Mr. Robot Blind SQL Injection Vulnerability
corenumb.wordpress.com
corenumb.wordpress.com
One would not necessarily expect that it was the actual Mr. Robot who created the website for the show. In fact I'd expect it to be a relatively junior agency.
Which would mean they've got QA & security process to match.
I'd also suspect that as an overwhelmingly awesome show that glorifies hackers, they're probably a relatively "safe" target.
I mean, we're talking the game of thrones of computer nerd shows here...
Nevertheless I find it more telling in terms of what the given company is about by their response to being shown a vulnerability than necessarily writing perfect software every time.
Here is a box of all your valuables. Reward please
But I get your point.
I did realize, which is why I don't keep your private information in there. They are in a safe hided somewhere.
That website clearly didn't realize that they had a window right there. Thanks to this guy, they now replaced it by a wall.
You accept the risk of that window, the people that goes into your house or do stuff in your house accept that risk while being near that window because they know the risk. On a website, you deal with other people stuff, not only there's an expectation of security, you won't have the luxury of knowing where's there's a window like that.
Is this person a just "friendly" pentester who "did you a favor" by finding a problem and just hasn't gotten around to telling you about it yet? Or was this an attacker who found a hole into your organization and is either hacking you further, selling the knowledge about your site's vulnerability to others, or monetizing this information in some other way?
You have no way to know. All you know is someone committed a crime.
If someone disclose you a security hole, you reward him.
2 reasons why: - You now know what's the issue and that there's one. He may have sold the whole private data of your organization to some other guy, but that's a constant in your situation. The only difference is knowing the source of the hole. If it help getting disclosure, even if it's from a black hat and he did committed something unethical, he still gave you something to fix.
- It give white hat a way to find hole in your security. Without that, they have no incentive to work on it. Again I will work on constant, black hat are a constant in the situation, either way they will try it, but without a bug bounty, you will only have black hat.
So what knowing if it's a black hat or a white hat change to you? Nothing, you still should have a bug bounty that reward disclosure because that's the only way to increase your odds of fixing theses security holes (the only thing that matter the most, whatever happens).
(I'm not saying not doing anything though if you see a SQL injection in your log, you fix it either way)
Basically I'd like to say "Hey, we wont sue you if you report security problems" but I feel that due to other available bug bounties with wealthier pockets out there I'd just look like a cheap SOB rather than managing to make the original point of not suing for responsible disclosure
Yes. Exploiting a blind SQL injection vulnerability to dump database tables and rows of a website you don't control without permission is a crime in most jurisdictions.
It's still a crime even if you were trying to "help" the web master.
It's still a crime even if you were just dumping the tables to "prove" the vulnerability exists.
It's still a crime even you "disclose it responsibility."
Why is finding vulns in say, outlook.com a crime but finding vulns in the thick client version of Outlook not a crime? Because of where the software is running.
Depending on how you learned of said vulnerabilities, you might still be culpable for the mere act of discovering them.
Remember that the CFAA has both a civil and a criminal component; if the state decides to charge you, the opinion of the company whose computers you illegally accessed does not necessarily matter. JSTOR asked Carmen Ortiz to drop the charges against Aaron Swartz and she declined to do so.
This is not the kind of thing you want to risk having to depend on a jury to justly decide -- juries have an atrocious record with technical subjects, and if you can't afford a world-class lawyer (which, for reference, is going to cost around a million dollars), your chances are even worse.
If the company informs the US Attorney about the case as a scare tactic, there's no guarantee that the attorney will back off when/if the company and the researcher reach an understanding. It's somewhat unlikely that they would, in fact, as "cybercrime prosecution" seems to be a widely-desired bullet point for prosectors' resumes. This is surely the only motive that existed behind the prosecution of Aaron Swartz.
If the plan is to take advantage of bug bounty programs, I believe the wise thing is to conceal your real identity. Anything that could potentially result in a CFAA claim or charge is much safer that way.
The relevant parts of the CFAA are aimed at unauthorized access.
There are other factors that come into play here too depending on the specific wording of the site's ToS and the bug bounty participation agreements/whatever. Access may be totally unauthorized, if, for example, one uses an automated scanning tool like sqlmap, as most sites have a ToS that bans any "automated access".
And there is the first factor, which is that if you're being sued by someone who is big enough for a bug bounty program, no normal person is going to be able to fight it, and if that company tells the prosector's office about you, you're going to have a hard time shaking them off as well.
Judges have also ruled that if you visit a public-facing page that contains information the rightsholder doesn't want you specifically to see (everyone else on the internet is OK), the temporary "unauthorized" copy that exists in the RAM of your computer constitutes copyright infringement.
Our internet access laws are horrifically outdated.
If Craigslist have sent you a letter by legally-certified mail telling you to stop scraping rent pricing information off their site, then it makes you both a jerk and a criminal if you keep doing it. Or you could be unintentionally denying their legitimate users service by overloading their servers.
Similarly, if they've sent you legally-certified mail telling you to stop stealing their information and reselling it for your hip new startup, then you're in copyright violation if you keep storing and reselling their data.
