4 ms·

> You are not entitled to conduct your own security tests of other people's applications. Leave them alone. Your attitude is part of the problem and why we nee

by meritt 14y ago

> You are not entitled to conduct your own security tests of other people's applications. Leave them alone. Your attitude is part of the problem and why we need a solution. Let's create an analogy: I drop off my daughter at daycare, I've entrusted this place of business with something vital to me, as have numerous other customers. I get off work early to go pick up my daughter, upon arrival, I find the guardian eating lunch in an adjacent room and the children are left completely unattended. This is clearly a problem on numerous levels. So what do I do? Do I politely inform the administration of the issue and hope they will fix things immediately? What if they blow me off and do not discipline nor change policy? Do I withdraw my child's enrollment and just blindly hope that other customers know of their utter disregard for the trust we've placed in them? Do I report them to the police or child protective services? Do I picket the business and attempt to inform other people of the issues? What if informing the public simultaneously informs some criminals of the ability to do some baby snatching? In this scenario, a parent actually has some legal recourse options to ensure the problem is fixed. The issue in web security is there is no governing authority to report the problem to and if we take our findings public, we place other customer's information at risk and put ourselves in a position of legal risk as well. We get branded a "criminal hacker" and find ourselves off to jail.

tptacek 14y ago
Two things. First, you're responding to a factual argument with an argument about my attitude. It is not "my attitude" that people "shouldn't" be entitled to test applications. It is a fact that they are not allowed to do that. Unauthorized access to computer systems, which has a broad but actually very straightforward definition, is unlawful. If you cause damages when you do it, you're liable for civil damages. If you attempt in any way to profit from having done it, you're liable for a felony charge. Second, arguing about this stuff by analogy is perilous. You can see that here, because it's immediately obvious that observing your child's caretaker eating lunch is not comparable to breaking into a web application to steal a database over the span of several days. To attempt to equalize the analogy, imagine that instead of simply observing your child's caretaker, you instead break into that caretaker's residence or place of work. You've now committed a felony. I am for many obvious reasons pro- security testing, and I'm happy to speak glowingly of the companies that have set up policies to make it safer for researchers to test their sites. In advice I've provided on HN and to startups, I've consistently told companies to create pages to thank security researchers. Having said all that: if you don't have permission to test someone's web app, don't do it. The law very reasonably says that if a company doesn't want to submit itself to unauthorized intrusive testing by strangers, it is entitled to treat its applications, its servers, and the data it holds as private property. Not every case in which a stranger pokes for flaws in someone's app will be open- and- shut, and that's for the best too. But the rule of thumb is very simple: leave other people's apps alone.
- meritt 14y ago
  (To be clear, I'm speaking more broadly about the topic and absolutely not condoning the weev's alleged actions. Lack of responsible disclosure, discussion of profiting from the flaw and exploiting it far beyond simple validation tests are all going to make it very difficult for him.) Observing sequential identifiers in a URL and validating a gaping security hole is hardly something I'd classify along the lines of "stealing a database" nor should it be considered "unauthorized access", however the judicial system clearly feels different and that's the sort of changes I'm advocating that need to be adjusted. Of course, discussing legislation changes that would allow anyone to execute security testing is probably not a very lucrative topic with the founder of a company that provides security research & testing.
  - tptacek 14y ago
    A.A. and his alleged coconspirator may be exonerated, so maybe you're right. But using a flaw like this to download 100,000 email addresses, and then select from those addresses those of prominent members of the media to do outreach for a PR campaign, all the while talking on IRC about selling the addresses to spammers --- that's something more than simply observing increasing numeric IDs. Your last sentence is needlessly and pointlessly hostile. If I was arguing out of personal interest, I wouldn't be recommending that companies pre-consent to having strangers test their web apps by setting up thank-you pages, now would I?
  - danielweber 14y ago
    That last sentence is incredibly lame. I've had problems with 'tptacek (from an incident several years ago that I'm finally over) but he argues for security policies that he believes work, not those that are in his interest. A wild-west attitude, with every man for himself, no-holds-barred, no-legal-resource-when-you-are-hacked is the best possible thing for security people, who would be kingmakers in such a universe.
    - chc 14y ago
      The security field in such a universe would be a gigantic, insanely lucrative shakedown racket. "I can help harden your systems against attacks — or I can just steal your customer database and sell their info to these nice Russian gentlemen. Whichever you prefer."
danielweber 14y ago
"I showed up early and saw something really bad" is hardly the same category as "I decided to test the security of someone else's webapp." If weev did nothing and randomly got someone else's private data sent to him (and people have reported similar incidents here on HN), that would be similar. Is the list of questions in your 4th paragraph meant to say that weev had no hope to get this fixed besides writing a tool that pulled down the information of thousands of users and then taking it to the press? We get branded a "criminal hacker" and find ourselves off to jail. It's not that hard to avoid landing in jail for computer crimes.

