4 ms·

genuinely interested in the last known story of someone going to prison for this type of pen testing without an established bug bounty.

aspenmayer 1y ago
This story is a pen test gone wrong, so somewhat different, but illustrates some of the same failure modes. https://www.darkreading.com/vulnerabilities-threats/dark-reading-confidential-pen-test-arrests-five-years-later https://www.darkreading.com/vulnerabilities-threats/dark-rea...
- aspenmayer 1y ago
  More info here: https://iowacapitaldispatch.com/2023/06/23/lawsuit-over-authorized-break-in-at-county-courthouse-moves-to-federal-court/ https://iowacapitaldispatch.com/2023/06/23/lawsuit-over-auth...
  - 12_throw_away 1y ago
    Oh, this is a rabbit hole. As far as I can tell the pentesters' suit against the sheriff is still ongoing, but back in Iowa courts. The federal court's ruling is ... not good [1]: 1) The court found that the county sheriff had the pentesters arrested and encouraged their prosecution _not_ because he believed there was any crime, but instead that was angry at some state official. (Which, y'know, sounds like a pretty serious civil rights violation.) 2) However, the civil rights / 4th amendment claims were dismissed by the federal court due to "qualified immunity", the doctrine where, in any sufficiently "unique" or "specific" situation, the police have no liability whatsoever for their actions [2]. [1] https://storage.courtlistener.com/recap/gov.uscourts.iasd.84192/gov.uscourts.iasd.84192.25.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.iasd.84... [2] https://en.wikipedia.org/wiki/Qualified_immunity https://en.wikipedia.org/wiki/Qualified_immunity
    - aspenmayer 1y ago
      Thanks for finding the court docs! Darknet Diaries has an episode on this (#59), with interviews from the parties involved. https://www.youtube.com/watch?v=Y0AbHKcIQxk https://www.youtube.com/watch?v=Y0AbHKcIQxk https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
mixdup 1y ago
https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach
sunaookami 1y ago
Not prison but in Germany someone was fined last year because he reported a plaintext password inside an EXE: https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal-confirms-guilt-of-security-researcher-10007206.html https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal... The company in questions is the Modern Solution GmbH & Co. KG.

aspenmayer 1y ago

This story is a pen test gone wrong, so somewhat different, but illustrates some of the same failure modes. https://www.darkreading.com/vulnerabilities-threats/dark-reading-confidential-pen-test-arrests-five-years-later https://www.darkreading.com/vulnerabilities-threats/dark-rea...

aspenmayer 1y ago
More info here: https://iowacapitaldispatch.com/2023/06/23/lawsuit-over-authorized-break-in-at-county-courthouse-moves-to-federal-court/ https://iowacapitaldispatch.com/2023/06/23/lawsuit-over-auth...
- 12_throw_away 1y ago
  Oh, this is a rabbit hole. As far as I can tell the pentesters' suit against the sheriff is still ongoing, but back in Iowa courts. The federal court's ruling is ... not good [1]: 1) The court found that the county sheriff had the pentesters arrested and encouraged their prosecution _not_ because he believed there was any crime, but instead that was angry at some state official. (Which, y'know, sounds like a pretty serious civil rights violation.) 2) However, the civil rights / 4th amendment claims were dismissed by the federal court due to "qualified immunity", the doctrine where, in any sufficiently "unique" or "specific" situation, the police have no liability whatsoever for their actions [2]. [1] https://storage.courtlistener.com/recap/gov.uscourts.iasd.84192/gov.uscourts.iasd.84192.25.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.iasd.84... [2] https://en.wikipedia.org/wiki/Qualified_immunity https://en.wikipedia.org/wiki/Qualified_immunity
  - aspenmayer 1y ago
    Thanks for finding the court docs! Darknet Diaries has an episode on this (#59), with interviews from the parties involved. https://www.youtube.com/watch?v=Y0AbHKcIQxk https://www.youtube.com/watch?v=Y0AbHKcIQxk https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/

mixdup 1y ago

https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

sunaookami 1y ago

Not prison but in Germany someone was fined last year because he reported a plaintext password inside an EXE: https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal-confirms-guilt-of-security-researcher-10007206.html https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal... The company in questions is the Modern Solution GmbH & Co. KG.