Slashdot Mirror
Is It Illegal To Disclose a Web Vulnerability?
Scott writes "I'm submitting my own story on an important topic: Is it illegal to discover a vulnerability on a Web site? No one knows yet, but Eric McCarty's pleading guilty to hacking USC's web site was 'terrible and detrimental,' according to tech lawyer Jennifer Granick. She believes the law needs at least to be clarified, and preferably changed to protect those who find flaws in production Web sites — as opposed to those who 'exploit' such flaws. Of course, the owners of sites often don't see the distinction between the two. Regardless of whether or not it's illegal to disclose Web vulnerabilities, it's certainly problematic, and perhaps a fool's errand. After all, have you seen how easy it is to find XSS flaws in Web sites? In fact, the Web is challenging the very definition of 'vulnerability,' and some researchers are scared. As one researcher in the story says: 'I'm intimidated by the possible consequences to my career, bank account, and sanity. I agree with [noted security researcher] H.D. Moore, as far as production websites are concerned: "There is no way to report a vulnerability safely."'"
Is this about discovering a vulerability, or trying to discover a vulnerability?
If I click a link, and something breaks, and I've 'discovered' a problem, I've probably not done anything. It just broke, and I was the one who was there.
If I try to find a problem, and do (even if I don't exploit it), then I might have been doing something I shouldn't.
A real world example would be, if you get caught outside of a door, trying to pick the lock, and then claim you were trying to ensure their locks were safe, you might get charged bith attempted B&E. You don't get to do a security audit on people's front doors.
As much as we like to separate people into black hats and white hats, if you were trying to jimmy the lock, for whatever reason, you were probably doing something you shouldn't have been.
Just my 2 cents, anyway.
Lost at C:>. Found at C.
What's the problem with sending info to a webmaster? And what's the point of doing anything else? If you post it publicly, you've created a race condition between script kiddies and the site admin, and should be punished. If you send it to the webmaster, you are doing a service, and shouldn't be punished. As long as you don't exploit it, you should be ok.
http://bgcommonsense.blogspot.com
A few years ago I was renewing my car tabs on the WA state's site and they had a box for 'donations to DOT' or somesuch. For kicks I tried putting in a negative value, and sure enough it reflected the total for my tabs as less. I went ahead and submitted things with a dollar taken off the value, just to see if it would actually go through. Sure enough, a week later I received my tabs, and the mathematically correct but embarrassing negative donation on my receipt.
I ended up calling them and letting them know about the bug. They were nice about it, and the next year at least it was fixed.
-Nic
It's not illegal to stand on the corner and say, "That house over there is selling cocaine for $10."
It is illegal to stand on the corner and say, "That house over there is selling cocaine for $10." when you are hired by the cocaine house.
So are these people saying, "Product X sux because of this vulnerabily xyz here, exploitable via abc", and that's that, or are they saying, "Product X sux because of blah blah blah, and company X, could you pay me $10 or I'll release the info?"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I once found childporn and told both the hostmaster and the police. After several days nothing had been done, so I went to the press. Right when it came out, the site went down. Good for me?
he police was after me because of:
1) Falcifying my identity, because I gave a fake adress on gmx.net
2) spreading of chldporn, because I replied to a Usenetmessage with the URL still in it
3) Obstruction of a police investigation. Because there was an investigation going on.
I never got a reply from the webmaster, because he apparently was not allowed to do anything, nor remove the site, because the police was investigating it already.
I never got a reply from the police, because their mailserver was down
I was able to explain to them what I did.
I had a very understanding boss, which was the one where I posted from and whom they told they needed the person posting because of a child-porn related crime investigation. At other places I might have lost my job.
It goes without saying that that sighting of childporn must have been a fluke. I have not ever seen any childporn or any other illegal activity on the Internet.
To sum it up: if diclosing web vulnerabilities is outlawed, only outlaws will disclose web vulnerabilities. Oh , and they don't.
Don't fight for your country, if your country does not fight for you.
If you don't own the website or you don't have the owners permission then it is illegal for you to attempt to access the web server except if you are "using it properly" (eg. you actually surf the web site via the links). So if you have found the exploit without permission then you have already committed a crime. Then telling people about it is 1. stupid, 2. gives people evidence to have you charged. As to whether it is illegal to disclose the vulnerability is anybodies guess. I would think that it wouldn't be illegal but i still would not do it.
I actually did find a real world security vulnerability of that form... Elevator in the building I worked in was prone to malfunction. the bottom floor of the building was a pub that was not open at 8 am when I went to work. normally visitors would be kept out of said pub by the fact that you would need a key for the elevator to go to that floor. one day I got on the elevator, pressed the button for the floor my office was on, when the doors opened I stepped out without paying much attention and found myself alone in the middle of the closed pub...
Now, is it my fault I ended up there? I don't think so... would the pub want to know they have this problem so they can install an additional security door/gate, probably. Was what I did illegal... maybe, I did tresspass on their property, though entirely by accident, had I been paying more attention I would not have exited the elevator, but I wasn't, so I stood in the middle of the pub long enough for the next elevator car to arrive.
would I get in trouble for reporting it? maybe... hard to say, people get insanely paranoid about security, and wether you are talking electronic security, or real world physical security, in most cases people would rather blame the person who found the problem than acknowledge the problem exists in the first place...
Bike U-locks had a defect and could be picked easily with a ball point pen. Informing people helps everyone. Informing no one helps bike thieves because they are the kind of people who find out these things and inform each other about them.
Why is this difficult to understand?
As for all the "doing something you shouldn't" bullshit, it's innocent until proven guilty. When did people become so terrified of freedom.
This will be my second post in here, something I normally don't do but I just recalled something from not so long ago that was actually posted on Slashdot. Do we all forget so quickly? Please read this:
3 2241&tid=172/
../../. However, he shouldn't have been doing that either. Tough one there.. but you've been warned!
http://it.slashdot.org/article.pl?sid=05/10/07/15
"Security consultant Daniel Cuthbert worried that he'd been stung by a phishing scam when he donated to a Tsunami relief effort in London, UK. He was convicted for hacking and lost his job after running a couple of checks on the website in question."
This is exactly what this article is discussing. Not only should you be held liable in some instances for "looking for vulnerabilities", you should be prosecuted. Now the above case is surely an extreme. Just reading the article I would be completely against prosecution in such an instance. Then again I wasn't part of the team that prosecuted or reported him. He might have tried to do a little more than just check a single
How many times have you seen a car with their lights on in a parking lot with nobody in the car?
In the old days, someone would check the doors to see if they were unlocked and turn off the lights for the person to keep their battery from running down.
Would you touch someone else's car today if the lights were on?
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling