Is It Illegal To Disclose a Web Vulnerability? 198
Scott writes "I'm submitting my own story on an important topic: Is it illegal to discover a vulnerability on a Web site? No one knows yet, but Eric McCarty's pleading guilty to hacking USC's web site was 'terrible and detrimental,' according to tech lawyer Jennifer Granick. She believes the law needs at least to be clarified, and preferably changed to protect those who find flaws in production Web sites — as opposed to those who 'exploit' such flaws. Of course, the owners of sites often don't see the distinction between the two. Regardless of whether or not it's illegal to disclose Web vulnerabilities, it's certainly problematic, and perhaps a fool's errand. After all, have you seen how easy it is to find XSS flaws in Web sites? In fact, the Web is challenging the very definition of 'vulnerability,' and some researchers are scared. As one researcher in the story says: 'I'm intimidated by the possible consequences to my career, bank account, and sanity. I agree with [noted security researcher] H.D. Moore, as far as production websites are concerned: "There is no way to report a vulnerability safely."'"
Discover, or try to discover? (Score:5, Interesting)
If I click a link, and something breaks, and I've 'discovered' a problem, I've probably not done anything. It just broke, and I was the one who was there.
If I try to find a problem, and do (even if I don't exploit it), then I might have been doing something I shouldn't.
A real world example would be, if you get caught outside of a door, trying to pick the lock, and then claim you were trying to ensure their locks were safe, you might get charged bith attempted B&E. You don't get to do a security audit on people's front doors.
As much as we like to separate people into black hats and white hats, if you were trying to jimmy the lock, for whatever reason, you were probably doing something you shouldn't have been.
Just my 2 cents, anyway.
What's the problem? (Score:4, Interesting)
Re:Discover, or try to discover? (Score:4, Interesting)
Well, I guess, like any legal matter, one hopes there is a threshold of evidence to indicate one way or the other, and that people are looking at it on a case-by-case basis.
If I bump into an owie on someone's site, send them a friendly "hey, did you know this", and the logs don't indicate that I spent a few hours entering in junk, then, maybe, I need the benefit of the doubt and I was a nice guy who told them of something unusual as soon as it happened.
If I spent hours putting in malformed urls, experimenting with SQL injection, XSS stuff, and the logs show it, then maybe you need to look at me a little closer as someone who was specifically trying to breach their security.
Like any such thing, I would hope it's not a truly black or white distinction -- I would hate to think that accidentally discovering a bug on a web page, which was a vulnerability, was a crime. That would mean that you were guilty of comitting a crime, when in fact, you found a bug in someone's software. And *that* is scary indeed!!
You do raise a good point; but sometimes it's better that the law use our nice little presumption of innocence and we miss people, as opposed to a presumption of guilt, and we arrest innocent people.
Cheers
Re:Discover, or try to discover? (Score:3, Interesting)
One of my network magazines that I get at no charge by filling out survey information had expired. I got a phone call and the person on the line asked me to renew. She provided a generic website address, and then a unique ID.
The problem was that the Unique ID was not random. It was something like 123456. When I put this in, it wasn't just a questioner. It had my personal information. I could put in 123457 or 123455 and bring up the personal information of someone else.
It is a web vulnerability, imo, caused by improper security on my personal data.
This doesn't match up with your simile of picking a lock.
I did report this, and the company did change their website. I reported it on the phone as I was talking to the person, as well as by e-mail.
It's been ok for me (Score:5, Interesting)
A few years ago I was renewing my car tabs on the WA state's site and they had a box for 'donations to DOT' or somesuch. For kicks I tried putting in a negative value, and sure enough it reflected the total for my tabs as less. I went ahead and submitted things with a dollar taken off the value, just to see if it would actually go through. Sure enough, a week later I received my tabs, and the mathematically correct but embarrassing negative donation on my receipt.
I ended up calling them and letting them know about the bug. They were nice about it, and the next year at least it was fixed.
-Nic
Re:Discover, or try to discover? (Score:3, Interesting)
I wondered what would happen if I changed the number in the URL and found that the site would happily show me the details for all the other applicants (including quite sensitive information).
