3 ms·

Intent to cause harm? By checking all the locks, and not just a handful of them? I don't think it's enough to show he was thorough to establish there is actua

by yebyen 12y ago

Intent to cause harm? By checking all the locks, and not just a handful of them? I don't think it's enough to show he was thorough to establish there is actual mens rea for a crime to have been committed. I bet that site had at least 44 separate form inputs. No sense checking just a handful of them. None of the third-party certifications you suggest looking for to assess a vendor's worthiness are even roughly analogous to a bank with, for example, FDIC insurance. If I have never undergone the certification processes myself (or perhaps even if I have, more so) they are the information-security equivalent of "tiger repellent" to me. I can only take the word of "experts" that they are good. If I can't tug on all the exposed levers, then I guess at least I can be assured only people who are paid to do that (or people who are breaking the law) have actually tugged on them. Can you understand how this kind of assurance would not reasonably instill any confidence of a system's security? The law does not forbid one from looking over one's own shoulder, so why should it be any more criminal to do that at every single corner you passed, even in an airport? There is a reason info-sec experts are sometimes seen as paranoid, it's because you don't know if you don't check.

Consultant32452 12y ago
The remark about there being 44 instances was in direct reference to the idea that it could have just been random stuff put into form fields. I've already stated I think that being brought up on 44 counts is abuse and shouldn't have stood up in court. However, even if it's just 44 form fields that's far more than enough to show intent to perform SQL injection and not just an oopsie bad copy/paste or errant form entry. It seems clear that he was attempting to gain unauthorized access to information. What he intended to do with that information is irrelevant. While 3rd party certifications might not hold the vigor of FDIC insurance you are unlikely to put information on a website that is as valuable or irreplaceable as what you put into a safe deposit box. Most of time we're talking about a name, address, and potentially credit card information as the maximum damage possible. Well, your name and address are almost certainly already public record. Your credit card similarly has excellent protection and aside from some incredibly rare nightmares most people who have their CC info stolen are back to normal within a few days of calendar time and less than an hour of time actually spent dealing with the issue. If you're putting something more valuable on the website you're perfectly within reason to contact the vendor and request permission to perform a security analysis or have your own trusted security analysis vendor perform such tests. This happens all the time in business. You can feel assured that only people who are paid to tug on the levers or people who are breaking the law are the only people tugging the levers at every company you conduct business with. And the literal "tuggin on the lever" analogy is really poor. A closer analogy would be, "I know many locks are vulnerable to being opened with a specially crafted bump key. I will walk around the building after hours and attempt to use a bump key on all the doors to ensure it's safe to conduct business here."
- yebyen 12y ago
  The "after hours" part doesn't help draw any real parallels either and only clouds things further. When is "after hours" for a website? All access is logged, at any time of day. We are going to have to agree to disagree. You seem to think that performing SQL injection, even just to see if it is possible and with no intent to steal information or in furtherance of any crime, should be criminally prosecuted. I think that SQL injection is such a basic attack that they should teach everyone how to perform it in introductory CS courses or earlier, as only through awareness of these basic forms can we all stamp out the threat of our own global systemic ignorance of those kind of forms. It's not a kind of magic. Nobody is born with the knowledge that "SELECT * FROM Table WHERE #{userdata}" is completely and perfectly wrong approach to taking input from users in any production system. You have to learn it somehow, and the law practically forbids you from learning it through application in the wild. So I suppose only criminals will get to have guns, then. > You can feel assured that only people who are paid to tug on the levers or people who are breaking the law are the only people tugging the levers at every company you conduct business with. I understood that already, and it didn't make me feel warm and fuzzy. I don't really think there's a ghost's chance that I'm in the majority here, either, and I do find that to be a shame. Even many otherwise smart people are just totally ignorant of computers.
  - Consultant32452 12y ago
    The word "SQL injection attack" has the word "attack" right there in the name. It's not innocuous. And there are plenty of places you can go where you're permitted to perform the types of analysis you're talking about without repercussions. If you want to be a locksmith you don't wander your neighborhood randomly attempting to break into houses as part of your training.
    - yebyen 12y ago
      Yes, it's called an attack, and defenses are a thing too. You can't learn to block if all comers are expressly forbidden from punching or feigning punching. This need not be a violent attack, it will not incorporate any weapons, and there is furthermore no concept of assault and battery against computer equipment. One should avoid any destruction of property when wearing the white hat. They are not "unauthorized" accesses, however. The supposed authorization controls have failed and the doors are really unlocked if the attack succeeds. Which situation is preferable: a) As a new business, I am contacted by a good Samaritan who informs me that my public website is vulnerable to a common attack. I take this information to my development staff and they verify that we are indeed vulnerable, then we fix it. Millions are saved. I send a thank-you note to my new friend in Samaria and maybe even write a check. b) Good Samaritans are prevented from helping by laws that divide adept lever pullers into only two groups: the paid kind and the unauthorized kind. There are then never good Samaritans because every Samaritan needs to take steps to remain anonymous themselves before performing any deeds which could constitute "an attempt to obtain unintendedly authorized access". It's clear that "The only reason to obscure the origin of a packet is in order to not be the one caught sending it." Anyone who does not want to get caught doing whatever they are doing, I think it follows obviously, can't possibly be helping but only up to no good. Now all Samaritans with knowledge of SQL injection are at odds with web service companies and all good and rational Samaritans do the smart thing and cease all helping. If anyone helps, they will do so anonymously; if they are identified, they will have to swear they only found the issue by accident and didn't even really know what to look for. In (B), your ability to secure yourself is directly at odds with the amount of spare time those (real) hordes of bad Samaritans or other nationalities behind seven proxies can spare. Got unlimited money? If you can't pay for enough pen testing, well I hope you did security right because nobody is going to help you now. Is that really the preferable scenario? We have varying degrees of laws protecting certain kinds of "Good Samaritans" in cases of medical emergency, they are on the books in every state. Unless or until it's an issue of something wrong on a computer. There is no such similar protection for any security pros or curious tinkerers. People who legitimately stumbled onto vulnerable services are best advised to never report them to anyone and forget whatever issue they saw, or they are persecuted by the FBI and prosecuted through CFAA and other legal channels. This cannot be considered optimal!

