Slashdot Mirror
FBI Raids Dental Software Researcher Who Found Patient Records On Public Server (dailydot.com)
blottsie writes: Yet another security researcher is facing possible prosecution under the CFAA for accessing data on a publicly accessible server. The FBI on Tuesday raided Texas-based dental software security researcher Justin Shafer, who found the protected health records of 22,000 patients stored on an anonymous FTP. "This is a troubling development. I hope the government doesn't think that accessing unsecured files on a public FTP server counts as an unauthorized access under the CFAA," Orin Kerr, a George Washington University law professor and CFAA scholar told the Daily Dot. "If that turns out to be the government's theory -- which we don't know yet, as we only have the warrant so far -- it will be a significant overreach that raises the same issues as were briefed but not resolved in [Andrew 'weev' Auernheimer's] case. I'll be watching this closely." It was also reported this week via The Intercept that a provision snuck into the still-secret text of the Senate's annual intelligence authorization that would give the FBI the ability to demand individuals' email data and possibly web-surfing history from their service providers using those beloved 'National Security Letters' -- without a warrant and in complete secrecy.
How is anon FTP not authorized? I give my "name" (anonymous), and credentials (email address), and the system makes the decision to let me in , based on the configuration the sysadmin set. If that's not authorization, what is?
"National Security is the chief cause of national insecurity." - Celine's First Law
...dental software security researcher ...
That's, er, pretty specialized!
I have a lot of "issues" with so-called "security researchers", which in many case are either opertunistic hackers or script kiddies. But really, how can it be "hacking" to access data that does not require "breaking in" to anything? Sure, the dude was not invited, but if it's out there, not fire-walled, and all you need to do is type in some random URL, how can that be illegal?
Now, there may very well be laws, rules, whatever about medical records, but if anything than it's on the medical provider for violating HIPAA or something. On the other hand, disclosing other people's medical records publically available or not might very well be against some law, and maybe it should be...
If you want news from today, you have to come back tomorrow.
The moral of the story is that if you discover something like this, close your browser and tell no one.
Reporting a vulnerability or data breach has come to mean that "you're some kind of criminal" and must be punished, regardless of the circumstances.
Just cruising through this digital world at 33 1/3 rpm...
An anonymous FTP server is like a park bench. Literally anyone can use it.
This is like alerting the owner of a bag of money which is on a park bench, and then being penalized for sitting on the bench or looking in the bag.
If only they'd go after Wall Street as ferociously as they go after those who investigate company security. But then, the reason they go after those who cross big companies is the same reason they don't go after the people in big companies.
He is not the first one. The popular racket is simple, they scan for rich doctor files accidentally left online. Once they find something, they offer a "security service" for $###,###. Sure, they don't report their paying "clients" to government for medical records protection violation. It doesn't apply to non-clients. It is not kiddie game.
First, that's not how locks work. A normal lock has only one keying. Master keyed locks are done do by larger organizations. To get that master key you have to either get it from them in an authorized manner, or steal it somehow. It isn't like the manufacturers maintain an "all locks" master key and hand it out to people.
However more to the point an anon FTP is an implicit invitation to anyone to come in, just like a public HTTP server. In terms of the real world, it is like an open store. If you enter an unlocked store, you are not trespassing. If they tell you to leave you have to, but simply entering is allowed because the fact that they are presenting themselves for the public to use and have not locked their door is saying "We want you to come in." That's different than a place that is locked. The lock is an explicit "keep out" message.
but one would have to wonder why he would be trying to access systems of someone who wasn't his client.
Because it was anonymous FTP? That's the whole point of anon FTP, you know: that anybody is allowed to use it.
"City hall" in German is "Rathaus" Kinda explains a few things......
and woe to the subject who points out that fact. Forget 'security by obscurity' - the gubmint seems hell-bent on 'security by denial'. These days it's safest to pretend not to see security failings. Failing that, it almost seems to be the safer, wiser course of action to profit illegally from said security flaws than to point them out in the hope that they'll be fixed.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Are you seriously that mentally challenged? How is it not clear that it was anonymous FTP?
led him to an anonymous FTP server that allowed anyone access.
That's pretty damned clear that it was an anonymous FTP server, because it's described as an anonymous FTP server right there in the text.
There's also the quote about it being a password protected FTP server back in 2006, with a single password that never changed, until they made it anonymous around 2010.
And are you really assuming that they were password protected because they're medical records, which are "always under password protected area?" They must have been password protected, simply because they should have been password protected? Your faith in humanity is astounding. And misplaced.
Maybe next time, instead of pretending you read the article, you could, you know, actually read the article.