DEX throws these yellow pages on my porch every few months. If I decided to start scanning the pages to seed a competitor, they'd have every right to tell me to stop and sue me for copyright infringement. And yes, the 'temporary' copy in my camera's SD card would constitute copyright infringement. I don't see what it being a website has to do with anything; DEXes are just as public-facing as a website when they throw them on your porch.
Judges in the United States do a terrific job - especially at the higher courts. The one handling the Oracle vs. Google API case taught himself Java to better understand the case. I think it's far more likely that you're oversimplifying in a dishonest way.
The facts in a list of facts, like the fact that there is a home for rent at a specific address and the landlord wants $x per month from potential tenants, cannot be copyrighted by anyone, certainly not a middleman like Craigslist. It is free information that anyone in the world may use as they like. The law is written that way, the courts have ruled that way. This is true of information in books, on billboards, flyers, CD-ROMs, whatever. It's only a technicality in the delivery mechanism that makes it any different when the information is read from a page retrieved by HTTP.
You gave the example of a phone book, which is unfortunate for you because that very example has been litigated in Feist Publications, Inc. v. Rural Telephone Service Co. [1] and the assertions you're making were ruled incorrect. It was ruled that it is perfectly legal to copy the facts out of a phone book, rearrange them, and republish the content. This was argued all the way up to the Supreme Court. Remember that you believe "judges do a terrific job, especially in the higher courts".
As you point out, there is no practical difference between copying out of a phone book or a web page for practical purposes. The reason one is legal and one is illegal is because of the obtuse wording of the CFAA and the technical ignorance of the judiciary, especially in the precedent-setting cases that were decided a decade or more ago, as the internet was still emerging as a force in American life.
>If Craigslist have sent you a letter by legally-certified mail telling you to stop scraping rent pricing information off their site, then it makes you both an asshole and a criminal if you keep doing it.
On what basis? We've already established there is no copyright interest in the factual data (though there may be in the exact wording of the ad, if only non-copyrightable factual data is extracted, there is no infringement).
Should it be illegal for me to read a book that I legally acquired just because the publisher sent me a letter and told me he didn't like what I was doing with the information I learned from it? Am I an asshole if I read a book by a politician and go on TV to talk about how I disagree with something he said therein? Should I be under either criminal or moral indictment for doing so?
The publisher must take responsibility for widely and publicly disseminating the information. If you don't want some people to know certain things, you shouldn't publish and then sell tens of thousands of books that contain that information. In the same way, if you're worried about what someone else may do when they learn that the house at 129 Main St is currently on the market, perhaps you shouldn't tell everyone.
Legally, the difference only exists because the internet works by pulling a copy of the web page from a server. That shouldn't matter most of the time, which, again, you already indicated.
>Or you could be unintentionally denying their legitimate users service by overloading their servers.
I agree that there should be reasonable civil liability for causing accidental DoS attacks. That's fine. The law should be amended so that it only covers this, not so that it covers normal information retrieval from the internet.
>And yes, the 'temporary' copy in my camera's SD card would constitute copyright infringement.
The correct analogy for a copy in RAM is the copy of the image that is reflected onto your retinas when you look at the copyrighted work, not a permanent storage device from which the content is eventually deleted. Every judge in the world would scoff if someone tried to claim that anyone who looked at his work owed him for the "infringing copy" that existed in their eyeballs, but because judges don't understand how computers or RAM work, they make decisions they'd scoff at if they knew what was really going on. [2]
[0] https://en.wikipedia.org/wiki/Threshold_of_originality
[1] https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R....
[2] https://en.wikipedia.org/wiki/Ticketmaster,_LLC_v._RMG_Techn....
If somebody set up a Craigslist mirror[1], and people scraped that mirror instead, I wouldn't see any problem with that.
But I don't think Craigslist itself should be obligated to serve you their data, the same way a bookstore that tells you to never come back should be allowed to call the police for trespassing if you try to buy a book from them again. I would still maintain that they should be able to tell you to stop visiting their website.
They do have terms on their site saying that you agree not to scrape their website by accessing it. I don't know how enforceable those are since they're buried at the bottom, but if Craigslist changed their website to more easily track users(with persistent accounts) and made the terms opt-in, then I'd say they don't even need to send you a letter for you to be in violation.
The phone book doesn't get to use this because they flung it on my porch; if you had to visit them and sign an NDA before they gave you a copy, I bet that case would've turned out differently. If they printed an implicit NDA on the first page and threw that on your porch, it's less clear but my guess is it wouldn't fly.
Additionally, if you lived right next door to Craigslist, and your requests never crossed state lines, I would tend to think that the federal government doesn't have the authority to regulate your request in the first place, and that it'd be up to the state.
[1] These archive the front page, but not the results. There's a robots.txt preventing that. If someone else ignored that request and mirrored everything, they would be doing something wrong but the scrapers of the mirror wouldn't be.
https://web.archive.org/web/20160503013529/http://portland.c...
http://webcache.googleusercontent.com/search?q=cache:craigsl...