Hacker News Reader

Comment by noodlesUK | Hacker News Reader

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find that you’re hacking something you weren’t expecting, and might piss someone off other than a scammer.

View on HN

While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this.

Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.

Maybe if you don't cause any collateral damage, you might have a low chance of conviction by a jury because the victim is highly non-sympathetic. (I'm not a lawyer. This is NOT LEGAL ADVICE.) That doesn't mean you won't get charged and incur a ton of legal costs if you pursue a jury trial rather than settling.

Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less left to interpretation), but it does have downsides.

> "Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less left to interpretation)"

Are they? My impression is that US courts rely heavily on the whims of a jury and the judge, leading to very different outcomes for similar cases. Though often leading to injustice (heavy punishments for poor and/or black people, light punishments for rich and/or white people) rather than justice.

I think their biases would have worse consequences if their goal was following some intuitive gut feeling of justice rather than having a goal of applying the law even when the law is known to be imperfect. That is, the less explicit the rules are, the more wiggle room there is for bias to act.

I'm not so sure, I feel the civil law system followed in continental Europe works much better as it's based on the spirit of the law instead of the exact letter and comma.

Hard to say if this would be a better fit for the US though -- I've no idea if that's causing issues elsewhere in more corrupt societies or not.

Jury nullification allows them to become courts of justice.

Which is why is screened for at the jury selection stage.

Then shut up about it and don't tell them?

> While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this.

Depends on who you fear more: law enforcement or organized crime.

The comment you replied to did say "Unless authorities are looking for an excuse to prosecute you, of course." If you suspect you're being monitored by the FBI or some other entity, you don't want to push the envelope.

O think weinzierl suggests that the criminals behind this might be more eager to punish you than law enforcement. But of course for that it doesn't really matter whether or not this is legal.

Until you realized you have been setup. The box you log into has child porn or those logs you download have them.

Now you pay up or cops are called.

Trying to play a hacker may get you in more trouble unless you really are one.

VPS owners will if your flooding causes issues for their (other) clients on the same hardware, etc.

It's definitely better to not do this.

What do you think the scammers are going to do, call the police?

They presumably wouldn't call the police to report you for messing with their scam, but it's not unthinkable–if they're able to identify who you are–that they could SWAT you. I believe Brian Krebs has been SWAT'ed multiple times, and has had heroin mailed to his house to frame him.

I have a colleague who is a security researcher. And every now and then, he tells me he got a threat from an internet criminal about "how they know where he lives".

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

IANAL:

This is what I expect the relevant text in the CFAA is...

knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Is it damage if you're just sending data to an endpoint to see what happens. Sounds like he didn't try to send a SQL Injection, he just sent more characters than what was expected.

Yes. It's even damage if you're sending expected requests, but the owner of the server didn't want you to. See: Aaron Schwartz.

Is it a protected computer?

Yes. It’s defined incredibly and ridiculously broadly in the law. Pretty much any server you can get to on the internet is “protected”

Looks accurate. It apparently does have a legal definition.

https://en.wikipedia.org/wiki/Protected_computer

Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?

> Is it a damage if you damage damaging thing?

When in doubt - yes. It's the same reasoning forbidding you from shooting criminals in the street, you'd just open up mob justice.

Of course, this is a pretty clear cut case and you might argue that this is an emergency (as people are clearly in danger of being scammed unless you act right now), but overall this is a very blurry line.

Depends: around here you can break into a shop at night to put out a fire or - more realistically - break a car window to pull out a kid (or animal) left alone in the sun.

I'd be careful with computer crimes on the Internet though.

> I'd be careful with computer crimes on the Internet though.

Exactly. Let us say you break into a shop owned by some mafia to put out a fire, then you might be fine w.r.t. authority, but you might be in trouble w.r.t. criminals. Similarly, say you break a car window to pull out a pit-bull left alone in the sun, you might have some issues with the owner if he turns out to be part of some drug trafficking gang.

There is no reason to believe that phishing websites are run by script-kiddies, there are obviously criminal rings running all sorts of businesses on the Internet too. I would rather leave the work to the authorities rather than risk going through trouble with unknown criminals, just so that I could have my funny revenge over them.

and the blog shows intent.

This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.

Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.

Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you.

Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.

If you're messing with criminals using an IP traceable to you then the police might be the least of your problems.

To poison some phishing data you don't need to overload any server. Although the act itself of poisoning data could be seen as a DoS but since the service in question is an illegal one IANAL but I don't think it would stand in court.

It is very important to understand this from the legal stand point. If you overload a legitimate or illegitimate service you might commit a crime (depending on the country). I can give you a simple example of this in a different context. In our country you cannot go after the criminal who committed the crime and cannot cause them harm. Few years back a lady got robbed by two guys on a motorbike and she went after them and hit the motorbike with her car. She was prosecuted for assault. This is a very similar situation here. Again, depending on your country, state etc. this _might_ be a bad idea.

I see your point but anyway I think that phishers hardly will sue you for poisoning their data, because you probably just uncovered one phishing campaign but they run tens of them. Putting Justice in the loop would be much riskier for them, I believe.

Reply on news.ycombinator.com