8 ms·

It is a terrible decision curl http://domain.com/showdocument?[00000-99999] should not be a crime!!

by lesslaw 13y ago

davidw 13y ago
What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account? Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right? Yes, it's their fault too for leaving it open, but you had a choice when you decided to access it N000 times, rather than saying "oops, that does something bad, I think I'll stop". I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. Once you've shown that someone stupidly left their door open, the polite thing is to let them know, rather than walking around in their house looking at all their things to show them the error of their ways. IMO a fine would more than suffice as a punishment, though.
- betterunix 13y ago
  "What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?" Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?
  - davidw 13y ago
    If they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.
    - betterunix 13y ago
      Sure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?
      - davidw 13y ago
        > Why are we acting like AT&T is an innocent victim? No one here is. I'm not sure why no one has done anything to them, legally. It'd be interesting if someone who actually knows what they're talking about in terms of the legal system about could comment on it.
    - FlyingAvatar 13y ago
      I think that the problem with this thinking is: (a) Even altering a parameter once in the address could be considered illegal under the current laws. (b) The access of information in and of itself would not be illegal alone. Say I kept a bunch of people's information in paper files in file cabinets. Then I gave you access to retrieve yours from the file drawer yourself. It is sleazy, but not necessarily illegal to look at other files in the drawer, as I have given you access to their container. (c) Even if you want to make the action in (b) illegal, the reasonable punishment is almost certainly not a double digit prison sentence.
  - publicfig 13y ago
    This analogy has been flawed from the beginning, but to extend it just for the fun of it, that's like pulling the trigger of a gun and then blaming the gun for having the mechanics to turn that trigger pull into a fired bullet that kills someone. The action being done is on your end, and the system, though possibly flawed, is not the cause of the results. It may be a factor and it may enable those results, but the actor is the cause in that situation. I honestly don't even know where I stand on the actual discussion point, but I do know where I stand in the weird analogy tree we've made.
    - betterunix 13y ago
      It is more like blaming the owner of the gun, who loaded the gun, aimed it, set up the shot, and then left it up to the trigger man whether or not to pull the trigger. Bringing things back to reality here, AT&T was entrusted with personal information but failed to properly secure it. They set up a system that automatically responded to requests for personal information. They gave unauthorized people access to that system. We should be blaming AT&T and making them pay punitive damages for their irresponsible behavior, not whining about how terrible Weev is for using the system they gave him access to. The fact that AT&T can just shrug it off is what allows the sorry state of security to persist.
- dorkitude 13y ago
  That would be a crime, because then the email addresses would've been "possessed" or "transferred" "in connection with" another distinct and separate crime. But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.
- walid 13y ago
  > I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. In this case there is no crime. And I repeat this again, AT&T was behaving like http://www.mailinator.com/ http://www.mailinator.com/
- DomreiRoam 13y ago
  GET method should be Safe ( and Idempotent). The implementation is not respecting the RFC 2616. The RFC says at the point 9.1.1 that: "Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the effects, so therefore cannot be held accountable for them."
IanCal 13y ago
Should I be allowed to brute force passwords then?
- betterunix 13y ago
  Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.
  - twoodfin 13y ago
    You and sneak seem to be proposing a legal regime under which no "hacking" of any kind is illegal. If the system will perform action B given request A, issuing request A, no matter the intent, cannot be a crime? If I'm missing an important distinction you'd make, I'd very much like to hear what it is.
    - betterunix 13y ago
      I would prefer if the system punished people for what they did with their access to data, not simply for having that access; organizations that hold private or sensitive information should be punished if unauthorized people can access it by any means. Having email addresses or credit card numbers should not be the crime, regardless of how you obtained that information. Committing credit card fraud or selling credit card information to other unauthorized people should be crimes (or failing to secure your computer where you store said information). So Weev should not be punished for downloading the email addresses. AT&T should be punished for making the list available to him (and likewise, if Weev made the list available to others, he should be punished for that).
      - twoodfin 13y ago
        Apologies for crossing threads, but aren't you pretty upset that the NSA simply has Verizon phone records, despite a lack of evidence they're planning on doing anything nefarious with them? Anyway, as I understand it, weev did speculate about selling the information. And would you be so sanguine if this were health records or private photographs? I'm not seeing a plausible guiding principle here.
efdee 13y ago
How about curl http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&password=[aaaaa-zzzzz] http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&passwo..., followed by curl http://domain.com/admin/wipeeverything?username=x&password=y http://domain.com/admin/wipeeverything?username=x&password=y ?
- rpicard 13y ago
  Couldn't we draw a line between retrieving information and modifying it?

