5 ms·

It is the server's problem. A misconfigured server is not a client's problem. Set aside the SQL injection. Suppose there's a bug in Apache's path parsing such

by ajays 13y ago

It is the server's problem. A misconfigured server is not a client's problem. Set aside the SQL injection. Suppose there's a bug in Apache's path parsing such that using "\" instead of "/" causes it to interpret it as an escaped string, which somehow (bear with me) causes it to run exec("/bin/rm -r /"). Now some n00b comes along and uses "\" in the path, because he's used to paths on MSDOS; crashing the server. Whose problem is it? The client's, for sending a malformed request? How do you expect the client to know that the "\" will trigger a catastrophe? Or what if the client made a mistake, and while he thought it was "some query string" in his cut buffer, it turned out to be "; drop table *" (or something like that). Now whose problem is it? If the server willy-nilly takes any input and doesn't check it, it is the server's fault.

meowface 13y ago
Whether it's the server's or the client's fault doesn't matter that much from a legal perspective. Intent plays a big role: if you knew that ending a URL with "\" causes `rm -rf /*` to be run, and intentionally run that on a server, you could likely be prosecuted and convicted if it were proven that you did it intentionally. If it were done accidentally by a client, they would (likely, and hopefully) not be convicted. Weev intentionally exploited an information disclosure flaw. Should he have gone to jail for that? No, I don't think so at all. But the scenario you're presenting has no relation to what happened here.
- ajays 13y ago
  No, Weev did not "exploit" anything. He _requested_ information from a server. If the server owner had so desired, they could have made the data private by adding a password. They chose not to. In the end, the decision to offer Weev the data was made _by the server_ . And if you're going to bring up the UserAgent spoofing, let me remind you that most browsers have done something like that for > 15 years.
  - meowface 13y ago
    He did not exploit a software flaw or a platform flaw, however he exploited an information disclosure / access separation EXPOSURE. Exploiting just means "taking advantage of something." He did exploit the fact that AT&T did not make the endpoint in question accessible only if the logged-in user matched the actual user ID (or just made it entirely inaccessible).
  - IanCal 13y ago
    Did Weev think that the email addresses didn't count as personal information, and were perfectly fine for anybody to scrape? > If the server owner had so desired, they could have made the data private by adding a password. But the server is still just sending data in response to a request, even with a password. The only reason a password is a line we draw is intent. It's hard to say you didn't realise that guessing at someones password was wrong.
    - drdaeman 13y ago
      Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not. Accessing information without providing the correct password is certainly unintended use, so is guessing passwords. And accessing knowing the password is definitely the intended mode of operation. A logical step is to make that machine readable. Oh, wait, suddenly this is getting to the server software and configuration, that server developer/administrator had screwed up. My question is - why we don't make that logical step and simplify things instead of relying on some "should be common sense" and "you should've known you wasn't supposed to do so" completely-gray-area?
      - mintplant 13y ago
        > Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not. You mean like the Terms of Use for the AT&T website? http://www.att.com/gen/general?pid=11561#14 http://www.att.com/gen/general?pid=11561#14
        drdaeman 13y ago
        Sort of, but in machine-readable form and under well-known location (like /robots.txt) so you could read and comply with them before you access the site. As for those exact terms, I suspect (IANAL) those exact terms prohibit almost any access to the site, as, for example, they forbid any programmatic access to obtain the information, and I haven't heard of any non-software user-agent implementations.
  - jezfromfuture 13y ago
    dude what part of he gave the info away to a third party before reporting it do you not understand to put ur bullshit out there >
    - 59nadir 13y ago
      Apparently in the future they've all learned to write from browsing MySpace profiles.

by ajays 13y ago

meowface 13y ago

Whether it's the server's or the client's fault doesn't matter that much from a legal perspective. Intent plays a big role: if you knew that ending a URL with "\" causes `rm -rf /*` to be run, and intentionally run that on a server, you could likely be prosecuted and convicted if it were proven that you did it intentionally. If it were done accidentally by a client, they would (likely, and hopefully) not be convicted. Weev intentionally exploited an information disclosure flaw. Should he have gone to jail for that? No, I don't think so at all. But the scenario you're presenting has no relation to what happened here.

ajays 13y ago
No, Weev did not "exploit" anything. He _requested_ information from a server. If the server owner had so desired, they could have made the data private by adding a password. They chose not to. In the end, the decision to offer Weev the data was made _by the server_ . And if you're going to bring up the UserAgent spoofing, let me remind you that most browsers have done something like that for > 15 years.
- meowface 13y ago
  He did not exploit a software flaw or a platform flaw, however he exploited an information disclosure / access separation EXPOSURE. Exploiting just means "taking advantage of something." He did exploit the fact that AT&T did not make the endpoint in question accessible only if the logged-in user matched the actual user ID (or just made it entirely inaccessible).
- IanCal 13y ago
  Did Weev think that the email addresses didn't count as personal information, and were perfectly fine for anybody to scrape? > If the server owner had so desired, they could have made the data private by adding a password. But the server is still just sending data in response to a request, even with a password. The only reason a password is a line we draw is intent. It's hard to say you didn't realise that guessing at someones password was wrong.
  - drdaeman 13y ago
    Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not. Accessing information without providing the correct password is certainly unintended use, so is guessing passwords. And accessing knowing the password is definitely the intended mode of operation. A logical step is to make that machine readable. Oh, wait, suddenly this is getting to the server software and configuration, that server developer/administrator had screwed up. My question is - why we don't make that logical step and simplify things instead of relying on some "should be common sense" and "you should've known you wasn't supposed to do so" completely-gray-area?
    - mintplant 13y ago
      > Then, it seems, a good solution to solve the problem is to have server owner to declare in advance what are intended use and what's not. You mean like the Terms of Use for the AT&T website? http://www.att.com/gen/general?pid=11561#14 http://www.att.com/gen/general?pid=11561#14
      - drdaeman 13y ago
        Sort of, but in machine-readable form and under well-known location (like /robots.txt) so you could read and comply with them before you access the site. As for those exact terms, I suspect (IANAL) those exact terms prohibit almost any access to the site, as, for example, they forbid any programmatic access to obtain the information, and I haven't heard of any non-software user-agent implementations.
- jezfromfuture 13y ago
  dude what part of he gave the info away to a third party before reporting it do you not understand to put ur bullshit out there >
  - 59nadir 13y ago
    Apparently in the future they've all learned to write from browsing MySpace profiles.