by yebyen 12y ago

Consultant32452 12y ago

The remark about there being 44 instances was in direct reference to the idea that it could have just been random stuff put into form fields. I've already stated I think that being brought up on 44 counts is abuse and shouldn't have stood up in court. However, even if it's just 44 form fields that's far more than enough to show intent to perform SQL injection and not just an oopsie bad copy/paste or errant form entry. It seems clear that he was attempting to gain unauthorized access to information. What he intended to do with that information is irrelevant. While 3rd party certifications might not hold the vigor of FDIC insurance you are unlikely to put information on a website that is as valuable or irreplaceable as what you put into a safe deposit box. Most of time we're talking about a name, address, and potentially credit card information as the maximum damage possible. Well, your name and address are almost certainly already public record. Your credit card similarly has excellent protection and aside from some incredibly rare nightmares most people who have their CC info stolen are back to normal within a few days of calendar time and less than an hour of time actually spent dealing with the issue. If you're putting something more valuable on the website you're perfectly within reason to contact the vendor and request permission to perform a security analysis or have your own trusted security analysis vendor perform such tests. This happens all the time in business. You can feel assured that only people who are paid to tug on the levers or people who are breaking the law are the only people tugging the levers at every company you conduct business with. And the literal "tuggin on the lever" analogy is really poor. A closer analogy would be, "I know many locks are vulnerable to being opened with a specially crafted bump key. I will walk around the building after hours and attempt to use a bump key on all the doors to ensure it's safe to conduct business here."

yebyen 12y ago
The "after hours" part doesn't help draw any real parallels either and only clouds things further. When is "after hours" for a website? All access is logged, at any time of day. We are going to have to agree to disagree. You seem to think that performing SQL injection, even just to see if it is possible and with no intent to steal information or in furtherance of any crime, should be criminally prosecuted. I think that SQL injection is such a basic attack that they should teach everyone how to perform it in introductory CS courses or earlier, as only through awareness of these basic forms can we all stamp out the threat of our own global systemic ignorance of those kind of forms. It's not a kind of magic. Nobody is born with the knowledge that "SELECT * FROM Table WHERE #{userdata}" is completely and perfectly wrong approach to taking input from users in any production system. You have to learn it somehow, and the law practically forbids you from learning it through application in the wild. So I suppose only criminals will get to have guns, then. > You can feel assured that only people who are paid to tug on the levers or people who are breaking the law are the only people tugging the levers at every company you conduct business with. I understood that already, and it didn't make me feel warm and fuzzy. I don't really think there's a ghost's chance that I'm in the majority here, either, and I do find that to be a shame. Even many otherwise smart people are just totally ignorant of computers.
- Consultant32452 12y ago
  The word "SQL injection attack" has the word "attack" right there in the name. It's not innocuous. And there are plenty of places you can go where you're permitted to perform the types of analysis you're talking about without repercussions. If you want to be a locksmith you don't wander your neighborhood randomly attempting to break into houses as part of your training.
  - yebyen 12y ago
    Yes, it's called an attack, and defenses are a thing too. You can't learn to block if all comers are expressly forbidden from punching or feigning punching. This need not be a violent attack, it will not incorporate any weapons, and there is furthermore no concept of assault and battery against computer equipment. One should avoid any destruction of property when wearing the white hat. They are not "unauthorized" accesses, however. The supposed authorization controls have failed and the doors are really unlocked if the attack succeeds. Which situation is preferable: a) As a new business, I am contacted by a good Samaritan who informs me that my public website is vulnerable to a common attack. I take this information to my development staff and they verify that we are indeed vulnerable, then we fix it. Millions are saved. I send a thank-you note to my new friend in Samaria and maybe even write a check. b) Good Samaritans are prevented from helping by laws that divide adept lever pullers into only two groups: the paid kind and the unauthorized kind. There are then never good Samaritans because every Samaritan needs to take steps to remain anonymous themselves before performing any deeds which could constitute "an attempt to obtain unintendedly authorized access". It's clear that "The only reason to obscure the origin of a packet is in order to not be the one caught sending it." Anyone who does not want to get caught doing whatever they are doing, I think it follows obviously, can't possibly be helping but only up to no good. Now all Samaritans with knowledge of SQL injection are at odds with web service companies and all good and rational Samaritans do the smart thing and cease all helping. If anyone helps, they will do so anonymously; if they are identified, they will have to swear they only found the issue by accident and didn't even really know what to look for. In (B), your ability to secure yourself is directly at odds with the amount of spare time those (real) hordes of bad Samaritans or other nationalities behind seven proxies can spare. Got unlimited money? If you can't pay for enough pen testing, well I hope you did security right because nobody is going to help you now. Is that really the preferable scenario? We have varying degrees of laws protecting certain kinds of "Good Samaritans" in cases of medical emergency, they are on the books in every state. Unless or until it's an issue of something wrong on a computer. There is no such similar protection for any security pros or curious tinkerers. People who legitimately stumbled onto vulnerable services are best advised to never report them to anyone and forget whatever issue they saw, or they are persecuted by the FBI and prosecuted through CFAA and other legal channels. This cannot be considered optimal!