8 ms·

Changing from: https://payroll.example.com/SSN=000-00-0000 to: https://payroll.example.com/SSN=000-00-0001 shows intent to gain access that you were obv

• tptacek 13y ago
  I was referring the "wondering if blocking tracking cookies" question. I don't have a problem with criminalizing attempts to pull up random people by their SSN.
  • pyre 13y ago
    > I don't have a problem with criminalizing > attempts to pull up random people by their > SSN. If I see that the URL contains my SSN, and want to investigate if they were stupid enough to have this as a security hole, what are my options? You seem to say that if I pull up the page of someone else, I am immediately a criminal and need to go to jail. Should I instead report the possible issue to the company? Will they actually take, "I see that SSN is in the URL and that might be security hole, but I don't know for sure because I haven't attempted to try it," seriously? Hopefully they would, but I find that hope to be way more optimistic than the 'real world' should get credit for.
    • ceol 13y ago
      You don't get to break into a bank because you want to see if you can exploit a security hole. What you're talking about is more akin to wiggling the bank's door handle and then leaving. What weev did is break in, steal a bunch of documents, and then talk about selling them.
      • sneak 13y ago
        "Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. ATT admitted in court to publishing this data on the web. Emitting email addresses in response to ICCIDs was a specific feature they explicitly implemented to reduce the number of steps required to resubscribe to service, not a "security hole". Your physical analogy is inappropriate, and serves to frame his actions as criminal when they are clearly not. Please read the brief.
        • ceol 13y ago
          > "Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. No, it doesn't. See, this is what happens when you start talking about crimes on the internet when you really shouldn't be. If I leave all my doors and windows opened, or if I put a box of valuables in the middle of an empty lot that I own, it doesn't suddenly make it legal for people to steal from me. AT&T leaving their doors and windows open does not suddenly authorize any ol' grody troll to walk in and take personal information. Whether you like it or not, his crime will be made into a physical analogy.
          • bigiain 13y ago
            I _mostly_ agree with you. How about _this_ analogy? AT&T left a box of valuables in the middle of a lot they own, and weev walked by and grabbed them. Problem is, they weren't AT&T's valuables, they were mine and yours and 100,000 other peoples who'd entrusted AT&T with them. Now who's "the bad guy"? Who's the more culpable "criminal"? WHo would we be holding to account if it were a bank who'd piled up the cash from 100,000 people's savings accounts into a building with all its doors and windows open? Sure, what weev did was wrong. I don't think it was the _only_ wrong done here, or possibly even the "worst" wrong.
            • ceol 13y ago
              I think that's fair. AT&T should be reprimanded for a serious lack of security — how much they should be reprimanded would be another topic for debate. But it doesn't take away from weev's crime (both this one and his previous harassments.)
      • Maxious 13y ago
        A bank you say? http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... http://www.smh.com.au/it-pro/security-it/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html http://www.smh.com.au/it-pro/security-it/super-bad-first-sta...
    • tptacek 13y ago
      First, you don't actually have the right to conduct security testing on third party servers. Nor should you. Real application security testing is disruptive, and in authorized tests, companies often take pains to ensure that testers aren't exposed to real user data. Second, if you poke around to confirm the security or insecurity of an application, immediately report results to the target, and comply with requests for information, you may be civilly liable for damages (which it's unlikely anyone would pursue, given the PR implications) but are probably not violating the CFAA even as it's written today (that is: badly).
      • pyre 13y ago
        What is your plan to hold companies to task then? Especially when you can't confirm that your suspicions are correct? Responsible disclosure? Say that you disclose your concerns to them. How does that play out? 1. They respond to you. They say that it is not a security flaw. You just have to trust them that there is not security flaw. 2. They respond to you, and tell you that they will not fix it. You tell them that if they won't then you'll disclose it to the public. They try to claim that you are extorting them. 3. They don't respond to you. You disclose it to the public. Turns out that it wasn't a security flaw. You are sued for defamation/libel/etc. 4. They don't respond to you. You disclose it to the public. The company has egg on their face and fixes it. I think that the biggest flaw in the system is that companies are not held to task for their security flaws. I realize that if all software had to be perfect it would cripple the industry, but at the same time there has to be some idea of criminal (or at least civilly liable) negligence for people/companies that don't at least follow best practices.
        • tptacek 13y ago
          I don't think random strangers on the Internet conducting unauthorized testing are really making much of a difference either way, so the prospect of changing how much of that goes on doesn't really factor in for me.
          • nitrogen 13y ago
            Then what's the point of all the bug bounty programs out there?
