Please stop using OpenClaw, formerly known as Moltbot
xda-developers.com
xda-developers.com
However I think there's going to be very few of that kind of people at the xda developers forum :) Or here, for that matter. This message would be better spread at more mainstream sites.
> Put it behind a tunnel, vpn etc and most of issues suddenly becomes no issue. I use wireguard to access openclaw. So there is no open port online.
Don't they realise that openclaw is not just insecure to operate in a DMZ jet it also just executes whatever text it finds.
The future is bright, my friends.
no exposed home ip, no server to maintain, enterprise-grade isolation. built ekuri.ai for people who want the openclaw experience without the security headaches.
You decide what to put with the lobster.
Just putting things on a cloud server that would not destroy your life if leaked, that is not how IT security works.
We designed security best practices for IT software for decades, this vibe coded wet dream of any North Korean hacker is throwing all of it over board.
It’s malware. Do not install malware.
The other part of the equation is people like you not understanding what running insecure software that allows for unnoticed access to your cloud hosted machine really means.
Once I have access to your cloud hosted Ubuntu server I have access to where, when and how you connect to that server.
I can then not just use your server to hide my own criminal activities and not give a shit if you go to jail for it because I used your server as a staging point for cybercrime activities and bounce off some other idiots Openclaw servers, I also have your home ip address.
Good luck explaining the FBI that a lobster was responsible for running a ransomware campaign against a company that deals with critical infrastructure and not you.
I pity those poor agents already because that will be part of their exhausting paperwork in the near future. AI did it sir, I swear. Doesn’t matter son, you better get your anus stretched and prepare for a ten year stay in a prison with real criminals that will greet you excitedly with a "fresh meat is on the menu boys".
From your home IP I can break into your router, or I don’t even need to because manipulating whatever you download from that server to your personal devices is likely enough to get access to the machine you connect from and probably your phone.
Suddenly your 2FA is no longer safe because I have access to both devices you use to authenticate everything from bank transfers to logins. And because I have access to your home network I can figure out from network activity alone when you sleep. I can destroy your whole life within the 4 to 8 hours you’re unconscious.
Once I’m in your router or personal pc I can then also scan for devices on your home network and put a persistent backdoor on one of the countless Chinese home appliances people use these days. Unless you burn your house down, you will never be able to get me out of it.
Once I have permanent access to your network I can watch you fap to heterotransgayporn over your camera and then blackmail you. I clone your voice, i take enough pictures or get them from your NAS to clone your face and steal your identity.
Maybe I open an account somewhere with videos of your wife undressing or the private photos on your daughters laptop and once your cloud server is burned, which I find out from the footage of heavily armed agents kicking in your door one morning, which I will also sell on the darknet for the amusement of others, I bleed you dry financially and disappear in the smoke.
You won’t need a lobster anymore to order your sneakers. You will never eat one again because you’re dead broke.
But you will turn the same color as one once you find out that I exposed everyone you love on the internet and made money from it and they will never be able to delete it from the internet again.
Congratulations, only putting things there within lobster reach that would not destroy you if leaked, basically killed your whole family.
I need to put it this drastically because that is how cybercriminals will put you and your family at risk irl without blinking an eye.
Companies lose millions every week because one of their senior employees fell victim to phishing attacks and then got blackmailed with compromising material of themselves. And those people all have the same in common. They think they are much smarter than they really are.
You thinking to "only put things there within lobsters reach that would not destroy you if leaked" puts you in the same group as any other idiot that have been hacked and their life’s ruined in the past.
Become smarter or a victim, your choice.
The court in McCall v. Wilder, 913 S.W.3d 150, generally detailed these elements of negligence.
In Kubert v. Best, the New Jersey Appellate Division held that “the sender of a text message can potentially be liable if an accident is caused by texting, but only if the sender knew or had special reason to know that the recipient would view the text while driving and thus be distracted."
In https://via.library.depaul.edu/law-review/vol49/iss2/12/ Robert Rabin has provided a categorization of cases decided primarily under common law reasoning that is helpful here.
Referring to what he terms “enabling torts,” Professor Rabin identifies a number of cases in which courts have held defendants liable even when unconnected third parties have actively caused harm to plaintiffs.
More modern recognition is that criminal acts are sometimes foreseeable, and where specific circumstances reflect that foreseeability, it is not justifiable to cut off liability of the party who enabled the tortfeaso.
It is not that compromised system owners are directly causing injury to the targets, but rather that they are furnishing the attacker with the tools necessary to launch the attack.
So in case of Openclaw, there are multiple public articles like this one warning of the security implications using the software.
If you rent and run a server facing the open Internet and voluntarily install Openclaw, I think it’s fair to say that you are neglecting your duty to avoid negligence, and on top you’re likely contractually instructed to keep your own server safe in the user agreement with the hosting companies, otherwise you need to go with a managed product.
And you are obviously able to install and use a complex software like Openclaw to do things on your behalf. Therefore being negligent in securing the server opens up liability for whatever you or someone that hacks your server does.
For example, if you live in a neighborhood where maybe one car gets stolen a year and you leave your car unlocked with the key in the ignition to fetch something from your house, if someone steals your car and does a drive-by shooting with it you are most likely not liable.
If you’re a police officer and do the same thing in a crime ridden neighborhood and provide criminals with a tool to do crime, just to stop them afterwards or push your crime solving rate, you’re definitely liable for the death of someone they shoot out of that car.
It’s complicated, but yes, if you’re technically savvy and also read the fine print in your server rent agreement that tells you you need to take appropriate security measures so your server doesn’t harm others on the internet, I don’t see how a judge would let you off the hook. Similar common sense laws exist in most parts of the world.