by meritt 14y ago

tptacek 14y ago

Two things. First, you're responding to a factual argument with an argument about my attitude. It is not "my attitude" that people "shouldn't" be entitled to test applications. It is a fact that they are not allowed to do that. Unauthorized access to computer systems, which has a broad but actually very straightforward definition, is unlawful. If you cause damages when you do it, you're liable for civil damages. If you attempt in any way to profit from having done it, you're liable for a felony charge. Second, arguing about this stuff by analogy is perilous. You can see that here, because it's immediately obvious that observing your child's caretaker eating lunch is not comparable to breaking into a web application to steal a database over the span of several days. To attempt to equalize the analogy, imagine that instead of simply observing your child's caretaker, you instead break into that caretaker's residence or place of work. You've now committed a felony. I am for many obvious reasons pro- security testing, and I'm happy to speak glowingly of the companies that have set up policies to make it safer for researchers to test their sites. In advice I've provided on HN and to startups, I've consistently told companies to create pages to thank security researchers. Having said all that: if you don't have permission to test someone's web app, don't do it. The law very reasonably says that if a company doesn't want to submit itself to unauthorized intrusive testing by strangers, it is entitled to treat its applications, its servers, and the data it holds as private property. Not every case in which a stranger pokes for flaws in someone's app will be open- and- shut, and that's for the best too. But the rule of thumb is very simple: leave other people's apps alone.

meritt 14y ago
(To be clear, I'm speaking more broadly about the topic and absolutely not condoning the weev's alleged actions. Lack of responsible disclosure, discussion of profiting from the flaw and exploiting it far beyond simple validation tests are all going to make it very difficult for him.) Observing sequential identifiers in a URL and validating a gaping security hole is hardly something I'd classify along the lines of "stealing a database" nor should it be considered "unauthorized access", however the judicial system clearly feels different and that's the sort of changes I'm advocating that need to be adjusted. Of course, discussing legislation changes that would allow anyone to execute security testing is probably not a very lucrative topic with the founder of a company that provides security research & testing.
- tptacek 14y ago
  A.A. and his alleged coconspirator may be exonerated, so maybe you're right. But using a flaw like this to download 100,000 email addresses, and then select from those addresses those of prominent members of the media to do outreach for a PR campaign, all the while talking on IRC about selling the addresses to spammers --- that's something more than simply observing increasing numeric IDs. Your last sentence is needlessly and pointlessly hostile. If I was arguing out of personal interest, I wouldn't be recommending that companies pre-consent to having strangers test their web apps by setting up thank-you pages, now would I?
- danielweber 14y ago
  That last sentence is incredibly lame. I've had problems with 'tptacek (from an incident several years ago that I'm finally over) but he argues for security policies that he believes work, not those that are in his interest. A wild-west attitude, with every man for himself, no-holds-barred, no-legal-resource-when-you-are-hacked is the best possible thing for security people, who would be kingmakers in such a universe.
  - chc 14y ago
    The security field in such a universe would be a gigantic, insanely lucrative shakedown racket. "I can help harden your systems against attacks — or I can just steal your customer database and sell their info to these nice Russian gentlemen. Whichever you prefer."

danielweber 14y ago

"I showed up early and saw something really bad" is hardly the same category as "I decided to test the security of someone else's webapp." If weev did nothing and randomly got someone else's private data sent to him (and people have reported similar incidents here on HN), that would be similar. Is the list of questions in your 4th paragraph meant to say that weev had no hope to get this fixed besides writing a tool that pulled down the information of thousands of users and then taking it to the press? We get branded a "criminal hacker" and find ourselves off to jail. It's not that hard to avoid landing in jail for computer crimes.