4 ms·

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting

by r0m4n0 12y ago

Right, they mentioned researching bugs like Heartbleed. Discovering and disclosing bugs on underlying open source technology hasn't been the target prosecuting under CFAA in the past so I follow you there. If a prosecuting attorney wanted to, couldn't they charge the researchers that discovered the bug? CFAA doesn't specify intent to do harm... If someone used the disclosure of the bug to do harm, you have assisted in unauthorized access of information.

tptacek 12y ago
I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have been prosecuted for disclosing the vulnerabilities. If you disclose a bug and someone unrelated to you breaks the law with it, CFAA does not say you're liable.
- deleted 12y ago
  [deleted]
- r0m4n0 12y ago
  haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?
  - tptacek 12y ago
    No, they would not. The equivalent of this scenario happens all the time. In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).
    - r0m4n0 12y ago
      The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds
      - tptacek 12y ago
        The story you told about discovering SQLI in Drupal simply isn't covered by CFAA.
    - tikums 12y ago
      > I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"), who wrote the POS sniffer. His friend, Albert Gonzalez, then used it to steal 170 million credit cards from TJ Maxx and other vendors back in 2006-2007.
  - snowwrestler 12y ago
    Look at it this way: what if Drupal's own security committee posted a description of a SQL injection vulnerability (as they often do when issuing patches), and another person takes that info and uses it to attack an unpatched Drupal government site? Would the security committee members be charged?
    - r0m4n0 12y ago
      I agree, this was probably a bad example because involvement seems a bit of a stretch (although posting on a known black hat forum might change some variables). What if you had only told your friend of the particular vulnerability and he used that information to write an exploit?
      - tptacek 12y ago
        Writing an exploit is also not illegal. Using the exploit is a problem. If you tell your friend about a vulnerability, and he writes an exploit and then uses it to break into a retail chain and steal credit card numbers, then you have a problem. Not because finding the vulnerability is illegal, but because there is now a chain of evidence that might link you to something that is unambiguously illegal. You won't be held liable for unwittingly enabling the crime; you'll be accused of sharing the vulnerability with the express purpose of enabling the crime (actually, maybe, technically, with the purpose of enabling any crime; conspiracy laws get weird). That intent will be something that needs to be proved in court. That liability is still a stretch, doubly so if, the moment you find out that your friend is doing something crazy, you inform the authorities.

by r0m4n0 12y ago

tptacek 12y ago

I don't understand what you're asking. The Heartbleed research they didn't probably didn't have any CFAA implications for them. The distinction isn't between "open source" and "closed source". It's between "software running on machines you own" and "software running on other people's machines". Hundreds of thousands of vulnerabilities have been discovered in the past decade and a half. None of those researchers have been prosecuted for disclosing the vulnerabilities. If you disclose a bug and someone unrelated to you breaks the law with it, CFAA does not say you're liable.

deleted 12y ago
[deleted]
r0m4n0 12y ago
haha not to drag this conversation out but just a hypothetical scenario: I download and install Drupal on my web server. I find an SQL Injection vulnerability in the login form. I post on a public forum the vulnerability where someone proceeds on their own to deface a government website using that knowledge. You don't think they would charge you in assisting?
- tptacek 12y ago
  No, they would not. The equivalent of this scenario happens all the time. In the one case I'm aware of where the developer of exploit code was found criminally liable for its use, that developer had a direct relationship with the person who actually did the exploiting (for commercial gain).
  - r0m4n0 12y ago
    The law doesn't require relationship or commercial gain. I can't share my story (and I'm sure there are others out there) but I can assure you: if you mess with the wrong people, the CFAA has no bounds
    - tptacek 12y ago
      The story you told about discovering SQLI in Drupal simply isn't covered by CFAA.
  - tikums 12y ago
    > I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"), who wrote the POS sniffer. His friend, Albert Gonzalez, then used it to steal 170 million credit cards from TJ Maxx and other vendors back in 2006-2007.
- snowwrestler 12y ago
  Look at it this way: what if Drupal's own security committee posted a description of a SQL injection vulnerability (as they often do when issuing patches), and another person takes that info and uses it to attack an unpatched Drupal government site? Would the security committee members be charged?
  - r0m4n0 12y ago
    I agree, this was probably a bad example because involvement seems a bit of a stretch (although posting on a known black hat forum might change some variables). What if you had only told your friend of the particular vulnerability and he used that information to write an exploit?
    - tptacek 12y ago
      Writing an exploit is also not illegal. Using the exploit is a problem. If you tell your friend about a vulnerability, and he writes an exploit and then uses it to break into a retail chain and steal credit card numbers, then you have a problem. Not because finding the vulnerability is illegal, but because there is now a chain of evidence that might link you to something that is unambiguously illegal. You won't be held liable for unwittingly enabling the crime; you'll be accused of sharing the vulnerability with the express purpose of enabling the crime (actually, maybe, technically, with the purpose of enabling any crime; conspiracy laws get weird). That intent will be something that needs to be proved in court. That liability is still a stretch, doubly so if, the moment you find out that your friend is doing something crazy, you inform the authorities.