7 ms·

> I don't have a problem with criminalizing > attempts to pull up random people by their > SSN. If I see that the URL contains my SSN, and want to investig

by pyre 13y ago

> I don't have a problem with criminalizing > attempts to pull up random people by their > SSN. If I see that the URL contains my SSN, and want to investigate if they were stupid enough to have this as a security hole, what are my options? You seem to say that if I pull up the page of someone else, I am immediately a criminal and need to go to jail. Should I instead report the possible issue to the company? Will they actually take, "I see that SSN is in the URL and that might be security hole, but I don't know for sure because I haven't attempted to try it," seriously? Hopefully they would, but I find that hope to be way more optimistic than the 'real world' should get credit for.

ceol 13y ago
You don't get to break into a bank because you want to see if you can exploit a security hole. What you're talking about is more akin to wiggling the bank's door handle and then leaving. What weev did is break in, steal a bunch of documents, and then talk about selling them.
- sneak 13y ago
  "Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. ATT admitted in court to publishing this data on the web. Emitting email addresses in response to ICCIDs was a specific feature they explicitly implemented to reduce the number of steps required to resubscribe to service, not a "security hole". Your physical analogy is inappropriate, and serves to frame his actions as criminal when they are clearly not. Please read the brief.
  - ceol 13y ago
    > "Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. No, it doesn't. See, this is what happens when you start talking about crimes on the internet when you really shouldn't be. If I leave all my doors and windows opened, or if I put a box of valuables in the middle of an empty lot that I own, it doesn't suddenly make it legal for people to steal from me. AT&T leaving their doors and windows open does not suddenly authorize any ol' grody troll to walk in and take personal information. Whether you like it or not, his crime will be made into a physical analogy.
    - bigiain 13y ago
      I _mostly_ agree with you. How about _this_ analogy? AT&T left a box of valuables in the middle of a lot they own, and weev walked by and grabbed them. Problem is, they weren't AT&T's valuables, they were mine and yours and 100,000 other peoples who'd entrusted AT&T with them. Now who's "the bad guy"? Who's the more culpable "criminal"? WHo would we be holding to account if it were a bank who'd piled up the cash from 100,000 people's savings accounts into a building with all its doors and windows open? Sure, what weev did was wrong. I don't think it was the _only_ wrong done here, or possibly even the "worst" wrong.
      - ceol 13y ago
        I think that's fair. AT&T should be reprimanded for a serious lack of security — how much they should be reprimanded would be another topic for debate. But it doesn't take away from weev's crime (both this one and his previous harassments.)
        walid 13y ago
        Sorry for your distorted reality. You're saying that everyone who accesses unsecured information on a badly secured server gets reprimanded. You're placing the onus of security on the user which makes your point pure BS.
        nathan_long 13y ago
        Granted. But how do you propose that AT&T would ever be reprimanded without someone like weev? I strongly believe that weev should have notified AT&T before Gawker. But if they were unresponsive, as often happens, what then?
    - moocowduckquack 13y ago
      Is more like if you wrote out your customers personal data in a book left nailed to a front door that opens onto a public street and then tried to criminalise anyone who looked at pages that weren't relevant to them.
- Maxious 13y ago
  A bank you say? http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... http://www.smh.com.au/it-pro/security-it/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html http://www.smh.com.au/it-pro/security-it/super-bad-first-sta...
tptacek 13y ago
First, you don't actually have the right to conduct security testing on third party servers. Nor should you. Real application security testing is disruptive, and in authorized tests, companies often take pains to ensure that testers aren't exposed to real user data. Second, if you poke around to confirm the security or insecurity of an application, immediately report results to the target, and comply with requests for information, you may be civilly liable for damages (which it's unlikely anyone would pursue, given the PR implications) but are probably not violating the CFAA even as it's written today (that is: badly).
- pyre 13y ago
  What is your plan to hold companies to task then? Especially when you can't confirm that your suspicions are correct? Responsible disclosure? Say that you disclose your concerns to them. How does that play out? 1. They respond to you. They say that it is not a security flaw. You just have to trust them that there is not security flaw. 2. They respond to you, and tell you that they will not fix it. You tell them that if they won't then you'll disclose it to the public. They try to claim that you are extorting them. 3. They don't respond to you. You disclose it to the public. Turns out that it wasn't a security flaw. You are sued for defamation/libel/etc. 4. They don't respond to you. You disclose it to the public. The company has egg on their face and fixes it. I think that the biggest flaw in the system is that companies are not held to task for their security flaws. I realize that if all software had to be perfect it would cripple the industry, but at the same time there has to be some idea of criminal (or at least civilly liable) negligence for people/companies that don't at least follow best practices.
  - tptacek 13y ago
    I don't think random strangers on the Internet conducting unauthorized testing are really making much of a difference either way, so the prospect of changing how much of that goes on doesn't really factor in for me.
    - nitrogen 13y ago
      Then what's the point of all the bug bounty programs out there?
stonemetal 13y ago
If you can access your own record without authentication shouldn't that be good enough proof? Why do you need to access everyone else's information illegally to prove that your own is available without proper controls in place?