"City hall" in German is "Rathaus" Kinda explains a few things......
If I access a router with a known backdoor password, and someone failed to patch it, that is breaking and entering. It is clear that such access was not intended by the owner of the device, and I am effectively breaching their perimeter without their permission. In this case the guy use anonymous FTP. The entire purpose of anonymous FTP is to allow anyone to download files. FTP technology and anonymous access is routinely employed by companies and websites specifically to exchange files with everyone. Therefore, given the plain and regular use of the technology, one can easily argue that they effective were inviting file downloads. Until this guy was able to validate the content of the files, he would arguably not have known that the files were supposed to be protected. The fact that he reported the finding shows that he was not behaving maliciously and acting in good faith.
Make an anon release to a news outlet. Hilarity ensues.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Boy some of you guys must be pretty young. Have you ever used anonymous ftp? Anonymous ftp works by entering the host, then your username, coincidentally: "anonymous" or "ftp", and then you enter your email or the password "guest". It doesn't even check if these are correct. It just let's you straight through
Society use your Sciences
> And are you really assuming that they were password protected because they're medical records, which are "always under password protected area?" They must have been password protected, simply because they should have been password protected? Your faith in humanity is astounding. And misplaced.
The company is legally required to keep that data in secure location. Thus the company's secure location extends to the place where the patient data was found. And accessing it without authorisation is illegal. It's basically similar situation than if you accidentally found out someone's credit card pin code. The person might be careless with communicating his secrets, but still it's still illegal to use the pin code for anything. Same happens with patient data, the secret data might be carelessly handled, but any access to the data is still illegal operation.
Yes, companies ARE required to keep private medical information secure but whether or not the company THOUGHT their secure location extended to the directory where the patient data was is irrelevant. The data was unencrypted and freely accessible via an anonymous ftp server. The company should be penalized for allowing this to happen, NOT the user who found the exposed ftp server and informed the company that the records were freely available.
Do what thou wilt shall be the whole of the Law - Aleister Crowley
The problem with your logic is that unless the filename makes its contents obvious, there's no way to know what's in a file on an FTP server without downloading it. It clearly makes no sense to prosecute someone for a crime if it isn't possible for them to know that they're committing a crime until they have already finished committing it....
Check out my sci-fi/humor trilogy at PatriotsBooks.
How does one report such things anonymously? I requested a password reset from a municipal website and they emailed my password to me in plain text. I'm honestly afraid to tell anybody.
That is completely nonsense. It is like walking up to a shop with the lights on and no Open or Closed sign or any posted hours and opening the door and entering the shop if the door opens.
I don't recall when I first accessed an anon FTP server, but it was certainly well over 25 years ago and I've used anon access many times. If user 'anonymous' and an arbitrary email address is accepted as a password, it's open for the public to access anything that the user can get to -- everyone knows that and everyone knows that every administrator who configures a system presumably intends it to be that way.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
but one would have to wonder why he would be trying to access systems of someone who wasn't his client.
Because it was anonymous FTP? That's the whole point of anon FTP, you know: that anybody is allowed to use it.
I do understand about anonymous FTP. The point I was trying to make is all that is moot if he was hired to test that security in the first place. I guess my question boils down to this: Who exactly hired him? I'm genuinely curious, cause to me this story doesn't make a whole lot of sense.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
The company is legally required to keep that data in secure location. Thus the company's secure location extends to the place where the patient data was found. And accessing it without authorisation is illegal. It's basically similar situation than if you accidentally found out someone's credit card pin code. The person might be careless with communicating his secrets, but still it's still illegal to use the pin code for anything. Same happens with patient data, the secret data might be carelessly handled, but any access to the data is still illegal operation.
That's a cute theory, and from TFS apparently the thing the prosecutor is trying to gain a conviction (and perhaps a promotion) with.
But it is a deeply disturbing conflation of two issues. First, we have the data, that ought to be protected. Second, we have the means with which it is or is not being protected, which is obliged to be there. This legal theory says that because you have the first, the second turns into legal protection, when it was supposed to be a legal stick to make sure there is actual protection for the data.
IOW, you may be obliged to protect that data but it doesn't have to be technical. You just boobietrap the thing with legal red tape and done. Which means that if you tell people about their technical protection oversights you're going to get ensnared and jailed, while if you simply snatch the data and sell it, nobody cares.
"Just don't get caught! -- Love, your friendly neighbourhood DA."
This is easy to see because what happened is that Company of Idiots, ultd. left the data with protection obligation out in the open on an anon ftp, which is to say entirely unprotected forsaking their obligation, and Shmuck R. Smudgycoat stumbled upon the data, then told CoI about it so that they might correct the error of their ways. Not so, says prosecutor, CoI has an obligation to protect so that's really a legal protection of the data so Smudgycoat is guiltee of accessing protected data. Even though it wasn't protected, it just was supposed to be.
