Slashdot Log In
Is It Illegal To Disclose a Web Vulnerability?
Posted by
kdawson
on Tue Jan 16, 2007 03:58 PM
from the responsible-schresponsible dept.
from the responsible-schresponsible dept.
Scott writes "I'm submitting my own story on an important topic: Is it illegal to discover a vulnerability on a Web site? No one knows yet, but Eric McCarty's pleading guilty to hacking USC's web site was 'terrible and detrimental,' according to tech lawyer Jennifer Granick. She believes the law needs at least to be clarified, and preferably changed to protect those who find flaws in production Web sites — as opposed to those who 'exploit' such flaws. Of course, the owners of sites often don't see the distinction between the two. Regardless of whether or not it's illegal to disclose Web vulnerabilities, it's certainly problematic, and perhaps a fool's errand. After all, have you seen how easy it is to find XSS flaws in Web sites? In fact, the Web is challenging the very definition of 'vulnerability,' and some researchers are scared. As one researcher in the story says: 'I'm intimidated by the possible consequences to my career, bank account, and sanity. I agree with [noted security researcher] H.D. Moore, as far as production websites are concerned: "There is no way to report a vulnerability safely."'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So is it illegal too... (Score:2, Insightful)
paste up a poster in the town square, announcing that the lock is broken on the back of the hardware store?
How is this different?
Re: (Score:2)
Re: (Score:3, Informative)
The problem is that there are many emperors that want to believe in security by obscurity, and when told they have no clothes, would rather shoot the messenger than face reality.
It is a little different (Score:3, Insightful)
Re:So is it illegal too... (Score:5, Insightful)
I doubt that you'd get in trouble -- and how could you? -- if you submitted the vulnerability, or even publicized it, anonymously. There are lots of ways to do this; Mixmaster comes to mind, and is practically invulnerable to tracing, particularly when your potential adversary isn't expecting an anonymous communication to come in.
If you found a problem, realize that no good is ever going to come to you because of it, and don't expect to ever be rewarded or thanked. Once you've acknowledged those things, there's no reason to attach your name to it, when you let them know.
It's when you try to have your cake and eat it too -- point out someone else's problem while getting rewarded for it -- that the problems really begin.
Parent
Re: (Score:3, Insightful)
Re:So is it illegal too... (Score:5, Insightful)
If the hardware store gets broken into it mainly effects the owner(s) of the store, the people who work there, and not many other people. If a site like yahoo (the mail aspect of it), a banking site, or paypal is broken into and exploited then it effects every single person who uses the site in a very negative way.
I don't think publically announcing a vulnerability in a specific public service or facility is very responsible. At the same time, many businesses don't do anything to fix the problem if only one person tells them about it. The public releases we commonly see are sometimes necessary because without the pressure of the public eye the business won't correct the problems in it's service.
I've done things similar to this on a few occasions. I found a vulnerability in Surgemail, an all-in-one mail server software for Linux, which allowed any remote user to read any mail to the root account, and to send mail as root. I emailed them about it several times and received no reply for over six months. I finally released the info on it, and they fixed it two weeks later. I did something similar with an online service schools in my area offer which allows anyone to see the grades and personal info (SS#, home address, etc) of students in the school through a SQL injection. I contacted several schools about the issue as well as the company they had contracted to write the software for them. It's been 2 years and they still haven't fixed it.
Parent
Test my house for security vulnerabilities (Score:2)
Re: (Score:2, Insightful)
Re:Test my house for security vulnerabilities (Score:5, Insightful)
It's more like checking the locks on the backside of a Walmart. Suspicious, but not illegal, and not nearly as unethical.
Heck, you may actually have a legitimate reason to be back there - such as offloading goods from a truck.
The same can be said for security vulnerabilities in websites. You can easily stumble across them when you're not even looking in places that you're supposed to be.
Parent
Re: (Score:3, Interesting)
Re:Test my house for security vulnerabilities (Score:5, Insightful)
Parent
If you found an unlocked door at an airport (Score:4, Informative)
Parent
Car Lights & Common Courtesy (Score:3, Interesting)
In the old days, someone would check the doors to see if they were unlocked and turn off the lights for the person to keep their battery from running down.
Would you touch someone else's car today if the lights were on?
no good deed (Score:2)
No good deed goes unpunished. The lesson here is, lett the poor bastards find out about the problem after it's too late.
