6 ms·

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morph

by r0m4n0 12y ago

you would think they would be more focused on vulnerabilities of websites and the underlying technology as Google is an internet company (though they have morphed into a wider spectrum). Most recent public security outcries have related to internet services so my assumption that would be their focus. Part of me hopes they tread in this gray area so that we are forced to address issues with the CFAA and how its presently enforced. It doesn't matter if you are sitting on a bean bag chair at a google lab, you have no defense in criminal court if you are unauthorized to test for a vuln in someone's system. Disclosing a flaw is sufficient grounds for a felony.

tptacek 12y ago
This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permission for testing (c) Web apps tested carefully and, at first, usually anonymously (or, if not, then by researchers working from jurisdictions where CFAA is hard to enforce)
- r0m4n0 12y ago
  Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted in unauthorized access of information.
  - tptacek 12y ago
    I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have been prosecuted for disclosing the vulnerabilities. If you disclose a bug and someone unrelated to you breaks the law with it, CFAA does not say you're liable.
    - deleted 12y ago
      [deleted]
    - r0m4n0 12y ago
      haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?
      - tptacek 12y ago
        No, they would not. The equivalent of this scenario happens all the time. In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).
        r0m4n0 12y ago
        The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds
        tptacek 12y ago
        The story you told about discovering SQLI in Drupal simply isn't covered by CFAA.
        tikums 12y ago
        > I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"), who wrote the POS sniffer. His friend, Albert Gonzalez, then used it to steal 170 million credit cards from TJ Maxx and other vendors back in 2006-2007.
      - snowwrestler 12y ago
- sneak 12y ago
  > This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. Scanning for heartbleed is a good example of why it may well be - through a normal, authorized connection, it becomes apparent if the implementation is vulnerable. Or are you referring specifically to sending a malformed heartbeat in the context of an authorized connection? It's certainly not black-and-white to me.
  - tptacek 12y ago
    So far as I know, Google didn't sweep the whole Internet for hosts vulnerable to Heartbleed. They found the software flaw on machines they ran.

by r0m4n0 12y ago

tptacek 12y ago

This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. The examples you've seen of above-board security research targeting web apps fall generally into these buckets: (a) Web apps run by other companies but which are available for download to run on one's own machines (b) Web apps run by other companies that have published bug bounties or other forms of permission for testing (c) Web apps tested carefully and, at first, usually anonymously (or, if not, then by researchers working from jurisdictions where CFAA is hard to enforce)

r0m4n0 12y ago
Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted in unauthorized access of information.
- tptacek 12y ago
  I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have been prosecuted for disclosing the vulnerabilities. If you disclose a bug and someone unrelated to you breaks the law with it, CFAA does not say you're liable.
  - deleted 12y ago
    [deleted]
  - r0m4n0 12y ago
    haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?
    - tptacek 12y ago
      No, they would not. The equivalent of this scenario happens all the time. In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).
      - r0m4n0 12y ago
        The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds
        tptacek 12y ago
        The story you told about discovering SQLI in Drupal simply isn't covered by CFAA.
      - tikums 12y ago
        > I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"), who wrote the POS sniffer. His friend, Albert Gonzalez, then used it to steal 170 million credit cards from TJ Maxx and other vendors back in 2006-2007.
    - snowwrestler 12y ago
sneak 12y ago
> This isn't a "grey area". It's illegal to test web applications run by other people for security vulnerabilities. Scanning for heartbleed is a good example of why it may well be - through a normal, authorized connection, it becomes apparent if the implementation is vulnerable. Or are you referring specifically to sending a malformed heartbeat in the context of an authorized connection? It's certainly not black-and-white to me.
- tptacek 12y ago
  So far as I know, Google didn't sweep the whole Internet for hosts vulnerable to Heartbleed. They found the software flaw on machines they ran.