Was changing the URL "trying to discover a vulnerability" or "discovering a vulnerability"?
What if the values had been sent using a HTTP POST (so I couldn't see them or edit them by just changing a URL)? What if they had been lightly encrypted or included a check-digit?
Re:Discover, or try to discover? (Score:3, Interesting)
If I store my stuff in a storage locker and have to use a lock the storage company provides, can I test its security?
If I live in an apartment building, can I check the lock on my door to make sure it's not easy to pick?
In reality, all locks are pretty easy to pick. Locksmiths and law enforcement have tools that can open most locks within minutes or seconds, and anyone with an interest can buy or fashion their own lockpicks relatively easily. On the Internet, security is supposed to mean more than just an easily defeated mechanical lock because the attack surface is world-wide and difficult to monitor. You can't hire cheap security guards to keep hackers out of websites like you can to protect locked doors. Computer and Internet security rely on vigilant eyes finding vulnerabilities in the system and fixing them, and since most companies don't seem to take security very seriously, it makes sense that people should be able to gauge the security of any system they are going to store information in, or in the general case just inspect any Internet host they want for vulnerabilities. As a shared medium, every host connected to the Internet can have a large impact in terms of DoS, worm, or spam attacks. If anything, the problem is that companies and individuals connect their systems to the Internet without realizing this, and want laws to protect them from things that the law can do essentially nothing about.
The way I see it, if a host on the Internet has an open known port (it shows up in
The Internet requires smart people looking for vulnerabilities and reporting them in order to function securely. Most companies do not have the money to pay smart people to do nothing but find vulnerabilities, which is unfortunate. The fact that people do it for free or for recognition should be recognized as the useful service that it is. Black hat crackers will always be interested in finding vulnerabilities and exploiting them in secret, or selling them to someone who can exploit them. It's exactly like an immune system that must be trained by infections in order to combat them in the future. Without knowing what attacks look like and how they work, there's no way to defend against them, short of rewriting all the software and proving the Internet and computer systems are perfectly secure by design.
Re:Test my house for security vulnerabilities (Score:2, Interesting)
It is illegal to stand on the corner and say, "That house over there is selling cocaine for $10." when you are hired by the cocaine house.
So are these people saying, "Product X sux because of this vulnerabily xyz here, exploitable via abc", and that's that, or are they saying, "Product X sux because of blah blah blah, and company X, could you pay me $10 or I'll release the info?"
Comment removed (Score:3, Interesting)
It's simple (Score:2, Interesting)
Re:Test my house for security vulnerabilities (Score:3, Interesting)
Now, is it my fault I ended up there? I don't think so... would the pub want to know they have this problem so they can install an additional security door/gate, probably. Was what I did illegal... maybe, I did tresspass on their property, though entirely by accident, had I been paying more attention I would not have exited the elevator, but I wasn't, so I stood in the middle of the pub long enough for the next elevator car to arrive.
would I get in trouble for reporting it? maybe... hard to say, people get insanely paranoid about security, and wether you are talking electronic security, or real world physical security, in most cases people would rather blame the person who found the problem than acknowledge the problem exists in the first place...
Not informing helps criminals. A LOT (Score:2, Interesting)
Why is this difficult to understand?
As for all the "doing something you shouldn't" bullshit, it's innocent until proven guilty. When did people become so terrified of freedom.
Prosecuted In England for This.. (Score:2, Interesting)
http://it.slashdot.org/article.pl?sid=05/10/07/15
"Security consultant Daniel Cuthbert worried that he'd been stung by a phishing scam when he donated to a Tsunami relief effort in London, UK. He was convicted for hacking and lost his job after running a couple of checks on the website in question."
This is exactly what this article is discussing. Not only should you be held liable in some instances for "looking for vulnerabilities", you should be prosecuted. Now the above case is surely an extreme. Just reading the article I would be completely against prosecution in such an instance. Then again I wasn't part of the team that prosecuted or reported him. He might have tried to do a little more than just check a single
Car Lights & Common Courtesy (Score:3, Interesting)
In the old days, someone would check the doors to see if they were unlocked and turn off the lights for the person to keep their battery from running down.
Would you touch someone else's car today if the lights were on?