It is a terrible decision curl http://domain.com/showdocument?[00000-99999] should not be a crime!!

by lesslaw 13y ago

It is a terrible decision curl http://domain.com/showdocument?[00000-99999] should not be a crime!!

What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account? Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right? Yes, it's their fault too for leaving it open, but you had a choice when you decided to access it N000 times, rather than saying "oops, that does something bad, I think I'll stop". I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. Once you've shown that someone stupidly left their door open, the polite thing is to let them know, rather than walking around in their house looking at all their things to show them the error of their ways. IMO a fine would more than suffice as a punishment, though.

betterunix 13y ago
"What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?" Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?
- davidw 13y ago
  If they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.
  - betterunix 13y ago
    Sure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?
    - davidw 13y ago
      > Why are we acting like AT&T is an innocent victim? No one here is. I'm not sure why no one has done anything to them, legally. It'd be interesting if someone who actually knows what they're talking about in terms of the legal system about could comment on it.
  - FlyingAvatar 13y ago
    I think that the problem with this thinking is: (a) Even altering a parameter once in the address could be considered illegal under the current laws. (b) The access of information in and of itself would not be illegal alone. Say I kept a bunch of people's information in paper files in file cabinets. Then I gave you access to retrieve yours from the file drawer yourself. It is sleazy, but not necessarily illegal to look at other files in the drawer, as I have given you access to their container. (c) Even if you want to make the action in (b) illegal, the reasonable punishment is almost certainly not a double digit prison sentence.
- publicfig 13y ago
  This analogy has been flawed from the beginning, but to extend it just for the fun of it, that's like pulling the trigger of a gun and then blaming the gun for having the mechanics to turn that trigger pull into a fired bullet that kills someone. The action being done is on your end, and the system, though possibly flawed, is not the cause of the results. It may be a factor and it may enable those results, but the actor is the cause in that situation. I honestly don't even know where I stand on the actual discussion point, but I do know where I stand in the weird analogy tree we've made.
  - betterunix 13y ago
    It is more like blaming the owner of the gun, who loaded the gun, aimed it, set up the shot, and then left it up to the trigger man whether or not to pull the trigger. Bringing things back to reality here, AT&T was entrusted with personal information but failed to properly secure it. They set up a system that automatically responded to requests for personal information. They gave unauthorized people access to that system. We should be blaming AT&T and making them pay punitive damages for their irresponsible behavior, not whining about how terrible Weev is for using the system they gave him access to. The fact that AT&T can just shrug it off is what allows the sorry state of security to persist.
dorkitude 13y ago
That would be a crime, because then the email addresses would've been "possessed" or "transferred" "in connection with" another distinct and separate crime. But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.
walid 13y ago
> I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. In this case there is no crime. And I repeat this again, AT&T was behaving like http://www.mailinator.com/ http://www.mailinator.com/
DomreiRoam 13y ago
GET method should be Safe ( and Idempotent). The implementation is not respecting the RFC 2616. The RFC says at the point 9.1.1 that: "Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the effects, so therefore cannot be held accountable for them."

IanCal 13y ago

Should I be allowed to brute force passwords then?

betterunix 13y ago
Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.
- twoodfin 13y ago
  You and sneak seem to be proposing a legal regime under which no "hacking" of any kind is illegal. If the system will perform action B given request A, issuing request A, no matter the intent, cannot be a crime? If I'm missing an important distinction you'd make, I'd very much like to hear what it is.
  - betterunix 13y ago
    I would prefer if the system punished people for what they did with their access to data, not simply for having that access; organizations that hold private or sensitive information should be punished if unauthorized people can access it by any means. Having email addresses or credit card numbers should not be the crime, regardless of how you obtained that information. Committing credit card fraud or selling credit card information to other unauthorized people should be crimes (or failing to secure your computer where you store said information). So Weev should not be punished for downloading the email addresses. AT&T should be punished for making the list available to him (and likewise, if Weev made the list available to others, he should be punished for that).
    - twoodfin 13y ago
      Apologies for crossing threads, but aren't you pretty upset that the NSA simply has Verizon phone records, despite a lack of evidence they're planning on doing anything nefarious with them? Anyway, as I understand it, weev did speculate about selling the information. And would you be so sanguine if this were health records or private photographs? I'm not seeing a plausible guiding principle here.

efdee 13y ago

How about curl http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&password=[aaaaa-zzzzz] http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&passwo..., followed by curl http://domain.com/admin/wipeeverything?username=x&password=y http://domain.com/admin/wipeeverything?username=x&password=y ?

rpicard 13y ago
Couldn't we draw a line between retrieving information and modifying it?