided to use those credentials to access an external system he must have known did not belong to his client without asking for permission. This rapidly enters grey hat territory and crosses a legal line. I think it's right to be appalled by the mere act of opening the file in an editor being considered suspect by the prosecution but I also think it's important to understand that it wasn't just the software analysis that got him into trouble, it was the digital trespass that this enabled.

If they connect with a desktop application, said application might run some queries against `INFORMATION_SCHEMA` in order to display schemas, tables, and columns. If the investigation is open-ended enough ("we have no idea so just figure it out"), then it might seem reasonable to connect to the database to see what it's about. It's already hard to see the malice in their actions but it's harder still when I consider that they immediately alerted the company who made the error. Even more when I consider that the company fixed the error. This developer did the company a favor and they had charges filed against them over it.

formerly_proven 3y ago
This is a high profile case because they went public with it, but I assure you, stuff like this happens a lot more frequently than you might think (the public can attend court proceedings in that country, but they are neither published nor publicized for the vast, vast majority of cases). It's why anyone remotely familiar with the legal situation (not just in germany, many countries have similarly broad laws, like CFAA or the Computer Misuse Act) will tell you to never ever, ever do vulnerability disclosure yourself to the responsible party.
- ptx 3y ago
  What should you do instead? How would someone familiar with the legal situation disclose a vulnerability?
hnbad 3y ago
It doesn't have to be malicious, it can just be negligent. What he did was essentially digital trespass. He assumed the database only contained data for his client but he knew the database was hosted and operated by the vendor and did not ask for permission to access it. Instead he analyzed the software (in the most basic way, i.e. opening it in a text editor and looking for plaintext strings) to retrieve credentials and used those for accessing the third-party system without permission. It's of course ridiculous that the police and prosecution called this "decompilation" but I agree with them to a point: the password didn't spontaneously fall in his lap, he deliberately went out to look for it in the software itself, even if he found it in the most trivial way possible. And then he decided to use those credentials to access an external system he must have known did not belong to his client without asking for permission. This rapidly enters grey hat territory and crosses a legal line. I think it's right to be appalled by the mere act of opening the file in an editor being considered suspect by the prosecution but I also think it's important to understand that it wasn't just the software analysis that got him into trouble, it was the digital trespass that this enabled.