4 ms·

> If you send a sufficiently vulnerable server a specially crafted request, you can get it to come back with "200 OK" and a list of everybody's credit card numb

> If you send a sufficiently vulnerable server a specially crafted request, you can get it to come back with "200 OK" and a list of everybody's credit card numbers. If, if, if, if. What Weev did was spoof what kind of client he was using. That's it. What you're suger coating here is using exploits to break into a secure system. That is, you encounter a secured system and find a way to circumvent that security. For the data Weev encountered was there any possible way to get a 401 response for the URLs?

AnthonyMouse 14y ago
>What you're suger coating here is using exploits to break into a secure system. No. Because using "exploits" (not a legally defined term AFAIK) doesn't necessarily mean that access was unauthorized. If you're the sysadmin for a remote server that you suddenly discover you can't login to with your account and that people are complaining that it's sending spam, and you smash the stack on a vulnerable application running on the server in order to regain control and shut it down, I should hope that wouldn't be "unauthorized access" and subject to criminal penalties. And then there's the fact that "exploit" is a fuzzy and undefined thing. Is changing "userid=4833" to "userid=4834" to get another user's account not an "exploit" but changing "userid=4833" to "userid=0" to get root access is? What if the maximum userid is 65535 and if you use "userid=65536" then it rolls back around and gives you root because it's equivalent to "userid=0" but doesn't get rejected like "userid=0" would? This is no way for a criminal law to operate. >For the data Weev encountered was there any possible way to get a 401 response for the URLs? Sure there was. If AT&T had configured their server properly then that's exactly what it would have given him. If I wanted to introduce some irony then I would have to ask you whether you were "blaming the victim" here.
- flyinRyan 14y ago
  I concede that it's a bit fuzzy at the moment, but my criteria would be that if a spider could have accidentally crawled this info then it can't be a crime. >Sure there was. If AT&T had configured their server properly then that's exactly what it would have given him. That's not a valid test. If a company decides they didn't want you to see something after the fact (as in this case) they can always just claim they didn't configured their servers how they meant to. >If I wanted to introduce some irony then I would have to ask you whether you were "blaming the victim" here. What blaming the victim? The victims were the people who's data got released. Since they trusted AT&T with it that would make AT&T responsible. Everyone is talking about Weev but chances are he wasn't the only person on the planet to know about this.
  - AnthonyMouse 14y ago
    >I concede that it's a bit fuzzy at the moment, but my criteria would be that if a spider could have accidentally crawled this info then it can't be a crime. I don't think that works as a test either. Spiders index whatever other websites link to. The URLs may have been trivial but if there were no public links to them then a spider wouldn't have followed them. And then on the other hand they would be on another website if anyone (like weev) had linked to them, which you can do just as easily with a link that will cause a buffer overrun, and the spider will then follow it and overrun the buffer. It's completely plausible for a search engine to provide you with a search hit which if you click on it will cause a buffer overflow on the destination server and give you root access to the machine, because some "hacker" posted such a link on their site and the search engine indexed it and put it in the database. >That's not a valid test. If a company decides they didn't want you to see something after the fact (as in this case) they can always just claim they didn't configured their servers how they meant to. That's what I'm saying. All prosecutions for "unauthorized access" are like that, because if the server had been configured properly then unauthorized access would be impossible, so when it's discovered that it was misconfigured after the fact, the server operator wants to go back and retroactively label the conduct as unauthorized even though their computer allowed it. There is certainly a matter of degree as to how far you had to go out of your way to get the server to do something you want it to do, but that is such a hopelessly vague and meaningless line between legal and illegal actions that (as Prof. Kerr has argued) it's potentially unconstitutional, to say nothing of whether it makes for good policy. >What blaming the victim? The victims were the people who's data got released. Again, that's the point. The law is stupid. The culpable party here is AT&T for putting its customers' info at risk. The party being imprisoned is the one who publicized the vulnerability rather than the ones responsible for putting it into production. I don't know if I support actual criminal penalties just for operating a vulnerable server, but I certainly take issue with the idea that if you do that and then someone publicizes your incompetence, you should have the right to put them in prison for it based on some vague notion of having gone too far in proving the point.
    - flyinRyan 14y ago
      Very well, I guess we're probably in violent agreement.

