Hacker News Reader

It wasn't hidden though.

Lets pretend the guy was a pest exterminator, hired to kill some bug infestation. He is given a keycard to access most of the building. As he is hunting down the nest, he finds a hole in the wall. Bugs tend to come through holes in walls, so he goes in to figure out whether what he is looking for originates there.

He enters the room on the other side, and looks around for other holes that might have bugs. He then notices a file with big red letters saying "TOP SECRET". Turns out he accidentally entered the maximum security file room. So now he leaves the room, goes to security and tells them what he found. Then gets arrested for 1 count of trespassing and 1 count of breaking and entering.

How is that fair?

Exactly. As the original article states, he just didn't assume he'd stumble onto a sensitive database.

> According to the defendant, the defendant has first assumed that the software on his customer's server will connect to a Modem Solution database that was only intended for his customer and contained only his data. From the read-out database name, this sounded quite plausible. However, the defendant quickly discovered that the corresponding database contained much more information.

Exactly. Maybe he could just be exploring an API.

It isn't hidden, maybe this is how I'm supposed to get data.

> It wasn't hidden though.

If a key is taped to the outside of the door that it opens, you still can't use it without committing a trespass. Not unless you got authorization to use it from the right person(s) first. Shitty security isn't a legal invitation.

The key was taped to the outside of the door explicitly to be used by the customer though.

No it wasn't intended for customer use, the customer wasn't supposed to be directly hitting that API. There was reverse engineering that had to happen before recovering the plaintext password. He was already someplace fairly iffy for him to be. It was much more like being on the front porch of a house you don't own and finding a key.

Enough with building comparisons.

The vendor put the master keys of the main database in a publicly-accessible package. It’s insane.

Of course the researchers tested the keys, to check whether it was true. If it can be proven that it was used for nefarious reasons, then ok for blaming him, but as far as we know, the researcher just used it to get convincing evidence and left the system.

The company is to blame 100%, and the research should get an encouraging award for white-hat reporting. Not this.

If you're just a "researcher" and you're not a cop then your job isn't to get convincing evidence of anything.

If you’re a company then your job is to keep our bank accounts safe. See, I can do it too.

Now that we’ve made clear that no-one is doing its job, YES, free citizen should be able to try to poke into the awful security of corporate IT systems and report it in good faith without even spending a second dealing with trouble.

No it really doesn't work that way. Companies don't go around testing the physical security of the banks that they use. They rely on the legal system and insurance to deal with any failures that the bank has.

The right to pen test businesses doesn't actually exist.

On what reasonable basis? Because it embarasses the company, possibly damaging their business? I say that the company reaps what they sow. They should be grateful. If an ethical hacker doesn't find it, eventually an unethical one will.

If that house (the app) was built inside my living room (my phone),

then how does the analogy play out?

I think an electronic keypad works better as a example.

You get to a door, and there is a postit note on the door saying "Keycode is 2424".

You know your job is in the building. Your keycard let you into the room with the door. Therefore, if this door lead to a "high-security" area, surely they wouldn't put a postit note there? Maybe, as the bug exterminator, or maintenance person, it is expected that I should be able to enter that room?

Except that this is an API which is not yours that you've found by reverse engineering. You're constructing an analogy where the authorization surface is much less distinct where you're already allowed into the building because that makes the surface much less distinct. That analogy isn't at all obvious to me and I don't think you've offered any rationale for why that is more appropriate.

Once you start playing around with someone's remote API then I'd strongly advise you to consider it more like a door around the outside of a building. If you want to argue about that with me, then you may wind up arguing about that with a judge.

Hmm, big caveat there is that in most jurisdictions that would only be considered trespass if you’ve been pre-warned that you’re not allowed in.

The “key” analogy though is a bit stretched.

It is clear that here, the credentials were used in a way other than intended.

The questions are now rather “is it reasonable to expect that a person interacting with a website normally would reasonably be permitted to use anything sent to them by that website in any way they choose?”

A lot of us here are more tech-minded and would likely say “yes, if you don’t want people using credentials, don’t provide them”. The courts on the other hand may take a different view and say “well we already restrict what people can do with content on a website through copyright laws, this person should not automatically have the right to use those credentials in any way other than the way provided”.

It will become even more complicated if the website has terms of service which clearly state something which has a similar technical meaning to “no trespassing”’s physical meaning.

In that case, it's his job to enter holes.

Nobody asked this developer to go through any holes. If you see a hole in your hotel room leading to another room, you don't go through it to see if there is anything to steal, even if you go through holes a lot for your job. You inform the owner that there is a hole.

His job was to debug the program though, so wouldn't that literally be all about poking around holes?

His job was to solve a problem with a database's log files. He found another second database. "Maybe this second database is causing duplicate log files?" so he goes in and looks.

It makes sense to me. Based on the german article: (machine translated to english)

> The software of Modern Solution had a database of the defendant's customer "fully littered with log reports," says the defence lawyer. His client was then given the order from his customer to solve this problem.

> The defendant then determined that the software from Modern Solution established a MySQL connection over the Internet to the servers of the Gladbeck company. ...the defendant has first assumed that the software on his customer's server will connect to a Modem Solution database that was only intended for his customer and contained only his data. From the read-out database name, this sounded quite plausible.

> However, the defendant quickly discovered that the corresponding database contained much more information. It later turned out that the data here was included Modern Solutions customers and from all end customers whose online shops were included. According to his own statement, the defendant had directly separated the database connection when he discovered that he had access to other customers' data.

> the programmer contacted the affected company with the help of a tech blogger, which then closed the security gap and displayed the programmer at the police.

To disconfuse: the "displayed" in the final sentence is a mistranslation from "anzeigen", which means pressing charges.

"Thank you for saving us from liability hell and damages by helping us fix our shit. Police officers should arrive at your door shortly."