by pyre 13y ago

ceol 13y ago

You don't get to break into a bank because you want to see if you can exploit a security hole. What you're talking about is more akin to wiggling the bank's door handle and then leaving. What weev did is break in, steal a bunch of documents, and then talk about selling them.

sneak 13y ago
"Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. ATT admitted in court to publishing this data on the web. Emitting email addresses in response to ICCIDs was a specific feature they explicitly implemented to reduce the number of steps required to resubscribe to service, not a "security hole". Your physical analogy is inappropriate, and serves to frame his actions as criminal when they are clearly not. Please read the brief.
- ceol 13y ago
  > "Breaking in" suggests that there is access control (locks, doors, walls, etc) in place. No, it doesn't. See, this is what happens when you start talking about crimes on the internet when you really shouldn't be. If I leave all my doors and windows opened, or if I put a box of valuables in the middle of an empty lot that I own, it doesn't suddenly make it legal for people to steal from me. AT&T leaving their doors and windows open does not suddenly authorize any ol' grody troll to walk in and take personal information. Whether you like it or not, his crime will be made into a physical analogy.
  - bigiain 13y ago
    I _mostly_ agree with you. How about _this_ analogy? AT&T left a box of valuables in the middle of a lot they own, and weev walked by and grabbed them. Problem is, they weren't AT&T's valuables, they were mine and yours and 100,000 other peoples who'd entrusted AT&T with them. Now who's "the bad guy"? Who's the more culpable "criminal"? WHo would we be holding to account if it were a bank who'd piled up the cash from 100,000 people's savings accounts into a building with all its doors and windows open? Sure, what weev did was wrong. I don't think it was the _only_ wrong done here, or possibly even the "worst" wrong.
    - ceol 13y ago
      I think that's fair. AT&T should be reprimanded for a serious lack of security — how much they should be reprimanded would be another topic for debate. But it doesn't take away from weev's crime (both this one and his previous harassments.)
      - walid 13y ago
        Sorry for your distorted reality. You're saying that everyone who accesses unsecured information on a badly secured server gets reprimanded. You're placing the onus of security on the user which makes your point pure BS.
      - nathan_long 13y ago
        Granted. But how do you propose that AT&T would ever be reprimanded without someone like weev? I strongly believe that weev should have notified AT&T before Gawker. But if they were unresponsive, as often happens, what then?
  - moocowduckquack 13y ago
    Is more like if you wrote out your customers personal data in a book left nailed to a front door that opens onto a public street and then tried to criminalise anyone who looked at pages that weren't relevant to them.
Maxious 13y ago
A bank you say? http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... http://www.smh.com.au/it-pro/security-it/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html http://www.smh.com.au/it-pro/security-it/super-bad-first-sta...

tptacek 13y ago

First, you don't actually have the right to conduct security testing on third party servers. Nor should you. Real application security testing is disruptive, and in authorized tests, companies often take pains to ensure that testers aren't exposed to real user data. Second, if you poke around to confirm the security or insecurity of an application, immediately report results to the target, and comply with requests for information, you may be civilly liable for damages (which it's unlikely anyone would pursue, given the PR implications) but are probably not violating the CFAA even as it's written today (that is: badly).

pyre 13y ago
What is your plan to hold companies to task then? Especially when you can't confirm that your suspicions are correct? Responsible disclosure? Say that you disclose your concerns to them. How does that play out? 1. They respond to you. They say that it is not a security flaw. You just have to trust them that there is not security flaw. 2. They respond to you, and tell you that they will not fix it. You tell them that if they won't then you'll disclose it to the public. They try to claim that you are extorting them. 3. They don't respond to you. You disclose it to the public. Turns out that it wasn't a security flaw. You are sued for defamation/libel/etc. 4. They don't respond to you. You disclose it to the public. The company has egg on their face and fixes it. I think that the biggest flaw in the system is that companies are not held to task for their security flaws. I realize that if all software had to be perfect it would cripple the industry, but at the same time there has to be some idea of criminal (or at least civilly liable) negligence for people/companies that don't at least follow best practices.
- tptacek 13y ago
  I don't think random strangers on the Internet conducting unauthorized testing are really making much of a difference either way, so the prospect of changing how much of that goes on doesn't really factor in for me.
  - nitrogen 13y ago
    Then what's the point of all the bug bounty programs out there?

stonemetal 13y ago

If you can access your own record without authentication shouldn't that be good enough proof? Why do you need to access everyone else's information illegally to prove that your own is available without proper controls in place?