Re: (Score:3, Funny)
Re: No good deed goes unpunished (Score:3, Informative)
Discover, or try to discover? (Score:5, Interesting)
If I click a link, and something breaks, and I've 'discovered' a problem, I've probably not done anything. It just broke, and I was the one who was there.
If I try to find a problem, and do (even if I don't exploit it), then I might have been doing something I shouldn't.
A real world example would be, if you get caught outside of a door, trying to pick the lock, and then claim you were trying to ensure their locks were safe, you might get charged bith attempted B&E. You don't get to do a security audit on people's front doors.
As much as we like to separate people into black hats and white hats, if you were trying to jimmy the lock, for whatever reason, you were probably doing something you shouldn't have been.
Just my 2 cents, anyway.
Re: (Score:2, Insightful)
Re: (Score:2)
This, however, is different in civil courts.
Re: (Score:3, Interesting)
One of my network magazines that I get at no charge by filling out survey information had expired. I got a phone call and the person on the line asked me to renew. She provided a generic website address, and then a unique ID.
The problem was that the Unique ID was not random. It was something like 123456. When I put this in, it wasn't just a questioner. It had my personal information. I could put in 123457 or 123455 and bring up the personal information of someone else.
It is a we
Re:Discover, or try to discover? (Score:4, Insightful)
A real world example would be, if you get caught outside of a door, trying to pick the lock, and then claim you were trying to ensure their locks were safe, you might get charged bith attempted B&E. You don't get to do a security audit on people's front doors.
I don't buy that analogy. Breaking and entering is a crime. Theft is a crime. Exploiting computer vulnerabilities is a crime. I'm not sure finding computer vulnerabilities is or should be a crime. I could just as easily use the analogy, "looking at the windows of houses to see if they are open or unlocked is not a crime, but climbing through a window is."
I think laws that rely upon somehow knowing the intent of the person performing an act are pretty poor laws. If I go tell you your locks are really old and can be opened with a plastic fork because I noticed it while walking by, and you happen to run a store I do business with and hence have my CC# on file, that sure shouldn't be a crime. If I write a letter to the editor of the newspaper saying the same, it should not be a crime. If I notice on your Web site the same level of e-security, I don't see how it is qualitatively different.
Parent
Re: (Score:3, Insightful)
I'm gonna divide that into two halves ... the one that makes sense, and the other.
If you truly 'walked by' and noticed the windows, and told me about it, that's like notif
Re:Discover, or try to discover? (Score:4, Insightful)
If you then went to a known burglar with the information, well, you're no longer just doing something nice and innocent now, are you??
Yes, but no one is claiming you should be able to find vulnerabilities and give or sell them to blackhats, merely make them public or inform the site operator without worrying about being sued.
or the second half ... WTF does having, or not having, your credit card # on file apply to this?? It seems a bit spurious to the conversation at hand, and I'll treat it as such.
No it isn't. If they have your credit card on file (as many e-businesses might) then you have a business relationship with them and a vested interest in their security. It is perfectly legal and sometimes industry practice to hire private investigators to look into the security of current or proposed business partners.
I don't think you've idly done nothing.
You've done something, but nothing illegal.
You've made available to people the means to commit and illegal act. The fact that it was just there for anyone to see (or you spent three hours trying to find it) doesn't mean you wouldn't have anything to do with them getting robbed.
So what if the local bank, where the whole town keeps their money, tends to leave the back door propped open and the safe unlocked? Should it be illegal for me to tell the paper or the paper to write an article letting everyone know they should take their money out? Should you have to be concerned about being sued if you write the bank manager and let him know what is going on?
I realize people figure that white hats should scream really loud so everyone knows the vulerability, because the black hats wouldn't. But, telling the black hats how to do it, you no longer get to say you're better than they are. In fact, you're probably worse, because you were the one casing the joint, as it were.
Not at all. Whitehats do not profit from illegal actions and are aiming to improve overall security. Full disclosure is not always the best way to go about improving security, but sometimes it is. Why you think only in terms of full disclosure, however, is a mystery to me. Even the summary specifically mentions people being sued for just telling the Web service provider that the service has vulnerabilities in it.
You don't have an obligation to ensure that everyone in the world knows how to open every unsecured lock.
