3 ms·
Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of
by nilved 12y ago
Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.
- derekp7 12y agoOut of curiosity, wouldn't this also apply to the security researcher at erratasec.com that did an earlier survey? That scan logged into peoples boxes and executed a ping going out. Now obviously there isn't any damage, but what legal theory is protecting these legit security researchers?
- thefreeman 12y agoNothing is protecting them legally, and many people mentioned similar things on those threads. However the fact that this guy sent himself reverse shells and actively exploited the servers makes it much more likely that someone will try to prosecute him.
- rbobby 12y agoReally this a question that can only be answered by a judge. The CFAA in the US might apply, section a.2.c bit is pretty broad: information from any protected computer). The wikipedia article is full of interesting bits and bobs: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act Though whether or not a DA would be bothered with investigating and building a case is a different story (probably not, unless there were lots of complaints and/or "serious" complaints). I strongly doubt anyone, even at the FBI, is tasked with finding hackers independent of any complaints.
- nilved 12y agoThe lack of anybody attempting to prosecute them.