AnthonyMouse 14y ago

>What you're suger coating here is using exploits to break into a secure system. No. Because using "exploits" (not a legally defined term AFAIK) doesn't necessarily mean that access was unauthorized. If you're the sysadmin for a remote server that you suddenly discover you can't login to with your account and that people are complaining that it's sending spam, and you smash the stack on a vulnerable application running on the server in order to regain control and shut it down, I should hope that wouldn't be "unauthorized access" and subject to criminal penalties. And then there's the fact that "exploit" is a fuzzy and undefined thing. Is changing "userid=4833" to "userid=4834" to get another user's account not an "exploit" but changing "userid=4833" to "userid=0" to get root access is? What if the maximum userid is 65535 and if you use "userid=65536" then it rolls back around and gives you root because it's equivalent to "userid=0" but doesn't get rejected like "userid=0" would? This is no way for a criminal law to operate. >For the data Weev encountered was there any possible way to get a 401 response for the URLs? Sure there was. If AT&T had configured their server properly then that's exactly what it would have given him. If I wanted to introduce some irony then I would have to ask you whether you were "blaming the victim" here.

flyinRyan 14y ago
I concede that it's a bit fuzzy at the moment, but my criteria would be that if a spider could have accidentally crawled this info then it can't be a crime. >Sure there was. If AT&T had configured their server properly then that's exactly what it would have given him. That's not a valid test. If a company decides they didn't want you to see something after the fact (as in this case) they can always just claim they didn't configured their servers how they meant to. >If I wanted to introduce some irony then I would have to ask you whether you were "blaming the victim" here. What blaming the victim? The victims were the people who's data got released. Since they trusted AT&T with it that would make AT&T responsible. Everyone is talking about Weev but chances are he wasn't the only person on the planet to know about this.
- AnthonyMouse 14y ago
  >I concede that it's a bit fuzzy at the moment, but my criteria would be that if a spider could have accidentally crawled this info then it can't be a crime. I don't think that works as a test either. Spiders index whatever other websites link to. The URLs may have been trivial but if there were no public links to them then a spider wouldn't have followed them. And then on the other hand they would be on another website if anyone (like weev) had linked to them, which you can do just as easily with a link that will cause a buffer overrun, and the spider will then follow it and overrun the buffer. It's completely plausible for a search engine to provide you with a search hit which if you click on it will cause a buffer overflow on the destination server and give you root access to the machine, because some "hacker" posted such a link on their site and the search engine indexed it and put it in the database. >That's not a valid test. If a company decides they didn't want you to see something after the fact (as in this case) they can always just claim they didn't configured their servers how they meant to. That's what I'm saying. All prosecutions for "unauthorized access" are like that, because if the server had been configured properly then unauthorized access would be impossible, so when it's discovered that it was misconfigured after the fact, the server operator wants to go back and retroactively label the conduct as unauthorized even though their computer allowed it. There is certainly a matter of degree as to how far you had to go out of your way to get the server to do something you want it to do, but that is such a hopelessly vague and meaningless line between legal and illegal actions that (as Prof. Kerr has argued) it's potentially unconstitutional, to say nothing of whether it makes for good policy. >What blaming the victim? The victims were the people who's data got released. Again, that's the point. The law is stupid. The culpable party here is AT&T for putting its customers' info at risk. The party being imprisoned is the one who publicized the vulnerability rather than the ones responsible for putting it into production. I don't know if I support actual criminal penalties just for operating a vulnerable server, but I certainly take issue with the idea that if you do that and then someone publicizes your incompetence, you should have the right to put them in prison for it based on some vague notion of having gone too far in proving the point.
  - flyinRyan 14y ago
    Very well, I guess we're probably in violent agreement.