That's about as arse-backwards as it gets. Which is nothing unusual in the USoA legal system, but still.
If you have nothing to hide, you should not be worried, they said. The government is there to protect us, they said. The government has a right to do those things, they said. The government would never cross the line, they said.
Well, I would say at this point it is probably past the "too late" stage and you are stuck with the monster which decades of apathy and "blind misplaced patriotism" has created.
The US government has so much power at this point, I find it hard to imagine the people could ever take it back without a lot of bloodshed. I hope I am wrong.
Every time I go to the hospital they have no ability to access my previous records!
:T:R:A:N:S:
This poor schlub is being prosecuted because he's highlighted one of the pitfalls of the ACA's requirements that medical records be converted to and stored as computer data...that, even barring malicious and intentional hacking, leaks and poor security practices will ensure that patient data will be exposed regardless of any laws or legal penalties put in place. Something those in power assured us would not happen.
He's getting screwed-over because he dared expose the dishonesty of those in power.
The lesson? If you just happen to discover a way to access any of the US government's law enforcement/intelligence networks, do not notify them of a vulnerability. Either sell the method of access and/or the data acquired, or simply post it on the 'net on a server located in Ecuador.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
If they aren't supposed to, then put a fence around it with a combination lock to open the gate, and only give the combination to people who are supposed to be there.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
> IOW, you may be obliged to protect that data but it doesn't have to be technical. You just boobietrap the thing with legal red tape and done. Which means that if you tell people about their technical protection oversights you're going to get ensnared and jailed, while if you simply snatch the data and sell it, nobody cares.
Maybe their cunning plan for data security was that the ip address of their ftp site is already enough protection for their patient data. If noone knows the server exists, it might even work. The article gave some pretty strange description of how the security researcher's found out about the server's existence. "They were researching issues about fixed database credientals". Which kinda sounds like operation that already requires authorised access -- who would give some random person on the internet access to a password file? Probably the real unauthorised access happened some time _before_ accesssing the ftp site. The article focuses that the anon ftp site and how anyone should be permitted access to such things, but it completely forgets that the unauthorised access can happen at the place where server's location on the internet is discovered, Normally you need a port scan or (in this case, examining the credientals), which might not exactly be legal operations in the first place.
Type up a sheet with instructions on how to access the data. Print copies and place in envelopes. Label envelopes with names of "real press" reporters. Drop envelopes at establishments or homes where reporters can be found. Watch news outlets. Eat popcorn.
What if no one hired him? What if he just happened upon the FTP server?
The article specifically says he's a dental software security researcher. It's his job. Therefore it stands to reason, someone hired him.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
The US is tripping over itself to become a police state as soon as possible.
Requiem for the American Dream
Second point is that although access to enter was granted, access to download is not implicit. One logged on, you are effectively in someone else's house. If this were a house and the door was left wide open, I think even entering may be construed as trespassing. If in said house, the owner left all their confidential information on their office desk, you are not allowed to take pictures of them with your phone. To go back to the original thread, if the researcher ended up on this frp server by following a link that the server owner provided, either directly or indirectly by having a link on a public web site saying 'Hey, go look at these documents', then I would exonerate the guy.
Net servers assume business rules, not residential.
Access implies permission to download in an anon FTP server. The whole purpose of anon FTP is to distribute data freely to the public (remember, it pre-dates HTTP).
The defendant's "crime" is as follows: He picks up the store manager's wallet off of the tray under the "Please take one" sign, holds it up and calls to the manager "Hey, I don't think you meant to leave this here". Suddenly cops with assault weapons appear behind him and take him away.
The icing on the cake? They completely ignored the muggers openly shaking down elderly customers in front of the store.
Your problem is use of the house/doorway metaphor where it does not fit. Even if you could make a case (which I'll not address here) that allowing someone to log into a server does not automatically grant the right to download files to which they have been given read access, you certainly cannot make such a case for an FTP server, which is dedicated to allowing downloads and/or uploads of accessible files. The fact of its being an FTP server that allows the user access counts as the "Please download" sign.
Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.
The wrong person was arrested.The absolute idiot that exposed secure info should be arrested, fined, and banned from any IT job or function for life. Further, the HIPPA regs need to be made clearer and more encompassing, and enforced. If my info were in that compromised data, I'd be very angry at NOT Mr Shafer, rather the blithering idiot that made these data so available!
Self-importance and self-indulgence is the root of ALL evil.