No, but sometimes telling the public how to open a particular lock is the best way to improve security. If Diebold starts selling a new combination bike lock, and I discover 1.2.3.4 always opens it, and I know at least one gang of thieves is already looking for these locks and stealing bikes via this method... I should 100% have no fear that I will suffer legal repercussions if I tell the support guys at Diebold. If Diebold refuses to acknowledge the problem I should likewise have no fear that my exercising my freedom of expression and telling the local newspaper will result in my being prosecuted for some crime. The same goes for software and services on computers.
Parent
Re: (Score:3, Interesting)
I wondered what would happen if I changed the number in the URL and found that the site would happily show me the details for all the other applicants (including quite sensitive information).
Was changing the URL "trying to discover a v
Re: (Score:3, Interesting)
If I store my stuff in a storage locker and have to use a lock the storage company provides, can I test its security?
If I live in an apartment building, can I check the lock on my door to make sure it's not easy to pick?
In reality, all locks are pretty easy to pick. Locksmiths and law enforcement have tools that can
Re:Discover, or try to discover? (Score:4, Interesting)
Well, I guess, like any legal matter, one hopes there is a threshold of evidence to indicate one way or the other, and that people are looking at it on a case-by-case basis.
If I bump into an owie on someone's site, send them a friendly "hey, did you know this", and the logs don't indicate that I spent a few hours entering in junk, then, maybe, I need the benefit of the doubt and I was a nice guy who told them of something unusual as soon as it happened.
If I spent hours putting in malformed urls, experimenting with SQL injection, XSS stuff, and the logs show it, then maybe you need to look at me a little closer as someone who was specifically trying to breach their security.
Like any such thing, I would hope it's not a truly black or white distinction -- I would hate to think that accidentally discovering a bug on a web page, which was a vulnerability, was a crime. That would mean that you were guilty of comitting a crime, when in fact, you found a bug in someone's software. And *that* is scary indeed!!
You do raise a good point; but sometimes it's better that the law use our nice little presumption of innocence and we miss people, as opposed to a presumption of guilt, and we arrest innocent people.
Cheers
Parent
Re: (Score:3, Insightful)
Clicking the link took me to a page that had links to pdf reports, etc. Clicking on one of those took me to a standard apache index page with a list of the contents of the directory.
After clicking around in there, the source files for a multi-thousand (close to $10,000) cold fusion enterprise CMS system were discovered. Clicking on one of the
Lack of qualifications ... (Score:2)
It's an issue of trust. If you sit outside the system and make pronouncements, it's difficult to trust what you say. If you break into
Anonymizers? (Score:5, Insightful)
Anonymizer tools have improved since then, especially for combating censorship. Would you be able to use TOR or something similar to report vulnerabilities without exposing your identity?
So don't. (Score:2)
Expensive lesson usually means lesson learned.
Why are we supposed to help the stupid? Let them continue doing stupid things until they get pwnt and it costs them their business.
It should be handled like every other related act (Score:3, Insightful)
What's the problem? (Score:4, Interesting)
Re:What's the problem? (Score:5, Insightful)
Parent
Re:What's the problem? (Score:4, Informative)
Parent
vulnerability disclosure: how much is too much? (Score:3, Informative)
damn litigious assholes (Score:2)
Finally! (Score:2)
It's been ok for me (Score:5, Interesting)
A few years ago I was renewing my car tabs on the WA state's site and they had a box for 'donations to DOT' or somesuch. For kicks I tried putting in a negative value, and sure enough it reflected the total for my tabs as less. I went ahead and submitted things with a dollar taken off the value, just to see if it would actually go through. Sure enough, a week later I received my tabs, and the mathematically correct but embarrassing negative donation on my receipt.
I ended up calling them and letting them know about the bug. They were nice about it, and the next year at least it was fixed.
-Nic
There's two types of people in the world.... (Score:2, Insightful)
and those that proudly proclaim "I am doing this and no-one can stop me. If you think you can arrest me for this, YOU ARE WRONG."