    • stonemetal 13y ago
      If you can access your own record without authentication shouldn't that be good enough proof? Why do you need to access everyone else's information illegally to prove that your own is available without proper controls in place?
  • deleted 13y ago
    [deleted]
  • sneak 13y ago
    Why do you think it's reasonable to make people take a guess (even an educated one) at the intent of the site operator?
    • tptacek 13y ago
      The law is full of "reasonable person" tests like this.
      • pyre 13y ago
        Unfortunately, "reasonable person" varies with the times. In Nazi Germany, a "reasonable person" would have understood that the reason they lost WW1 was due to the Jews. /godwin [I also take issue with usage of the term 'common sense' because it is so nebulous.]
        • tptacek 13y ago
          If you want to re-litigate all of English Common Law, I've got no objection, but not much to contribute.
        • mpyne 13y ago
          "Reasonable person" varying with the times is actually kind of the point though. Laws exist to inform the actions of people, not computers. I think that's lost on people of our expertise sometimes when we start to seriously envision a world where there is no ambiguity whatsoever for a given action. But we've already seen a world like that: It's called 'zero tolerance' just as we see at schools in the U.S. and it's been, on the whole, a disaster. Anything other than zero tolerance or full tolerance leaves room for interpretation, no matter how much you try to pin it down. At least with 'reasonable person' tests we know that ahead of time.
          • pyre 13y ago
            While 'zero tolerance' is a disaster, I really don't like the law being too open-ended, because then I can never be certain how my actions will be interpreted in light of the law.
  • bigiain 13y ago
    Could we not turn that objection around to say we'd like to see implementations that allow exposure of random people's payroll data by typo-ed/bit-rotted/guessed SSNs should be criminalized? In my head, this is related to the "expectation of privacy in public" and "ubiquitous surveillance" arguments. If somebody makes available on the public internet, a system that reveals my payroll data "secured" only by an enumerable/guessable SSN - while an attacker exploiting that vulnerability is "in the wrong", so too in my opinion is the developer/management/company who deployed that system. It seems to me that AT&T should be being held to account for their actions at least as much as weev is. If the data weev acquired was worth prosecuting over, then AT&T need to be considered culpable/negligent for it's exposure.
    • tptacek 13y ago
      I have no problem with attaching penalties, perhaps even criminal ones, to negligence on the part of people deploying apps, too. I don't see why it has to be one or the other. Incidentally: I have literally no opinion about the Auernheimer case, so don't read anything into these comments.
    • anoncow 13y ago
      This could be the basis for a class action(?) lawsuit against AT&T for gross negligence in handling sensitive data.
  • krichman 13y ago
    This is absurd. If there's no access controls, but it's still a crime, we're going to have to determine if we can legally access all web addresses beforehand. But that's what 403 status codes are for.
    • mpyne 13y ago
      The same thing happens in real life all the time. We're supposed to use our brains and make ethical decisions on our own, not simply rely completely on technical safeguards to clue us into proper behavior.
      • reginaldjcooper 13y ago
        What he did was unethical. But the idea that connecting to a URL you changed on a hunch could ever be a felony is outrageous. Imagine if it had been comics published online. Because the server refuses to interact with your Chrome browser, you tell the website you are an IE. Because the "next" button is small, you use keyboard shortcuts to change the URL and view the next one. Without realizing it, you view a handful that weren't released yet. That's now a felony with a court precedent.
        • mpyne 13y ago
          Why does it have to be binary with all you guys? :P I didn't say weev deserved a felony conviction. I said he dun goofed, as a counterpoint to what many here are saying, that because the API he accessed was unauthenticated, it meant he did nothing wrong. That argument's completely bogus as well, just as much as a 2 year prison sentence for this is bogus.
          • krichman 13y ago
            I don't think what he did is ethical and I would be happy to see him jailed for an actual crime. But talking to a webserver isn't like entering a house. It's like making a phone call. "Hi.. my name is Firef--, I mean, Mobile Safari. Can I have your email?" I think creating a precedent for prosecution when accessing a number of web pages after spoofing a header is far, far worse than making an example of a troll that exploited a loophole to grab information that he shouldn't have. When talking to a webserver, without a clear separation between public and private with something like an API key or username/password, the only possible convictions we should allow is over DoS and that is only if there is malicious intent.
  • jcromartie 13y ago
    The problem is that criminals are free to harvest data thanks to insecure programming, while white-hat hackers are banned from discovering these vulnerabilities (hopefully) before they are exploited.