I hope this company ends up paying dearly for this. Anything else would be a devastating precedence for information security. A business like that has no business staying in business.

Unfortunately, like many physical security analogies, there's no one correct way of translating the details from the software world to the real world.

I think how close you think those two situations are depends on whether you consider the application to be an agent of the customer (like a personal shopper), or of the shop (like a salesman).

Did:

A - the programmer coerce the application (an agent of the shop) into accessing secret information (breaking into the shop warehouse), or

B - the programmer ask the application (his own agent, a personal shopper) to go and look for interesting things in the database (shop's warehouse) for him, a privilege that the application (personal shopper) was afforded in advance by the shop?

I personally think that A is a dangerous precedent to set for society. Treating any network-bound application as the agent of its creator would mean it was wrong to observe your computer (which you generally use for more than just accessing one online shop), and would therefore effectively kill FOSS.

He didn't ask the application though. He changed the application or used information in the source code in a way that the shop didn't intend. So B is clearly not the case.

But even just assuming that the fact that the app was using a key means that he can try to access other things with it is a dangerous precedent. Can I access your OnlyFans if you give me the password to your Netflix account and you use the same password for both? Can I access the company database directly if the app connects to it? There could be all sorts of confidential info on that server, perhaps the gossip of the customer service people about you or info about other customers.

It's not similar at all.

The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis.

This would be like mistaking a door for the bathroom but find a closet full of gold instead.

He had access to the key by looking at the source code. The key wasn't intended to be used by him manually.

I wonder if there was some kind of software license that stated that the developer was giving the user the key but the user wasn't permitted to use it. At least in that case, he would have known the company's intentions.

I don't think we can otherwise know for sure the company's intentions. If I leave the front door to my house open (or if I tape the key to the outside of the door, to further strain the physical key analogy), is it my intention that people just come on in? We have no idea.

Are you given a key if it is contained in the source code of a compiled binary that you are given?

...except it was not the source code. Apparently right there in the application in cleartext. If what the investigator intended didn't matter, then what the vendor intended doesn't matter, either.

He literally opened the application binary in a text editor to look for clues (despite the fact that there are common tools like `strings` for this) and saw the credentials, and since he'd been specifically hired to fix a problem with the database, he used those credentials to connect to the database. `SHOW DATABASES` would be a perfectly normal thing to type at this point, and apparently once he saw that these credentials granted access to everything he immediately stopped and logged out.

If his lawyers had been better this would have never made it to court. Liability should have fallen on the contract customer, but for certain the design of Modern Solution's software and application were nothing short of wildy irresponsible. If they really face no risk for this, it's time for all German companies to start contracting firms in other countries where idiots aren't allowed to leave thousands of customers data exposed to the first schlub who happens to notice them.

Well, the key was already “given to him” by the nature of leaving it under the mat.

Oh, but this is a food truck that he’s been visiting on a regular basis so obviously he’s allowed to go in the back door, with full access to all the ingredients and poking around inside the cash register?

Also, if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.

> leaving it under the mat.

Nothing was "under the mat" since he was already using his PC to connect to the database with those same credentials.

> if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.

Nothing was stolen, he informed the vendor of the issue immediately.

But he had no right to examine the app, or enter the database outside the app. Even if that is a simple task for an expert, it's still an obvious difference between legitimate usage of the app, and illegitimate usage of the database.

Wouldn't that account as reverse-engineering, which is often also illegal?

We’re getting downvoted by the “I have no clue about how the criminal justice system works” brigade.

You are getting down voted by people who understand that, while the situation is nuanced, it is NOT equivalent to flipping over the house mat at random house and entering it.

It may not be totally akin to a security card opening more doors than it should, but it is entirely reasonable to assume that "the key in your copy of the app" is "your personal access key".

Well, apparently the courts think it is equivalent, at least in Germany and the United States.

That you favor one argument over another as your lens with which to side when it comes to really stupid analogies, including mine, is entirely in bad faith.

So your argument is that since the courts think a certain way, that we should accept that and move on?

I agree with the courts. Most people so outside of a vocal minority on this forum.

What is you plan if you disaggre?

It's just a fundamental disconnect then, I guess. You and I have a very different understanding of how this "crime" was carried out.

He was charged for connecting to a database with credentials that he was already connecting to before with the application. I could argue that he already had access to the other data because the connection allowed it.

So, that begs the question: what did he actually "break" into and how is it different than connecting to the database via the app on the same PC? Would you even be able to tell the difference as a sysadmin looking at logs?

If you want to argue about the law, you can! There is this entire profession dedicated to this!

> it is entirely reasonable to assume that "the key in your copy of the app" is "your personal access key".

I've never been in a situation where I was given an app binary as a user but where the author intended for me to go find a key in the decompilation so that I could manually access information that wasn't visible in the app.

This seems like it is an unreasonable thing to assume. And courts seem to agree.

> This seems like it is an unreasonable thing to assume. And courts seem to agree.

Illegal vs legal and reasonable vs unreasonable are not entirely analogous.

There are lots of laws that I think are unreasonable and a lot of legal things that I think are unreasonable.

The word 'house' is doing a lot of illicit work in your metaphor. A better analogy would be if a bunch of families had decided to install CCTV cameras, then got their neighbor Garry to watch them.

Unbeknownst to them, Garry was storing the tapes a lot longer than anybody imagined, was pointing the cameras so they looked into people's bedrooms, and he was selling some metadata to third parties, and he also kept the key to his house in a plant pot by the door.

Some teenagers messing around, find the key, and have a look around.

Suddenly, it's the teenager, not Garry, who's the problem here. That's how data breaches work at the moment. And because it's Garry's 'house', we all think of the company as the victim.

If the mat was in their driveway, maybe.