But the credentials were stolen and used to access information that was supposed to be private (even if keys are left lying on the ground, you can't just take the car that they open like its yours).
All of the legal liability of having broken the law, while very little street cred of having done anything particularly novel.
What if the data was on a hidden URL that required no auth, would that still be considered a "hack"? After all the URL wasn't suppose to be known, even if it was in public sight.
And and even more extreme example would be what if the information was mistakenly published? Is it still illegal to download it?
There must be some line here right? Is it just that there needs to be a reasonable assumption that the data is public?
So if there's a URL that isn't normally accessed by the public which has no auth on it, and you stumble across it as part of scanning of the api, then accessing that information is very likely illegal.
If you try to use that information to publicly embarrass the company, you may wind up getting arrested for it.
For the information to be made public, to have a defense you probably need to show that somebody in the company deliberately pressed some kind of "make it public" button. If there's a folder with 999 other documents which the company intended to be public but one of them shouldn't have been included then you've got a lot better leg to stand on.
Your freedom may very well come down to which analogy lawyers can convince a judge to apply. Don't expect the law to act like a computer program with definitive inputs and outputs. You very well may get treated as guilty if you "act guilty". And the bigger risk here is that if you find something like a document which was errantly made public that you may get treated like someone who went jiggling doorknobs and found one that opened for you. There is no definitive line, there is only what a prosecutor can convince a judge.
The defense of "but they had crappy security, I'm just doing a public service letting the public know how bad they are" never flies, and there's a constant trickle of "security researchers" who get charged with hacking crimes for stuff like this.
If I read "Data from Atlassian dumped online" the obvious inference is that it would be the primary data from Atlassian, i.e. the customer data about customer projects which Atlassian is hosting as the key part of their business. This is not it, this is something much less sensitive that affects much less people - while this is bad, this is absolutely insignificant compared to the level of badness that the title implies.
It doesn't matter how credentials were leaked.
I was trying to distinguish between breaches that result from intentional exploitation (malicious or otherwise) and breaches that result from negligence. Having thought about it a bit more, these things are not actually mutually exclusive. Many intentional exploitations take advantage of dumb mistakes (e.g. posting credentials in a public repo).
As such, I take back my earlier disagreement: this is a valid use of the word “hack”.
Note the difference:
> accidentally posting credentials for Atlassian's Envoy setup in a public repository
this was a leak.
Using those credentials to then obtain other data and post them publicly-> this is the hack. A hack does not need to be complicated, just to accomplish something that was not intended.
Similarly, convincing a security guard to let you in to an area of a building that you aren’t allowed into is also an exploit.
Can you go into this a bit more as I'm not seeing anything being exploited? Were the credentials not valid? Was exporting data not available to that authentication user? Did they elevate their permissions beyond what the original credentials provided?
If I find $20 on the street and buy a lotto ticket and win, what was exploited? I used the money to buy an item that can be purchased with money. In this example would you be saying that finding the money was the exploit or using the discovered money to buy something?
> Similarly, convincing a security guard to let you in to an area of a building that you >aren’t allowed into is also an exploit.
I agree this is an exploit, aptly named social engineering. However in this example you started with nothing and "convinced" the guard to do something.
This is different than already having the credentials. The equivalent for this example, to me, would be finding a persons office/building card and walking past the guard but I wouldn't see that as an exploit. Both the access control and guard are reacting accordingly to the expected inputs.
I would view an exploit as going beyond the intent of the built-in/existing controls.
You can debate crackers vs. hackers and that its the intent that differentiates them but its a moot point based on that very thin veil of separation. Similar to the title security researcher or pentester you only can believe whats presented publicly by that person, group or organization and you can never validate that they haven't sold access or exploits to anyone else.
I would say your generalized term would be better understood as a security audit, pentest or bug bounty which would appear to represent a non-malicious intent to gain "successful unauthorized computer system access" as defined by the contract.
[1] https://www.merriam-webster.com/dictionary/hack [2] https://cybersecurityventures.com/movies-about-cybersecurity... [3] https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espiona...
https://en.wikipedia.org/wiki/Hacker
"Reflecting the two types of hackers, there are two definitions of the word "hacker":
1. Originally, hacker simply meant advanced computer technology enthusiast (both hardware and software) and adherent of programming subculture; see hacker culture.[3]
2. Someone who is able to subvert computer security. If doing so for malicious purposes, the person can also be called a cracker.[4]
Today, mainstream usage of "hacker" mostly refers to computer criminals, due to the mass media usage of the word since the 1990s."
Fortunetly there is a trend to revert back to the non malicous meaning of the word. See you are commenting on a "Hacker" news site. See https://hackaday.com/ See even "DailyHacks" or "LifeHacks" in a social non technical setting, etc. Hacking is simply fiddling with a system and making it do something that it was not designed to do.
In my original comment I was looking for the OP to expand upon:
"I have never in my life heard that hack comes with malicious intent"
In this case, they weren't exploiting any weakness of the system thus they did not hack. Logging in is an authorized action. Who is using those credentials is another story. Clearly it is a user mistake. It's like leaking your SSN and saying people hacked your credit card.
Most likely they were API keys that were leaked.
... which begs the question why they were using API keys and not workload identity?