The first kind of people contribute nothing to our freedoms. They are crippled by uncertainty and their annoying whining makes people think that, hey, maybe there is something to fear. The second kind of people challenge the norms and make that which was uncertain clearly
Look who will argue, write and advocate the law. (Score:3, Insightful)
Each time an exploit comes out, the pattern is the same. the company doesn't announce it, anti-virus makers are either paid off (as in 'approved' spyware and/or rootkits) or not kept informed, and once the story breaks, the public relations machine starts. The researcher is vilified as a hacker, the problem is denied or minimized, and the prospect of a patch is left moot because this would require accepting that a huge problem exists. Most of us scream that this is ridiculous, companies should tell everyone when an exploit shows up, and patch it as soon as possible. More to the point, they should expose their source code to scrutiny in order to better provide services to their customers.
Are you sitting down? good. They won't and they don't care. The first rule in the PR handbook is to deny and put off realization. If the big front is that there isn't a problem, or that a crack of a voting machine can only be done in a lab, and months down the road, the company quietly sues the researcher or releases a patch, they win. People have a limited attention span and fatigue quickly in the face of fear and hysteria. As long as your company's admission of guilt comes well after the original problem, or not at all, people are happy.
With this in mind, let's look at the law. thankfully, whistleblowers have some protection, and some internal voices about code might not be silenced, especially if the review takes place within the judicial system, and not through a new law. Of course, corporate secrecy, as in the case of Apple and HP, is pretty extreme, and most employees wouldn't risk the civil consequences of voicing a problem that doesn't rise to the level of a public safety hazard.
Outside researchers are in more and more trouble, and this really only leads to problems for the customer base as a whole. We rely on sites like MOAB [info-pull.com] to shame companies into action. We also rely on OSS competition in order to make products like IE better--Firefox gives an economic incentive to Microsoft to improve their product, otherwise, security development would have languished.
Very few analogues exist in the places where this is critically important: commercial and banking software. CITIbank [boingboing.net] suffers a classbreak and doesn't bother informing their customers. Security conscious customers can voice their discontent and move to another bank, but we have to trust that the new bank is as averse to security breaches as we are. For the rest of the millions of customers, security will not improve. Since identity theft costs are largely borne by the customers, the banks don't care. because the banks don't care, it is much easier, and better in their eyes, to make publishing voulnerabilities like this one [eweek.com] illegal and trust that their customers will never be the wiser.
check out this article:
[PDF] Why information security is hard [google.com]
It may not be illegal... (Score:3, Insightful)
But then, it's not your business, either.
Should you discover a security vulnerability, the correct response is to forget it. Here's why:
Naturally, we might feel a sense of duty to help someone out - if they have an exposed security flaw, we naturally want to help them. But first consider how it will be received. Most companies would rather produce software with publicly unknown flaws than to produce perfect software, websites, etc... at a much higher cost.
And, if you feel that the website owner would appreciate knowing, you might at least disclose it from an anonymous email address.
Re: (Score:3, Insightful)
As a website owner, and admin of several sites, yes I do want to know and while no one likes bad n
The long term influence (Score:3, Interesting)
he police was after me because of:
1) Falcifying my identity, because I gave a fake adress on gmx.net
2) spreading of chldporn, because I replied to a Usenetmessage with the URL still in it
3) Obstruction of a police investigation. Because there was an investigation going on.
I never got a reply from the webmaster, because he apparently was not allowed to do anything, nor remove the site, because the police was investigating it already.
I never got a reply from the police, because their mailserver was down
I was able to explain to them what I did.
I had a very understanding boss, which was the one where I posted from and whom they told they needed the person posting because of a child-porn related crime investigation. At other places I might have lost my job.
It goes without saying that that sighting of childporn must have been a fluke. I have not ever seen any childporn or any other illegal activity on the Internet.
To sum it up: if diclosing web vulnerabilities is outlawed, only outlaws will disclose web vulnerabilities. Oh , and they don't.
Re:It ought to be (Score:4, Insightful)
Expecting privacy on a publicly advertised service is different to people using zoom lenses to peer through the fence of your gated community.
Parent
Re:It ought to be (Score:4, Insightful)
She has drapes for this.
Parent
Re:It ought to be (Score:4, Funny)
Is she cute?
Does she use her drapes?
Parent
Re:It ought to be (Score:5, Insightful)
Parent
Re: (Score:2)
Re:Moot issue? (Score:4, Informative)
That gives small time security experts a platform of anonymity to disclose vulnerabilities to anyone (not just 3com's customers) while retaining the possibility of a reward.
Parent