4 ms·

It's not similar at all. The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis. This wo

It's not similar at all. The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis. This would be like mistaking a door for the bathroom but find a closet full of gold instead.

User3456335 3y ago
He had access to the key by looking at the source code. The key wasn't intended to be used by him manually.
- ryandrake 3y ago
  I wonder if there was some kind of software license that stated that the developer was giving the user the key but the user wasn't permitted to use it. At least in that case, he would have known the company's intentions. I don't think we can otherwise know for sure the company's intentions. If I leave the front door to my house open (or if I tape the key to the outside of the door, to further strain the physical key analogy), is it my intention that people just come on in? We have no idea.
  - User3456335 3y ago
    Are you given a key if it is contained in the source code of a compiled binary that you are given?
- evilDagmar 3y ago
  ...except it was not the source code. Apparently right there in the application in cleartext. If what the investigator intended didn't matter, then what the vendor intended doesn't matter, either. He literally opened the application binary in a text editor to look for clues (despite the fact that there are common tools like `strings` for this) and saw the credentials, and since he'd been specifically hired to fix a problem with the database, he used those credentials to connect to the database. `SHOW DATABASES` would be a perfectly normal thing to type at this point, and apparently once he saw that these credentials granted access to everything he immediately stopped and logged out. If his lawyers had been better this would have never made it to court. Liability should have fallen on the contract customer, but for certain the design of Modern Solution's software and application were nothing short of wildy irresponsible. If they really face no risk for this, it's time for all German companies to start contracting firms in other countries where idiots aren't allowed to leave thousands of customers data exposed to the first schlub who happens to notice them.
deleted 3y ago
[deleted]
williamcotton 3y ago
Well, the key was already “given to him” by the nature of leaving it under the mat. Oh, but this is a food truck that he’s been visiting on a regular basis so obviously he’s allowed to go in the back door, with full access to all the ingredients and poking around inside the cash register? Also, if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.
- hypeatei 3y ago
  > leaving it under the mat. Nothing was "under the mat" since he was already using his PC to connect to the database with those same credentials. > if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing. Nothing was stolen, he informed the vendor of the issue immediately.
PurpleRamen 3y ago
But he had no right to examine the app, or enter the database outside the app. Even if that is a simple task for an expert, it's still an obvious difference between legitimate usage of the app, and illegitimate usage of the database. Wouldn't that account as reverse-engineering, which is often also illegal?
- williamcotton 3y ago
  We’re getting downvoted by the “I have no clue about how the criminal justice system works” brigade.
  - Ensorceled 3y ago
    You are getting down voted by people who understand that, while the situation is nuanced, it is NOT equivalent to flipping over the house mat at random house and entering it. It may not be totally akin to a security card opening more doors than it should, but it is entirely reasonable to assume that "the key in your copy of the app" is "your personal access key".
    - williamcotton 3y ago
      Well, apparently the courts think it is equivalent, at least in Germany and the United States. That you favor one argument over another as your lens with which to side when it comes to really stupid analogies, including mine, is entirely in bad faith.
      - hypeatei 3y ago
        So your argument is that since the courts think a certain way, that we should accept that and move on?
        williamcotton 3y ago
        I agree with the courts. Most people so outside of a vocal minority on this forum. What is you plan if you disaggre?

User3456335 3y ago

He had access to the key by looking at the source code. The key wasn't intended to be used by him manually.

ryandrake 3y ago
I wonder if there was some kind of software license that stated that the developer was giving the user the key but the user wasn't permitted to use it. At least in that case, he would have known the company's intentions. I don't think we can otherwise know for sure the company's intentions. If I leave the front door to my house open (or if I tape the key to the outside of the door, to further strain the physical key analogy), is it my intention that people just come on in? We have no idea.
- User3456335 3y ago
  Are you given a key if it is contained in the source code of a compiled binary that you are given?
evilDagmar 3y ago
...except it was not the source code. Apparently right there in the application in cleartext. If what the investigator intended didn't matter, then what the vendor intended doesn't matter, either. He literally opened the application binary in a text editor to look for clues (despite the fact that there are common tools like `strings` for this) and saw the credentials, and since he'd been specifically hired to fix a problem with the database, he used those credentials to connect to the database. `SHOW DATABASES` would be a perfectly normal thing to type at this point, and apparently once he saw that these credentials granted access to everything he immediately stopped and logged out. If his lawyers had been better this would have never made it to court. Liability should have fallen on the contract customer, but for certain the design of Modern Solution's software and application were nothing short of wildy irresponsible. If they really face no risk for this, it's time for all German companies to start contracting firms in other countries where idiots aren't allowed to leave thousands of customers data exposed to the first schlub who happens to notice them.

deleted 3y ago

[deleted]

williamcotton 3y ago

Well, the key was already “given to him” by the nature of leaving it under the mat. Oh, but this is a food truck that he’s been visiting on a regular basis so obviously he’s allowed to go in the back door, with full access to all the ingredients and poking around inside the cash register? Also, if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.

hypeatei 3y ago
> leaving it under the mat. Nothing was "under the mat" since he was already using his PC to connect to the database with those same credentials. > if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing. Nothing was stolen, he informed the vendor of the issue immediately.

PurpleRamen 3y ago

But he had no right to examine the app, or enter the database outside the app. Even if that is a simple task for an expert, it's still an obvious difference between legitimate usage of the app, and illegitimate usage of the database. Wouldn't that account as reverse-engineering, which is often also illegal?

williamcotton 3y ago
We’re getting downvoted by the “I have no clue about how the criminal justice system works” brigade.
- Ensorceled 3y ago
  You are getting down voted by people who understand that, while the situation is nuanced, it is NOT equivalent to flipping over the house mat at random house and entering it. It may not be totally akin to a security card opening more doors than it should, but it is entirely reasonable to assume that "the key in your copy of the app" is "your personal access key".
  - williamcotton 3y ago
    Well, apparently the courts think it is equivalent, at least in Germany and the United States. That you favor one argument over another as your lens with which to side when it comes to really stupid analogies, including mine, is entirely in bad faith.
    - hypeatei 3y ago
      So your argument is that since the courts think a certain way, that we should accept that and move on?
      - williamcotton 3y ago
        I agree with the courts. Most people so outside of a vocal minority on this forum. What is you plan if you disaggre?