    • tptacek 13y ago
      There is not in fact an arms race going on between unauthorized white hat hackers and criminals.
• darkarmani 13y ago
  You are explicitly authorized by the specified policy that uses SSN to look up the data. If you aren't authorized, why is it sending you the data? If you make no effort to authenticate requests, I find it very unreasonable to act like any requests are unauthorized.
  • mpyne 13y ago
    So what about denial of service attacks going against just the public unauthenticated API? Just because AT&T does a boneheaded security implementation for which they deserve sanction, does not entitle weev or anyone else to go beyond ethical boundaries in discovering (and in weev's case, abusing) that security lapse.
    • darkarmani 13y ago
      I think DoS is covered by clauses other than just authorized or unauthorized. You can't legally DoS people even if you are an authorized user. > that security lapse. I don't think you can call this a lapse. It's not like they had passwords but forgot to change them. They designed it without any security.
      • mpyne 13y ago
        > They designed it without any security. Is that the only criterion now? You'll only do the ethical thing if someone else remembered to bake in technical safeguards?
• grey-area 13y ago
  What if someone makes a typo entering their SSN in the form that leads to this page, are they also a hacker? By your definition, they would be. If your data is on the internet and not secured, it is being scraped by robots constantly for a start, some of which might iterate counters, so some responsibility lies with those who maintain the website. There isn't a clear line like the threshold of a dwelling we can point to, because it's not always clear which urls are authorised for a user and which are not. Ultimately you're not going to stop the curious, and bots, from scraping the web, so if there are no access controls on your payroll you can expect data to leak, even if you come down hard on every single person you find accessing it without authorisation. I think the emphasis here should be on intent, as shown by the data taken, and what was done with it, not on trying public urls. If someone shows intent to steal information by changing urls, then downloads the info, then uses it for identity theft or sells it on, that's clearly a crime, and unless they have mitigating circumstances, perhaps it deserves a fine or a very short jail sentence for serious cases. I do think the sentences today are excessive for this sort of activity. If they simply access a URL as you propose above, I don't think you can show intent. Even if they access several urls, was their intent to explore, or to steal information, or did they just follow a bad set of links or make a mistake with their web crawler?
  • mattmanser 13y ago
    You've missed the point. Making a typo and accessing the page once with the wrong SSN using the submit buttons on the web page provided has absolutely no intent. Using an automated script bypassing the webform to cycle through as many as possible clearly shows intent to access something you're not supposed to. People don't just access urls at random, they will never type a url with query strings into the browser. They click links or submit forms. Someone pen testing a website will be deliberately circumventing those methods. It's like running wireshark on a public unsecured network, there's likely no good reason for you to be doing it and you know what you're doing if you're running that tool. That's intent. Note: I'm personally very pleased that they're fighting this. Just wanted to clarify what they mean by intent.
    • angersock 13y ago
• TeMPOraL 13y ago
  Does it? Maybe it shows intent to see what kind of fancy 403 page payroll.example.com is employing? I think one of the reasons people (including me) have problems with penalizing GET parameter change is that they are obviously visible and trivial to change. They are a part of URL and pretty much designed to be modified by hand. Growing up on the Internet we learned that if we want to see e.g. the next page of the gallery or board, we don't have to look for "next" button. We just change /0/ to /1/, or ?start=100 to ?start=150 in the address bar and press ENTER. It's easier. It's quicker. It's more natural. I can't feel that there's anything wrong with changing a GET parameter. It doesn't register on an emotional level. My personal feelings are that on the Internet you're supposed to use HTTP codes like 403 or 404 to mark places user is denied to access. IMO the space of legally accessible addresses for given user should be defined by a superspace of all URLs that return 200 Ok when that user tries to access them. If you screw up and serve sensitive data without proper access check, it should be your (legal) responsibility, not the person's who (accidentally or not) discovers this.
  • rmc 13y ago
    Just because you're used to it, and because you find it easy and natural doesn't mean it is or should be legal. There are people who, upon seeing the good laid out in a shop, will find it easy and natural to just pick it up and walk out. They find it easy and natural. It's right there.
    • angersock 13y ago
      Can we please refrain from trying to make analogies to stealing? Or really, any analogies to the physical world?
    • testbro 13y ago
      I'd analogise it to an open book in a public space. The information is there for you to see when you walk up to it, and you have to interact with it (turning the page) to see the other information. On being caught turning the pages on the book, you get yelled at and imprisoned, despite your contention that it's the book owner's fault for not making sure turning pages was prevented.