4 ms·

The article states that he was scanning the website for vulnerabilities. He wanted to do harm.. My assumption is that he was looking for exploits, perhaps a XSS

The article states that he was scanning the website for vulnerabilities. He wanted to do harm.. My assumption is that he was looking for exploits, perhaps a XSS in the comments section (filling out comments with junk text) or he was just trying to DoS the site. Had he found a vulnerability in the site, what do you think he would have done? He doesn't seem to be a white hat, but does the county have a vulnerability reporting policy? (my guess is no.) I equate what he did with a burglar snooping around a house and checking for an open door or window to break in. I think the laws they used were wrong--but it appears he was up to no good.

1337biz 12y ago
it appears he was up to no good The emphasis is on "appears". You can't convict anyone on (your personal) "suspicions".
- bostonpete 12y ago
  > You can't convict anyone on (your personal) "suspicions" That's true, but he can reserve his outrage for people who didn't appear to be up to no good.
- eyeareque 12y ago
  No, you can't. But I haven't seen the evidence. It isn't legal to scan a website for vulns without permission. I assume the have evidence that he did scan the site.
  - lawnchair_larry 12y ago
    "It isn't legal to scan a website for vulns without permission." This isn't true. I do it quite a bit, so do other people who have no malicious intentions. Some professionals do it quite publicly, and even blog about it. Check out this guy, not just scanning for, but actually exploiting shellshock to execute commands on servers he doesn't own, internet-wide: http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in... Are we better off with him in prison?
    - eyeareque 12y ago
      You're taking a risk when you do this. Not many people go after these types of scans, but you're basically doing it without permission. It's a grey area, be careful. If your scans cause an issue for the server, either through slowing the system down, or causing a web server to crash, you've now broken a law.

1337biz 12y ago

it appears he was up to no good The emphasis is on "appears". You can't convict anyone on (your personal) "suspicions".

bostonpete 12y ago
> You can't convict anyone on (your personal) "suspicions" That's true, but he can reserve his outrage for people who didn't appear to be up to no good.
eyeareque 12y ago
No, you can't. But I haven't seen the evidence. It isn't legal to scan a website for vulns without permission. I assume the have evidence that he did scan the site.
- lawnchair_larry 12y ago
  "It isn't legal to scan a website for vulns without permission." This isn't true. I do it quite a bit, so do other people who have no malicious intentions. Some professionals do it quite publicly, and even blog about it. Check out this guy, not just scanning for, but actually exploiting shellshock to execute commands on servers he doesn't own, internet-wide: http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in... Are we better off with him in prison?
  - eyeareque 12y ago
    You're taking a risk when you do this. Not many people go after these types of scans, but you're basically doing it without permission. It's a grey area, be careful. If your scans cause an issue for the server, either through slowing the system down, or causing a web server to crash, you've now broken a law.